Quantum-resistant security enhancement method for security assertion markup protocol

Abstract

The present application discloses a quantum-resistant security enhancement method for a security assertion markup protocol in a communication network. The method comprises: receiving an authentication request sent by a second network device and forwarded by a terminal; on the basis of the authentication request, generating an initial identity assertion; acquiring a first quantum key and a quantum key identifier from a first network node connected to a first network device; on the basis of the quantum key identifier, performing post-quantum cryptographic signature processing on the initial identity assertion to obtain an extended identity assertion; on the basis of the first quantum key, performing encryption processing on the extended identity assertion to obtain a first encrypted message; and sending the first encrypted message via the terminal to the second network device, so that the second network device determines a resource access permission of the terminal on the basis of the first encrypted message. The second network device and the first network device use a post-quantum cryptographic algorithm and quantum key distribution technology to encrypt communication, thereby significantly enhancing the capability to resist quantum computing attacks.

Description

Anti-quantum security enhancement method of security assertion markup protocol

[0001] The present application claims priority to the Chinese patent application No. 202411122393.3, filed on August 15, 2024, and entitled "Anti-quantum security enhancement method of security assertion markup protocol", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of network security, and more particularly, to an anti-quantum security enhancement method of security assertion markup protocol of a communication network. BACKGROUND

[0003] The leap in computing power represented by quantum computing has a significant impact on related algorithms in classical cryptography in terms of security. Understandably, with the advent of large-scale quantum computers, there will be some impact on key agreement, encryption, signature, and other applications in classical cryptography. Therefore, it is an urgent problem to provide a cryptographic technology that can resist quantum computing attacks. SUMMARY

[0004] The present application provides an anti-quantum security enhancement method of security assertion markup protocol of a communication network.

[0005] In a first aspect, the present application provides an anti-quantum security enhancement method of security assertion markup protocol of a communication network, the communication network comprising a first network device, a second network device, and a terminal, the method being used for the first network device, and the method comprising:

[0006] receiving an authentication request forwarded by the terminal and sent by the second network device, the second network device generating the authentication request according to a received resource access request sent by the terminal;

[0007] generating an initial identity assertion according to the authentication request;

[0008] obtaining a first quantum key and a quantum key identifier from a first network node accessing the first network device;

[0009] performing post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier to obtain an expanded identity assertion;

[0010] performing encryption processing on the expanded identity assertion according to the first quantum key to obtain a first encrypted message;

[0011] sending the first encrypted message to the second network device via the terminal, so that the second network device determines the resource access authority of the terminal according to the first encrypted message.

[0012] Thus, in the communication process in which the terminal uses the first network device to obtain resource access permission from the second network device, the first network device and the second network device encrypt and protect the identity assertion generated in the communication process according to a post-quantum cryptographic algorithm and a quantum key. The post-quantum cryptographic algorithm is a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good anti-quantum computing attack capability. In this way, by generating an identity assertion with anti-quantum capability, the second network device can safely receive the identity assertion sent by the first network device, thereby enhancing the anti-quantum computing attack capability of the communication data information in the communication process in which the terminal uses the first network device to obtain resource access permission from the second network device.

[0013] In some embodiments, the method further comprises:

[0014] accessing the first network node through a pre-established channel;

[0015] loading a security certificate of the second network device or a security certificate of the first network device.

[0016] Thus, before communicating with the second network device, the first network node is accessed through a pre-established channel. The pre-established channel can protect data during communication and reduce the risk of unauthorized access during communication. Then, the security certificate of the second network device or the security certificate of the first network device is loaded. After the security certificate is loaded, it will be used to establish and maintain a secure communication channel, thereby enhancing the security of data during transmission.

[0017] In some embodiments, the authentication request includes a second random number randomly generated by the second network device and an anti-quantum authentication request. The anti-quantum authentication request is obtained by the second network device performing post-quantum cryptographic signature processing on an initial authentication request. The initial authentication request is obtained by the second network device according to the resource access request of the terminal.

[0018] Thus, the second random number is subsequently used to splice with the quantum key identifier, which has the effect of resisting replay attacks and maintaining message freshness. The post-quantum cryptographic signature processing on the authentication request makes the authentication request have good anti-quantum computing attack capability and can detect unauthorized access of the authentication request during transmission.

[0019] In some embodiments, the first network node accessing the first network device obtains a first quantum key and a quantum key identifier, comprising:

[0020] sending a quantum key application to the first network node accessing the first network device;

[0021] receive the first quantum key and the quantum key identifier distributed by the first network node according to the quantum key application, the quantum key identifier being obtained by the first network node from the first quantum key according to an identification code of the first network node.

[0022] In this way, the first network device sends a quantum key application to the first network node. Then, in the case that the quantum key application is passed, the first quantum key and the quantum key identifier distributed by the first network node according to the quantum key application are received, and the quantum key identifier is obtained by the first network node from the first quantum key by using an identification code of the first network node. In this way, the first quantum key and the quantum key identifier are obtained, the first quantum key can be used for subsequent generation of a key with quantum computing attack resistance, and the quantum key identifier helps to use and manage the first quantum key.

[0023] In some embodiments, the authentication request includes a second random number randomly generated by the second network device, and the extended identity assertion obtained by performing the post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier includes:

[0024] The second random number, a first network device identifier of the first network device, a second network device identifier of the second network device, authorization information of the terminal, attribute information of the terminal, the quantum key identifier, and a first random number randomly generated by the first network device are concatenated to obtain a first verification message;

[0025] The first verification message is subjected to post-quantum cryptographic signature processing to obtain a first signature message;

[0026] The first signature message, the quantum key identifier, the first random number, and the second random number are stored in the initial identity assertion to obtain the extended identity assertion.

[0027] Thus, the first network device concatenates the second random number, the first network device identifier of the first network device, the second network device identifier of the second network device, the authorization information of the terminal, the attribute information of the terminal, the quantum key identifier, and the first random number randomly generated by the first network device to obtain a first verification message. Then, the first network device performs post-quantum cryptographic signature processing on the first verification message to obtain a first signature message. Finally, the first network device stores the first signature message, the quantum key identifier, the first random number, and the second random number in the initial identity assertion to obtain an expanded identity assertion. In this way, the first network device adds random numbers to the related information in the initial identity assertion to make the related information have anti-replay attack capability and maintain the freshness of the messages. In addition, the first network device also adds the quantum key identifier and performs signature protection on the related information in the initial identity assertion according to the post-quantum cryptographic signature algorithm to obtain the first signature message, so that the first signature message has good anti-quantum computing attack capability. The first network device stores the first signature message, the quantum key identifier, the first random number, and the second random number in the initial identity assertion to obtain the expanded identity assertion, and the quantum key identifier can be used for subsequent application of quantum keys.

[0028] In some embodiments, the encrypting the expanded identity assertion according to the first quantum key to obtain a first encrypted message comprises:

[0029] Encrypting the contents in the expanded identity assertion except the quantum key identifier and the second network device identifier according to the first quantum key to obtain a first encrypted message.

[0030] Thus, the first network device encrypts the contents in the expanded identity assertion except the quantum key identifier and the second network device identifier according to the first quantum key to obtain a first encrypted message. In this way, the expanded identity assertion has good anti-quantum computing attack capability during transmission.

[0031] In a second aspect, the embodiments of the present application also provide an anti-quantum security enhancement method of a security assertion markup protocol of a communication network, the communication network comprising a first network device, a second network device, and a terminal, the method being used for the second network device, and the method comprising:

[0032] Receiving a resource access request sent by the terminal;

[0033] Generating an authentication request according to the resource access request, and sending the authentication request to the first network device;

[0034] Receiving a first encrypted message obtained by the first network device according to the authentication request, the first encrypted message being obtained by the first network device according to the authentication request;

[0035] decrypting the first encrypted message to obtain an extended identity assertion;

[0036] verifying the extended identity assertion according to a post-quantum signature algorithm to determine that the terminal has the resource access right.

[0037] In this way, in the communication process in which the terminal uses the first network device to obtain the resource access right from the second network device, the first network device and the second network device encrypt and protect the identity assertion generated in the communication process according to a post-quantum cryptographic algorithm and a quantum key. The post-quantum cryptographic algorithm is a series of encryption algorithms designed to resist quantum computing attacks. The quantum key has good anti-quantum computing attack capability. In this way, by generating an identity assertion with anti-quantum capability, the second network device safely receives the identity assertion sent by the first network device, and the anti-quantum computing attack capability of the communication data information in the communication process in which the terminal uses the first network device to obtain the resource access right from the second network device is enhanced.

[0038] In some embodiments, the method of generating an authentication request according to the resource access request comprises:

[0039] generating an initial authentication request according to the resource access request, the resource access request comprising terminal information of the terminal and resource information of a resource corresponding to the resource access request;

[0040] splicing a splicing message according to a second random number generated at random and related information in the initial authentication request;

[0041] signing the splicing message according to a post-quantum signature algorithm to obtain an anti-quantum authentication request;

[0042] storing the anti-quantum authentication request and the second random number in the initial authentication request to obtain an authentication request.

[0043] In this way, the second network device generates an initial authentication request according to a resource access request, the resource access request comprising terminal information of the terminal and resource information of a resource corresponding to the resource access request. Then, the second network device splices a splicing message according to a second random number generated at random and related information in the initial authentication request. Then, the second network device signs the splicing message according to a post-quantum signature algorithm to obtain an anti-quantum authentication request. Finally, the second network device stores the anti-quantum authentication request and the second random number in the initial authentication request to obtain an authentication request. In this way, the second network device signs and protects the splicing message obtained by splicing the second random number and the initial authentication request according to a post-quantum signature algorithm to obtain an authentication request, so that the authentication request has anti-quantum computing attack capability.

[0044] In some embodiments, the receiving the first encrypted message sent by the first network device and forwarded by the terminal to determine the resource access right of the terminal according to the first encrypted message comprises:

[0045] decrypting the first encrypted message to obtain an extended identity assertion;

[0046] verifying the extended identity assertion according to a post-quantum cryptographic signature algorithm to determine that the terminal has the resource access right.

[0047] In this way, the second network device decrypts the first encrypted message to obtain an extended identity assertion. Then, the second network device verifies the extended identity assertion according to a post-quantum cryptographic signature algorithm to determine that the terminal has the resource access right. In this way, the second network device obtains the extended identity assertion, and can allow the terminal to access the resource corresponding to the resource access right according to the related information of the extended identity assertion.

[0048] In some embodiments, the decrypting the first encrypted message to obtain an extended identity assertion comprises:

[0049] obtaining a quantum key identifier from the first encrypted message;

[0050] obtaining a second quantum key from a second network node of the second network device according to the quantum key identifier;

[0051] decrypting the first encrypted message according to the second quantum key to obtain the extended identity assertion.

[0052] In this way, the second network device obtains a quantum key identifier from the first encrypted message. Then, the second network device obtains a second quantum key from a second network node of the second network device according to the quantum key identifier. Finally, the second network device decrypts the first encrypted message according to the second quantum key to obtain an extended identity assertion. In this way, the second network device applies for a second quantum key according to the quantum key identifier, so that the second quantum key corresponds to the first quantum key. And the second network device obtains the extended identity assertion from the first encrypted message according to the second quantum key, so that the second network device can allow the terminal to access the corresponding resource according to the extended identity assertion.

[0053] In some embodiments, the verifying the extended identity assertion according to a post-quantum cryptographic signature algorithm to determine that the terminal has the resource access right comprises:

[0054] verifying the extended identity assertion according to a post-quantum signature algorithm;

[0055] In a case where the quantum key identifier and the extended identity assertion are confirmed to be correct according to the signature verification processing, the terminal is allowed to access a resource corresponding to the resource access request;

[0056] In a case where the quantum key identifier and the extended identity assertion are confirmed to be incorrect according to the signature verification processing, the terminal is denied to access the resource corresponding to the resource access request.

[0057] In this way, the second network device performs signature verification processing on the extended identity assertion according to the post-quantum signature algorithm. In a case where the quantum key identifier and the extended identity assertion are confirmed to be correct according to the signature verification processing, the second network device allows the terminal to access a resource corresponding to the resource access request. In a case where the quantum key identifier and the extended identity assertion are confirmed to be incorrect according to the signature verification processing, the second network device denies the terminal to access the resource corresponding to the resource access request. In this way, by verifying the correctness of the extended identity assertion, it is determined whether the terminal can access the resource corresponding to the resource access request.

[0058] In a third aspect, the embodiments of the present application provide a computing processing device, comprising: a memory, wherein the computer readable code is stored; and one or more processors, when the computer readable code is executed by the one or more processors, the computing processing device performs the anti-quantum security enhancement method of the security assertion markup protocol of the communication network according to the first aspect and the second aspect.

[0059] In a fourth aspect, the embodiments of the present application provide a computer program comprising computer readable code, which when executed on a computing processing device causes the computing processing device to perform the anti-quantum security enhancement method of the security assertion markup protocol of the communication network according to the first aspect and the second aspect.

[0060] In a fifth aspect, the present application provides a computer readable medium storing the computer program according to the fourth aspect.

[0061] Additional aspects and advantages of the embodiments of the present application will be in part apparent and in part pointed out hereinafter in the description of the embodiments of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0062] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the following description of the embodiments of the present application, taken in conjunction with the accompanying drawings.

[0063] FIG. 1 is a flow diagram of an anti-quantum security enhancement method according to an embodiment of the present application;

[0064] FIG. 2 is an architecture diagram of an anti-quantum security enhancement method according to an embodiment of the present application;

[0065] FIG. 3 is a signaling diagram of a quantum-resistant security enhancement method according to an embodiment of the present application;

[0066] FIG. 4 is a flow diagram of a quantum-resistant security enhancement method according to an embodiment of the present application;

[0067] FIG. 5 is a flow diagram of a quantum-resistant security enhancement method according to an embodiment of the present application;

[0068] FIG. 6 is a flow diagram of a quantum-resistant security enhancement method according to an embodiment of the present application;

[0069] FIG. 7 is a flow diagram of a quantum-resistant security enhancement method according to an embodiment of the present application;

[0070] FIG. 8 is a flow diagram of a quantum-resistant security enhancement method according to an embodiment of the present application;

[0071] FIG. 9 is a flow diagram of a quantum-resistant security enhancement method according to an embodiment of the present application;

[0072] FIG. 10 is a flow diagram of a quantum-resistant security enhancement method according to an embodiment of the present application;

[0073] FIG. 11 is a flow diagram of a quantum-resistant security enhancement method according to an embodiment of the present application;

[0074] FIG. 12 is a flow diagram of a quantum-resistant security enhancement method according to an embodiment of the present application;

[0075] FIG. 13 is a structural diagram of a computing processing device for a quantum-resistant security enhancement method according to an embodiment of the present application;

[0076] FIG. 14 is a structural diagram of a computer program for a quantum-resistant security enhancement method according to an embodiment of the present application. DETAILED DESCRIPTION

[0077] Embodiments of the present application are described in detail below with reference to the attached drawings. The embodiments described below are examples of the present application and are not intended to limit the present application. The embodiments described below are not intended to limit the present application.

[0078] The leap of computing power represented by quantum computing has a great impact on the security of related algorithms in classical cryptography. That is, quantum computing poses a more direct and urgent threat to the breaking of classical cryptography. A series of classical algorithms such as Diffie-Hellman, RSA, and elliptic curve (ECC) face greater security risks because the number theory problems on which they are based, such as large prime factorization and discrete logarithm, are no longer difficult in the quantum era. Understandably, with the implementation of large quantum computers, there will be some impact on the applications of key agreement, encryption, and signature in classical cryptography.

[0079] Thus, the security of the Internet, which uses classical cryptography algorithms to protect the communication process, is threatened by quantum computing attacks. For example, the Security Assertion Markup Language (SAML), which provides a strong framework for identity verification, authorization, and secure communication through its security assertion and communication mechanism, defines three roles: User, Identity Provider (IdP), and Service Provider (SP). The user requests a service from the service provider, who in turn requests the identity provider and obtains an identity assertion therefrom. The service provider can make a judgment on resource access control based on this identity assertion, i.e., decide whether the user has the right to perform certain services. The Security Assertion Markup Language uses digital signatures based on the XML Signature standard for identity verification and message integrity verification, and uses the XML Encryption standard to support encrypted name identifiers, encrypted attributes, and encrypted assertions. However, the digital signature algorithm of the XML Signature standard and the encryption algorithm of the XML Encryption standard both have the problem of insufficient quantum resistance. Therefore, the Security Assertion Markup Language has a greater security risk when facing quantum computing attacks.

[0080] Currently, the technologies for addressing the threat of quantum computing attacks internationally mainly fall into two categories: one is to use quantum key distribution (QKD) networks for symmetric key agreement in scenarios where asymmetric algorithms are used for (symmetric) key agreement and then encrypted transmission through symmetric algorithms, to protect the security of the key; the other is to study post-quantum cryptography (PQC) algorithms, which directly replace existing asymmetric algorithms. Quantum key distribution technology uses quantum mechanics to generate keys that cannot be intercepted by a third party, ensuring the security of key transmission. It is particularly suitable for key exchange scenarios and can replace existing asymmetric key agreement algorithms such as RSA or ECC to improve the security of the key. However, quantum key distribution technology cannot completely replace all applications of asymmetric algorithms, such as signature verification, integrity protection, and anti-repudiation scenarios, which still require the use of asymmetric algorithms.

[0081] Post-quantum cryptography algorithms are asymmetric cryptography algorithms designed based on new mathematical problems, aiming to resist the threat of quantum computers. NIST has announced the first batch of 4 post-quantum cryptography algorithms for standardization, including Kyber, Dilithium, Falcon, and SPHINCS+, which cover multiple technical routes to reduce the risk of a single technology being cracked. Post-quantum cryptography algorithms can theoretically replace all asymmetric algorithms and are more versatile. However, the security of post-quantum cryptography algorithms still depends on the complexity of the computational problem, and in the future, they may face new cracking methods or become insecure as computing power improves. In addition, the post-quantum cryptography algorithm standard has not been officially announced, and the production and certification of related products also require time, so its large-scale application still needs a long period.

[0082] Both post-quantum cryptography algorithms and quantum key distribution technology have the ability to resist quantum computing attacks, but each has its limitations, so providing a relatively low-cost and highly secure cryptographic technology that can resist quantum computing attacks has become a pressing problem.

[0083] Based on the above problems, referring to FIG. 1, the embodiment of the present application provides a method for enhancing the security of a security assertion markup protocol in a communication network, the communication network comprising a first network device, a second network device, and a terminal, the method being used for the first network device, and the method comprising:

[0084] 011: receiving an authentication request sent by the second network device and forwarded by the terminal;

[0085] 012: generating an initial identity assertion according to the authentication request;

[0086] 013: obtain a first quantum key and a quantum key identifier from a first network node connected to the first network device;

[0087] 014: perform post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier to obtain an extended identity assertion;

[0088] 015: perform encryption processing on the extended identity assertion according to the first quantum key to obtain a first encrypted message;

[0089] 016: send the first encrypted message to the second network device via the terminal, so that the second network device determines the resource access right of the terminal according to the first encrypted message.

[0090] The embodiment of the application also provides a first network device, which comprises a memory and a processor. The method of the embodiment of the application can be implemented by the first network device of the embodiment of the application. Specifically, the memory stores a computer program, and the processor is configured to receive an authentication request forwarded by a terminal and sent by a second network device, and generate an initial identity assertion according to the authentication request. The processor is further configured to obtain a first quantum key and a quantum key identifier from a first network node connected to the first network device, and perform post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier to obtain an extended identity assertion. The processor is further configured to perform encryption processing on the extended identity assertion according to the first quantum key to obtain a first encrypted message, and send the first encrypted message to the second network device via the terminal, so that the second network device determines the resource access right of the terminal according to the first encrypted message.

[0091] The embodiment of the application also provides a first network device security enhancement device. The method of the embodiment of the application can be implemented by the first network device security enhancement device of the embodiment of the application. Specifically, the first network device security enhancement device comprises a receiving module, a derivation module, an obtaining module, a processing module, an encryption module and a sending module. The receiving module is configured to receive an authentication request forwarded by a terminal and sent by a second network device. The derivation module is configured to generate an initial identity assertion according to the authentication request. The obtaining module is configured to obtain a first quantum key and a quantum key identifier from a first network node connected to the first network device. The processing module is configured to perform post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier to obtain an extended identity assertion. The encryption module is configured to perform encryption processing on the extended identity assertion according to the first quantum key to obtain a first encrypted message. The sending module is configured to send the first encrypted message to the second network device via the terminal, so that the second network device determines the resource access right of the terminal according to the first encrypted message.

[0092] The application provides a communication system based on a security assertion markup protocol, the communication system comprising the first network device, the second network device, the terminal and the quantum key distribution network of the above-mentioned embodiments, and the quantum key distribution network is configured to distribute quantum keys to the first network device or the second network device.

[0093] Specifically, the terminal is configured to acquire a security assertion for accessing the second network device from the first network device through the security assertion markup protocol.

[0094] The quantum key distribution network comprises network nodes and a quantum network link control center, the network nodes are configured to store and distribute quantum keys in the quantum key distribution network, and the quantum network link center is capable of establishing quantum key distribution and relay links between the network nodes according to the names of the network nodes, and the quantum key distribution and relay links are used for data transfer and other functions. The quantum key distribution network is used to implement quantum key generation, quantum key relay, quantum key provision and other services.

[0095] Referring to FIG. 2, in some embodiments, the terminal requests a service from the second network device, and the second network device sends a request to the first network device and acquires an identity assertion from the first network device. The second network device can determine whether the terminal has the right to access some services through the identity assertion. The first network device and the second network device access a network node through a trusted channel respectively. When the first network device sends a quantum key application to the network node accessed by the first network device, the network node sends a quantum key generated by the quantum key distribution network to the first network device. At the same time when the first network device acquires the quantum key, the quantum network link control center synchronously causes the second network node accessed by the second network device to generate a quantum key, but the quantum key is not immediately distributed to the second network device accessed by the second network device, but is stored in the network node first. The correspondence between the above-mentioned first network device, second network device, service node and network node is provided by the management platform.

[0096] It should be noted that the embodiments of the present application take the FIPS 203 Module-Lattice-based Key-Encapsulation Mechanism Standard as the PQC key encapsulation algorithm, and take the FIPS 204 Module-Lattice-Based Digital Signature Standard as the PQC digital signature algorithm as an example for explanation and description. The following description of the operations related to the PQC algorithm is based on the above FIPS standard. Of course, in other embodiments, other algorithms such as the NewHope algorithm, the Sidh algorithm, and the HQC algorithm can also be used as the related algorithm of the PQC. It should also be noted that the method of the present application is directed to the Security Assertion Markup Language (SAML), hereinafter referred to as the SAML protocol. The method of the present application does not involve the identity authentication process between the user and the identity provider and the service provider, but only involves the security assertion request and response process specified in the SAML protocol. In addition, it should also be noted that the identity provider can generate an identity assertion (Assertion_X) for each service provider X in a plurality of service providers for a user at a time. The embodiments of the present application take the identity provider generating an identity assertion for a user for only one service provider as an example.

[0097] Specifically, the initial identity assertion is an identity assertion generated by the first network device according to the SAML protocol.

[0098] The second network device receives a resource access request of the terminal to some resources in the second network device. The second network device generates an authentication request according to the related information of the resource access request, and sends the authentication request to the terminal, which then forwards the authentication request to the first network device.

[0099] The first network device receives the authentication request sent by the second network device forwarded by the terminal. Then, the first network device generates an initial identity assertion according to the authentication request. Then, the first network device obtains a first quantum key and a quantum key identifier from a first network node accessed to the first network device. The first network device further performs a post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier to obtain an expanded identity assertion. The first network device further performs an encryption processing on the expanded identity assertion according to the first quantum key to obtain a first encrypted message. Finally, the first network device sends the first encrypted message to the second network device via the terminal, so that the second network device determines the resource access right of the terminal according to the first encrypted message.

[0100] The second network device receives the first encrypted message obtained by the first network device according to the authentication request, decrypts the first encrypted message to obtain an extended identity assertion. Then, the second network device verifies the extended identity assertion message according to the post-quantum cryptographic signature algorithm to determine whether the terminal has the resource access right.

[0101] The method of the embodiment of the application is described below with an example. In the example, the first network device is an identity provider (IdP) that provides identity authentication data of a user to a service provider. The second network device is a service provider (SP) that provides a network service resource for the user to access. The terminal is a user of the SAML protocol that obtains a security assertion for accessing the service provider (SP) from the identity provider (IdP) through the SAML protocol. The quantum network node is a network node that stores and provides a generated quantum key to the service provider through a trusted channel or provides a generated quantum key to the identity provider through a trusted channel.

[0102] The authentication request is an AuthnRequest message. The initial identity assertion is Assertion-1, the extended identity assertion is Assertion-2, and the first encrypted message is Assertion-3.

[0103] Referring to FIG. 3, the service provider receives a resource access request of a user for some resources in the service provider. The service provider generates an AuthnRequest message according to related information of the resource access request, and sends the AuthnRequest message to the user, which forwards the AuthnRequest message to the identity provider.

[0104] The identity provider receives the AuthnRequest message sent by the service provider forwarded by the user. After verifying the message content using the classical digital signature algorithm (RSA or ECC) of the service provider and verifying the AuthnRequest message using the PQC signature algorithm, the identity of the user and the associated service provider are determined. Next, the identity provider generates an initial identity assertion Assertion-1 according to the authentication request AuthnRequest message. Then, the identity provider obtains a first quantum key QK_UUID-1 and a quantum key identifier UUID_QK from the first network node accessed to the identity provider. The identity provider further performs a post-quantum cryptographic signature processing on Assertion-1 according to the quantum key identifier UUID_QK to obtain Assertion-2. And performs an encryption processing on Assertion-2 according to the first quantum key QK_UUID-1 to obtain Assertion-3. Finally, the identity provider sends Assertion-3 to the service provider via the user, so that the service provider determines the resource access permission of the user according to Assertion-3.

[0105] After the service provider receives the Assertion-3 obtained by the identity provider according to the authentication request, the service provider performs a decryption processing on Assertion-3 to obtain Assertion-2. Next, the service provider verifies the extended identity assertion message according to the post-quantum cryptographic signature algorithm to determine that the user has the resource access permission.

[0106] In summary, in the communication network security assertion markup protocol anti-quantum security enhancement method, the communication system, the first network device and the second network device of the embodiments of the present application, for the communication process of the terminal using the first network device to obtain the resource access permission from the second network device, the first network device and the second network device encrypt and protect the identity assertion generated in the communication process according to the post-quantum cryptographic algorithm and the quantum key. The post-quantum cryptographic algorithm is a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good anti-quantum computing attack ability. In this way, by generating an identity assertion with anti-quantum ability, the second network device safely receives the identity assertion sent by the first network device, and the anti-quantum computing attack ability of the communication data information in the communication process of the terminal using the first network device to obtain the resource access permission from the second network device is enhanced.

[0107] Referring to FIG. 4, in some embodiments, the method further comprises:

[0108] 017: accessing the first network node through the pre-established channel;

[0109] 018: loading a security certificate of the second network device or a security certificate of the first network device.

[0110] In some embodiments, the access module is configured to access the first network node via the pre-established channel, and the loading module is configured to load a security certificate of the second network device or a security certificate of the first network device.

[0111] In some embodiments, the processor is further configured to access the first network node via the pre-established channel, and load a security certificate of the second network device or a security certificate of the first network device.

[0112] Specifically, before data transmission with the second network device, the network device accesses the first network node via the pre-established channel, which can protect data during data transmission and reduce the risk of unauthorized access during transmission. Then, the network device loads a security certificate of the network device or a security certificate of the second network device, which will be used to establish and maintain a secure communication channel, enhancing the security of data during transmission.

[0113] Referring to the above example again, referring to FIG. 3, before data transmission between the identity provider and the service provider, the identity provider accesses the first quantum network node closest in physical distance and authorized to complete via a trusted channel, which refers to a mechanism or protocol that provides a secure communication path between two communication entities. One way to establish is that the identity provider and the first quantum network node are directly connected inside the same cabinet and shielded with network cables. This channel ensures the confidentiality, integrity, and availability of data during transmission, preventing unauthorized access, tampering, or eavesdropping. At the same time, the identity provider loads the key pair of the post-quantum cryptography algorithm of the service provider through offline import, including the encryption key pair and the signature key pair, or the certificate issued by the certificate system, including the encryption certificate and the signature certificate. Offline import means that the transmission of the key or certificate will not go through the Internet or other network paths that may be monitored or attacked, ensuring the security of the transmission process. In this way, the identity provider accesses the first quantum network node via a trusted channel and loads security certificates through offline import, ensuring the confidentiality of network device data and reducing the risk of data leakage.

[0114] Referring to FIG. 5, in some embodiments, step 013 (obtaining a first quantum key and a quantum key identifier from the first network node accessed to the first network device) includes:

[0115] 0131: sending a quantum key application to the first network node accessed to the first network device;

[0116] 0132: receive the first quantum key and the quantum key identifier distributed by the first network node according to the quantum key application, the quantum key identifier being obtained by the first network node from the first quantum key according to an identification code of the first network node.

[0117] In some embodiments, the sending module is configured to send a quantum key application to a first network node accessing the first network device. The receiving module is configured to receive a first quantum key and a quantum key identifier distributed by the first network node according to the quantum key application, the quantum key identifier being obtained by the first network node from the first quantum key according to an identification code of the first network node.

[0118] In some embodiments, the processor is further configured to send a quantum key application to a first network node accessing the first network device. The processor is further configured to receive a first quantum key and a quantum key identifier distributed by the first network node according to the quantum key application, the quantum key identifier being obtained by the first network node from the first quantum key according to an identification code of the first network node.

[0119] Specifically, the first network device sends a quantum key application to the first network node. Then, in the case that the quantum key application is passed, the first network node distributes a first quantum key and a quantum key identifier according to the quantum key application, the quantum key identifier being obtained by the first network node from the first quantum key by using an identification code of the first network node. In this way, the first quantum key and the quantum key identifier are obtained, the first quantum key can be used for subsequent generation of a key with quantum computing attack resistance, and the quantum key identifier helps to use and manage the first quantum key.

[0120] Continuing with the above example, referring again to FIG. 3, the identity provider sends a quantum key application to the first quantum network node. Then, in the case that the quantum key application is passed, the first quantum network node distributes a first quantum key QK_UUID-1 and a quantum key identifier UUID_QK according to the quantum key application, the quantum key identifier UUID_QK being obtained by the first quantum network node from the first quantum key QK_UUID-1 by using a unique universal identification code of the first quantum network node. In this way, the first quantum key QK_UUID-1 and the quantum key identifier UUID_QK are obtained, the first quantum key QK_UUID-1 can be used for subsequent generation of a key with stronger quantum computing attack resistance, and the quantum key identifier UUID_QK helps to use and manage the first quantum key QK_UUID-1.

[0121] In this way, the identity provider obtains the first quantum key QK_UUID-1 and the quantum key identifier UUID_QK, which can be used for subsequent generation of a key with stronger quantum computing attack resistance.

[0122] Referring to FIG. 6, in some embodiments, the authentication request includes a second random number randomly generated by the second network device, step 014 (post-quantum cryptographic signature processing of the initial identity assertion according to the quantum key identifier to obtain an extended identity assertion) includes:

[0123] 0141: concatenating the second random number, the first network device identifier of the first network device, the second network device identifier of the second network device, the authorization information of the terminal, the attribute information of the terminal, the quantum key identifier, and the first random number randomly generated by the first network device to obtain a first verification message;

[0124] 0142: post-quantum cryptographic signature processing of the first verification message to obtain a first signature message;

[0125] 0143: storing the first signature message, the quantum key identifier, the first random number, and the second random number in the initial identity assertion to obtain an extended identity assertion.

[0126] In some embodiments, the concatenating module is configured to concatenate the second random number, the first network device identifier of the first network device, the second network device identifier of the second network device, the authorization information of the terminal, the attribute information of the terminal, the quantum key identifier, and the first random number randomly generated by the first network device to obtain a first verification message. The signature module is configured to perform post-quantum cryptographic signature processing on the first verification message to obtain a first signature message. The storage module is configured to store the first signature message, the quantum key identifier, the first random number, and the second random number in the initial identity assertion to obtain an extended identity assertion.

[0127] In some embodiments, the processor is further configured to concatenate the second random number, the first network device identifier of the first network device, the second network device identifier of the second network device, the authorization information of the terminal, the attribute information of the terminal, the quantum key identifier, and the first random number randomly generated by the first network device to obtain a first verification message. Perform post-quantum cryptographic signature processing on the first verification message to obtain a first signature message. And store the first signature message, the quantum key identifier, the first random number, and the second random number in the initial identity assertion to obtain an extended identity assertion.

[0128] Specifically, the first network device concatenates the second random number, the first network device identifier of the first network device, the second network device identifier of the second network device, the authorization information of the terminal, the attribute information of the terminal, the quantum key identifier, and the first random number randomly generated by the first network device to obtain a first verification message. Then, the first network device performs post-quantum cryptographic signature processing on the first verification message to obtain a first signature message. Finally, the first network device stores the first signature message, the quantum key identifier, the first random number, and the second random number in the initial identity assertion to obtain an extended identity assertion. In this way, the first network device adds random numbers to the related information in the initial identity assertion to make the related information have anti-replay attack capability and maintain the freshness of the messages. In addition, the first network device also adds the quantum key identifier and performs signature protection on the related information in the initial identity assertion according to the post-quantum cryptographic signature algorithm to obtain the first signature message, so that the first signature message has good anti-quantum computing attack capability. The first network device stores the first signature message, the quantum key identifier, the first random number, and the second random number in the initial identity assertion to obtain the extended identity assertion, and the quantum key identifier can be used for subsequent application of quantum keys.

[0129] Continuing the above example, the AuthnRequest message includes the second random number R2 of the service provider. Referring again to FIG. 3, the identity provider generates Assertion-1 according to the SAML protocol, and generates an XML signature based on a classical digital signature algorithm for Assertion-1, such as the RSA algorithm and the ECC algorithm. The identity provider concatenates the second random number generated by the service provider, the identity provider identifier Issuer, the service provider identifier Recipient, the authorization information AuthnStatement of the user, the attribute information AttributeStatement of the user, the quantum key identifier UUID_QK, and the first random number R1 randomly generated as 128 bits to obtain a first verification message, and the concatenation method is (R2|Issuer|Recipient|AuthnStatement|AttributeStatement|UUID_QK|R1). The identity provider further performs PQC signature protection on the first verification message as M in the PQC signature algorithm to obtain a first signature message M1. The first signature message M1, the quantum key identifier UUID_QK, the first random number R1, and the second random number R2 are placed as Extension elements in Assertion-1 to obtain Assertion-2. The identity provider identifier Issuer, the service provider identifier Recipient, the authorization information AuthnStatement of the user, and the attribute information AttributeStatement of the user are all important elements in the initial identity assertion Assertion-1.

[0130] Thus, the identity provider adds the random number to make the relevant information in the initial identity assertion Assertion-1 have anti-replay attack ability, and maintains the freshness of the messages. In addition, the first network device also adds the quantum key identifier UUID QK and protects the relevant information in the initial identity assertion by signing according to the post-quantum password signing algorithm to obtain the first signed message M1, so that the first signed message M1 has good anti-quantum computing attack ability. The first network device stores the first signed message M1, the quantum key identifier UUID QK, the first random number R1 and the second random number R2 in the initial identity assertion Assertion-1 to obtain the expanded identity assertion Assertion-2, and the quantum key identifier UUID QK can be used for subsequent application of quantum keys.

[0131] Referring to FIG. 7, in some embodiments, step 015 (encrypting the expanded identity assertion according to the first quantum key to obtain the first encrypted message) includes:

[0132] 0151: encrypting the contents of the expanded identity assertion except the quantum key identifier and the second network device identifier according to the first quantum key to obtain the first encrypted message.

[0133] In some embodiments, the encryption module is configured to encrypt the contents of the expanded identity assertion except the quantum key identifier and the second network device identifier according to the first quantum key to obtain the first encrypted message.

[0134] In some embodiments, the processor is further configured to encrypt the contents of the expanded identity assertion except the quantum key identifier and the second network device identifier according to the first quantum key to obtain the first encrypted message.

[0135] Specifically, the first network device encrypts the contents of the expanded identity assertion except the quantum key identifier and the second network device identifier according to the first quantum key to obtain the first encrypted message. In this way, the expanded identity assertion has good anti-quantum computing attack ability during transmission by using quantum keys to encrypt the expanded identity assertion.

[0136] Continuing with the above example, referring to FIG. 3, the identity provider uses the first quantum key QK UUID-1 and the symmetric encryption algorithm to encrypt the contents of the expanded identity assertion Assertion-2 except the quantum key identifier UUID QK and Recipient to obtain the first encrypted message Assertion-3. Then, the identity provider sends the Response message composed of Assertion-3 and the quantum key identifier back to the user and forwards it to the service provider.

[0137] Thus, the identity provider encrypts the extended identity assertion Assertion-2 using the first quantum key QK_UUID-1, so that the extended identity assertion Assertion-2 has good anti-quantum computing attack capability during transmission.

[0138] Referring to FIG. 8, the embodiment of the present application provides a method for anti-quantum security enhancement of a security assertion markup protocol of a communication network, the communication network including a first network device, a second network device, and a terminal, the method being used for the second network device, and the method including:

[0139] 021: receiving a resource access request sent by the terminal;

[0140] 022: generating an authentication request according to the resource access request, and sending the authentication request to the first network device;

[0141] 023: receiving a first encrypted message sent by the first network device and forwarded by the terminal, to determine a resource access right of the terminal according to the first encrypted message, wherein the first network device generates an initial identity assertion according to the authentication request, obtains a first quantum key and a quantum key identifier from a first network node of the first network device to which the terminal accesses, performs post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier to obtain an extended identity assertion, and performs encryption processing on the extended identity assertion according to the first quantum key to obtain the first encrypted message;

[0142] The embodiment of the present application also provides a second network device including a memory and a processor. The method of the embodiment of the present application can be implemented by the second network device of the embodiment of the present application. Specifically, the memory stores a computer program, and the processor is configured to receive a resource access request sent by a terminal. The processor is also configured to generate an authentication request according to the resource access request, and send the authentication request to a first network device. The processor is further configured to receive a first encrypted message sent by the first network device and forwarded by the terminal, to determine a resource access right of the terminal according to the first encrypted message, wherein the first network device generates an initial identity assertion according to the authentication request, obtains a first quantum key and a quantum key identifier from a first network node of the first network device to which the terminal accesses, performs post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier to obtain an extended identity assertion, and performs encryption processing on the extended identity assertion according to the first quantum key to obtain the first encrypted message.

[0143] The embodiment of the application further provides a second network device security enhancement apparatus. The method of the embodiment of the application can be implemented by the second network device security enhancement apparatus of the embodiment of the application. Specifically, the second network device security enhancement apparatus comprises a receiving module, a generating module, a receiving module, a decryption module and a verification module. The receiving module is configured to receive a resource access request sent by a terminal. The generating module is configured to generate an authentication request according to the resource access request, and send the authentication request to a first network device. The receiving module is configured to receive a first encrypted message sent by the first network device and forwarded by the terminal, so as to determine a resource access right of the terminal according to the first encrypted message, wherein the first network device generates an initial identity assertion according to the authentication request, obtains a first quantum key and a quantum key identifier from a first network node accessed to the first network device, performs post-quantum cryptographic signature processing on the initial identity assertion to obtain an expanded identity assertion according to the quantum key identifier, and performs encryption processing on the expanded identity assertion to obtain the first encrypted message according to the first quantum key.

[0144] The application provides a communication system based on a security assertion markup protocol, the communication system comprising the second network device, the first network device, the terminal and the quantum key distribution network of the above-mentioned embodiments, and the quantum key distribution network is configured to distribute a quantum key to the first network device or the second network device.

[0145] Specifically, the anti-quantum security enhancement method of the embodiment takes the second network device as the execution object, and details are not repeated here.

[0146] In summary, in the anti-quantum security enhancement method of the security assertion markup protocol of the communication network, the communication system, the first network device and the second network device of the embodiment of the application, for the communication process in which the terminal uses the first network device to obtain a resource access right from the second network device, the first network device and the second network device perform encryption protection on the identity assertion generated in the communication process according to a post-quantum cryptographic algorithm and a quantum key. The post-quantum cryptographic algorithm is a series of encryption algorithms aiming at resisting quantum computing attacks, and the quantum key has good anti-quantum computing attack ability. In this way, by generating an identity assertion with anti-quantum ability, the second network device safely receives the identity assertion sent by the first network device, and the anti-quantum computing attack ability of the communication data information in the communication process in which the terminal uses the first network device to obtain a resource access right from the second network device is enhanced.

[0147] Referring to FIG. 9, in some embodiments, step 022 (generating an authentication request according to a resource access request) comprises:

[0148] 0221: generating an initial authentication request according to a resource access request, the resource access request comprising terminal information of the terminal and resource information of a resource corresponding to the resource access request;

[0149] 0222: obtaining a spliced message by splicing a second random number generated randomly and related information in the initial authentication request;

[0150] 0223: obtaining a quantum-resistant authentication request by signing the spliced message according to a post-quantum cryptographic signature algorithm;

[0151] 0224: storing the quantum-resistant authentication request and the second random number in the initial authentication request to obtain an authentication request.

[0152] In some embodiments, the derivation module is configured to generate an initial authentication request according to a resource access request, the resource access request comprising terminal information of the terminal and resource information of a resource corresponding to the resource access request. The splicing module is configured to obtain a spliced message by splicing a second random number generated randomly and related information in the initial authentication request. The signing module is configured to obtain a quantum-resistant authentication request by signing the spliced message according to a post-quantum cryptographic signature algorithm. The storage module is configured to store the quantum-resistant authentication request and the second random number in the initial authentication request to obtain an authentication request.

[0153] In some embodiments, the processor is further configured to generate an initial authentication request according to a resource access request, the resource access request comprising terminal information of the terminal and resource information of a resource corresponding to the resource access request. The processor is further configured to obtain a spliced message by splicing a second random number generated randomly and related information in the initial authentication request. The processor is further configured to obtain a quantum-resistant authentication request by signing the spliced message according to a post-quantum cryptographic signature algorithm, and to store the quantum-resistant authentication request and the second random number in the initial authentication request to obtain an authentication request.

[0154] Specifically, the second network device generates an initial authentication request according to a resource access request, the resource access request comprising terminal information of the terminal and resource information of a resource corresponding to the resource access request. Next, the second network device obtains a spliced message by splicing a second random number generated randomly and related information in the initial authentication request. Then, the second network device obtains a quantum-resistant authentication request by signing the spliced message according to a post-quantum cryptographic signature algorithm. Finally, the second network device stores the quantum-resistant authentication request and the second random number in the initial authentication request to obtain an authentication request. In this way, the second network device protects the authentication request by signing the spliced message of the second random number and the initial authentication request according to a post-quantum cryptographic signature algorithm, so that the authentication request has the ability to resist quantum computing attacks.

[0155] In the above example, the initial authentication request is the AuthnRequest-1 message, the post-quantum resistant authentication request is the AuthnRequest-2 message, and the authentication request is the AuthnRequest-3 message.

[0156] Referring back to FIG. 3, after receiving the resource access request sent by the user, the service provider generates an initial authentication request AuthnRequest-1 message according to the resource access request in accordance with the SAML protocol, and the resource access request includes user information and resource information of the resource corresponding to the resource access request. The service provider also performs XML signature based on a classical digital signature algorithm (RSA or ECC) on the content in the message. Then, the service provider concatenates the second random number R2 and the Subject, SingleSignOnService, AssertionConsumerServiceURL (or AssertionConsumerServiceIndex), and KeyDescriptor in the AuthnRequest-1 message to obtain a concatenated message. Then, the service provider performs PQC signature protection on the concatenated message as M in the PQC signature algorithm to obtain a post-quantum resistant authentication request AuthnRequest-2 message. Finally, the service provider stores the AuthnRequest-2 message and the second random number R2 in the AuthnRequest-1 message to obtain an authentication request AuthnRequest-3 message.

[0157] In this way, the service provider performs signature protection on the concatenated message of the second random number R2 and the AuthnRequest-1 message according to the post-quantum cryptographic signature algorithm to obtain the AuthnRequest-2 message, so that the AuthnRequest-1 message has the ability to resist quantum computing attacks.

[0158] Referring to FIG. 10, in some embodiments, step 023 (receiving a first encrypted message sent by the first network device and forwarded by the terminal to determine the resource access authority of the terminal according to the first encrypted message) includes:

[0159] 0231: decrypting the first encrypted message to obtain an extended identity assertion;

[0160] 0232: verifying the extended identity assertion according to the post-quantum cryptographic signature algorithm to determine that the terminal has the resource access authority.

[0161] In some embodiments, the decryption module is configured to decrypt the first encrypted message to obtain an extended identity assertion. The verification module is configured to verify the extended identity assertion according to the post-quantum cryptographic signature algorithm to determine that the terminal has the resource access right.

[0162] In some embodiments, the processor is further configured to decrypt the first encrypted message to obtain an extended identity assertion. The verification module is configured to verify the extended identity assertion according to the post-quantum cryptographic signature algorithm to determine that the terminal has the resource access right.

[0163] Specifically, the second network device decrypts the first encrypted message to obtain an extended identity assertion. Then, the second network device verifies the extended identity assertion according to the post-quantum cryptographic signature algorithm to determine that the terminal has the resource access right. In this way, the second network device obtains the extended identity assertion, and can allow the terminal to access the resource corresponding to the resource access right according to the relevant information of the extended identity assertion.

[0164] With reference to the above example, please refer to FIG. 3. The service provider decrypts the first encrypted message Assertion-3 to obtain an extended identity assertion Assertion-2. Then, the service provider verifies the extended identity assertion Assertion-2 according to the post-quantum cryptographic signature algorithm to determine that the user has the resource access right.

[0165] In this way, the service provider obtains the extended identity assertion Assertion-2, and can allow the user to access the resource corresponding to the resource access right according to the relevant information of the extended identity assertion Assertion-2.

[0166] With reference to FIG. 11, in some embodiments, the step 0231 (decrypting the first encrypted message to obtain an extended identity assertion) includes:

[0167] 02311: obtaining a quantum key identifier from the first encrypted message;

[0168] 02312: obtaining a second quantum key from a second network node of the second network device according to the quantum key identifier;

[0169] 02313: decrypting the first encrypted message to obtain an extended identity assertion according to the second quantum key.

[0170] In some embodiments, the obtaining module is further configured to obtain a quantum key identifier from the first encrypted message. The obtaining module is further configured to obtain a second quantum key from a second network node of the second network device according to the quantum key identifier. The decryption module is configured to decrypt the first encrypted message to obtain an extended identity assertion according to the second quantum key.

[0171] In some embodiments, the processor is further configured to obtain the quantum key identifier from the first encrypted message, and obtain a second quantum key from a second network node of the second network device according to the quantum key identifier, and decrypt the first encrypted message according to the second quantum key to obtain the extended identity assertion.

[0172] In particular, the second network device obtains the quantum key identifier from the first encrypted message. Then, the second network device obtains the second quantum key from a second network node of the second network device according to the quantum key identifier. Finally, the second network device decrypts the first encrypted message according to the second quantum key to obtain the extended identity assertion. In this way, the second network device applies for the second quantum key according to the quantum key identifier, so that the second quantum key corresponds to the first quantum key. And the second network device obtains the extended identity assertion according to the second quantum key, so that the second network device can allow the terminal to access the corresponding resource according to the extended identity assertion.

[0173] With reference to the above example, please refer to FIG. 3. The service provider receives the Response message sent by the identity provider, and obtains the quantum key identifier UUID_QK from the identity assertion. The service provider obtains the second quantum key QK_UUID-2 from a second quantum network node of the service provider according to the obtained quantum key identifier UUID_QK. Then, the service provider decrypts the first encrypted message Assertion-3 in the Response message according to the second quantum key QK_UUID-2 to obtain the extended identity assertion Assertion-2.

[0174] In this way, the service provider applies for the second quantum key QK_UUID-2 according to the quantum key identifier UUID_QK, so that the second quantum key QK_UUID-2 corresponds to the first quantum key QK_UUID-1. And the service provider obtains the extended identity assertion Assertion-2 according to the second quantum key QK_UUID-2, so that the service provider can allow the terminal to access the corresponding resource according to the extended identity assertion Assertion-2.

[0175] With reference to FIG. 12, in some embodiments, the step 0232 (verifying the extended identity assertion according to the post-quantum signature algorithm to determine whether the terminal has the resource access right) comprises:

[0176] 02321: performing signature verification processing on the extended identity assertion according to the post-quantum signature algorithm;

[0177] 02322: in the case where the quantum key identifier and the extended identity assertion are confirmed to be correct according to the signature verification processing, allowing the terminal to access the resource corresponding to the resource access request;

[0178] 02323: In a case where the quantum key identifier and the extended identity assertion are confirmed to be incorrect according to the signature verification processing, the terminal is denied access to the resource corresponding to the resource access request.

[0179] In some embodiments, the signature verification module is configured to perform signature verification on the extended identity assertion according to a post-quantum signature algorithm. The access module is configured to allow the terminal to access the resource corresponding to the resource access request in a case where the quantum key identifier and the extended identity assertion are confirmed to be correct according to the signature verification processing. The access module is also configured to deny the terminal to access the resource corresponding to the resource access request in a case where the quantum key identifier and the extended identity assertion are confirmed to be incorrect according to the signature verification processing.

[0180] In some embodiments, the processor is further configured to perform signature verification on the extended identity assertion according to a post-quantum signature algorithm. The processor is also configured to allow the terminal to access the resource corresponding to the resource access request in a case where the quantum key identifier and the extended identity assertion are confirmed to be correct according to the signature verification processing. The processor is also configured to deny the terminal to access the resource corresponding to the resource access request in a case where the quantum key identifier and the extended identity assertion are confirmed to be incorrect according to the signature verification processing.

[0181] Specifically, the second network device performs signature verification on the extended identity assertion according to a post-quantum signature algorithm. The second network device allows the terminal to access the resource corresponding to the resource access request in a case where the quantum key identifier and the extended identity assertion are confirmed to be correct according to the signature verification processing. The second network device denies the terminal to access the resource corresponding to the resource access request in a case where the quantum key identifier and the extended identity assertion are confirmed to be incorrect according to the signature verification processing. In this way, by verifying the correctness of the extended identity assertion, it is determined whether the terminal can access the resource corresponding to the resource access request.

[0182] With reference to the above example again, referring to FIG. 3, the service provider uses the public key of the identity provider to perform classical digital signature algorithm verification, such as RSA algorithm or ECC algorithm, on the content of the extended identity assertion Assertion-2. The PQC signature algorithm is also used to verify the content in the extended identity assertion Assertion-2. In a case where it is confirmed that the received quantum key identifier UUID_QK and the extended identity assertion are correct, the service provider allows the user to access the corresponding resource according to the relevant identity information and authorization information of the extended identity assertion. In a case where it is confirmed that the received quantum key identifier UUID_QK and the extended identity assertion are incorrect, the user is denied to access the corresponding resource.

[0183] Further, the user caches the Response message, and when the user needs to access the service provider corresponding to the extended identity assertion Assertion-2 again, the user can directly submit the Response message or the extended identity assertion Assertion-2 corresponding to the service provider to the service provider, and the service provider re-performs identity verification according to the above verification process.

[0184] In this way, by verifying the correctness of the extended identity assertion Assertion-2, it is determined whether the user can access the resource corresponding to the resource access request.

[0185] The apparatus embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment. Those skilled in the art can understand and implement it without creative labor.

[0186] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that microprocessors or digital signal processors (DSP) can be used in practice to implement some or all of the functions of some or all of the components in the computing processing device according to the embodiments of the present application. The present application can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for performing part or all of the methods described herein. Such program implementing the present application can be stored on a computer readable medium or can have the form of one or more signals. Such signals can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0187] For example, Fig. 13 shows a computing processing device which can implement the methods according to the present application. The computing processing device conventionally comprises a processor 1010 and a computer program product or computer readable medium in the form of a memory 1020. The memory 1020 can be an electronic storage such as a flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk or ROM. The memory 1020 has a storage space 1030 for program code 1031 for performing any of the method steps in the above methods. For example, the storage space 1030 for program code can comprise individual program codes 1031 for implementing the various steps in the above methods, respectively. These program codes can be read from or written to one or more computer program products. These computer program products comprise program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such computer program products are typically portable or stationary storage units as described with reference to Fig. 14. The storage unit can have a storage section, storage space, etc. arranged similarly to the memory 1020 in the computing processing device of Fig. 13. The program code can be compressed, for example, in a suitable form. Typically, the storage unit comprises computer readable code 1031', i.e. code which can be read by a processor such as 1010, which, when run by the computing processing device, causes the computing processing device to perform the various steps in the above described methods.

[0188] It is to be understood that the computer program can comprise computer program code. The computer program code can be in source code form, object code form, executable form, or in some intermediate form. The computer readable storage medium can comprise any entity or medium capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, Read-Only Memory (ROM), Random Access Memory (RAM), software distribution medium, etc.

[0189] In the description of the specification, the descriptions referring to the terms "specifically", "further", "particularly", "it can be understood that", etc. mean that the specific features, structures, materials or characteristics described in connection with the embodiments or examples are included in at least one embodiment or example of the present application. In the specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Also, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the specification and the features of the different embodiments or examples without contradiction.

[0190] Any procedural or methodological descriptions in flow charts or otherwise described herein can be understood to represent modules, segments or portions of code that include executable instructions for implementing the specified logical function or process(es), and the scope of preferred embodiments of the present application includes additional implementations that can not perform the functions in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, as will be understood by those skilled in the art to which embodiments of the present application pertain.

[0191] Although the embodiments of the present application have been shown and described above, it is to be understood that the above-described embodiments are exemplary only, and are not to be taken in a limiting sense, and that variations, modifications, substitutions and alterations to the above-described embodiments can be made by those skilled in the art within the scope of the present application.

Claims

1. A method of quantum-resistant security enhancement of a security assertion markup protocol of a communication network, wherein, The communication network comprises a first network device, a second network device and a terminal, the method is used for the first network device, and the method comprises the following steps of: receiving an authentication request forwarded by the terminal and sent by the second network device, wherein the second network device generates the authentication request according to a received resource access request sent by the terminal; generating an initial identity assertion according to the authentication request; obtaining a first quantum key and a quantum key identifier from a first network node accessed to the first network device; performing post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier to obtain an expanded identity assertion; performing encryption processing on the expanded identity assertion according to the first quantum key to obtain a first encrypted message; sending the first encrypted message to the second network device via the terminal, so that the second network device determines resource access permission of the terminal according to the first encrypted message.

2. The method of claim 1, wherein, The method further comprises the following steps of: accessing a first network node through a pre-established channel; loading a security certificate of the second network device or a security certificate of the first network device.

3. The method of claim 1, wherein, The authentication request comprises a second random number randomly generated by the second network device and an anti-quantum authentication request, wherein the anti-quantum authentication request is obtained by performing post-quantum cryptographic signature processing on an initial authentication request by the second network device, and the initial authentication request is obtained by the second network device according to a resource access request of the terminal.

4. The method of claim 1, wherein, The step of obtaining a first quantum key and a quantum key identifier from a first network node accessed to the first network device comprises the following steps of: sending a quantum key application to the first network node accessed to the first network device; receiving the first quantum key and the quantum key identifier distributed by the first network node according to the quantum key application, wherein the quantum key identifier is obtained by the first network node according to the first quantum key and an identification code of the first network node.

5. The method of Claim 1, wherein, The authentication request comprises a second random number randomly generated by the second network device, and the step of performing post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier to obtain an expanded identity assertion comprises the following steps of: splicing the second random number, a first network device identifier of the first network device, a second network device identifier of the second network device, authorization information of the terminal, attribute information of the terminal, the quantum key identifier and a first random number randomly generated by the first network device to obtain a first verification message; performing post-quantum cryptographic signature processing on the first verification message to obtain a first signature message; storing the first signature message, the quantum key identifier, the first random number and the second random number in the initial identity assertion to obtain the expanded identity assertion.

6. The method of claim 5, wherein, The step of performing encryption processing on the expanded identity assertion according to the first quantum key to obtain a first encrypted message comprises the following step of: performing encryption processing on contents in the expanded identity assertion except the quantum key identifier and the second network device identifier according to the first quantum key to obtain the first encrypted message.

7. A method of quantum-resistant security enhancement of a security assertion markup protocol of a communication network, wherein, The communication network comprises a first network device, a second network device and a terminal, the method is used for the second network device, and the method comprises: receiving a resource access request sent by the terminal; generating an authentication request according to the resource access request, and sending the authentication request to the first network device; receiving a first encrypted message sent by the first network device and forwarded by the terminal, to determine resource access permission of the terminal according to the first encrypted message, wherein the first network device generates an initial identity assertion according to the authentication request, obtains a first quantum key and a quantum key identifier from a first network node accessed to the first network device, performs post-quantum cryptographic signature processing on the initial identity assertion according to the quantum key identifier to obtain an expanded identity assertion, and performs encryption processing on the expanded identity assertion according to the first quantum key to obtain the first encrypted message.

8. The method of claim 7, wherein, The method comprises: generating an initial authentication request according to the resource access request, wherein the resource access request comprises terminal information of the terminal and resource information of a resource corresponding to the resource access request; performing splicing processing on a second random number generated randomly and related information in the initial authentication request to obtain a spliced message; performing signature processing on the spliced message according to a post-quantum cryptographic signature algorithm to obtain an anti-quantum authentication request; storing the anti-quantum authentication request and the second random number in the initial authentication request to obtain the authentication request.

9. The method of claim 7, wherein, The method comprises: performing decryption processing on the first encrypted message to obtain an expanded identity assertion; verifying the expanded identity assertion according to a post-quantum cryptographic signature algorithm, to determine that the terminal has resource access permission.

10. The method of claim 9, wherein, The method comprises: obtaining a quantum key identifier from the first encrypted message; obtaining a second quantum key from a second network node accessed to the second network device according to the quantum key identifier; performing decryption processing on the first encrypted message according to the second quantum key to obtain the expanded identity assertion.

11. The method of claim 10, wherein, The method comprises: performing signature verification processing on the expanded identity assertion according to a post-quantum signature algorithm; in a case where the quantum key identifier and the expanded identity assertion are confirmed to be correct according to the signature verification processing, allowing the terminal to access a resource corresponding to the resource access request; in a case where the quantum key identifier and the expanded identity assertion are confirmed to be incorrect according to the signature verification processing, refusing the terminal to access the resource corresponding to the resource access request.

12. A computing processing device, wherein, comprise: a memory in which computer readable code is stored; one or more processors, the computing processing device, when the computer readable code is executed by the one or more processors, performs the method of quantum-resistant security enhancement of a security assertion marking protocol of a communication network as claimed in any of claims 1-6 or 7-11.

13. A computer program comprising computer readable code which, when run on a computing processing device, causes the computing processing device to perform the method of quantum-resistant security enhancement of a security assertion marking protocol of a communication network as claimed in any of claims 1-6 or 7-11.

14. A computer readable medium having stored therein the computer program as claimed in claim 13.

Images