Authentication and key agreement method and system

Abstract

Disclosed are an authentication and key agreement method and a system. The method comprises: receiving first verification information sent by a communication initiator, and after the first verification information passes verification, querying to obtain information of a first QKD node and information of a second QKD node; sending to the first QKD node a first identity verification request, so that after verifying that the first identity verification request has passed, the first QKD node generates a session key at the first QKD node and the second QKD node; receiving a key distribution session message which is sent by the first QKD node and carries an identifier of a session key, and forwarding said message to the second QKD node; and when the session key corresponding to the identifier of the session key exists at the second QKD node, receiving an identifier of a session key which is sent by the second QKD node, and forwarding the identifier of the session key to the communication initiator, so that the communication initiator carries the identifier of the session key to request a session key from the first QKD node.

Description

Identity authentication and key exchange method and system Technical Field

[0001] The present invention relates to the technical field of password application, and in particular to an identity authentication and key exchange method and system. Background Art

[0002] Typical authentication and key agreement (AKA) protocols include Kerberos in symmetric cryptographic systems. Kerberos is a trusted third-party authentication protocol designed for TCP / IP network systems. In asymmetric cryptographic systems based on public key infrastructure (PKI), there are Internet Key Exchange (IKE) and Transport Layer Security (TLS). These authentication and key agreement (AKA) protocols have the following shortcomings: (1) The security of the entire Kerberos protocol system is based on the non-leakability of the pre-shared key, a long-term static key. However, the longer the static key is used, the greater the possibility of it being guessed or stolen. This brings complexity to key management, and cross-domain key sharing is particularly difficult.

[0003] (2) In a PKI-based security protocol system, the private key, as a long-term static key, is likely to be leaked as the frequency of use increases. Moreover, with the development of quantum computing technology, it will become computationally feasible to deduce the private key from the public key. Although the application of Post-Quantum Cryptography (PQC) in security protocols such as TLS has greatly alleviated the threat of quantum computing, there are still significant problems with the practical application of the PQC algorithm. In addition, if cross-domain access is to be performed between different CA certificate systems, it must be achieved through a hierarchical CA certificate chain or cross-certification of digital certificates, which is relatively complex, inefficient, and easily introduces new attack surfaces.

[0004] In related technologies, patent application publication number CN113612610A requires a key exchange server to generate a session key, which is then securely negotiated between the communicating parties through key verification with the initiator and receiver. Patent application publication number CN113630248A requires the communication initiator to proactively generate a session key, which is then securely negotiated between the communicating parties through key verification with the receiver and server. In both of these session key negotiation schemes, all encryption and signature keys are centrally managed by the key exchange server, enabling rapid responses to key usage. However, the key exchange servers described in these two patent applications are actually key management centers, through which the keys of the communicating parties are negotiated and exchanged, essentially the same as classic key distribution.

[0005] Summary of the Invention

[0006] The technical problem to be solved by the present invention is how to ensure the security of cross-domain key transmission which is relatively risky.

[0007] The present invention solves the above technical problems through the following technical means:

[0008] In a first aspect, the present invention provides an identity authentication and key exchange method, which is applied to an identity provider. The method includes: receiving first verification information sent by a communication initiator, and after the first verification information is verified, querying to obtain information about a first QKD node corresponding to the communication initiator and information about a second QKD node corresponding to the communication responder;

[0009] Sending a first identity authentication request to the first QKD node, so that the first QKD node initiates generation of a session key through a key distribution channel between the first QKD node and the second QKD node after verifying that the first identity authentication request is passed, and generates a session key on the first QKD node and the second QKD node;

[0010] receiving a key distribution session message carrying a session key identifier from the first QKD node, and forwarding the message to the second QKD node;

[0011] When the second QKD node has a session key corresponding to the identifier of the session key, it receives the identifier of the session key sent by the second QKD node and forwards the identifier of the session key to the communication initiator so that the communication initiator applies for the session key from the first QKD node with the identifier of the session key.

[0012] In a second aspect, the present invention proposes an identity authentication and key exchange method, which is applied to a communication initiator, and the method includes:

[0013] Sending first verification information to an identity provider, so that the identity provider can query and obtain information of a first QKD node corresponding to a communication initiator and information of a second QKD node corresponding to a communication responder after the first verification information is verified; receiving information from the identity provider carrying an identifier of a session key, where the session key is generated at the first QKD node and the second QKD node based on a key distribution channel between the first QKD node and the second QKD node;

[0014] Applying for a session key from the first QKD node, carrying the identifier of the session key;

[0015] Generate an encrypted communication request message and send it to the communication responder so that the communication responder applies for a session key from the second QKD node.

[0016] In a third aspect, the present invention provides an identity authentication and key exchange method, which is applied to a communication responder, and the method includes:

[0017] Receive the encrypted communication request message sent by the communication initiator, the encrypted communication request message carries information including the master key K A_R [j] and the identity of the session key, the master key K A_R [j] is pre-shared by the communication responder and the second QKD node;

[0018] Using the master key K A_R [j] after verifying that the encrypted communication request message is passed, sending a session key request message to the second QKD node, the session key request message carrying an identifier of the session key, and the second QKD node generating the session key;

[0019] Receive the second protection information returned by the second QKD node, where the second protection information is the second QKD node using the master key K A_R [j] encrypting the session key and the identifier of the session key;

[0020] Using the master key K A_R [j] Decrypt the second protection information to obtain the session key, and send an encrypted communication response message to the communication initiator.

[0021] In a fourth aspect, the present invention proposes an identity authentication and key exchange method, applied to a first QKD node, the method comprising:

[0022] Receive a first identity authentication request sent by the identity provider, and after verification, initiate the generation of a session key based on the key distribution channel between the first QKD node and the second QKD node, and generate a session key at the first QKD node and the second QKD node, the first QKD node is connected to the communication initiator, and the second QKD node is connected to the communication responder;

[0023] Generate a key distribution session message carrying an identifier of the session key and send the message to the identity provider, so that the identity provider sends the identifier of the session key and session information to the second QKD node;

[0024] After the communication initiator obtains the identifier of the session key sent by the identity provider, receiving the session key request information sent by the communication initiator;

[0025] Send the first protection information to the communication initiator, the first protection information is a master key K T_I [i] The session key and the identifier of the session key are encrypted and protected.

[0026] In a fifth aspect, the present invention provides an identity provider, comprising:

[0027] A verification information receiving module is configured to receive first verification information sent by a communication initiator, and after the first verification information is verified, query and obtain information about a first QKD node corresponding to the communication initiator and information about a second QKD node corresponding to the communication responder;

[0028] a verification request sending module, configured to send a first identity authentication request to the first QKD node, so that the first QKD node, after verifying that the first identity authentication request is passed, initiates generation of a session key through a key distribution channel between the first QKD node and the second QKD node, and generates a session key between the first QKD node and the second QKD node;

[0029] a key distribution session message receiving module, configured to receive a key distribution session message carrying a session key identifier sent by the first QKD node, and forward the message to the second QKD node;

[0030] An identification receiving module is used to receive the identification of the session key sent by the second QKD node and forward the identification of the session key to the communication initiator when the second QKD node has a session key corresponding to the identification of the session key, so that the communication initiator applies for the session key from the first QKD node with the identification of the session key.

[0031] In a sixth aspect, the present invention provides a communication initiating terminal, comprising:

[0032] A verification information sending module is configured to send first verification information to an identity provider, so that the identity provider can query and obtain information about a first QKD node corresponding to a communication initiator and a second QKD node corresponding to a communication responder after the first verification information is verified;

[0033] an identification information receiving module, configured to receive information from the identity provider that carries an identification of a session key, where the session key is generated between the first QKD node and the second QKD node based on a key distribution channel between the first QKD node and the second QKD node;

[0034] A first session key application module is used to apply for a session key from the first QKD node with an identifier of the session key; a message generation module is used to generate an encrypted communication request message and send it to the communication responder so that the communication responder applies for a session key from the second QKD node.

[0035] In a seventh aspect, the present invention provides a communication response terminal, comprising:

[0036] The message receiving module is used to receive the encrypted communication request message sent by the communication initiator, and the encrypted communication request message carries information including the master key K A_R [j] and the identity of the session key, the master key K A_R [j] is pre-shared by the communication responder and the second QKD node;

[0037] The first session key application module is used to use the master key K A_R [j] after verifying that the encrypted communication request message is passed, sending a session key request message to the second QKD node, the session key request message carrying an identifier of the session key, and the second QKD node generating the session key;

[0038] A protection information receiving module is configured to receive the second protection information returned by the second QKD node, wherein the second protection information is the second QKD node using the master key K A_R [j] encrypting the session key and the identifier of the session key;

[0039] Response message sending module, used to use the master key K A_R [j] Decrypt the second protection information to obtain the session key, and send an encrypted communication response message to the communication initiator.

[0040] In an eighth aspect, the present invention provides a first QKD node, comprising:

[0041] A verification request receiving module is configured to receive a first identity authentication request sent by an identity provider, and after verification is successful, initiate the generation of a session key based on a key distribution channel between the first QKD node and the second QKD node, and generate a session key at the first QKD node and the second QKD node, wherein the first QKD node is connected to the communication initiator and the second QKD node is connected to the communication responder;

[0042] A key distribution session message generation module is configured to generate a key distribution session message carrying a session key identifier and send the message to the identity provider, so that the identity provider sends the session key identifier and session information to the second QKD node; a key request receiving module is configured to receive a session key request message sent by the communication initiator after the communication initiator obtains the session key identifier sent by the identity provider;

[0043] The protection information sending module is used to send the first protection information to the communication initiator, wherein the first protection information is a master key K T_I [i] The session key and the identifier of the session key are encrypted and protected.

[0044] In a ninth aspect, the present invention provides an identity authentication and key exchange system, comprising a communication initiator, a communication responder, an identity provider, and a quantum key distribution network, wherein the quantum key distribution network includes a plurality of QKD nodes, the communication initiator is connected to a first QKD node, the communication responder is connected to a second QKD node, the first QKD node and the second QKD node are both connected to the identity provider, and the communication initiator is connected to the communication responder;

[0045] Initiating generation of a session key through a key distribution channel between the first QKD node and the second QKD node, and generating a session key at the first QKD node and the second QKD node;

[0046] The identity provider is configured to search for the security domain and the QKD node to which the communication initiator and the communication responder belong according to the identifier of the communication initiator and the identifier of the communication responder;

[0047] The communication initiator is configured to obtain the session key from the first QKD node and establish encrypted communication with the communication responder using the session key;

[0048] The communication responder is used to obtain the session key from the second QKD node and establish encrypted communication with the communication initiator using the session key.

[0049] The advantages of the present invention are:

[0050] (1) The identity authentication and key exchange method proposed in the present invention is applied to encrypted communication between devices or applications belonging to different security domains. The identity provider only provides the correspondence between the communication node and the QKD node. The session key is distributed directly by different QKD nodes to the communication node to which it belongs. The encrypted communication session key between different security domains is transmitted and synchronized by using a quantum key distribution (QKD) channel with unconditional physical security characteristics. This is based on true quantum key distribution QKD, ensuring the security of cross-domain key transmission with higher risks.

[0051] (2) The entire protocol interaction process uses symmetric keys to perform keyed hash calculations and symmetric encryption and decryption calculations for identity authentication, which meets the security properties of information transmission confidentiality, integrity, untraceability, and forward / backward secrecy. It also has certain advantages in communication efficiency and computational overhead compared to other protocols such as the Identity Authentication and Key Exchange Protocol (AKA).

[0052] (3) A pre-shared master key with the characteristics of "one-time password" and "destructible upon use" carried by a large-capacity secure medium is used to distribute and protect the encrypted communication session key within the same security domain, which has forward and backward security.

[0053] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] FIG1 is a flow chart of an identity authentication and key exchange method according to an embodiment of the present invention;

[0055] FIG2 is a flow chart of an identity authentication and key exchange method according to an embodiment of the present invention;

[0056] FIG3 is a flow chart of an identity authentication and key exchange method according to an embodiment of the present invention;

[0057] FIG4 is a flow chart of an identity authentication and key exchange method according to an embodiment of the present invention;

[0058] FIG5 is a schematic structural diagram of an identity providing terminal proposed in one embodiment of the present invention;

[0059] FIG6 is a schematic structural diagram of a communication initiating terminal proposed in one embodiment of the present invention;

[0060] 7 is a schematic structural diagram of a communication response terminal proposed in one embodiment of the present invention;

[0061] FIG8 is a schematic structural diagram of a first QKD node proposed in one embodiment of the present invention;

[0062] 9 is a schematic structural diagram of an identity authentication and key exchange system proposed in one embodiment of the present invention;

[0063] FIG10 is a flowchart of an identity authentication and key exchange system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0064] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0065] Example 1

[0066] As shown in FIG1 , the first embodiment of the present invention discloses an identity authentication and key exchange method, which is applied to an identity provider. The method includes the following steps:

[0067] S101, receiving first verification information sent by a communication initiator, and after the first verification information is verified, querying to obtain information of a first QKD node corresponding to the communication initiator and information of a second QKD node corresponding to the communication responder;

[0068] S102: Send a first identity authentication request to the first QKD node, so that the first QKD node, after verifying that the first identity authentication request is passed, initiates generation of a session key through a key distribution channel between the first QKD node and the second QKD node, and generates a session key between the first QKD node and the second QKD node;

[0069] S103: Receive a key distribution session message carrying a session key identifier sent by the first QKD node, and forward the message to the second QKD node;

[0070] S104. When the second QKD node has a session key corresponding to the identifier of the session key, receive the identifier of the session key sent by the second QKD node and forward the identifier of the session key to the communication initiator so that the communication initiator applies for the session key from the first QKD node with the identifier of the session key.

[0071] This embodiment uses a quantum key distribution channel with unconditional physical security characteristics to transmit encrypted communication session keys between different security domains, ensuring the security of cross-domain key transmission with higher risks.

[0072] In one embodiment, step S101: receiving first verification information sent by a communication initiator, and querying to obtain information of a first QKD node corresponding to the communication initiator and information of a second QKD node corresponding to the communication responder after the first verification information is verified, specifically includes the following steps:

[0073] S111, receiving pre-verification information sent by the communication initiator, the pre-verification information carries information including the communication initiator identifier, the communication responder identifier and the master key K T_I [i] The master key is pre-shared by the communication initiator and the first QKD node;

[0074] Specifically, the communication initiator I will use his own ID I and the identification ID of the communication responder R R Sent to the identity provider S, the communication initiator I selects the valid pre-master key K shared with the first QKD node T from its own large-capacity secure medium in sequence T_I [i] Perform a keyed hash operation on the identification information of both parties and the master key serial number i, and then send it to the identity provider S along with the master key serial number i. The representation is as follows:

[0075] I→S∶{ID S ||ID I ||ID R ||i||H(K T_I [i]){ID I ||ID R ||i}}

[0076] Where: I→S means the communication initiator I sends a message to the identity provider S, ID S is the identifier of the identity provider, H(K T_I [i]){ID I ||ID R ||i} indicates the I ||ID R ||i} with master key K T_I [i] hash operation, || means concatenating byte strings.

[0077] S112, the current timestamp T S Return to the communication initiator, expressed as:

[0078] S→I∶{T S}

[0079] Where S→I indicates that the identity provider S sends a message to the communication initiator I.

[0080] S113: Receive first verification information sent by the communication initiator, where the first verification information carries information including a timestamp T S and hash value h{IP I ||IP S ||ID I ||ID R ||T S}, where IP I The IP address of the communication initiator, IP S IP address and ID of the identity provider I Identifies the communication initiator, ID R T is the communication responder identifier, S is the timestamp, h{} represents the hash value calculation, and || is the concatenated string used to concatenate byte strings;

[0081] Specifically, the communication initiator I calculates h{IP I ||IP S ||ID I ||ID R ||T S}, and send the calculation result together with the timestamp to the identity provider S, expressed as:

[0082] I→S∶{ID S ||ID I ||ID R ||i||T S ||h{IP I ||IP S ||ID I ||ID R ||T S}||H(K T_I [i]){ID I ||ID R ||i}}

[0083] Where, I→S means that the communication initiator I sends a message to the identity provider S, IP I Indicates the IP address of the communication initiator, IP S Represents the IP address of the identity provider, || is a concatenated string, h{} represents hash calculation, and H() represents cryptographic hash calculation with a key.

[0084] S114. Verify timestamp T S and h{IP I ||IP S ||IDI ||ID R ||T S After passing the communication, the information of the first QKD node and the information of the second QKD node are obtained according to the communication initiator identifier and the communication responder identifier.

[0085] Specifically, the identity provider S verifies the timestamp T S Within the current time window, calculate and verify h{IP I ||IP S || ID I ||ID R ||T S}, after passing according to ID I and ID R Query its own database to obtain the identification information ID of the first QKD node T corresponding to the communication initiator and the communication responder T and the identification information ID of the second QKD node A A , and authenticate the initiator to the first QKD node T.

[0086] It should be noted that in this embodiment, each communication node, namely the communication initiator and the communication responder, is equipped with a large-capacity secure medium with a key storage space of at least 2M bytes. Based on the AES or SM4 algorithm with a key length of 128 bits, this can store at least 100,000 keys. The QKD nodes in each security domain use quantum random numbers to generate a key pool with a capacity of at least 100,000 keys for each communication node within the domain (the master key in the key pool is sequentially indexed by an ID number of at least 32 bits). The key pool is then copied to the large-capacity secure medium of each communication node for storage and distributed to the communication nodes for use. All QKD nodes and communication nodes are registered with the identity provider S (also known as the IDP) and their affiliation is registered.

[0087] In one embodiment, the step S102 of sending a first identity authentication request to the first QKD node includes the following steps:

[0088] S121, using the random number N generated by itself S , a key K pre-shared with the first QKD node T_S , master key K T_I [i] and the information of the first QKD node and the information of the second QKD node, generate the first identity authentication request; specifically, the identity provider S performs initiator identity authentication on the first QKD node T, and the generated first identity authentication request is represented as follows:

[0089] S→T∶{ID S ||ID T||ID A ||ID I ||ID R ||i||N S ||H(K T_I [i]){ID I ||ID R ||i}||H(K T_S ){ID S ||ID T ||ID A ||ID I ||ID R ||N S}}

[0090] Where S→T means the identity provider S sends a message to the first QKD node T, N S A random number generated by the identity provider S.

[0091] S122: Send the first identity authentication request to the first QKD node, so that the first QKD node uses the key K T_S Verify the authenticity of the first QKD node, the second QKD node and the identity provider, and use the master key K T_I [i] Verify the authenticity of the communication initiator and the communication responder.

[0092] Specifically, the first QKD node T uses the key K T_S Verify the identity of the identity provider S and the identification ID of the first QKD node T and the identification ID of the second QKD node A The authenticity of the master key K T_I [i] The effectiveness and use of K T_I [i] Verify the identity ID of the communication initiator I and the identity ID of the communication responder R After the authenticity is verified, the generation and synchronous transmission of the session key are initiated based on the QKD key distribution channel between the first QKD node and the second QKD node. At the same time, the corresponding session key ID-ID is generated at both ends of the QKD channel. s , the first QKD node T uses the session key ID s Identifies this key distribution session (ID s :K I_R ,ID I ,ID R ), K I_R is the session key.

[0093] In one embodiment, step S103: receiving a key distribution session message carrying a session key identifier sent by the first QKD node and forwarding the message to the second QKD node includes the following steps:

[0094] S131: Receive a key distribution session message sent by the first QKD node, wherein the key distribution session message uses the key K T_S and the master key K T_I [i] A key-based hash operation is performed, and the key distribution session message carries the session key and the identification ID of the session key. s and the random number N generated by the first QKD node T , where the key K T_S The master key K is pre-shared between the identity provider and the first QKD node. T_I [i] is pre-shared between the communication initiator and the first QKD node, where i represents the sequence number of the master key;

[0095] Specifically, the first QKD node will session identifier ID s Use K T_S and K T_I [i] Perform a keyed hash operation and generate a new random number N T Sent to the identity provider S, in the form of:

[0096] T→S∶{ID S ||ID T ||ID I ||ID R ||ID s ||i||N T ||N S ||H(K T_I [i]){ID s ||ID T ||ID I ||ID R ||i||N T}||H(K T_S ){ID S ||ID T ||ID I ||N S ||N T}}

[0097] Where T→S means the first QKD node T sends a message to the identity provider S, N T The random number generated by the first QKD node.

[0098] S132, using the key K T_SAfter verifying that the key distribution session message is passed, the ID s and session information using the key K A_S Perform a hash operation with a key to obtain an encrypted message and forward the encrypted message to the second QKD node. The key K A_S The identity provider and the second QKD node are pre-shared.

[0099] Specifically, the identity provider S uses the key K T_S After verifying the message, the session ID s and session information using the key K A_S Perform a keyed hash operation and send it to the second QKD node A, expressed as:

[0100] S→A∶{ID A ||ID S ||ID T ||ID R ||ID I ||ID s ||N S `||H(K A_S ){ID A ||ID S ||ID T ||ID R ||ID I ||ID s ||N S `}}

[0101] Where S→A means that the identity provider S sends a message to the second QKD node, N S `Random number generated by the identity provider.

[0102] The session information here refers to the identification of the session participants: ID A 、ID T 、ID R 、ID I .

[0103] In one embodiment, step S104: when the second QKD node has a session key corresponding to the identifier of the session key, receiving the identifier of the session key sent by the second QKD node and forwarding the identifier of the session key to the communication initiator so that the communication initiator applies for the session key from the first QKD node with the identifier of the session key, includes the following steps:

[0104] S141, receiving the identification encryption information sent by the second QKD node, wherein the identification encryption information is the encryption information of the second QKD node using the key K A_SAfter verifying that there is a session key corresponding to the identifier of the session key, the master key K A_R [j] Identification ID for the session key s The encrypted hash value is calculated, and the identification encryption information carries the random number N generated by the second QKD node A , the key K A_S The master key K is pre-shared by the identity provider and the second QKD node. A_R [j] is pre-shared between the communication responder and the second QKD node, and j represents the sequence number of the master key;

[0105] Specifically, the second QKD node A uses the key K A_S Verify and confirm the existence of the ID s The session key is identified when using ID s Identifies this key distribution session (ID s :K I_R ,ID I ,ID R ), and selects the valid pre-master key K shared with the communication responder from the key pool in sequence A_R [j], j is the primary key sequence number, and the session ID s Calculate the keyed hash value and generate a new random number N A Then sent to the identity provider S, expressed in the form of:

[0106] A→S∶{ID S ||ID A ||ID T ||ID I ||ID R ||j||ID s ||N A ||N S `||H(K A_S ){ID S ||ID A ||ID R ||N A ||N S `}||H(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}

[0107] Where A→S means the second QKD node sends a message to the identity provider S, N A The random number generated by the second QKD node.

[0108] S142, using key K A_S After verifying that the identification encryption information is passed, the information carrying the identification of the session key is forwarded to the communication initiator, so that the communication initiator uses the master key K T_I [i] After verification, obtain the identifier of the session key and apply for the session key from the first QKD node with the identifier of the session key.

[0109] Specifically, the identity provider S uses the key K A_S After verifying the message, the relevant information is forwarded to the communication initiator I, which is expressed as:

[0110] S→I∶{ID I ||ID S ||ID s ||ID R ||i||j||N T ||N A ||H(K T_I [i]){ID s ||ID T ||ID I ||ID R ||i||N T}||H(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}

[0111] S→I means that the identity provider S sends a message to the communication initiator I, so that the communication initiator I uses the master key K T_I [i] Perform keyed hashing verification and save session information, and apply for a session key from the first QKD node T with the session identifier.

[0112] It should be noted that the entire protocol interaction process uses symmetric keys to perform keyed hash calculations and symmetric encryption and decryption calculations for identity authentication, which meets the security properties of information transmission confidentiality, integrity, untraceability and forward / backward secrecy, and has certain advantages in communication efficiency and computational overhead compared to other protocols such as the Identity Authentication and Key Exchange Protocol AKA.

[0113] Example 2

[0114] As shown in FIG2 , the second embodiment of the present invention discloses an identity authentication and key exchange method, which is applied to a communication initiator. The method includes the following steps:

[0115] S201. Sending first verification information to an identity provider, so that the identity provider can query and obtain information about a first QKD node corresponding to a communication initiator and a second QKD node corresponding to a communication responder after the first verification information is verified;

[0116] S202: Receive information from the identity provider that carries an identifier of a session key, where the session key is generated between the first QKD node and the second QKD node based on a key distribution channel between the first QKD node and the second QKD node;

[0117] S203: Apply for a session key from the first QKD node with the identifier of the session key;

[0118] S204: Generate an encrypted communication request message and send it to the communication responder so that the communication responder applies for a session key from the second QKD node.

[0119] In the identity authentication and key exchange protocol, this embodiment adopts a quantum key distribution channel with unconditional physical security characteristics to transmit encrypted communication session keys between different security domains, ensuring the security of cross-domain key transmission with higher risks.

[0120] In one embodiment, step S201 of sending first verification information to an identity provider, so that the identity provider queries and obtains information about a first QKD node corresponding to a communication initiator and information about a second QKD node corresponding to a communication responder after the first verification information is verified, includes the following steps:

[0121] S211, using the master key K T_I [i] Perform a keyed hash operation on the communication sender ID and the communication responder ID, and attach the master key K T_I [i] The serial number is sent to the identity provider in the form of:

[0122] I→S∶{ID S ||ID I ||ID R ||i||H(K T_I [i]){ID I ||ID R ||i}}

[0123] Where: I→S means the communication initiator I sends a message to the identity provider S, ID S is the identifier of the identity provider, H(K T_I [i]){ID I ||ID R ||i} indicates the I ||IDR ||i} with master key K T_I [i] is a hash operation, and || represents byte string concatenation.

[0124] S212: Receive the current timestamp T returned by the identity provider. S ;

[0125] S213: Generate the first verification information and send it to the identity provider. The first verification information carries information including a timestamp T S and hash value h{IP I ||IP S ||ID I ||ID R ||T S}, where IP I The IP address of the communication initiator, IP S IP address and ID of the identity provider I Identifies the communication initiator, ID R T is the communication responder identifier, S is a timestamp, h{} indicates hash value calculation, and || is a concatenated string used to concatenate byte strings.

[0126] Specifically, the communication initiator I calculates h{IP I ||IP S ||ID I ||ID R ||T S}, and send the calculation result together with the timestamp to the identity provider S, expressed as:

[0127] I→S∶{ID S ||ID I ||ID R ||i||T S ||h{IP I ||IP S ||ID I ||ID R PT S}||H(K T_I [i]){ID I ||ID R ||i}}

[0128] Where, I→S means that the communication initiator I sends a message to the identity provider S, IP I Indicates the IP address of the communication initiator, IP S Represents the IP address of the identity provider, || represents byte string concatenation, h{} represents hash calculation, and H() represents keyed cryptographic hash calculation.

[0129] In one embodiment, the step S202 of receiving information sent by the identity provider that carries an identifier of a session key includes:

[0130] Receive the information sent by the identity provider carrying the session key identifier, and use the master key K T_I [i] Perform key hashing to verify the session information and session key identifier, where the master key K T_I [i] is pre-shared by the communication initiator and the first QKD node.

[0131] Specifically, the information carrying the identifier of the session key is represented as follows:

[0132] S→I∶{ID I ||ID S ||ID s ||ID R ||i||j||N T ||N A ||H(K T_I [i]){ID s ||ID T ||ID I ||ID R ||i||N T}||H(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}

[0133] Where N A The random number generated by the second QKD node.

[0134] The communication initiator uses the master key K T_I [i] Perform keyed hashing to verify and save session information and session identifier.

[0135] In one embodiment, step S203: applying for a session key from the first QKD node with the identifier of the session key specifically includes the following steps:

[0136] S231: Send a session key application message to the first QKD node, where the session key application message carries information including the session key identifier, the master key K T_I [i] and the random number N generated by the communication initiator I ;

[0137] Specifically, the communication initiator carries the session identifier and applies for a session key from the first QKD node T, which is expressed as:

[0138] I→T∶{ID T ||ID I ||ID s ||i||N I ||N T ||H(K T_I [i]){ID s ||i||N I ||N T}}

[0139] Among them, N I N is the random number newly generated by the communication initiator. T The random number generated by the first QKD node.

[0140] S232: Receive first protection information sent by the first QKD node, where the first protection information is a master key K T_I [i] The session key, the identifier of the session key and the random number N I Encrypted protection is obtained;

[0141] Specifically, the first QKD node T uses the master key K T_I [i] Encrypt the session key and then use the master key K T_I [i] Perform a keyed hash operation on the session identifier, session key and random number N T Perform integrity protection and send it to the communication initiator I, after which the first QKD node T marks the master key K T_I [i] is invalid and the ID is deleted s The first protection information of the identified session is represented as follows:

[0142] T→I∶{ID I ||ID T ||ID s ||i||N I ||E(K T_I [i]){K I_R}||H(K T_I [i]){ID s ||i||N I ||E(K T_I [i]){K I_R}}}

[0143] Where T→I means the first QKD node T sends a message to the communication initiator I, K I_R is the session key.

[0144] S233, using the master key K T_I [i] Decrypting and verifying the first protection information to obtain the session key.

[0145] Specifically, the communication initiator I uses the master key K T_I [i] Decrypt and verify the session key K I_R , then the communication initiator I marks the master key K T_I [i] is invalid and i=i+1.

[0146] It should be noted that this embodiment equips each communication node, i.e., the communication initiator and the communication responder, with a large-capacity secure medium. The QKD nodes in each security domain use quantum random numbers to generate a key pool for each communication node within the domain (the master key in the key pool is sequentially indexed by an ID number of at least 32 bits). The key pool is then copied to the large-capacity secure medium of each communication node for storage, and the secure medium is distributed to the communication nodes for use.

[0147] This embodiment uses a pre-shared master key with the characteristics of "one-time password" and "destructible upon use" carried by a large-capacity secure medium to distribute and protect encrypted communication session keys within the same security domain, and has forward and backward security.

[0148] In one embodiment, step S204: generating an encrypted communication request message and sending it to the communication responder so that the communication responder applies for a session key from the second QKD node specifically includes:

[0149] Generate and send an encrypted communication request message to the communication responder so that the communication responder can use the master key K A_R [j] After verifying that the encrypted communication request message is passed, it carries the identifier of the session key and applies to the second QKD node for the session key, wherein the encrypted communication request message carries information including the master key K A_R [j], the random number N generated by the communication initiator I `, the key K2 derived from the session key and the identifier of the session key, the master key K A_R [j] is pre-shared by the communication responder and the second QKD node.

[0150] Specifically, the communication initiator I sends an encrypted communication request message to the communication responder R, which is expressed as:

[0151] I→R∶{ID R ||ID I ||ID s ||j||N A ||N I `||H(K2){ID I||ID R ||N I `}||H(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}

[0152] Where I→R means that the communication initiator I sends a message to the communication responder R, N I ` is a new random number generated by the communication initiator, and K2 is the key derived from the session key.

[0153] In one embodiment, the key K2 derived from the session key is expressed as:

[0154] K1=H(h(K I_R )){ID s ||ID I ||ID R ||N I `||N R `}

[0155] K2=H(h(K1)){ID s ||ID I ||ID R ||N I `||N R `||0}

[0156] Where K I_R is the session key, ID s Identity provider ID I Identifies the communication initiator, ID R N is the communication responder identifier, I ` is the random number generated by the communication initiator, N R ` is the random number generated by the communication responder, h() is the hash calculation, H() is the cryptographic hash calculation with a key, and P represents byte string splicing.

[0157] The entire protocol interaction process of this embodiment uses symmetric keys to perform keyed hash calculations and symmetric encryption and decryption calculations for identity authentication, which meets the security properties of information transmission confidentiality, integrity, untraceability and forward / backward secrecy, and has certain advantages in communication efficiency and computational overhead compared to other protocols such as the Identity Authentication and Key Exchange Protocol AKA.

[0158] Example 3

[0159] As shown in FIG3 , a third embodiment of the present invention provides an identity authentication and key exchange method, which is applied to a communication responder and includes the following steps:

[0160] S301, receiving an encrypted communication request message sent by a communication initiator, wherein the encrypted communication request message carries information including a master key K A_R [j] and the identity of the session key, the master key K A_R [j] is pre-shared by the communication responder and the second QKD node;

[0161] S302, using the master key K A_R [j] after verifying that the encrypted communication request message is passed, sending a session key request message to the second QKD node, the session key request message carrying an identifier of the session key, and the second QKD node generating the session key;

[0162] S303, receiving the second protection information returned by the second QKD node, the second protection information is the second QKD node using the master key K A_R [j] encrypting the session key and the identifier of the session key;

[0163] S304, using the master key K A_R [j] Decrypt the second protection information to obtain the session key, and send an encrypted communication response message to the communication initiator.

[0164] In the identity authentication and key exchange protocol, this embodiment adopts a quantum key distribution channel with unconditional physical security characteristics to transmit encrypted communication session keys between different security domains, ensuring the security of cross-domain key transmission with higher risks.

[0165] Specifically, after receiving the encrypted communication request message sent by the communication initiator, the communication responder R confirms the master key K A_R [j] Validity and use of K A_R [j] Calculate the hash verification session information and apply for the session key from the responding QKD node A with the session identifier:

[0166] R→A∶{ID A ||ID R ||ID s ||j||N A ||N R ||H(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}

[0167] Among them, N R A random number newly generated by the communication responder.

[0168] The second QKD node A uses the master key K A_R [j] Encrypt the session key, and then perform a keyed hash operation on the session identifier, session key, and random number N A Perform integrity protection to generate the second protection information and send it to the communication responder R. Then the second QKD node A marks K A_R [j] is invalid and j=j+1 and delete ID s The second protection information of the identified session is expressed as:

[0169] A→R∶{ID R ||ID A ||ID s ||j||N R ||E(K A_R [j]){K I_R}||H(K A_R [j]){ID s ||j||N R ||E(K A_R [j]){K I_R}}}

[0170] The communication responder R uses the master key K A_R [j] Decrypt to obtain the session key K I_R After that, calculate and verify H(h(K I_R )){ID I ||ID R ||N I `}After that, an encrypted communication response message is sent to the communication initiator I, which is expressed as:

[0171] R→I∶{ID I ||ID R ||ID s ||N R `||H(K2){ID I ||ID R ||ID s ||N I `||N R `}}

[0172] Among them, N R `Generate a new random number for the communication responder, N I ` is a random number generated by the communication sender, and K2 is the key derived from the session key.

[0173] In one embodiment, the communication initiator I and the communication responder R are based on the session key K I_R Key derivation is performed to obtain the symmetric encryption key, MAC key, initialization vector, etc. for each data flow according to the requirements of the specific encryption communication protocol. This embodiment does not involve the specific encryption communication protocol and cryptographic algorithm. The key derivation process is as follows:

[0174] K1=H(h(K I_R )){ID s ||ID I ||ID R ||N I `||N R `}

[0175] K2=H(h(K1)){ID s ||ID I ||ID R ||N I `||N R `||0}

[0176] K3=H(h(K1)){ID s ||ID I ||ID R ||N I `||N R `||1}.

[0177] Example 4

[0178] As shown in FIG4 , the fourth embodiment of the present invention proposes an identity authentication and key exchange method, which is applied to a first QKD node. The method includes the following steps:

[0179] S401. Receive a first identity authentication request sent by an identity provider, and after verification, initiate generation of a session key based on a key distribution channel with a second QKD node, and generate a session key at a first QKD node and a second QKD node. The first QKD node is connected to the communication initiator, and the second QKD node is connected to the communication responder.

[0180] S402: Generate a key distribution session message carrying an identifier of a session key and send the message to the identity provider, so that the identity provider sends the identifier of the session key and session information to the second QKD node;

[0181] S403: After the communication initiator obtains the identifier of the session key sent by the identity provider, it receives session key request information sent by the communication initiator;

[0182] S404: Send first protection information to the communication initiator. The first protection information is a master key KT_I [i] The session key and the identifier of the session key are encrypted and protected.

[0183] This embodiment uses a quantum key distribution channel with unconditional physical security characteristics to transmit encrypted communication session keys between different security domains, ensuring the security of cross-domain key transmission with higher risks.

[0184] In one embodiment, the step S402 of generating a key distribution session message carrying an identifier of a session key and sending the message to the identity provider includes:

[0185] The identifier of the session key is respectively represented by the key K T_S and the master key K T_I [i] Perform a keyed hash operation to obtain the key K T_S The master key K is pre-shared between the identity provider and the first QKD node. T_I [i] is pre-shared between the communication initiator and the first QKD node, and i represents the serial number of the master key.

[0186] Specifically, the first QKD node uses the key K to T_S and K T_I [i] Perform a keyed hash operation and generate a new random number N T Sent to the identity provider S, in the form of:

[0187] T→S:{ID S ||ID T ||ID I ||ID R ||ID s ||i||N T ||N S ||H(K T_I [i]){ID s ||ID T ||ID I ||ID R ||i||N T}||H(K T_S ){ID S ||ID T ||ID I ||N S ||N T}}

[0188] Identity provider S uses K T_S After verifying the message, the session identifier and session information are used as K A_S Perform a keyed hash operation and send it to the second QKD node A, expressed as:

[0189] S→A∶{ID A ||ID S ||ID T ||ID R ||ID I ||ID s ||N S `||H(K A_S ){ID A ||ID S ||ID T ||ID R ||ID I ||ID s ||N S `}}The second QKD node A uses K A_S Verify and confirm the existence of the ID s The session key identified by ID s Identifies this key distribution session (ID s :K I_R ,ID I ,ID R ), select the valid pre-master key K shared with the communication responder from the key pool in order A_R [j] Calculate the key hash value for the session identifier and generate a new random number N A Then sent to the identity provider S, expressed in the form of:

[0190] A→S∶{ID S ||ID A ||ID T ||ID I ||ID R ||j||ID s ||N A ||N S `||H(K A_S ){ID S ||ID A ||ID R ||N A ||N S `}||H(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}

[0191] Identity provider S uses K A_S After verifying the message, the relevant information is forwarded to the communication initiator I, which is expressed as:

[0192] S→I∶{ID I ||ID S ||ID s ||ID R ||i||j||N T ||N A ||H(K T_I [i]){ID s ||ID T ||ID I ||ID R ||i||N T}||H(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}

[0193] The communication initiator I uses K T_I [i] Perform key hashing to verify and save the session information, and apply for the session key from the initiator QKD node T with the session identifier, where N I Generate a new random number for the communication initiator, expressed as:

[0194] I→T∶{ID T ||ID I ||ID s ||i||N I ||N T ||H(K T_I [i]){ID s ||i||N I ||N T}}.

[0195] In one embodiment, the first QKD node T uses K T_I [i] Encrypt the session key and then use K T_I [i] Perform a keyed hash operation on the session identifier, session key and random number N T Perform integrity protection and obtain first protection information, which is sent to the communication initiator I. The first protection information is expressed as:

[0196] T→I∶{ID I ||ID T ||ID s ||i||N I ||E(K T_I [i]){K I_R}||H(K T_I [i]){ID s ||i||NI ||E(K T_I [i]){K I_R}}}.

[0197] In one embodiment, after sending the first protection information to the communication initiator, the method further includes: marking the master key K T_I [i] Invalidate and delete the session represented by the identity of the session key.

[0198] In one embodiment, before receiving the first identity authentication request sent by the identity provider, the method further includes:

[0199] A key pool is generated for communication nodes within the domain using quantum random numbers, and the master keys in the key pool are indexed sequentially using ID numbers.

[0200] Example 5

[0201] As shown in FIG5 , the first embodiment of the present invention further provides an identity provider, including:

[0202] The verification information receiving module 11 is used to receive the first verification information sent by the communication initiator, and after the first verification information is verified, query and obtain the information of the first QKD node corresponding to the communication initiator and the information of the second QKD node corresponding to the communication responder;

[0203] a verification request sending module 12, configured to send a first identity authentication request to the first QKD node, so that the first QKD node initiates generation of a session key through a key distribution channel between the first QKD node and the second QKD node after verifying that the first identity authentication request is passed, and generates a session key between the first QKD node and the second QKD node;

[0204] A key distribution session message receiving module 13 is configured to receive a key distribution session message carrying a session key identifier sent by the first QKD node and forward the message to the second QKD node;

[0205] The identification receiving module 14 is used to receive the identification of the session key sent by the second QKD node and forward the identification of the session key to the communication initiator when the second QKD node has a session key corresponding to the identification of the session key, so that the communication initiator applies for the session key from the first QKD node with the identification of the session key.

[0206] In one embodiment, the verification information receiving module 11 is configured to:

[0207] Receive pre-verification information sent by the communication initiator, which carries information including the communication initiator identifier, the communication responder identifier and the master key K T_I [i], the master key is pre-shared by the communication initiator and the first QKD node; the current timestamp T S Returning to the communication initiator;

[0208] Receive the first verification information sent by the communication initiator, the first verification information carries information including a timestamp T S and hash value h{IP I ||IP S ||ID I ||ID R ||T S}, where IP I The IP address of the communication initiator, IP S IP address and ID of the identity provider I Identifies the communication initiator, ID R T is the communication responder identifier, S is the timestamp, h{} represents the hash value calculation, and || is the concatenated string used to concatenate byte strings;

[0209] Verify timestamp T S and h{IP I ||IP S ||ID I ||ID R ||T S After passing the communication, the information of the first QKD node and the information of the second QKD node are obtained according to the communication initiator identifier and the communication responder identifier.

[0210] In one embodiment, the verification request sending module 12 is configured to:

[0211] Using the random number N generated by itself S , a key K pre-shared with the first QKD node T_S , master key K T_I [i] and the information of the first QKD node and the information of the second QKD node, generating the first identity authentication request;

[0212] Send the first authentication request to the first QKD node so that the first QKD node uses the key K T_S Verify the authenticity of the first QKD node, the second QKD node and the identity provider, and use the master key K T_I [i] Verify the authenticity of the communication initiator and the communication responder.

[0213] In one embodiment, the key distribution session message receiving module 13 is configured to:

[0214] Receive a key distribution session message sent by the first QKD node, wherein the key distribution session message uses the key K T_S and the master key K T_I [i] A key-based hash operation is performed, and the key distribution session message carries the session key and the identification ID of the session key. s and the random number N generated by the first QKD node T , where the key K T_S The master key K is pre-shared between the identity provider and the first QKD node. T_I [i] is pre-shared between the communication initiator and the first QKD node, where i represents the sequence number of the master key;

[0215] Using the key K T_S After verifying that the key distribution session message is passed, the ID s and session information (Participant Identifier: ID A 、ID T 、ID R 、ID I ) Using the key K A_S Perform a hash operation with a key to obtain an encrypted message and forward the encrypted message to the second QKD node. The key K A_S The identity provider and the second QKD node are pre-shared.

[0216] In one embodiment, the identification receiving module 14 is configured to:

[0217] Receive the identification encryption information sent by the second QKD node, the identification encryption information is the second QKD node using the key K A_S After verifying that there is a session key corresponding to the identifier of the session key, the master key K A_R [j] Identification ID for the session key s The encrypted hash value is calculated, and the identification encryption information carries the random number N generated by the second QKD node A , the key K A_S The master key K is pre-shared by the identity provider and the second QKD node. A_R [j] is pre-shared between the communication responder and the second QKD node, and j represents the sequence number of the master key;

[0218] Using key K A_SAfter verifying that the identification encryption information is passed, the information carrying the identification of the session key is forwarded to the communication initiator, so that the communication initiator uses the master key K T_I [i] After verification, obtain the identifier of the session key and apply for the session key from the first QKD node with the identifier of the session key.

[0219] It should be noted that other embodiments or implementation methods of the identity provider of the present invention can refer to the above method.

[0220] Example 1 is not repeated here.

[0221] Example 6

[0222] As shown in FIG6 , the sixth embodiment of the present invention discloses a communication initiating terminal, including:

[0223] A verification information sending module 21 is configured to send first verification information to an identity provider, so that the identity provider can query and obtain information about a first QKD node corresponding to a communication initiator and a second QKD node corresponding to a communication responder after the first verification information is verified;

[0224] an identification information receiving module 22, configured to receive information from the identity provider that carries an identification of a session key, where the session key is generated between the first QKD node and the second QKD node based on a key distribution channel between the first QKD node and the second QKD node;

[0225] A first session key application module 23, configured to apply for a session key from the first QKD node with the identifier of the session key;

[0226] The message generation module 24 is used to generate an encrypted communication request message and send it to the communication responder so that the communication responder applies for a session key from the second QKD node.

[0227] In one embodiment, the verification information sending module 21 is configured to:

[0228] Using the master key K T_I [i] Perform a keyed hash operation on the communication sender ID and the communication responder ID, and attach the master key K T_I [i] The serial number is sent to the identity provider;

[0229] Receive the current timestamp T returned by the identity provider S ;

[0230] Generate the first verification information and send it to the identity provider, the first verification information carries information including the timestamp T Sand hash value h{IP I ||IP S ||ID I ||ID R ||T S}, where IP I The IP address of the communication initiator, IP S IP address and ID of the identity provider I Identifies the communication initiator, ID R T is the communication responder identifier, S is a timestamp, h{} indicates hash value calculation, and || is a concatenated string used to concatenate byte strings.

[0231] In one embodiment, the identification information receiving module 22 is configured to:

[0232] Receive the information sent by the identity provider carrying the session key identifier, and use the master key K T_I [i] Perform key hashing to verify the session information and session key identifier, where the master key K T_I [i] is pre-shared by the communication initiator and the first QKD node.

[0233] In one embodiment, the first session key application module 23 is configured to:

[0234] Send a session key application message to the first QKD node, the session key application message carrying information including the session key identifier, the master key K T_I [i] and the random number N generated by the communication initiator I ;

[0235] Receive the first protection information sent by the first QKD node, the first protection information is a master key K T_I [i] The session key, the identifier of the session key and the random number N I Encrypted protection is obtained;

[0236] Using the master key K T_I [i] Decrypting and verifying the first protection information to obtain the session key.

[0237] In one embodiment, the master key K T_I [i] After decrypting the first protection information and verifying the session key, the method further includes:

[0238] Mark the master key K T_I [i] is invalid, and let i=i+1.

[0239] In one embodiment, the message generation module 24 is configured to:

[0240] Generate and send an encrypted communication request message to the communication responder so that the communication responder can use the master key K A_R [j] After verifying that the encrypted communication request message is passed, it carries the identifier of the session key and applies to the second QKD node for the session key, wherein the encrypted communication request message carries information including the master key K A_R [j], the random number N generated by the communication initiator I `, the key K2 derived from the session key and the identifier of the session key, the master key K A_R [j] is pre-shared by the communication responder and the second QKD node.

[0241] In one embodiment, the key K2 derived from the session key is expressed as:

[0242] K1=H(h(K I_R )){ID s ||ID I ||ID R ||N I `||N R `}

[0243] K2=H(h(K1)){ID s ||ID I ||ID R ||N I `||N R `||0}

[0244] Where K I_R is the session key, ID s Identity provider ID I Identifies the communication initiator, ID R N is the communication responder identifier, I ` is the random number generated by the communication initiator, N R ` is a random number generated by the communication responder, h() is a hash calculation, H() is a cryptographic hash calculation with a key, and || represents byte string splicing.

[0245] It should be noted that other embodiments or implementation methods of the identity provider of the present invention can refer to the above method.

[0246] Example 2 is not repeated here.

[0247] Example 7

[0248] As shown in FIG7 , the seventh embodiment of the present invention discloses a communication response terminal, including:

[0249] The message receiving module 31 is used to receive the encrypted communication request message sent by the communication initiator, and the encrypted communication request message carries information including the master key K A_R [j] and the identity of the session key, the master key K A_R [j] is pre-shared by the communication responder and the second QKD node;

[0250] The first session key application module 32 is used to use the master key K A_R [j] after verifying that the encrypted communication request message is passed, sending a session key request message to the second QKD node, the session key request message carrying an identifier of the session key, and the second QKD node generating the session key;

[0251] The protection information receiving module 33 is configured to receive the second protection information returned by the second QKD node, wherein the second protection information is the second protection information of the second QKD node using the master key K A_R [j] Encrypt the session key and the identifier of the session key to obtain; Response message sending module 34, for using the master key K A_R [j] Decrypt the second protection information to obtain the session key, and send an encrypted communication response message to the communication initiator.

[0252] In one embodiment, the encrypted communication response message carries a key K2 derived from the session key, which is expressed as follows:

[0253] K1=H(h(K I_R )){ID s ||ID I ||ID R ||N I `||N R `}

[0254] K2=H(h(K1)){ID s ||ID I ||ID R ||N I `||N R `||0}

[0255] Where K I_R is the session key, ID s Identity provider ID I Identifies the communication initiator, ID R N is the communication responder identifier, I ` is the random number generated by the communication initiator, N R` is a random number generated by the communication responder, h() is a hash calculation, H() is a cryptographic hash calculation with a key, and || represents byte string splicing.

[0256] It should be noted that other embodiments or implementation methods of the identity provider of the present invention can refer to the above method.

[0257] Example 3 is not repeated here.

[0258] Example 8

[0259] As shown in FIG8 , the eighth embodiment of the present invention discloses a first QKD node, including:

[0260] The verification request receiving module 41 is configured to receive a first identity authentication request sent by an identity provider, and after verification is successful, initiate the generation of a session key based on a key distribution channel between the first QKD node and the second QKD node, and generate a session key at the first QKD node and the second QKD node, wherein the first QKD node is connected to the communication initiator and the second QKD node is connected to the communication responder;

[0261] A key distribution session message generation module 42 is configured to generate a key distribution session message carrying an identifier of a session key and send the message to the identity provider, so that the identity provider sends the identifier of the session key and session information to the second QKD node;

[0262] The key request receiving module 43 is configured to receive the session key request information sent by the communication initiator after the communication initiator obtains the identifier of the session key sent by the identity provider;

[0263] The protection information sending module 44 is used to send the first protection information to the communication initiator. The first protection information is a master key K T_I [i] The session key and the identifier of the session key are encrypted and protected.

[0264] In one embodiment, the key distribution session message generation module 42 is configured to:

[0265] The identifier of the session key is respectively represented by the key K T_S and the master key K T_I [i] Perform a keyed hash operation to obtain the key K T_S The master key K is pre-shared between the identity provider and the first QKD node. T_I [i] is pre-shared between the communication initiator and the first QKD node, and i represents the serial number of the master key.

[0266] In one embodiment, the protection information sending module 44 is configured to:

[0267] Using the master key K T_I [i] encrypting the session key;

[0268] Using the master key K T_I [i] Perform a keyed hash operation to protect the session key identifier and the session key integrity to obtain the first protection information.

[0269] In one embodiment, after sending the first protection information to the communication initiator, the method further includes: marking the master key K T_I [i] Invalidate and delete the session represented by the identity of the session key.

[0270] In one embodiment, before receiving the first identity authentication request sent by the identity provider, the method further includes:

[0271] A key pool is generated for communication nodes within the domain using quantum random numbers, and the master keys in the key pool are indexed sequentially using ID numbers.

[0272] It should be noted that other embodiments or implementation methods of the identity provider of the present invention can refer to the above-mentioned method embodiment 4, which will not be repeated here.

[0273] Example 9

[0274] As shown in FIG9 , the ninth embodiment of the present invention discloses an identity authentication and key exchange system, which includes a communication initiator 1, a communication responder 2, an identity provider 3, and a quantum key distribution network 4. The quantum key distribution network includes several QKD nodes. The communication initiator 1 is connected to a first QKD node, the communication responder 2 is connected to a second QKD node, the first QKD node and the second QKD node are both connected to the identity provider 3, and the communication initiator 1 is connected to the communication responder 2.

[0275] Initiating generation of a session key through a key distribution channel between the first QKD node and the second QKD node, and generating a session key at the first QKD node and the second QKD node;

[0276] The identity provider 3 is configured to search for the security domain and the QKD node to which the communication initiator 1 or the communication responder 2 belongs according to the identifier of the communication initiator 1 or the identifier of the communication responder 2;

[0277] The communication initiator 1 is configured to obtain the session key from the first QKD node and establish encrypted communication with the communication responder using the session key;

[0278] The communication responder 2 is used to obtain the session key from the second QKD node and establish encrypted communication with the communication initiator using the session key.

[0279] Specifically, the communication initiator is a user terminal used to initiate encrypted communication or an encryption agent or encryption gateway that encrypts and decrypts user data on the initiating side. It obtains the session key from the first QKD node, confirms the key with the communication responder, and then uses the session key to establish encrypted communication with the responder.

[0280] The communication responder is the user terminal that accepts encrypted communication or the encryption agent or encryption gateway that encrypts and decrypts the user data on the receiving side. It obtains the session key from the second QKD node, replies to the initiator's key confirmation message and uses the session key to establish encrypted communication with the initiator.

[0281] A QKD node, consisting of an initiator QKD node and a responder QKD node, and the quantum communication link connecting the two nodes, forms a QKD key distribution channel, which is considered to meet unconditional physical security properties. The QKD node is responsible for key distribution within a domain and key transmission between domains. The transmission of inter-domain session keys on the QKD key distribution channel is considered secure. Key distribution between a QKD node and communication nodes within its domain is protected by a pre-shared master key. The QKD node maintains a master key pool for all communication nodes in the domain and copies the master key pool to the communication nodes via large-capacity secure media. Communication between the QKD node and the communication nodes is protected by a randomly selected master key.

[0282] The identity provider is used to locate the security domain and QKD node to which the initiator or responder belongs based on their ID (which can be an IP address, domain name, phone number, or other namespace). All QKD nodes and communication nodes must register with the IDP and their affiliations. After the communication initiator or responder obtains the QKD node information of the communicating peer from the IDP, it uses this information to obtain the inter-domain session key from the QKD node in its own domain.

[0283] The quantum key distribution network includes QKD nodes and a quantum network link control center, which realizes services such as quantum key generation, quantum key relay, and quantum key provision; the quantum network link control center can establish quantum key distribution and relay links between nodes according to the QKD node ID.

[0284] Specifically, as shown in FIG10 , the workflow of an identity authentication and key exchange system proposed in this embodiment is as follows: (1) In the initialization phase, each communication node is equipped with a large-capacity secure medium with a key storage space of more than 2M bytes. With reference to the AES or SM4 algorithm with a key length of 128 bits, it can store more than 100,000 keys. The QKD node of each security domain uses quantum random numbers to generate a key pool with a capacity of no less than 100,000 keys for each communication node in the domain (the keys in the key pool are sequentially indexed by an ID number of more than 32 bits), copies the key pool to the large-capacity secure medium of each communication node for storage, and distributes the secure medium to the communication nodes for use. All QKD nodes and communication nodes are registered with the IDP and register their subordinate relationships.

[0285] (2) The communication initiator I sends its own identity and the identity of the communication responder R to the identity provider S. I selects the valid pre-master key K shared with the initiator QKD node T from its own large-capacity secure medium in sequence. T_I [i] Perform a keyed hash operation on the identification information of both parties and the master key serial number i, and then send it to S along with the master key serial number i:

[0286] I→S∶{ID S ||ID I ||ID R ||i||H(K T_I [i]){ID I ||ID R ||i}}.

[0287] (3) The identity provider S sends the current timestamp back to the communication initiator I:

[0288] S→I∶{T S}.

[0289] (4) The communication initiator I calculates h{IP I ||IP S ||ID I ||ID R ||T S}, send the calculation result and timestamp to the identity provider S:

[0290] I→S∶{ID S ||ID I ||ID R ||i||T S ||h{IP I ||IP S ||ID I ||ID R ||T S}||H(K T_I[i]){ID I ||ID R ||i}}.

[0291] (5) The identity provider S verifies that the timestamp is within the current time window and calculates and verifies h{IP I ||IP S ||ID I ||ID R ||T S}, after passing according to ID I and ID R Query its own database to obtain the QKD node information ID corresponding to the initiator and responder T and ID A , and authenticate the initiator to the initiator QKD node T:

[0292] S→T:

[0293] {ID S ||ID T ||ID A ||ID I ||ID R ||i||N S ||H(K T_I [i]){ID I ||ID R ||i}||H(K T_S ){ID S ||ID T ||ID A ||ID I ||ID R ||N S}}.

[0294] (6) The first QKD node T uses K T_S Verify the identity and ID of the identity provider T and ID A The authenticity of the master key K T_I [i] The effectiveness and use of K T_I [i] Verify the identity and ID of the communication initiator I and ID R The authenticity of the session key is verified, and then the generation and synchronous transmission of the session key are initiated through the QKD key distribution channel between the responder QKD node A. At the same time, the corresponding session key ID-ID is generated at both ends of the QKD channel. s , the initiator QKD node T uses ID s Identifies this key distribution session (ID s :K I_R ,ID I ,IDR );

[0295] The first QKD node uses K T_S and K T_I [i] Perform a keyed hash operation and generate a new random number N T Sent to identity provider S:

[0296] T→S∶{ID S ||ID T ||ID I ||ID R ||ID s ||i||N T ||N S ||H(K T_I [i]){ID s ||ID T ||ID I ||ID R ||i||N T}||H(K T_S ){ID S ||ID T ||ID I ||N S ||N T}}.

[0297] (7) Identity provider S uses K T_S After verifying the message, the session identifier and session information are used as K A_S Perform key hashing and send to responder QKD node A:

[0298] S→A∶{ID A ||ID S ||ID T ||ID R ||ID I ||ID s ||N S `||H(K A_S ){ID A ||ID S ||ID T ||ID R ||ID I ||ID s ||N S `}}.

[0299] (8) The second QKD node A uses K A_S Verify and confirm the existence of the ID s The session key identified by ID s Identifies this key distribution session (IDs :K I_R ,ID I ,ID R ), select the valid pre-master key K shared with the communication responder from the key pool in order A_R [j] Calculate the key hash value for the session identifier and generate a new random number N A Then sent to the identity provider S:

[0300] A→S∶{ID S ||ID A ||ID T ||ID I ||ID R ||j||ID s ||N A ||N S `||H(K A_S ){ID S ||ID A ||ID R ||N A ||N S `}PH(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}.

[0301] (9) Identity provider S uses K A_S After verifying the message, the relevant information is forwarded to the communication initiator I:

[0302] S→I∶{ID I ||ID S ||ID s ||ID R ||i||j||N T ||N A ||H(K T_I [i]){ID s ||ID T ||ID I ||ID R ||i||N T}||H(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}.

[0303] (10) The communication initiator I uses KT_I [i] Perform key hashing to verify and save the session information, and apply for the session key from the initiator QKD node T with the session identifier, where N I Generate a new random number for the communication initiator:

[0304] I→T∶{ID T ||ID I ||ID s ||i||N I ||N T ||H(K T_I [i]){ID s ||i||N I ||N T}}.

[0305] (11) The first QKD node T uses K T_I [i] Encrypt the session key and then use K T_I [i] Perform a keyed hash operation on the session identifier, session key and random number N T Perform integrity protection and send it to the communication initiator I, then T marks K T_I [i] is invalid and the ID is deleted s Identified session:

[0306] T→I∶{ID I ||ID T ||ID s ||i||N I ||E(K T_I [i]){K I_R}||H(K T_I [i]){ID s ||i||N I ||E(K T_I [i]){K I_R}}}.

[0307] (12) The communication initiator I uses K T_I [i] Decrypt and verify the session key K I_R , then I marks K T_I [i] is invalid and i=i+1, I sends an encrypted communication request message to the communication responder R, N I `Generate a new random number for the communication initiator. The method for generating K2 is shown in step (16):

[0308] I→R∶ {ID R ||ID I ||ID s ||j||N A ||N I `||H(K2){IDI ||ID R ||N I `}||H(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}.

[0309] (13) The communication responder R confirms the pre-master key K A_R [j] Validity and use of K A_R [j] Calculate the hash verification session information and apply for the session key from the responding QKD node A with the session identifier, where N R Generate a new random number for the communication responder:

[0310] R→A∶{ID A ||ID R ||ID s ||j||N A ||N R ||H(K A_R [j]){ID s ||ID A ||ID R ||ID I ||j||N A}}.

[0311] (14) The second QKD node A uses K A_R [j] Encrypt the session key, and then perform a keyed hash operation on the session identifier, session key, and random number N A Perform integrity protection and send it to the communication responder R, then A marks K A_R [j] is invalid and j=j+1 and delete ID s Identified session:

[0312] A→R∶{ID R ||ID A ||ID s ||j||N R ||E(K A_R [j]){K I_R}||H(K A_R [j]){ID s ||j||N R ||E(K A_R [j]){K I_R}}}.

[0313] (15) The communication responder R uses K A_R [j] Decryption to obtain KI_R After that, calculate and verify H(h(K I_R )){ID I ||ID R ||N I `}, then sends an encrypted communication response message to the communication initiator I, where N R Generate a new random number for the communication responder. The method for generating K2 is shown in step (16):

[0314] R→I∶{ID I ||ID R ||ID s ||N R `||H(K2){ID I ||ID R ||ID s ||N I `||N R `}}.

[0315] (16) The communication initiator I and the communication responder R use the session key K I_R Perform key derivation to obtain the symmetric encryption key, MAC key, initialization vector, etc. for each data flow according to the requirements of the specific encryption communication protocol. This patent does not involve specific encryption communication protocols and cryptographic algorithms. Key derivation:

[0316] K1=H(h(K I_R )){ID s ||ID I ||ID R ||N I `||N R `}

[0317] K2=H(h(K1)){ID s ||ID I ||ID R ||N I `||N R `||0}

[0318] K3=H(h(K1)){ID s ||ID I ||ID R ||N I `||N R `||1}

[0319] …

[0320] This embodiment uses quantum key distribution to perform identity authentication and key exchange, and is used for encrypted communication between devices or applications belonging to different security domains. The technical advantages are:

[0321] (1) Using a quantum key distribution channel with unconditional physical security characteristics to transmit encrypted communication session keys between different security domains, ensuring the security of cross-domain key transmission with higher risks;

[0322] (2) Using a pre-shared key with the characteristics of "one-time password" and "destructible after use" carried by a large-capacity secure medium to encrypt the communication session key distribution protection within the same security domain, with forward and backward security;

[0323] (3) The entire protocol interaction process uses symmetric keys to perform keyed hash calculations and symmetric encryption and decryption calculations for identity authentication. In terms of computational overhead, it has certain advantages over other protocols such as the Identity Authentication and Key Exchange Protocol (AKA).

[0324] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0325] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0326] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. An identity authentication and key exchange method, characterized in that: Applied to an identity provider, the method comprises: Receive first verification information sent by a communication initiator, and after the first verification information is verified, query to obtain information of a first QKD node corresponding to the communication initiator and information of a second QKD node corresponding to the communication responder; Sending a first identity authentication request to the first QKD node, so that the first QKD node initiates generation of a session key through a key distribution channel between the first QKD node and the second QKD node after verifying that the first identity authentication request is passed, and generates a session key at the first QKD node and the second QKD node; receiving a key distribution session message carrying an identifier of a session key sent by the first QKD node, and forwarding the message to the second QKD node; When the second QKD node has a session key corresponding to the identifier of the session key, it receives the identifier of the session key sent by the second QKD node and forwards the identifier of the session key to the communication initiator so that the communication initiator applies for the session key from the first QKD node with the identifier of the session key.

2. The identity authentication and key exchange method as claimed in claim 1, characterized in that: The receiving first verification information sent by the communication initiator, and querying to obtain information of the first QKD node corresponding to the communication initiator and information of the second QKD node corresponding to the communication responder after the first verification information is verified, includes: Receive the pre-verification information sent by the communication initiator, the pre-verification information carries information including the communication initiator identifier, the communication responder identifier and the master key K T_I [i], the master key is pre-shared by the communication initiator and the first QKD node; the current timestamp T S Return to the communication initiator; Receive the first verification information sent by the communication initiator, the first verification information carrying information including a timestamp T S and hash value h{IP I ||IP S ||ID I ||ID R ||T S }, where IP I The IP address of the communication initiator, IP S IP address and ID of the identity provider I Identifies the communication initiator, ID R T is the communication responder identifier, S is a timestamp, h{} indicates hash value calculation, and || is a concatenated string used to concatenate byte strings; Verify timestamp T S and h{IP I ||IP S ||ID I ||ID R ||T S After passing the communication, the information of the first QKD node and the information of the second QKD node are obtained by querying the communication initiator identifier and the communication responder identifier.

3. The identity authentication and key exchange method as claimed in claim 1, characterized in that: The sending a first identity authentication request to the first QKD node includes: Using the random number N generated by itself S , a key K pre-shared with the first QKD node T_S , master key K T_I [i] and the information of the first QKD node and the information of the second QKD node, generating the first identity authentication request; Send the first identity authentication request to the first QKD node so that the first QKD node uses the key K T_S Verify the authenticity of the first QKD node, the second QKD node and the identity provider, and use the master key K T_I [i] Verify the authenticity of the communication initiator and the communication responder.

4. The identity authentication and key exchange method as claimed in claim 1, characterized in that: The receiving of a key distribution session message carrying a session key identifier sent by the first QKD node and forwarding the message to the second QKD node includes: receiving a key distribution session message sent by the first QKD node, wherein the key distribution session message uses the key K T_S and the master key K T_I [i] A key-based hash operation is performed, and the key distribution session message carries the session key and the identification ID of the session key. s and the random number N generated by the first QKD node T , where the key K T_S The master key K is pre-shared by the identity provider and the first QKD node. T_I [i] is pre-shared between the communication initiator and the first QKD node, and i represents the sequence number of the master key; Using the key K T_S After verifying that the key distribution session message is passed, the ID s and session information using the key K A_S Perform a hash operation with a key to obtain an encrypted message and forward the encrypted message to the second QKD node. The key K A_S The identity provider is pre-shared with the second QKD node.

5. The identity authentication and key exchange method as claimed in claim 1, characterized in that: When the second QKD node has a session key corresponding to the identifier of the session key, receiving the identifier of the session key sent by the second QKD node and forwarding the identifier of the session key to the communication initiator so that the communication initiator applies for the session key from the first QKD node with the identifier of the session key, comprises: Receive the identification encryption information sent by the second QKD node, where the identification encryption information is the encryption information of the second QKD node using the key K A_S After verifying that there is a session key corresponding to the identifier of the session key, the master key K A_R [j] The session key ID s The encrypted hash value is calculated, and the identification encrypted information carries the random number N generated by the second QKD node A , the key K A_S The master key K is pre-shared by the identity provider and the second QKD node. A_R [j] is pre-shared by the communication responder and the second QKD node, and j represents the serial number of the master key; Using key K A_S After verifying that the identification encryption information is passed, the information carrying the identification of the session key is forwarded to the communication initiator, so that the communication initiator uses the master key K T_I [i] After verification, obtain the session key identifier and apply for the session key from the first QKD node by carrying the session key identifier.

6. An identity authentication and key exchange method, characterized in that: Applied to a communication initiator, the method comprises: Sending first verification information to the identity provider, so that the identity provider can query and obtain information of a first QKD node corresponding to the communication initiator and information of a second QKD node corresponding to the communication responder after the first verification information is verified; Receiving information sent by the identity provider that carries an identifier of a session key, where the session key is generated at the first QKD node and the second QKD node based on a key distribution channel between the first QKD node and the second QKD node; Apply for a session key from the first QKD node carrying the identifier of the session key; Generate an encrypted communication request message and send it to the communication responder so that the communication responder applies for a session key from the second QKD node.

7. The identity authentication and key exchange method as claimed in claim 6, characterized in that: The sending of the first verification information to the identity provider so that the identity provider can query and obtain information of the first QKD node corresponding to the communication initiator and information of the second QKD node corresponding to the communication responder after the first verification information is verified, includes: Using the master key K T_I [i] Perform a keyed hash operation on the communication sender ID and the communication responder ID, and attach the master key K T_I [i] the serial number is sent to the identity provider; Receive the current timestamp T returned by the identity provider S ; Generate the first verification information and send it to the identity provider, the first verification information carries information including a timestamp T S and hash value h{IP I ||IP S ||ID I ||ID R ||T S }, where IP I The IP address of the communication initiator, IP S IP address and ID of the identity provider I Identifies the communication initiator, ID R T is the communication responder identifier, S is a timestamp, h{} indicates hash value calculation, and || is a concatenated string used to concatenate byte strings.

8. The identity authentication and key exchange method as claimed in claim 6, characterized in that: The receiving information sent by the identity provider and carrying the identifier of the session key includes: Receive the information sent by the identity provider carrying the session key identifier, and use the master key K T_I [i] Performing a keyed hash operation to verify the session information and session key identifier, wherein the master key K T_I [i] is pre-shared by the communication initiator and the first QKD node.

9. The identity authentication and key exchange method as claimed in claim 6, characterized in that: The identifier carrying the session key applies for a session key from the first QKD node, comprising: Send a session key application message to the first QKD node, the session key application message carrying information including the session key identifier, the master key K T_I [i] and the random number N generated by the communication initiator I ; Receive first protection information sent by the first QKD node, where the first protection information is a master key K T_I [i] the session key, the session key identifier and the random number N I Encryption protection is obtained; Using the master key K T_I [i] Decrypt the first protection information and verify to obtain the session key.

10. The identity authentication and key exchange method according to claim 9, characterized in that: In the method using the master key K T_I [i] After decrypting the first protection information and verifying the session key, the method further includes: Mark the master key K T_I [i] is invalid, and let i=i+1.

11. The identity authentication and key exchange method according to claim 6, characterized in that: The generating of an encrypted communication request message and sending it to the communication responder so that the communication responder applies for a session key from the second QKD node comprises: generating and sending an encrypted communication request message to the communication responder so that the communication responder applies for a session key from the second QKD node using the master key K A_R [j] After verifying that the encrypted communication request message is passed, the encrypted communication request message carries the identifier of the session key and applies to the second QKD node for the session key, wherein the encrypted communication request message carries information including the master key K A_R [j], the random number N generated by the communication initiator I `, the key K2 derived from the session key and the identifier of the session key, the master key K A_R [j] is pre-shared by the communication responder and the second QKD node.

12. The identity authentication and key exchange method according to claim 11, characterized in that: The formula of the key K2 derived from the session key is: K1 = H(h(K I_R )){ID s ||ID I ||ID R ||N I `||N R `} K2=H(h(K1)){ID s ||ID I ||ID R ||N I `||N R `||0} In the formula, K I_R is the session key, ID s Identifier of the identity provider, ID I Identifies the communication initiator, ID R N is the communication responder identifier, I ` is the random number generated by the communication initiator, N R ` is a random number generated by the communication responder, h() is a hash calculation, H() is a cryptographic hash calculation with a key, and || represents byte string concatenation.

13. An identity authentication and key exchange method, characterized in that: The application and the communication responder, the method comprising: Receive an encrypted communication request message sent by the communication initiator, the encrypted communication request message carries information including the master key K A_R [j] and the identity of the session key, the master key K A_R [j] is pre-shared by the communication responder and the second QKD node; Using the master key K A_R [j] after verifying that the encrypted communication request message is passed, sending a session key request message to the second QKD node, wherein the session key request message carries an identifier of the session key, and the second QKD node generates the session key; Receive the second protection information returned by the second QKD node, where the second protection information is the second QKD node using the master key K A_R [j] encrypting the session key and the identifier of the session key; Using the master key K A_R [j] Decrypt the second protection information to obtain the session key, and send an encrypted communication response message to the communication initiator.

14. The identity authentication and key exchange method according to claim 13, characterized in that: The encrypted communication response message carries a key K2 derived from the session key, which is expressed as follows: K1 = H(h(K I_R )){ID s ||ID I ||ID R ||N I `||N R `} K2=H(h(K1)){ID s ||ID I ||ID R ||N I `||N R `||0} In the formula, K I_R is the session key, ID s Identifier of the identity provider, ID I Identifies the communication initiator, ID R N is the communication responder identifier, I ` is the random number generated by the communication initiator, N R ` is the random number generated by the communication responder, h() is the hash Calculation, H() is the cryptographic hash calculation with a key, and || represents byte string concatenation.

15. An identity authentication and key exchange method, characterized in that: Applied to a first QKD node, the method includes: receiving a first identity authentication request sent by an identity provider, and after the authentication is passed, initiating generation of a session key based on a key distribution channel between a second QKD node, and generating a session key at the first QKD node and the second QKD node, the first QKD node is connected to the communication initiator, and the second QKD node is connected to the communication responder; Generate a key distribution session message carrying an identifier of a session key and send the message to the identity provider, so that the identity provider sends the identifier of the session key and session information to the second QKD node; After the communication initiator obtains the identifier of the session key sent by the identity provider, receiving the session key request information sent by the communication initiator; Sending first protection information to the communication initiator, wherein the first protection information is a master key K T_I [i] The session key and the identifier of the session key are encrypted and protected.

16. The identity authentication and key exchange method according to claim 15, characterized in that: The generating a key distribution session message carrying an identifier of a session key and sending the message to the identity provider includes: The session key identifiers are respectively identified by keys K T_S and the master key K T_I [i] A key hash operation is performed to obtain the key K T_S The master key K is pre-shared by the identity provider and the first QKD node. T_I [i] is pre-shared between the communication initiator and the first QKD node, and i represents the serial number of the master key.

17. The identity authentication and key exchange method according to claim 15, characterized in that: The sending the first protection information to the communication initiator includes: Using the master key K T_I [i] encrypting the session key; Using the master key K T_I [i] Perform a keyed hash operation to protect the session key identifier and the session key integrity to obtain the first protection information.

18. The identity authentication and key exchange method according to claim 15, characterized in that: After sending the first protection information to the communication initiator, the method further includes: Mark the master key K T_I [i] Invalidate and delete the session represented by the identity of the session key.

19. The identity authentication and key exchange method according to claim 15, characterized in that: Before receiving the first identity authentication request sent by the identity provider, the method further includes: A key pool is generated for communication nodes within the domain using quantum random numbers, and the master keys in the key pool are indexed in sequence using ID numbers.

20. An identity provider, characterized in that: include: The verification information receiving module is used to receive the first verification information sent by the communication initiator and verify the first verification information. Obtain information of the first QKD node corresponding to the communication initiator and information of the second QKD node corresponding to the communication responder through post-query; A verification request sending module, configured to send a first identity authentication request to the first QKD node, so that the first QKD node initiates the generation of a session key through a key distribution channel between the first QKD node and the second QKD node after verifying that the first identity authentication request is passed, and generates a session key between the first QKD node and the second QKD node; A key distribution session message receiving module, configured to receive a key distribution session message carrying a session key identifier sent by the first QKD node, and forward the message to the second QKD node; An identification receiving module is used to receive the identification of the session key sent by the second QKD node and forward the identification of the session key to the communication initiator when the second QKD node has a session key corresponding to the identification of the session key, so that the communication initiator applies for the session key from the first QKD node with the identification of the session key.

21. A communication initiating terminal, characterized in that: include: A verification information sending module, used to send first verification information to an identity provider, so that the identity provider can query and obtain information of a first QKD node corresponding to a communication initiator and information of a second QKD node corresponding to a communication responder after the first verification information is verified; an identification information receiving module, configured to receive information carrying an identification of a session key sent by the identity provider, wherein the session key is generated at the first QKD node and the second QKD node based on a key distribution channel between the first QKD node and the second QKD node; A first session key application module is used to apply for a session key from the first QKD node with an identifier of the session key; a message generation module is used to generate an encrypted communication request message and send it to the communication responder so that the communication responder applies for a session key from the second QKD node.

22. A communication response terminal, characterized in that: include: The message receiving module is used to receive the encrypted communication request message sent by the communication initiator, and the encrypted communication request message carries information including the master key K A_R [j] and the identity of the session key, the master key K A_R [j] is pre-shared by the communication responder and the second QKD node; The first session key application module is used to use the master key K A_R [j] after verifying that the encrypted communication request message is passed, sending a session key request message to the second QKD node, wherein the session key request message carries an identifier of the session key, and the second QKD node generates the session key; A protection information receiving module is used to receive the second protection information returned by the second QKD node, wherein the second protection information The second QKD node uses the master key K A_R [j] encrypting the session key and the identifier of the session key; Response message sending module, used to use the master key K A_R [j] Decrypt the second protection information to obtain the session key, and send an encrypted communication response message to the communication initiator.

23. A first QKD node, characterized in that: include: A verification request receiving module is used to receive a first identity authentication request sent by an identity provider, and after the verification is passed, initiate the generation of a session key based on a key distribution channel between the first QKD node and the second QKD node, and generate a session key at the first QKD node and the second QKD node, the first QKD node is connected to the communication initiator, and the second QKD node is connected to the communication responder; A key distribution session message generation module, configured to generate a key distribution session message carrying an identifier of a session key and send the message to the identity provider, so that the identity provider sends the identifier of the session key and session information to the second QKD node; A key request receiving module, configured to receive session key request information sent by the communication initiator after the communication initiator obtains the identifier of the session key sent by the identity provider; A protection information sending module is used to send first protection information to the communication initiator, wherein the first protection information is a master key K T_I [i] The session key and the identifier of the session key are encrypted and protected.

24. An identity authentication and key exchange system, characterized in that: The system includes a communication initiator, a communication responder, an identity provider, and a quantum key distribution network, wherein the quantum key distribution network includes a plurality of QKD nodes, the communication initiator is connected to a first QKD node, the communication responder is connected to a second QKD node, the first QKD node and the second QKD node are both connected to the identity provider, and the communication initiator is connected to the communication responder; the generation of a session key is initiated through a key distribution channel between the first QKD node and the second QKD node, and a session key is generated at the first QKD node and the second QKD node; The identity provider is used to find the security domain and the QKD node to which the communication initiator belongs according to the identifier of the communication responder and the identifier of the communication responder; The communication initiator is used to obtain the session key from the first QKD node and use the session key to establish encrypted communication with the communication responder; The communication responder is used to obtain the session key from the second QKD node and establish encrypted communication with the communication initiator using the session key.

Images