Quantum-resistant security enhancement method for open authorization protocol

Abstract

Disclosed in the present application is a quantum-resistant security enhancement method for an open authorization protocol in a communication network. The method comprises: sending an authorization request to a second network device; receiving an authorization code generated by the second network device on the basis of the authorization request; on the basis of the authorization code, acquiring a first quantum key from a first network node; on the basis of the first quantum key and a post-quantum cryptography algorithm, performing encryption processing on parameter information of an initial token request, so as to obtain quantum-resistant parameter information, and sending the quantum-resistant parameter information to the second network device; receiving a quantum-resistant token sent by the second network device; and on the basis of the quantum-resistant token, sending a resource access request to the second network device, and the second network device confirming an access permission for a resource on the basis of the resource access request, such that a first network device performs resource access on the second network device. The first network device and the second network device perform encrypted communication by using a post-quantum cryptography algorithm and a quantum key distribution technique, thereby significantly enhancing the capability of resisting quantum computing attacks.

Description

Anti-quantum security enhancement method of open authorization protocol

[0001] The present application claims priority to the Chinese patent application No. 202411122478.1, filed on August 15, 2024, and entitled "Anti-quantum security enhancement method of open authorization protocol", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of network security, and more particularly, to an anti-quantum security enhancement method of open authorization protocol of a communication network. BACKGROUND

[0003] The leap in computing power represented by quantum computing has a significant impact on related algorithms in classical cryptography in terms of security. Understandably, with the implementation of large-scale quantum computers, there will be some impact on key agreement, encryption, signature, and other applications in classical cryptography. Therefore, providing a cryptographic technology that can resist quantum computing attacks has become a problem to be solved. SUMMARY

[0004] The present application provides an anti-quantum security enhancement method of open authorization protocol of a communication network.

[0005] In a first aspect, the present application provides an anti-quantum security enhancement method of open authorization protocol of a communication network, the communication network comprising a first network device and a second network device, the method being used for the first network device, and the method comprising:

[0006] sending an authorization request to the second network device;

[0007] receiving an authorization code generated by the second network device according to the authorization request;

[0008] obtaining a first quantum key from a first network node of the first network device according to the authorization code;

[0009] encrypting parameter information of an initial token request according to the first quantum key and a post-quantum cryptographic algorithm to obtain anti-quantum parameter information, and sending the anti-quantum parameter information to the second network device, the parameter information of the initial token request being generated by the first network device according to the authorization code;

[0010] receiving an anti-quantum token sent by the second network device, the anti-quantum token being generated by the second network device according to the anti-quantum parameter information;

[0011] According to the anti-quantum token, a resource access request is sent to the second network device, and the second network device confirms the access right of the resource corresponding to the resource access request according to the resource access request, so that the first network device accesses the resource of the second network device.

[0012] Thus, in the communication process of the first network device applying to access the resource in the second network device, the first network device applies to obtain the quantum key, and uses the quantum key and the post-quantum cryptographic algorithm to encrypt the parameter information of the initial token request generated according to the authorization code to generate anti-quantum parameter information capable of resisting quantum computing attack. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attack, and the quantum key has good anti-quantum computing attack ability. Then, the second network device generates an anti-quantum token according to the anti-quantum parameter information sent by the first network device, and sends the anti-quantum token to the first network device. Then, the first network device generates a resource access request according to the anti-quantum token, for accessing the resource in the second network device. Finally, the second network device determines whether the first network device can access the resource corresponding to the resource access request by checking the validity of the anti-quantum token. In this way, the quantum key distribution technology and the post-quantum cryptographic algorithm enhance the anti-quantum computing attack ability of the communication process of the first network device applying to access the resource in the second network device.

[0013] In some embodiments, the method further comprises:

[0014] sending a registration request to the second network device, the registration request comprising a post-quantum public key of the first network device;

[0015] receiving a registration response request sent by the second network device, the registration response request comprising a public key of the second network device.

[0016] Thus, the first network device sends a registration request to the second network device, and the registration request comprises a post-quantum public key of the first network device. Then, the first network device receives a registration response request sent by the second network device according to the registration request, and the registration response request comprises a public key of the second network device. In this way, the first network device and the second network device can securely exchange keys, the first network device obtains the public key of the second network device for subsequent signature and verification processes, and the second network device obtains the post-quantum public key of the first network device, which has good anti-quantum computing attack ability and can make the transmitted data have good anti-quantum computing attack ability.

[0017] In some embodiments, the first quantum key is obtained from a first network node of the first network device according to the authorization code, comprising:

[0018] replenish a plurality of keys to a cryptographic module of the first network device by using the service node;

[0019] send a quantum key application to the service node according to the authorization code, the quantum key application being protected by a protection key, the protection key being one of the plurality of keys replenished to the cryptographic module and used randomly;

[0020] receive a quantum key encryption result obtained by the service node from encryption processing of the first quantum key according to the protection key, the first quantum key being distributed to the service node by a first network node accessing the service node;

[0021] decrypt the quantum key encryption result to obtain the first quantum key.

[0022] Thus, the first network device replenishes a plurality of keys to a cryptographic module of the first network device by using the service node. Then, the first network device sends a quantum key application to the service node according to the authorization code received from the second network device, the quantum key application being protected by a protection key, the protection key being one of the plurality of keys replenished to the cryptographic module and used randomly. Then, the first network device receives a quantum key encryption result obtained by the service node from encryption processing of the first quantum key according to the protection key, the first quantum key being generated by a first network node accessing the service node and distributed to the service node. Finally, the first network device decrypts the quantum key encryption result to obtain the first quantum key. In this way, the first network device obtains the first quantum key, which has good anti-quantum computing attack capability and can protect the communication between the first network device and the second network device from quantum computing attack.

[0023] In some embodiments, the encryption processing of the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain the anti-quantum parameter information, and sending the anti-quantum parameter information to the second network device, comprises:

[0024] generating an initial token request according to the authorization code;

[0025] encrypting the parameter information of the initial token request according to the first quantum key to obtain a first encrypted message;

[0026] performing post-quantum cryptographic signature processing on the spliced whole of the parameter information according to the post-quantum public key of the first network device to obtain a first signature message;

[0027] composing the anti-quantum parameter information according to the parameter information, the first encrypted message and the first signature message.

[0028] Thus, the first network device generates an initial token request according to the authorization code. Then, the first network device encrypts the parameter information of the initial token request according to the first quantum key to obtain a first encrypted message. Then, the first network device further performs post-quantum signature processing on the spliced whole of the parameter information according to the post-quantum public key of the first network device to obtain a first signature message. Finally, the first network device constructs the anti-quantum parameter information according to the parameter information, the first encrypted message and the first signature message. In this way, the first network device encrypts the parameter information of the initial token request by using the first quantum key to obtain the first encrypted message, so that the parameter information of the initial token request has good anti-quantum computing attack ability. And the parameter information is signed by using the post-quantum public key, which can ensure the integrity and authenticity of the parameter information in the transmission process.

[0029] In some embodiments, the method further comprises:

[0030] verifying the received anti-quantum token according to the public key of the second network device to determine the correctness of the anti-quantum token, the anti-quantum token comprising a second random number randomly generated by the second network device.

[0031] Thus, the first network device verifies the received anti-quantum token according to the public key of the second network device to determine the correctness of the anti-quantum token, the anti-quantum token comprising a second random number randomly generated by the second network device. In this way, the first network device verifies the anti-quantum token by the public key of the second network device, and the first network device can confirm that the anti-quantum token is issued by the second network device, thereby ensuring the authenticity of the anti-quantum token.

[0032] In some embodiments, the method further comprises:

[0033] splicing the first random number randomly generated by the first network device and the second random number to obtain a first splicing body;

[0034] performing post-quantum signature processing on the first splicing body to obtain a first post-quantum signature value;

[0035] sending the first post-quantum signature value with the resource access request to the second network device.

[0036] Thus, the first network device splices the first random number and the second random number randomly generated by the first network device to obtain a first splice body. Then, the first network device performs post-quantum cryptographic signature processing on the first splice body to obtain a first post-quantum signature value. Finally, the first network device sends the first post-quantum signature value to the second network device with the resource access request. In this way, by splicing the second random number and the first random number and performing post-quantum cryptographic signature processing to obtain the first post-quantum signature value, the uniqueness and unpredictability of the first post-quantum signature value are increased, which helps to prevent replay attacks and improve the security of the token. Using the post-quantum signature algorithm can ensure the integrity and authenticity of the token during transmission.

[0037] In a second aspect, the embodiments of the present application provide another method for anti-quantum security enhancement of an open authorization protocol of a communication network, the communication network comprising a first network device and a second network device, the method being used by the second network device, and the method comprising:

[0038] receiving an authorization request sent by the first network device;

[0039] obtaining an authorization code from a second network node of the second network device according to the authorization request, and sending the authorization code to the first network device;

[0040] receiving anti-quantum parameter information sent by the first network device, the anti-quantum parameter information being obtained by the first network device by encrypting parameter information of an initial token request according to a first quantum key and a post-quantum cryptographic algorithm, the first quantum key being obtained by the first network device from a first network node of the first network device according to the authorization code, and the parameter information being generated by the first network device according to the authorization code;

[0041] generating an anti-quantum token according to the anti-quantum parameter information, and sending the anti-quantum token to the first network device;

[0042] receiving a resource access request generated by the first network device according to the anti-quantum token, and confirming the access right of a resource corresponding to the resource access request, so as to enable the first network device to access the resources of the second network device.

[0043] Thus, in the communication process in which the first network device applies to access the resource in the second network device, the first network device applies to obtain a quantum key, and uses the quantum key and a post-quantum cryptographic algorithm to perform encryption processing on the parameter information of the initial token request generated according to the authorization code to generate anti-quantum parameter information capable of resisting quantum computing attacks, the post-quantum cryptographic algorithm includes a series of encryption algorithms aiming at resisting quantum computing attacks, and the quantum key has good anti-quantum computing attack capability. Then, the second network device generates an anti-quantum token according to the anti-quantum parameter information sent by the first network device, and sends the anti-quantum token to the first network device. Then, the first network device generates a resource access request according to the anti-quantum token, for accessing the resource in the second network device. Finally, the second network device determines whether the first network device can access the resource corresponding to the resource access request by checking the validity of the anti-quantum token. In this way, the quantum key distribution technology and the post-quantum cryptographic algorithm enhance the anti-quantum computing attack capability of the communication process in which the first network device applies to access the resource in the second network device.

[0044] In some embodiments, the method further comprises:

[0045] receiving the registration request sent by the first network device, the registration request comprising a post-quantum public key of the first network device;

[0046] sending a registration response request generated according to the registration request, the registration response request comprising a public key of the second network device.

[0047] Thus, the second network device receives the registration request sent by the first network device, and the registration request comprises a post-quantum public key of the first network device. Then, the second network device sends a registration response request generated according to the registration request, and the registration response request comprises a public key of the second network device. In this way, the first network device and the second network device can securely exchange keys, the first network device obtains the public key of the second network device for subsequent signing and verification processes, and the second network device obtains the post-quantum public key of the first network device, which has good anti-quantum computing attack capability and can make the transmitted data have good anti-quantum computing attack capability.

[0048] In some embodiments, the obtaining of the authorization code from a second network node of the second network device according to the authorization request and the sending of the authorization code to the first network device comprise:

[0049] in the case where the second network device determines to approve the authorization request, sending a quantum key application to the second network node;

[0050] receiving, by the second network device, a second quantum key and a quantum key identifier sent by the second network node according to the quantum key application, the quantum key identifier being obtained by the second network node from the second quantum key according to an identification code of the second network node;

[0051] sending, by the second network device, the quantum key identifier as the authorization code to the first network device.

[0052] Thus, in the case that the second network device determines to approve the authorization request, the second network device sends a quantum key application to the second network node. Then, the second network device receives a second quantum key and a quantum key identifier sent by the second network node according to the quantum key application, the quantum key identifier being obtained by the second network node from the second quantum key according to an identification code of the second network node. Finally, the second network device sends the quantum key identifier as the authorization code to the first network device. In this way, the second network device obtains the second quantum key and the quantum key identifier, the second quantum key has good anti-quantum computing attack ability and can be used to make the communication between the first network device and the second network device have strong confidentiality. The quantum key identifier helps to manage and use the quantum key. The quantum key identifier as the authorization code has strong confidentiality.

[0053] In some embodiments, the anti-quantum token request includes a first encrypted message and a first signed message, and the method further includes:

[0054] In the case that the anti-quantum parameter information sent by the first network device is received, confirming the anti-quantum token application state of the first network device;

[0055] In the case that the first network device has not applied for the anti-quantum token, encrypting the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message, so as to determine that the second encrypted message is consistent with the first encrypted message;

[0056] In the case that the second encrypted message is consistent with the first encrypted message, performing signature verification processing on the first signed message using the post-quantum public key of the first network device, so as to confirm that the first network device can obtain the anti-quantum token.

[0057] Thus, in the case of receiving the anti-quantum parameter information sent by the first network device, the second network device confirms the anti-quantum token application state of the first network device. In the case that the first network device has not applied for the anti-quantum token, the second network device encrypts the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message, so as to determine whether the second encrypted message is consistent with the first encrypted message. In the case that the second encrypted message is consistent with the first encrypted message, the first signature message is verified using the post-quantum public key of the first network device, so as to confirm that the first network device can obtain the anti-quantum token. In this way, by comparing the consistency of the second encrypted message and the first encrypted message, the integrity and non-tampering of the information can be ensured. And through multiple verifications, the second network device confirms that the first network device can obtain the anti-quantum token, ensuring the security and effectiveness of the authorization process.

[0058] In some embodiments, the method of generating the anti-quantum token according to the anti-quantum parameter information and sending the anti-quantum token to the first network device comprises:

[0059] generating an initial token according to the anti-quantum parameter information;

[0060] splicing the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second splicing body;

[0061] signing the second splicing body according to the public key of the second network device to obtain a second signature message;

[0062] storing the second random number and the second signature message in the initial token to obtain the anti-quantum token;

[0063] sending the anti-quantum token to the first network device.

[0064] Thus, the second network device generates an initial token according to the anti-quantum parameter information. And the second network device splices the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second splicing body. Then, the second network device signs the second splicing body according to the public key of the second network device to obtain a second signature message. Then, the second network device stores the second random number and the second signature message in the initial token to obtain the anti-quantum token. Finally, the second network device sends the anti-quantum token to the first network device. In this way, the second network device splices the second random number and the anti-quantum parameter information, ensuring the uniqueness and complexity of the anti-quantum token, which helps to prevent replay attacks and improve the security of the anti-quantum token. And combined with random number, splicing processing and signature technology, it provides strong protection for the security and integrity of the anti-quantum token, which helps to protect the security of data and communication.

[0065] In some embodiments, the resource access request comprises a first post-quantum signature value and a first signature message, the receiving the resource access request generated by the anti-quantum token request, confirming the access right of the resource corresponding to the resource access request, so that the first network device accesses the resource of the second network device, the method comprises:

[0066] determining the correctness of the first post-quantum signature value according to the post-quantum cryptographic signature algorithm;

[0067] determining the correctness of the first signature message according to the post-quantum public key of the first network device;

[0068] determining the correctness of the second signature message according to the public key of the second network device;

[0069] in the case that the first post-quantum signature value is correct and the second signature message is correct, allowing the first network device to access the resource corresponding to the resource access request.

[0070] In this way, the second network device determines the correctness of the first post-quantum signature value according to the post-quantum cryptographic signature algorithm. Then, the correctness of the first signature message is determined according to the post-quantum public key of the first network device. Then, the second network device determines the correctness of the second signature message according to the public key of the second network device. In the case that the first post-quantum signature value is correct, the first signature message is correct, and the second signature message is correct, the second network device allows the first network device to access the resource corresponding to the resource access request. In this way, by verifying the correctness of the first post-quantum signature value, the first signature message and the second signature message, the second network device can ensure the authenticity of the identity of the first network device, provide strong security and quantum security for the resource access request, and help protect the security of data and communication.

[0071] In a third aspect, the present application provides a computing processing device, comprising: a memory, wherein the computer readable code is stored; one or more processors, when the computer readable code is executed by the one or more processors, the computing processing device executes the anti-quantum security enhancement method of the open authorization protocol of the communication network as proposed in the first aspect and the second aspect above.

[0072] In a fourth aspect, the present application provides a computer program comprising computer readable code, which when executed on a computing processing device causes the computing processing device to perform the anti-quantum security enhancement method of the open authorization protocol of the communication network as proposed in the first aspect and the second aspect above.

[0073] In a fifth aspect, the present application provides a computer readable medium storing the computer program as proposed in the fourth aspect above.

[0074] Additional aspects and advantages of the embodiments of the present application will be in part apparent and in part pointed out below. BRIEF DESCRIPTION OF DRAWINGS

[0075] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the following description, including the references to the figures, in which:

[0076] Fig. 1 is one of flow diagrams of the method according to an embodiment of the present application;

[0077] Fig. 2 is an architecture diagram of the method according to an embodiment of the present application;

[0078] Fig. 3 is a signaling diagram of the method according to an embodiment of the present application;

[0079] Fig. 4 is another of flow diagrams of the method according to an embodiment of the present application;

[0080] Fig. 5 is a third of flow diagrams of the method according to an embodiment of the present application;

[0081] Fig. 6 is a fourth of flow diagrams of the method according to an embodiment of the present application;

[0082] Fig. 7 is a fifth of flow diagrams of the method according to an embodiment of the present application;

[0083] Fig. 8 is a sixth of flow diagrams of the method according to an embodiment of the present application;

[0084] Fig. 9 is a seventh of flow diagrams of the method according to an embodiment of the present application;

[0085] Fig. 10 is an eighth of flow diagrams of the method according to an embodiment of the present application;

[0086] Fig. 11 is a ninth of flow diagrams of the method according to an embodiment of the present application;

[0087] Fig. 12 is a tenth of flow diagrams of the method according to an embodiment of the present application;

[0088] Fig. 13 is an eleventh of flow diagrams of the method according to an embodiment of the present application;

[0089] Fig. 14 is a twelfth of flow diagrams of the method according to an embodiment of the present application;

[0090] Fig. 15 is a structural diagram of a computing processing device for an anti-quantum security enhancement method of an open authorization protocol of a communication network according to another embodiment of the present application;

[0091] FIG. 16 is a structural diagram of a computer program of an anti-quantum security enhancement method of an open authorization protocol of a communication network according to another embodiment of the present application. DETAILED DESCRIPTION

[0092] Embodiments of the present application are described in detail below with reference to the attached drawings, which show by way of example, embodiments in which the same or similar elements have the same or similar reference numbers and in which:

[0093] The leap of computing power represented by quantum computing has a great impact on the security of related algorithms in classical cryptography. That is, quantum computing poses a more direct and urgent threat to the breaking of classical cryptography. A series of classical algorithms such as Diffie-Hellman, RSA, and elliptic curve (ECC) face a greater security risk because the number theory problems on which they are based, such as large prime factorization and discrete logarithm, are no longer difficult in the quantum era. Understandably, with the implementation of large quantum computers, there will be some impact on key agreement, encryption, signature, and other applications in classical cryptography.

[0094] Thus, the security of the Internet, which uses classical cryptography algorithms to protect the communication process, is threatened by quantum computing attacks. For example, the open authorization protocol (OAuth), an open standard authorization protocol, is used to authorize an application or service to access a user's resources in another application without providing a username and password. This allows users to share their data resources while maintaining control over their data. The open authorization protocol is an authentication framework based on which various authentication mechanisms can be implemented, such as authentication codes, security assertions, security tokens, JOSE (Json Signature and Encryption Objects), etc. These classical authentication technologies use classical public key encryption algorithms such as RSA algorithms and ECC algorithms. However, the open authorization protocol does not have the ability to resist quantum computing attacks and has a greater security risk when facing quantum computing attacks.

[0095] Currently, the technologies for responding to the threat of quantum computing attacks internationally mainly fall into two categories: one is to use quantum key distribution (QKD) networks for symmetric key agreement in scenarios using asymmetric algorithms for (symmetric) key agreement and then encrypted transmission through symmetric algorithms to protect the security of the key; the other is to study post-quantum cryptography (PQC) algorithms to directly replace existing asymmetric algorithms. Quantum key distribution technology uses quantum mechanics to generate keys that cannot be stolen by a third party, ensuring the security of key transmission. It is particularly suitable for key exchange scenarios and can replace existing asymmetric key agreement algorithms such as RSA or ECC to improve the security of the key. However, quantum key distribution technology cannot completely replace all applications of asymmetric algorithms, such as signature verification and integrity protection scenarios, which still require the use of asymmetric algorithms.

[0096] Post-quantum cryptography algorithms are asymmetric cryptography algorithms designed based on new mathematical problems, aiming to resist the threat of quantum computers. NIST has announced the first batch of four post-quantum cryptography algorithms for standardization, including Kyber, Dilithium, Falcon, and SPHINCS+, which cover multiple technical routes to reduce the risk of a single technology being cracked. Post-quantum cryptography algorithms can theoretically replace all asymmetric algorithms and are more versatile. However, the security of post-quantum cryptography algorithms still depends on the complexity of the computational problem, and in the future, they may face new cracking methods or become insecure as computing power improves. In addition, the post-quantum cryptography algorithm standard has not been officially announced, and the production and certification of related products also require time, so its large-scale application still needs a long period.

[0097] Both post-quantum cryptography algorithms and quantum key distribution technology have the ability to resist quantum computing attacks, but each has its limitations, so providing a relatively low-cost and highly secure cryptographic technology that can resist quantum computing attacks has become a pressing problem.

[0098] Based on the above problems, referring to FIG. 1, the present embodiment provides an anti-quantum security enhancement method for an open authorization protocol of a communication network, the communication network comprising a first network device and a second network device, the method being used for the first network device, and the method comprising:

[0099] 011: sending an authorization request to the second network device;

[0100] 012: receiving an authorization code generated by the second network device according to the authorization request;

[0101] 013: obtaining a first quantum key from a first network node of the first network device according to the authorization code;

[0102] 014: obtaining anti-quantum parameter information by encrypting parameter information of an initial token request according to the first quantum key and a post-quantum cryptographic algorithm, and sending the anti-quantum parameter information to the second network device;

[0103] 015: receiving the anti-quantum token sent by the second network device;

[0104] 016: sending a resource access request to the second network device according to the anti-quantum token.

[0105] The embodiment of the application also provides a first network device, which comprises a memory and a processor. The method of the embodiment of the application can be implemented by the first network device of the embodiment of the application. Specifically, the memory stores a computer program, and the processor is configured to send an authorization request to a second network device, receive an authorization code generated by the second network device according to the authorization request, and obtain a first quantum key from a first network node of the first network device according to the authorization code. The processor is further configured to obtain anti-quantum parameter information by encrypting parameter information of an initial token request according to the first quantum key and a post-quantum cryptographic algorithm, and send the anti-quantum parameter information to the second network device. The processor is further configured to receive an anti-quantum token sent by the second network device. The processor is further configured to send a resource access request to the second network device according to the anti-quantum token.

[0106] The embodiment of the application also provides a first network device security enhancement device. The method of the embodiment of the application can be implemented by the first network device security enhancement device of the embodiment of the application. Specifically, the first network device security enhancement device comprises a sending module, a receiving module, an obtaining module, an encryption module and a receiving module. The sending module is configured to send an authorization request to a second network device. The receiving module is configured to receive an authorization code generated by the second network device according to the authorization request. The obtaining module is configured to obtain a first quantum key from a first network node of the first network device according to the authorization code. The encryption module is configured to obtain anti-quantum parameter information by encrypting parameter information of an initial token request according to the first quantum key and a post-quantum cryptographic algorithm, and send the anti-quantum parameter information to the second network device. The receiving module is configured to receive an anti-quantum token sent by the second network device. The sending module is further configured to send a resource access request to the second network device according to the anti-quantum token.

[0107] The application provides a communication system based on an open authorization protocol, which comprises the first network device, the second network device and the quantum key distribution network of the above-mentioned embodiment, and the quantum key distribution network is configured to distribute quantum keys to the first network device or the second network device.

[0108] In particular, the quantum key distribution network comprises network nodes, a quantum network link control center, the network nodes being configured to store and distribute quantum keys in the quantum key distribution network. The quantum network link control center is configured to establish quantum key distribution and relay links between the network nodes according to the names of the network nodes, the quantum key distribution and relay links being configured to perform functions such as data switching. The quantum key distribution network is configured to implement services such as quantum key generation, quantum key relay, and quantum key provision.

[0109] Referring to FIG. 2, in some embodiments, the first network device sends an authorization request to the second network device, and the second network device responds to the authorization request sent by the first network device. In addition, the first network device also sends a token request to the second network device, and the second network device also responds to the token request sent by the first network device. Through multiple request sending and responses, the first network device and the second network device complete the generation and distribution of the token. The first network device accesses a service node, which is a transit station for the first network device to connect with the network node, and is configured to charge the first network device with the quantum key and relay and store the quantum key. When the first network device sends a quantum key application, the network node sends the quantum key generated by the quantum key distribution network to the service node accessed by the first network device, and the service node sends the quantum key to the first network device. The simple process of the first network device and the second network device obtaining the quantum key is as follows: first, the second network device sends a quantum key application to a second network node accessed by the second network device. Then, the second network node distributes the quantum key generated according to the quantum key application to the second network device. At the same time, the quantum network link control center synchronously causes a first network node accessed by the first network device to generate a quantum key, but the quantum key is not immediately distributed to the first network device, but is first stored in the network node. The correspondence between the above-mentioned first network device, second network device, service node, and network node is provided by the management platform.

[0110] ​It should be noted that the embodiments of the present application take the FIPS203 Module-Lattice-based Key-Encapsulation Mechanism Standard as the PQC key encapsulation algorithm, and take the FIPS204 Module-Lattice-Based Digital Signature Standard as the PQC digital signature algorithm as an example for explanation and description. The following description of the operations related to the PQC algorithm is based on the above FIPS standard. Of course, in other embodiments, other algorithms such as the NewHope algorithm, the Sidh algorithm, and the HQC algorithm can also be used as the related algorithm of the PQC. It should also be noted that the embodiments of the present application are directed to the Open Authorization (OAuth) protocol, which is referred to as the OAuth protocol hereinafter.

[0111] Specifically, the parameter information of the initial token request is the parameter information required by the first network device to initiate the access token request.

[0112] The first network device sends an authorization request to the second network device for accessing the resource in the second network device. In the case that the second network device receives the authorization request sent by the first network device, the second network device receives the quantum key identifier sent by the second network node and returns the quantum key identifier to the first network device as an authorization code.

[0113] The first network device receives the authorization code generated by the second network device according to the authorization request, and obtains the first quantum key from the first network node of the first network device according to the authorization code. The first network device further encrypts the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain the anti-quantum parameter information, and sends the anti-quantum parameter information to the second network device. The parameter information of the initial token request is generated by the first network device according to the authorization code.

[0114] The second network device receives the anti-quantum parameter information sent by the first network device, and generates an anti-quantum token according to the anti-quantum parameter information, and then sends the anti-quantum token to the first network device.

[0115] The first network device receives the anti-quantum token sent by the second network device, and then sends a resource access request to the second network device according to the anti-quantum token. The second network device receives the resource access request generated by the first network device according to the anti-quantum token, and confirms the access right of the resource corresponding to the resource access request, so that the first network device can access the resource of the second network device.

[0116] The method of the embodiment of the application is described below by way of an example. In the example of the application, the first network device is a client, an OAUTH client, and a third-party application that needs to access related resources in an OAUTH application scenario. The client includes a resource owner, which is a third-party application that needs to access the resources in the OAUTH application scenario and is authorized by the resource owner to access the resources. The second network device is a server, which includes an authentication server and a resource server. The authentication server is a server that processes an authentication request and issues a token for accessing related resources in the OAUTH application scenario. The resource server is a server that provides related resources and services. The resource server and the authentication server can be the same server or different servers. The same or different servers have no substantial influence on the quantum resistance enhancement method of the application. In actual applications, the same or different servers depend on specific requirements, security considerations, and budgets. In the example of the application, the resource server and the authentication server are the same server.

[0117] The quantum network node is a network node. The quantum network node stores and provides the generated quantum key to the server through a trusted channel or provides the generated quantum key to the client through the cryptographic service node. The cryptographic service node is a service node. The cryptographic service node is used to connect the quantum network node and provide pre-shared key charging and quantum key services for multiple clients.

[0118] The authorization request is an Authorization Request message. The authorization code is an Authorization Code. The initial token request is an Access Token Request message. The initial token is an Access Token-1. The quantum resistance token is an Access Token-2.

[0119] Referring to FIG. 3, the client sends an authorization request Authorization Request to the authentication server for accessing resources in the resource server. In the case where the authentication server receives the authorization request Authorization Request sent by the client, the authentication server receives the quantum key identifier UUID_QK sent by the second quantum network node accessing the authentication server and returns the quantum key identifier UUID_QK to the client as an authorization code Authorization Code.

[0120] The client receives the authorization code Authorization Code generated according to the authorization request Authorization Request sent by the authentication server, and obtains a first quantum key QK_UUID-1 from a first quantum network node of the access client according to the authorization code Authorization Code. The client further encrypts the parameter information of an initial token request Access Token Request message according to the first quantum key QK_UUID-1 and a post-quantum cryptographic algorithm to obtain quantum-resistant parameter information, and sends the quantum-resistant parameter information to the authentication server. The parameter information of the initial token request Access Token Request message is generated by the client according to the authorization code Authorization Code.

[0121] The authentication server receives the quantum-resistant parameter information sent by the client, generates a quantum-resistant token Access Token-2 according to the quantum-resistant parameter information, and sends the quantum-resistant token Access Token-2 to the client.

[0122] The client receives the quantum-resistant token Access Token-2 sent by the authentication server, and then sends a resource access request to the resource server according to the quantum-resistant token Access Token-2. The resource server receives the resource access request generated by the client according to the quantum-resistant token Access Token-2, confirms the access permission of the resource corresponding to the resource access request, so that the client can access the resource server.

[0123] In summary, in the communication network open authorization protocol anti-quantum security enhancement method, the communication system, the first network device and the second network device, for the communication process of the first network device applying for accessing the resource in the second network device, the first network device applies for obtaining a quantum key, and uses the quantum key and a post-quantum cryptographic algorithm to encrypt the parameter information of the initial token request generated according to the authorization code to generate anti-quantum parameter information capable of resisting quantum computing attacks, the post-quantum cryptographic algorithm includes a series of encryption algorithms aimed at resisting quantum computing attacks, and the quantum key has good anti-quantum computing attack capability. Then, the second network device generates an anti-quantum token according to the anti-quantum parameter information sent by the first network device, and sends the anti-quantum token to the first network device. Then, the first network device generates a resource access request according to the anti-quantum token, for accessing the resource in the second network device. Finally, the second network device determines whether the first network device can access the resource corresponding to the resource access request by checking the validity of the anti-quantum token. In this way, the quantum key distribution technology and the post-quantum cryptographic algorithm enhance the anti-quantum computing attack capability of the communication process of the first network device applying for accessing the resource in the second network device.

[0124] Referring to FIG. 4, in some embodiments, the method further includes:

[0125] 017: sending a registration request to the second network device;

[0126] 018: receiving a registration response request sent by the second network device according to the registration request.

[0127] In some embodiments, the sending module is configured to send the registration request to the second network device, and the receiving module is configured to receive the registration response request sent by the second network device according to the registration request.

[0128] In some embodiments, the processor is further configured to send the registration request to the second network device, and receive the registration response request sent by the second network device according to the registration request.

[0129] Specifically, the first network device sends a registration request to the second network device, and the registration request includes a post-quantum public key of the first network device. Then, the first network device receives a registration response request sent by the second network device according to the registration request, and the registration response request includes a public key of the second network device. In this way, the first network device and the second network device can securely exchange keys, the first network device obtains the public key of the second network device for subsequent signature and verification processes, and the second network device obtains the post-quantum public key of the first network device, which has good anti-quantum computing attack capability and can make the transmitted data have anti-quantum capability.

[0130] With the above examples, please refer to FIG. 3 again. Before the client sends an authorization request to the server, the client sends a registration request to the authentication server according to the standard document RFC7591 (OAuth 2.0 Dynamic Registration) published by the Internet Engineering Task Force (IETF), and submits the PQC public key of the client in the registration request. Then, the client receives the registration response request generated by the authentication server according to the registration request, and the successfully returned registration response request carries the ECC or RSA public key of the authentication server.

[0131] In this way, the client and the authentication server can securely exchange keys. The client obtains the ECC or RSA public key of the authentication server, which is used for subsequent signature and verification processes. The authentication server obtains the PQC public key of the client, which has good resistance to quantum computing attacks and can make the transmitted data resistant to quantum attacks.

[0132] Please refer to FIG. 5. In some embodiments, step 013 (obtaining a first quantum key from a first network node of a first network device according to an authorization code) includes:

[0133] 0131: charging a plurality of keys to a cryptographic module of the first network device by using a service node;

[0134] 0132: sending a quantum key application to the service node according to the authorization code;

[0135] 0133: receiving a quantum key encryption result obtained by encrypting the first quantum key according to a protection key by the service node;

[0136] 0134: decrypting the quantum key encryption result to obtain the first quantum key.

[0137] In some embodiments, the charging module is configured to charge a plurality of keys to a cryptographic module of the first network device by using a service node. The sending module is configured to send a quantum key application to the service node according to the authorization code. The receiving module is configured to receive a quantum key encryption result obtained by encrypting the first quantum key according to a protection key by the service node. The decryption module is configured to decrypt the quantum key encryption result to obtain the first quantum key.

[0138] In some embodiments, the processor is further configured to charge a plurality of keys to a cryptographic module of the first network device by using a service node, and send a quantum key application to the service node according to an authorization code, the quantum key application being protected by a protection key. The processor is further configured to receive a quantum key encryption result obtained by encrypting the first quantum key according to the protection key by the service node, and decrypt the quantum key encryption result to obtain the first quantum key.

[0139] Specifically, the first network device uses the service node to charge a plurality of keys to the password module of the first network device. Then, the first network device sends a quantum key application to the service node according to the received authorization code sent by the second network device, the quantum key application is protected by a protection key, and the protection key is randomly used from the plurality of keys charged to the password module. Then, the first network device receives the quantum key encryption result obtained by the service node according to the encryption processing of the first quantum key by the protection key, and the first quantum key is generated by the first network node accessing the service node and distributed to the service node. Finally, the first network device decrypts the quantum key encryption result to obtain the first quantum key. In this way, the first network device obtains the first quantum key, and the first quantum key has good anti-quantum computing attack ability, which can protect the communication between the first network device and the second network device to have good anti-quantum computing attack ability.

[0140] Continuing the above example, please refer to FIG. 3 again, the client uses the cryptographic service node to charge the personal password module of the resource owner in the client with pre-shared keys, the total amount of charge is 1M bits of 128-bit keys, and the personal password module includes but is not limited to smart password key (HSM), virtual security module (VSM). Then, the client sends a quantum key application to the cryptographic service node according to the authorization code, and uses a smart password key as a protection key by randomly using one of the smart password keys. The client uses the SM3 algorithm and the protection key to perform a hash operation (HMAC) on the key ID and the application content. Then, the cryptographic service node also uses the SM3 algorithm and the protection key to perform a hash operation on the key ID and the application content to verify the integrity and authenticity of the data. HMAC is a method of using a hash function and a key to provide data integrity and source authentication.

[0141] After the quantum key application is confirmed to be successful, the client receives the quantum key encryption result obtained by the cryptographic service node according to the encryption processing of the first quantum key QK_UUID-1 by the protection key, and the first quantum key QK_UUID-1 is generated by the first quantum network node accessing the cryptographic service node and distributed to the cryptographic service node. The client decrypts the quantum key encryption result according to the protection key to obtain the first quantum key QK_UUID-1.

[0142] In this way, the client obtains the first quantum key QK_UUID-1, which can be used to generate a key with stronger anti-quantum computing attack ability in the future.

[0143] Referring to FIG. 6, in some embodiments, the step 014 (encrypting parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain anti-quantum parameter information, and sending the anti-quantum parameter information to the second network device) comprises:

[0144] 0141: generating an initial token request according to the authorization code;

[0145] 0142: encrypting parameter information of the initial token request according to the first quantum key to obtain a first encrypted message;

[0146] 0143: performing post-quantum cryptographic signature processing on the spliced whole of the parameter information according to the post-quantum public key of the first network device to obtain a first signature message;

[0147] 0144: constructing anti-quantum parameter information according to the parameter information, the first encrypted message, and the first signature message.

[0148] In some embodiments, the derivation module is configured to generate an initial token request according to the authorization code. The encryption module is configured to encrypt parameter information of the initial token request according to the first quantum key to obtain a first encrypted message. The signature module is configured to perform post-quantum cryptographic signature processing on the spliced whole of the parameter information according to the post-quantum public key of the first network device to obtain a first signature message. The encapsulation module is configured to construct anti-quantum parameter information according to the parameter information, the first encrypted message, and the first signature message.

[0149] In some embodiments, the processor is further configured to generate an initial token request according to the authorization code, and encrypt parameter information of the initial token request according to the first quantum key to obtain a first encrypted message, and perform post-quantum cryptographic signature processing on the spliced whole of the parameter information according to the post-quantum public key of the first network device to obtain a first signature message. The processor is further configured to construct anti-quantum parameter information according to the parameter information, the first encrypted message, and the first signature message.

[0150] Specifically, the first network device generates an initial token request according to the authorization code. Then, the first network device encrypts parameter information of the initial token request according to the first quantum key to obtain a first encrypted message. Then, the first network device performs post-quantum cryptographic signature processing on the spliced whole of the parameter information according to the post-quantum public key of the first network device to obtain a first signature message. Finally, the first network device constructs anti-quantum parameter information according to the parameter information, the first encrypted message, and the first signature message. In this way, the first network device encrypts parameter information of the initial token request using the first quantum key to obtain a first encrypted message, so that the parameter information of the initial token request has good anti-quantum computing attack ability. And using the post-quantum public key to sign the parameter information processing can ensure the integrity and authenticity of the parameter information in the transmission process.

[0151] In the above example, the initial token request is an Access Token Request message, and the parameter information of the initial token request includes a client and user ID, a resource ID, a scope, a recipient, and the like.

[0152] Referring to FIG. 3, after the client obtains the first quantum key QK_UUID-1 according to the authorization code UUID_QK, the client generates an initial token request Access Token Request message according to the authorization code UUID_QK. The client sends the Access Token Request message to the authentication server to request an initial token Access Token-1 that can access the resource. The client generates parameter information of the Access Token Request message according to the requirement for the resource, such as a client and user ID, a resource ID, a scope, a recipient, and the like. The client calculates the parameter information of the Access Token Request message as a whole using the first quantum key QK_UUID-1 as a hash key to obtain a first encrypted message m1 of 256 bits or more. In addition, the client calculates the spliced whole of the parameter information of the Access Token Request message using a PQC signature algorithm and its own PQC signature private key to obtain a first signature message M1. Subsequently, the client takes the parameter information of the Access Token Request message and the first encrypted message m1 as the request content of the Access Token Request message, and takes the first signature message as the client authentication content in the Access Token Request message to obtain a new Access Token Request message, and calls the Access Token Request message as quantum-resistant parameter information.

[0153] In this way, the client encrypts the parameter information of the initial token request Access Token Request message using the first quantum key QK_UUID-1 to obtain the first encrypted message m1, so that the parameter information of the Access Token Request message has good anti-quantum computing attack capability. The parameter information is signed using a post-quantum public key, which can ensure the integrity and authenticity of the parameter information in the transmission process.

[0154] Referring to FIG. 7, in some embodiments, the method further includes:

[0155] 019: verifying the received quantum-resistant token according to the public key of the second network device to determine the correctness of the quantum-resistant token.

[0156] In some embodiments, the verification module is configured to verify the received anti-quantum token according to the public key of the second network device to determine the correctness of the anti-quantum token.

[0157] In some embodiments, the processor is further configured to verify the received anti-quantum token according to the public key of the second network device to determine the correctness of the anti-quantum token.

[0158] In particular, the first network device verifies the received anti-quantum token according to the public key of the second network device to determine the correctness of the anti-quantum token, the anti-quantum token including a second random number randomly generated by the second network device. In this way, the first network device verifies the anti-quantum token through the public key of the second network device, and the first network device can confirm that the anti-quantum token is issued by the second network device, thereby ensuring the authenticity of the anti-quantum token.

[0159] In the above example, the public key of the authentication server is a public key in a classical algorithm, such as an ECC public key or an RSA public key. Referring to FIG. 3, the client verifies the received anti-quantum token Access Token-2 according to the public key of the authentication server to determine the correctness of the anti-quantum token Access Token-2, the anti-quantum token Access Token-2 including a second random number R2 randomly generated by the authentication server.

[0160] In this way, the client verifies the anti-quantum token Access Token-2, and the client can confirm that the anti-quantum token Access Token-2 is issued by the authentication server, thereby ensuring the authenticity of the anti-quantum token.

[0161] Referring to FIG. 8, in some embodiments, the method further includes:

[0162] 020: concatenating the first random number and the second random number randomly generated by the first network device to obtain a first concatenation;

[0163] 021: performing post-quantum signature processing on the first concatenation to obtain a first post-quantum signature value;

[0164] 022: sending the first post-quantum signature value with a resource access request to the second network device.

[0165] In some embodiments, the concatenating module is configured to concatenate the first random number and the second random number randomly generated by the first network device to obtain a first concatenation. The signing module is configured to perform post-quantum signature processing on the first concatenation to obtain a first post-quantum signature value. The sending module is configured to send the first post-quantum signature value with a resource access request to the second network device.

[0166] In some embodiments, the processor is further configured to splice the first random number and the second random number randomly generated by the first network device to obtain a first spliced body, perform post-quantum cryptographic signature processing on the first spliced body to obtain a first post-quantum signature value, and send the first post-quantum signature value to the second network device with the resource access request.

[0167] Specifically, the first network device splices the first random number and the second random number randomly generated by the first network device to obtain a first spliced body. Then, the first network device performs post-quantum cryptographic signature processing on the first spliced body to obtain a first post-quantum signature value. Finally, the first network device sends the first post-quantum signature value to the second network device with the resource access request. In this way, by splicing the second random number and the first random number and performing post-quantum cryptographic signature processing to obtain the first post-quantum signature value, the uniqueness and unpredictability of the first post-quantum signature value are increased, which helps to prevent replay attacks and improve the security of the token. Using the post-quantum signature algorithm can ensure the integrity and authenticity of the token during transmission.

[0168] Continuing the above example, referring again to FIG. 3, after determining the correctness of the anti-quantum token, the client sends a resource access request to the resource server carrying the anti-quantum token sent by the authentication server, and the resource access request includes the authentication message of the client, i.e., the first post-quantum signature value. The first post-quantum signature value is generated as follows: the client splices the randomly generated 256-bit first random number R1 and the second random number R2 carried in the anti-quantum token generated by the authentication server to obtain a first spliced body. The client then performs post-quantum cryptographic signature processing on the first spliced body to obtain a first post-quantum signature value.

[0169] In this way, the client splices the second random number R2 and the first random number R1 and performs post-quantum cryptographic signature processing to obtain the first post-quantum signature value, which increases the uniqueness and unpredictability of the first post-quantum signature value, helps to prevent replay attacks and improve the security of the anti-quantum token, and using the post-quantum signature algorithm can ensure the integrity and authenticity of the anti-quantum token during transmission.

[0170] Referring to FIG. 9, the present application provides an anti-quantum security enhancement method for an open authorization protocol of a communication network, the communication network including a first network device and a second network device, the method being used for the second network device, and the method including:

[0171] 031: receiving an authorization request sent by the first network device;

[0172] 032: obtaining an authorization code from a second network node of the second network device according to the authorization request, and sending the authorization code to the first network device;

[0173] 033: receive the anti-quantum parameter information sent by the first network device;

[0174] 034: generate an anti-quantum token according to the anti-quantum parameter information, and send the anti-quantum token to the first network device;

[0175] 035: receive a resource access request generated by the first network device according to the anti-quantum token, and confirm the access right of the resource corresponding to the resource access request, so that the first network device accesses the resource of the second network device.

[0176] The embodiment of the application also provides a second network device, comprising a memory and a processor. The method of the embodiment of the application can be implemented by the second network device of the embodiment of the application. Specifically, the memory stores a computer program, and the processor is configured to receive an authorization request sent by a first network device, and obtain an authorization code from a second network node of the second network device according to the authorization request, and send the authorization code to the second network device. The processor is also configured to receive anti-quantum parameter information sent by the first network device, and generate an anti-quantum token according to the anti-quantum parameter information, and send the anti-quantum token to the first network device. The processor is also configured to receive a resource access request generated by the first network device according to the anti-quantum token, and confirm the access right of the resource corresponding to the resource access request, so that the first network device accesses the resource of the second network device.

[0177] The embodiment of the application also provides a second network device security enhancement device. The method of the embodiment of the application can be implemented by the second network device security enhancement device of the embodiment of the application. Specifically, the second network device security enhancement device comprises a receiving module, an obtaining module and a derivation module. The receiving module is configured to receive an authorization request sent by a first network device. The obtaining module is configured to obtain an authorization code from a second network node of the second network device according to the authorization request, and send the authorization code to the second network device. The receiving module is also configured to receive anti-quantum parameter information sent by the first network device. The derivation module is configured to generate an anti-quantum token according to the anti-quantum parameter information, and send the anti-quantum token to the first network device. The receiving module is also configured to receive a resource access request generated by the first network device according to the anti-quantum token, and confirm the access right of the resource corresponding to the resource access request, so that the first network device accesses the resource of the second network device.

[0178] The application provides a communication system based on an open authorization protocol, the communication system comprising the second network device, the first network device and the quantum key distribution network of the above-mentioned embodiments, and the quantum key distribution network is configured to distribute a quantum key to the first network device or the second network device.

[0179] Specifically, the anti-quantum security enhancement method of the present embodiment is basically the same as the anti-quantum security enhancement method of the first network device in the foregoing embodiment, and specific reference can be made to the explanation and description of the corresponding part. The difference is that the second network device is taken as the execution object in the present embodiment, which will not be described here.

[0180] In summary, in the anti-quantum security enhancement method of the open authorization protocol of the communication network, the communication system, the first network device and the second network device of the present embodiment, for the communication process of the first network device applying for accessing the resource in the second network device, the first network device applies for obtaining a quantum key, and uses the quantum key and a post-quantum cryptographic algorithm to encrypt the parameter information of the initial token request generated according to the authorization code to generate anti-quantum parameter information capable of resisting quantum computing attacks. The post-quantum cryptographic algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good anti-quantum computing attack ability. Then, the second network device generates an anti-quantum token according to the anti-quantum parameter information sent by the first network device, and sends the anti-quantum token to the first network device. Then, the first network device generates a resource access request according to the anti-quantum token, for accessing the resource in the second network device. Finally, the second network device determines whether the first network device can access the resource corresponding to the resource access request by checking the validity of the anti-quantum token. In this way, the quantum key distribution technology and the post-quantum cryptographic algorithm enhance the anti-quantum computing attack ability of the communication process of the first network device applying for accessing the resource of the second network device.

[0181] Referring to FIG. 10, in some embodiments, the method further comprises:

[0182] 036: receiving the registration request sent by the first network device;

[0183] 037: sending a registration response request generated according to the registration request.

[0184] In some embodiments, the receiving module is further configured to receive the registration request sent by the first network device. The sending module is further configured to send a registration response request generated according to the registration request.

[0185] In some embodiments, the processor is further configured to receive the registration request sent by the first network device, and send a registration response request generated according to the registration request.

[0186] Specifically, the second network device receives the registration request sent by the first network device, and the registration request includes the post-quantum public key of the first network device. Then, the second network device sends a registration response request generated according to the registration request, and the registration response request includes the public key of the second network device. In this way, the first network device and the second network device can securely exchange keys, the first network device obtains the public key of the second network device for subsequent signature and verification processes, and the second network device obtains the post-quantum public key of the first network device, which has good anti-quantum computing attack capability.

[0187] With reference to the above example, please refer to FIG. 3. The authentication server receives the registration request sent by the client according to RFC7591, and the registration request includes the post-quantum public key of the first network device. Then, the authentication server sends a registration response request generated according to the registration request, and the registration response request includes the public key of the second network device, such as an ECC public key or an RSA public key.

[0188] In this way, the client and the authentication server can securely exchange keys, the client obtains the public key of the authentication server for subsequent signature and verification processes, and the authentication server obtains the post-quantum public key of the client, which has good anti-quantum computing attack capability and can make the transmitted data have good anti-quantum computing attack capability.

[0189] Please refer to FIG. 11. In some embodiments, step 032 (obtaining an authorization code from the second network node of the second network device according to the authorization request, and sending the authorization code to the first network device) includes:

[0190] 0321: In the case where the second network device determines to approve the authorization request, sending a quantum key application to the second network node;

[0191] 0322: Receiving the second quantum key and the quantum key identifier sent by the second network node according to the quantum key application;

[0192] 0323: Taking the quantum key identifier as the authorization code, and sending the authorization code to the first network device.

[0193] In some embodiments, the sending module is further configured to, in the case where the second network device determines to approve the authorization request, send a quantum key application to the second network node. The receiving module is further configured to receive the second quantum key and the quantum key identifier sent by the second network node according to the quantum key application. The processing module is configured to take the quantum key identifier as the authorization code, and send the authorization code to the first network device.

[0194] In some embodiments, the processor is further configured to, in a case where the second network device determines to approve the authorization request, send a quantum key application to the second network node, receive a second quantum key and a quantum key identifier sent by the second network node according to the quantum key application, and send the quantum key identifier as an authorization code to the first network device.

[0195] Specifically, in a case where the second network device determines to approve the authorization request, the second network device sends a quantum key application to the second network node. Then, the second network device receives a second quantum key and a quantum key identifier sent by the second network node according to the quantum key application, the quantum key identifier being identified by the second network node according to a unique identification code of the second network node. Finally, the second network device sends the quantum key identifier as an authorization code to the first network device. In this way, the second network device obtains the second quantum key and the quantum key identifier, the second quantum key having good resistance to quantum computing attacks and being able to be used to make the communication between the first network device and the second network device have strong confidentiality. The quantum key identifier helps to manage and use the quantum key. The quantum key identifier as the authorization code has strong confidentiality.

[0196] Following the above example, please refer to FIG. 3. Before communicating with the client, the authentication server accesses the second quantum network node closest in physical distance and authorized to complete through a trusted channel. The trusted channel refers to a mechanism or protocol that provides a secure communication path between two communication entities. One way to establish is that the authentication server and the second quantum network node are inside the same cabinet and are directly connected by shielding network cables. This channel ensures the confidentiality, integrity and availability of data during transmission, preventing unauthorized access, tampering or eavesdropping.

[0197] After the authentication server receives the authorization request sent by the client, the authentication server redirects the authorization request to the resource owner. In a case where the resource owner determines to approve the authorization request, the authentication server sends a quantum key application to the accessed second quantum network node. Then, the authentication server receives a second quantum key QK_UUID-2 and a quantum key identifier UUID_QK sent by the second quantum network node according to the quantum key application, the quantum key identifier UUID_QK being identified by the second quantum network node according to a unique universal identification code of the second quantum network node. Finally, the authentication server sends the quantum key identifier UUID_QK as an authorization code to the client together with an authorization request response.

[0198] Thus, the authentication server obtains the second quantum key QK_UUID-2 and the quantum key identifier UUID_QK, the second quantum key QK_UUID-2 has good anti-quantum computing attack ability and can be used to make the communication between the client and the authentication server have strong confidentiality. The quantum key identifier UUID_QK helps to manage and use the quantum key. The quantum key identifier UUID_QK has strong confidentiality as an authorization code.

[0199] Referring to FIG. 12, in some embodiments, the anti-quantum token request includes a first encrypted message and a first signed message, and the method further includes:

[0200] 038: In the case of receiving the anti-quantum parameter information sent by the first network device, confirming the anti-quantum token application state of the first network device;

[0201] 039: In the case where the first network device has not applied for an anti-quantum token, encrypting the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message, so as to determine that the second encrypted message is consistent with the first encrypted message;

[0202] 040: In the case where the second encrypted message is consistent with the first encrypted message, using the post-quantum public key of the first network device to perform signature verification processing on the first signed message, so as to confirm that the first network device can obtain the anti-quantum token.

[0203] In some embodiments, the confirmation module is configured to, in the case of receiving the anti-quantum parameter information sent by the first network device, confirm the anti-quantum token application state of the first network device. The encryption module is configured to, in the case where the first network device has not applied for an anti-quantum token, encrypt the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message, so as to determine that the second encrypted message is consistent with the first encrypted message. The signature verification module is configured to, in the case where the second encrypted message is consistent with the first encrypted message, use the post-quantum public key of the first network device to perform signature verification processing on the first signed message, so as to confirm that the first network device can obtain the anti-quantum token.

[0204] In some embodiments, the processor is further configured to, in the case of receiving the anti-quantum parameter information sent by the first network device, confirm the anti-quantum token application state of the first network device. In the case where the first network device has not applied for an anti-quantum token, encrypt the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message, so as to determine that the second encrypted message is consistent with the first encrypted message. In the case where the second encrypted message is consistent with the first encrypted message, use the post-quantum public key of the first network device to perform signature verification processing on the first signed message, so as to confirm that the first network device can obtain the anti-quantum token.

[0205] Specifically, in the case of receiving the anti-quantum token sent by the first network device, the second network device confirms the anti-quantum token application state of the first network device. In the case where the first network device has not applied for the anti-quantum token, the second network device encrypts the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message, so as to determine whether the second encrypted message is consistent with the first encrypted message. In the case where the second encrypted message is consistent with the first encrypted message, the first signature message is verified using the post-quantum public key of the first network device, so as to confirm that the first network device can obtain the anti-quantum token. In this way, by comparing the consistency of the second encrypted message and the first encrypted message, the integrity and non-tampering of the information can be ensured. And through multiple verifications, the second network device confirms that the first network device can obtain the anti-quantum token, ensuring the security and effectiveness of the authorization process.

[0206] With reference to the above example, please refer to FIG. 3. In the case of receiving the anti-quantum parameter information sent by the client, the authentication server confirms the anti-quantum token application state of the client, that is, whether the client has previously applied for obtaining the anti-quantum token. In the case where the client has not applied for the anti-quantum token, the authentication server encrypts the parameter information of the initial token request according to the second quantum key QK_UUID-2 to obtain a second encrypted message, so as to determine whether the second encrypted message is consistent with the first encrypted message. In the case where the second encrypted message is consistent with the first encrypted message, the first signature message is verified using the post-quantum public key of the client, the identity of the client is verified, and then according to the corresponding access control policy, it is confirmed that the token parameter of the client can be authorized, and it is confirmed that the client can obtain the anti-quantum token.

[0207] In this way, the authentication server can ensure the integrity and non-tampering of the information by comparing the consistency of the second encrypted message and the first encrypted message. And through multiple verifications, the authentication server confirms that the client can obtain the anti-quantum token, ensuring the security and effectiveness of the authorization process.

[0208] Please refer to FIG. 13. In some embodiments, step 034 (generating an anti-quantum token according to anti-quantum parameter information, and sending the anti-quantum token to the first network device) includes:

[0209] 0341: generating an initial token according to the anti-quantum parameter information;

[0210] 0342: splicing the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second splicing body;

[0211] 0343: signing the second splicing body according to the public key of the second network device to obtain a second signature message;

[0212] 0344: store the second random number and the second signature message in the initial token to obtain the anti-quantum token;

[0213] 0345: send the anti-quantum token to the first network device.

[0214] In some embodiments, the derivation module is further configured to generate the initial token according to the anti-quantum parameter information. The splicing module is configured to splice the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second splicing body. The signature module is configured to sign the second splicing body according to the public key of the second network device to obtain a second signature message. The storage module is configured to store the second random number and the second signature message in the initial token to obtain the anti-quantum token. The sending module is further configured to send the anti-quantum token to the first network device.

[0215] In some embodiments, the processor is further configured to generate the initial token according to the anti-quantum parameter information, and splice the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second splicing body. The processor is further configured to sign the second splicing body according to the public key of the second network device to obtain a second signature message, and store the second random number and the second signature message in the initial token to obtain the anti-quantum token. The processor is further configured to send the anti-quantum token to the first network device.

[0216] Specifically, the second network device generates the initial token according to the anti-quantum parameter information. The second network device splices the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second splicing body. Then, the second network device signs the second splicing body according to the public key of the second network device to obtain a second signature message. Then, the second network device stores the second random number and the second signature message in the initial token to obtain the anti-quantum token. Finally, the anti-quantum token is sent to the first network device. In this way, the second network device splices the second random number and the anti-quantum parameter information, which guarantees the uniqueness and complexity of the anti-quantum token, helps to prevent replay attacks and improve the security of the anti-quantum token. And combining random number, splicing processing and signature technology, it provides strong protection for the security and integrity of the anti-quantum token, and helps to protect the security of data and communication.

[0217] Continuing the above example, the token response Access Token Response is the response message of the initial token request Access Token Request, which is generated according to the OAUTH protocol.

[0218] Please refer to FIG. 3 again. The authentication server generates an initial token Access Token-1 according to the anti-quantum parameter information. The authentication server splices the 256-bit second random number R2 generated by the authentication server and the anti-quantum parameter information to obtain a second splice. Then, the authentication server signs the second splice according to the public key of the authentication server to obtain a second signature message. If an ECC public key is used, the second signature message is an ECC signature. If an RSA public key is used, the second signature message is an RSA signature. Finally, the authentication server stores the second random number and the second signature message in the initial token Access Token-1 to obtain an anti-quantum token Access Token-2. The anti-quantum token Access Token-2 is returned to the client together with the token response Access Token Response.

[0219] In this way, the authentication server splices the second random number R2 and the anti-quantum parameter information, ensuring the uniqueness and complexity of the anti-quantum token Access Token-2, which helps to prevent replay attacks and improve the security of the anti-quantum token Access Token-2. In combination with the random number, the splicing process and the signature technology, the security and integrity of the anti-quantum token are strongly protected, which helps to protect the security of data and communication.

[0220] Please refer to FIG. 14. In some embodiments, the resource access request includes a first post-quantum signature value and a first signature message, and step 035 (receiving a resource access request generated by the first network device according to the anti-quantum token, confirming the access right of the resource corresponding to the resource access request, so that the first network device accesses the resource of the second network device) includes:

[0221] 0351: determining the correctness of the first post-quantum signature value according to the post-quantum cryptographic signature algorithm;

[0222] 0352: determining the correctness of the first signature message according to the post-quantum public key of the first network device;

[0223] 0353: determining the correctness of the second signature message according to the public key of the second network device;

[0224] 0354: in the case that the first post-quantum signature value is correct and the second signature message is correct, allowing the first network device to access the resource corresponding to the resource access request.

[0225] In some embodiments, the determining module is configured to determine the correctness of the first post-quantum signature value according to a post-quantum cryptographic signature algorithm. The determining module is further configured to determine the correctness of the first signed message according to the post-quantum public key of the first network device. The determining module is further configured to determine the correctness of the second signed message according to the public key of the second network device. The processing module is further configured to allow the first network device to access the resource corresponding to the resource access request if the first post-quantum signature value is correct and the second signed message is correct.

[0226] In some embodiments, the processor is further configured to determine the correctness of the first post-quantum signature value according to a post-quantum cryptographic signature algorithm. The processor is further configured to determine the correctness of the first signed message according to the post-quantum public key of the first network device. The processor is further configured to determine the correctness of the second signed message according to the public key of the second network device. The processor is further configured to allow the first network device to access the resource corresponding to the resource access request if the first post-quantum signature value is correct and the second signed message is correct.

[0227] Specifically, the second network device determines the correctness of the first post-quantum signature value according to a post-quantum cryptographic signature algorithm. Then, the second network device determines the correctness of the first signed message according to the post-quantum public key of the first network device. Next, the second network device determines the correctness of the second signed message according to the public key of the second network device. In the case that the first post-quantum signature value is correct, the first signed message is correct, and the second signed message is correct, the second network device allows the first network device to access the resource corresponding to the resource access request. In this way, by verifying the correctness of the first post-quantum signature value, the first signed message, and the second signed message, the second network device can ensure the authenticity of the identity of the first network device, providing strong security and quantum security for the resource access request, and helping to protect the security of data and communication.

[0228] With reference to the above example and FIG. 3, after the resource server receives the resource access request sent by the client, the resource server submits the received anti-quantum token Access Token-2 and the first post-quantum signature value to the authentication server for verification. Then, the authentication server determines the correctness of the first post-quantum signature value according to a post-quantum cryptographic signature algorithm. The authentication server determines the correctness of the first signed message according to the post-quantum public key of the first network device. Next, the authentication server determines the correctness of the second signed message according to the public key of the authentication server. In the case that the first post-quantum signature value is correct, the first signed message is correct, and the second signed message is correct, the authentication server notifies the resource server that the resource server can access the resource corresponding to the resource access request.

[0229] In this way, by verifying the correctness of the first post-quantum signature value, the first signed message and the second signed message, the server can ensure the authenticity of the identity of the client, providing strong security and quantum security for the resource access request, helping to protect the security of data and communication.

[0230] The various component embodiments of the present application can be implemented in hardware, or as software modules running on one or more processors, or combinations thereof. Those skilled in the art will appreciate that some or all of the functions of some or all of the components of the computing processing device according to embodiments of the present application can be implemented using a microprocessor or a digital signal processor (DSP) in practice. The present application can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for performing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer readable medium or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, or provided on a carrier signal, or in any other form.

[0231] For example, Fig. 15 shows a computing processing device that can implement methods according to the present application. The computing processing device traditionally comprises a processor 1010 and a computer program product or computer readable medium in the form of a memory 1020. The memory 1020 can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard drive, or a ROM. The memory 1020 has a storage space 1030 for program code 1031 for performing any of the method steps in the methods described above. For example, the storage space 1030 for program code can comprise individual program code 1031 for implementing the various steps in the methods above, respectively. The program code can be read from or written to one or more computer program products. The computer program products comprise program code carriers such as hard disks, compact disks (CDs), memory cards, or floppy disks. Such computer program products are often portable or stationary memory units as described with reference to Fig. 16. The memory unit can have a storage section, a storage space, etc., arranged similarly to the memory 1020 in the computing processing device of Fig. 15. The program code can be compressed, for example, in a suitable form. Typically, the memory unit comprises computer readable code 1031', i.e., code that can be read by a processor such as 1010, which, when run by the computing processing device, causes the computing processing device to perform the various steps in the methods described above.

[0232] It can be understood that the computer program includes computer program code. The computer program code can be in the form of source code, object code, executable files, or some intermediate forms, etc. The computer readable storage medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution medium, etc.

[0233] In the description of the present specification, the description referring to the terms "specifically", "further", "particularly", "it can be understood that", etc. means that the specific features, structures, materials or characteristics described in connection with the embodiments or examples are included in at least one embodiment or example of the present application. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples without contradiction.

[0234] Any process or method descriptions or descriptions in flow charts or otherwise described herein can be understood as representing code modules, segments, or portions of code which include one or more executable instructions for performing specific logic functions or steps in the process, and the preferred embodiments of the application include additional implementations in which the order of steps can be changed, additional steps can be added, some steps can be eliminated, or some steps can be performed at least partially in parallel with other steps, all without departing from the scope of the application.

[0235] Although the embodiments of the present application have been shown and described above, it can be understood that the above-described embodiments are exemplary and cannot be construed as limiting the present application, and those of ordinary skill in the art can make changes, modifications, replacements and variations to the above-described embodiments within the scope of the present application.

Claims

1. A method of quantum-resistant security enhancement of an open authorization protocol of a communication network, wherein, The communication network comprises a first network device and a second network device, the method is used for the first network device, and the method comprises the following steps: sending an authorization request to the second network device; receiving an authorization code generated by the second network device according to the authorization request; obtaining a first quantum key from a first network node of the first network device according to the authorization code; encrypting parameter information of an initial token request according to the first quantum key and a post-quantum cryptographic algorithm to obtain anti-quantum parameter information, and sending the anti-quantum parameter information to the second network device, wherein the parameter information of the initial token request is generated by the first network device according to the authorization code; receiving an anti-quantum token sent by the second network device, wherein the anti-quantum token is generated by the second network device according to the anti-quantum parameter information; sending a resource access request to the second network device according to the anti-quantum token, wherein the second network device confirms an access right of a resource corresponding to the resource access request according to the resource access request, so that the first network device accesses the resource of the second network device.

2. The method of claim 1, wherein, The method further comprises the following steps: sending a registration request to the second network device, wherein the registration request comprises a post-quantum public key of the first network device; receiving a registration response request generated by the second network device according to the registration request, wherein the registration response request comprises a public key of the second network device.

3. The method of Claim 1, wherein, The step of obtaining a first quantum key from a first network node of the first network device according to the authorization code comprises the following steps: recharging a plurality of keys to a cryptographic module of the first network device by using a service node; sending a quantum key application to the service node according to the authorization code, wherein the quantum key application is protected by a protection key, and the protection key is randomly used from the plurality of keys recharged to the cryptographic module; receiving a quantum key encryption result obtained by encrypting the first quantum key according to the protection key by the service node, wherein the first quantum key is distributed to the service node by the first network node accessing the service node; decrypting the quantum key encryption result to obtain the first quantum key.

4. The method of quantum-secure enhancement of open authorization protocols of a communication network according to claim 3, wherein, The step of encrypting the parameter information of the initial token request according to the first quantum key and the post-quantum cryptographic algorithm to obtain the anti-quantum parameter information, and sending the anti-quantum parameter information to the second network device comprises the following steps: generating an initial token request according to the authorization code; encrypting the parameter information of the initial token request according to the first quantum key to obtain a first encrypted message; performing post-quantum cryptographic signature processing on the spliced whole of the parameter information according to the post-quantum public key of the first network device to obtain a first signature message; constructing the anti-quantum parameter information according to the parameter information, the first encrypted message and the first signature message.

5. The method of Claim 2, wherein, The method further comprises the following steps: verifying the received anti-quantum token according to the public key of the second network device to determine the correctness of the anti-quantum token, wherein the anti-quantum token comprises a second random number randomly generated by the second network device.

6. The method of quantum-secure enhancement of open authorization protocols of a communication network according to claim 5, wherein, The method further comprises: splicing the first random number randomly generated by the first network device and the second random number to obtain a first splicing body; performing post-quantum password signature processing on the first splicing body to obtain a first post-quantum signature value; sending the first post-quantum signature value with the resource access request to the second network device.

7. A method of quantum-resistant security enhancement of an open authorization protocol of a communication network, wherein, The communication network comprises a first network device and a second network device, and the method is used for the second network device, and the method comprises: receiving an authorization request sent by the first network device; obtaining an authorization code from a second network node accessing the second network device according to the authorization request, and sending the authorization code to the first network device; receiving anti-quantum parameter information sent by the first network device, the anti-quantum parameter information being obtained by the first network device by encrypting parameter information of an initial token request according to a first quantum key and a post-quantum password algorithm, the first quantum key being obtained by the first network device from a first network node accessing the first network device according to the authorization code, and the parameter information being generated by the first network device according to the authorization code; generating an anti-quantum token according to the anti-quantum parameter information, and sending the anti-quantum token to the first network device; receiving a resource access request generated by the first network device according to the anti-quantum token, and confirming the access right of the resource corresponding to the resource access request, so that the first network device accesses the resource of the second network device.

8. The method of quantum-secure enhancement of open authorization protocols of a communication network according to claim 7, wherein, The method further comprises: receiving a registration request sent by the first network device, the registration request comprising a post-quantum public key of the first network device; sending a registration response request generated according to the registration request, the registration response request comprising a public key of the second network device.

9. The method of quantum-secure enhancement of open authorization protocols of a communication network according to claim 8, wherein, The method further comprises: in the case where the second network device determines to approve the authorization request, sending a quantum key application to the second network node; receiving a second quantum key and a quantum key identifier sent by the second network node according to the quantum key application, the quantum key identifier being obtained by the second network node by identifying the second quantum key according to an identification code of the second network node; sending the quantum key identifier as the authorization code to the first network device.

10. The method of quantum-secure enhancement of open authorization protocols of a communication network according to claim 9, wherein, The anti-quantum token request comprises a first encrypted message and a first signature message, and the method further comprises: in the case where the anti-quantum parameter information sent by the first network device is received, confirming the anti-quantum token application state of the first network device; in the case where the first network device has not applied for an anti-quantum token, encrypting the parameter information of the initial token request according to the second quantum key to obtain a second encrypted message, so as to determine that the second encrypted message is consistent with the first encrypted message; In a case where the second encrypted message is consistent with the first encrypted message, the first signed message is verified using a post-quantum public key of the first network device to confirm that the first network device can obtain the anti-quantum token.

11. The method of Claim 7, wherein, The method of generating an anti-quantum token according to the anti-quantum parameter information and sending the anti-quantum token to the first network device, the method comprises: generating an initial token according to the anti-quantum parameter information; splicing the second random number randomly generated by the second network device and the anti-quantum parameter information to obtain a second splicing body; signing the second splicing body according to a public key of the second network device to obtain a second signed message; storing the second random number and the second signed message in the initial token to obtain the anti-quantum token; sending the anti-quantum token to the first network device.

12. The method of Claim 11, wherein, The resource access request comprises a first post-quantum signature value and a first signed message, the method of receiving a resource access request requested by the first network device according to the anti-quantum token, confirming the access right of the resource corresponding to the resource access request, so that the first network device accesses the resource of the second network device, the method comprises: determining the correctness of the first post-quantum signature value according to a post-quantum cryptographic signature algorithm; determining the correctness of the first signed message according to a post-quantum public key of the first network device; determining the correctness of the second signed message according to a public key of the second network device; in a case where the first post-quantum signature value is correct, and the second signed message is correct, allowing the first network device to access the resource corresponding to the resource access request.

13. A computing processing device, wherein, comprises: a memory, wherein computer readable code is stored; one or more processors, when the computer readable code is executed by the one or more processors, the computing processing device executes the anti-quantum security enhancement method of the open authorization protocol of the communication network as claimed in any one of claims 1-6 or 7-12.

14. A computer program comprising computer readable code which, when run on a computing processing device, causes the computing processing device to perform the anti-quantum security enhancement method of the open authorization protocol of the communication network as claimed in any one of claims 1-6 or 7-12.

15. A computer readable medium having stored therein the computer program of claim 14.

Images