Quantum-resistant security enhancement method for openid connect

Abstract

The present application discloses a quantum-resistant security enhancement method for OpenID Connect in a communication network. The method comprises: when communication preprocessing is completed, receiving quantum-resistant token request information sent by a client; generating an access token and an identity token on the basis of the quantum-resistant token request information; generating a temporary key pair associated with the client; acquiring a quantum key identifier; processing the access token to generate a quantum-resistant access token; obtaining a quantum-resistant identity token on the basis of the temporary key pair, the quantum key identifier, post-quantum cryptography and the identity token; sending the quantum-resistant access token and the quantum-resistant identity token to the client; and receiving a resource access request generated on the basis of the quantum-resistant access token and the quantum-resistant identity token, and confirming an access permission to a corresponding resource, such that the client performs resource access on a server. The server and the client encrypt communications by means of post-quantum cryptography and quantum key distribution, thereby significantly enhancing the ability to resist quantum computing attacks.

Description

Quantum-resistant security enhancement methods for open identity connection protocols

[0001] This application claims priority to Chinese Patent Application No. 202411191650.9, filed on August 28, 2024, entitled “Method for Enhancing Quantum Security of Open Identity Connection Protocol”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of network security, and more specifically, to a method for enhancing the quantum-resistant security of an open identity connection protocol for communication networks. Background Technology

[0003] The leap in computing power, exemplified by quantum computing, has significantly impacted the security of algorithms in classical cryptography. Understandably, the realization of large-scale quantum computers will affect applications in classical cryptography such as key negotiation, encryption, and signature. Therefore, providing cryptographic techniques resistant to quantum computing attacks has become an urgent problem to solve. Summary of the Invention

[0004] This application provides a method for enhancing the quantum-resistant security of an open identity connection protocol for communication networks.

[0005] In a first aspect, embodiments of this application provide a method for enhancing the quantum security of an open identity connection protocol for a communication network, the communication network including a server and a client, the method being used on the server, the method comprising:

[0006] After completing communication preprocessing, receive the anti-quantum token request information sent by the client;

[0007] Generate an access token and an identity token based on the quantum-resistant token request information;

[0008] A temporary key pair is randomly generated and associated with the client, the temporary key pair including a temporary public key and a temporary private key;

[0009] Obtain the quantum key identifier from the first network node connected to the server;

[0010] The access token is encrypted to generate a quantum-resistant access token;

[0011] A quantum-resistant identity token is obtained based on the temporary key pair, the quantum key identifier, the post-quantum cryptography algorithm, and the identity token;

[0012] Send the quantum-resistant access token and the quantum-resistant identity token to the client;

[0013] The server receives a resource access request generated by the client based on the quantum-resistant access token and the quantum-resistant identity token, and confirms the access permissions of the resource corresponding to the resource access request, so that the client can access the server for resources.

[0014] Thus, during the communication process where a client requests access to resources on the server, the client sends a quantum-resistant token request message to the server. Upon receiving the quantum-resistant token request message, the server requests a quantum key and uses the quantum key and a post-quantum cryptography algorithm to encrypt the access token and identity token generated based on the quantum-resistant token request message, generating quantum-resistant access tokens and quantum-resistant identity tokens that are resistant to quantum computing attacks. The post-quantum cryptography algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has strong resistance to quantum computing attacks. Next, the client receives the quantum-resistant access token and quantum-resistant identity token sent by the server and sends a resource access request generated based on the quantum-resistant access token and quantum-resistant identity token to the server. Then, the server verifies the validity of the quantum-resistant access token and quantum-resistant identity token to determine whether the server can access the resource corresponding to the resource access request. In this way, quantum key distribution technology and post-quantum cryptography algorithms enhance the resistance to quantum computing attacks in the communication process of the client requesting access to server resources.

[0015] In some embodiments, the method further includes:

[0016] Receive a registration request sent by the client, the registration request including the client's second post-quantum public key and second classical public key;

[0017] Send a registration response request generated based on the registration request, the registration response request including the server's first post-quantum public key and first classical public key;

[0018] Receive the authorization request sent by the client based on the registration response request;

[0019] An authorization code is generated based on the authorization request, and the authorization code is sent to the client.

[0020] Thus, the server receives a registration request from the client, which includes the client's second post-quantum public key and second classical public key. Next, the server sends a registration response request generated based on the registration request, which includes the server's first post-quantum public key and first classical public key. Then, the server receives an authorization request from the client, obtained based on the registration response request. Finally, the server generates an authorization code based on the authorization request and sends the authorization code to the client. In this way, the server and client can securely exchange keys, obtaining each other's post-quantum and classical public keys for subsequent signing and verification processes. The post-quantum public key has strong resistance to quantum computing attacks, ensuring that the transmitted data is well-protected against such attacks.

[0021] In some embodiments, the quantum-resistant token request information includes an access random number, an identity random number, access token request information, identity token request information, a second post-quantum signature message, and a second classical signature message. The method further includes:

[0022] The second post-quantum signature message is verified using the received second post-quantum public key to confirm the correctness of the access token request information and the access random number;

[0023] The second classic signature message is verified using the received second classic public key to confirm the correctness of the identity token request information and the identity random number.

[0024] Thus, the server verifies the second-quantum signature message using the received second-quantum public key to confirm the correctness of the access token request information and access random number. Next, the server verifies the second-classical signature message using the received second-classical public key to confirm the correctness of the identity token request information and identity random number. In this way, the verification process confirms that the received access token request information, access random number, identity token request information, and identity random number all originate from the client and have not been accessed without authorization.

[0025] In some implementations, the quantum-resistant token request information includes an access random number, an identity random number, access token request information, and identity token request information. Generating the access token and identity token based on the quantum-resistant token request information includes:

[0026] The access token is generated based on the access token request information, and the access token includes an access random number;

[0027] The identity token is generated based on the identity token request information, and the identity token includes an identity random number.

[0028] Thus, the server generates an access token based on the access token request information, and the access token includes an access random number. Next, the server generates an identity token based on the identity token request information, and the identity token includes an identity random number. In this way, both the access token and the identity token carry corresponding random numbers to maintain their uniqueness and freshness.

[0029] In some implementations, obtaining the quantum key identifier from the first network node accessing the server includes:

[0030] Send a quantum key request to the first network node connected to the server;

[0031] The network node receives a first quantum key and a quantum key identifier, wherein the quantum key identifier is obtained by the first network node identifying the first quantum key according to the identification code of the first network node.

[0032] Thus, the server sends a quantum key request to the first network node accessing the server. Next, the server receives the first quantum key and quantum key identifier from the network node. The quantum key identifier is obtained by the first network node through identification processing of the first quantum key based on its own identifier. In this way, the server obtains the first quantum key and quantum key identifier. The first quantum key has strong resistance to quantum computing attacks and can be used to ensure strong confidentiality in communication between the server and the client. The quantum key identifier facilitates the management and use of the quantum key.

[0033] In some implementations, the quantum-resistant token request information includes a second post-quantum signature message, and the encryption of the access token to generate a quantum-resistant access token includes:

[0034] The access token is signed using the classic signature algorithm and the received first classic private key to obtain a first classic signature message;

[0035] The first classical signature message and the second post-quantum signature message are stored in the access token to obtain a quantum-resistant access token.

[0036] Thus, the server signs the access token using the classical signature algorithm and the received first classical private key to obtain a first classical signature message. Next, the server stores the first classical signature message and the second post-quantum signature message in the access token, obtaining a quantum-resistant access token. In this way, the server obtains a quantum-resistant access token with strong quantum resistance, preventing unauthorized access to data during the transmission of the quantum-resistant access token.

[0037] In some embodiments, the method further includes:

[0038] The temporary private key is encrypted using the first quantum key to obtain an encrypted temporary private key;

[0039] Replace the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair.

[0040] Thus, the server encrypts the temporary private key using the first quantum key to obtain an encrypted temporary private key. Next, the server replaces the temporary private key with the encrypted temporary private key, obtaining an encrypted temporary key pair. In this way, by encrypting the temporary private key in the generated temporary key pair, the security and confidentiality of the temporary key pair are ensured, preventing unauthorized access during transmission and storage.

[0041] In some implementations, the quantum-resistant token request information includes a second classical signature message, and obtaining the quantum-resistant identity token based on the temporary key pair, the quantum key identifier, the post-quantum cryptography algorithm, and the identity token includes:

[0042] The encrypted temporary key pair and the quantum key identifier are stored in the identity token to obtain an intermediate identity token;

[0043] The intermediate identity token is processed by post-quantum signature based on the server's first post-quantum private key to obtain a first post-quantum signature message.

[0044] The first post-quantum signature message and the second classical signature message are stored in the intermediate identity token to obtain the quantum-resistant identity token.

[0045] In this way, the server stores the encrypted temporary key pair and the quantum key identifier in the identity token, obtaining an intermediate identity token. Next, the server performs post-quantum signature processing on the intermediate identity token using its first post-quantum private key to obtain a first post-quantum signed message. Finally, the server stores the first post-quantum signed message and the second classical signature message in the intermediate identity token, obtaining a quantum-resistant identity token. In this way, the server can generate a quantum-resistant identity token that is both secure and resistant to quantum computing attacks, and can verify the integrity and authenticity of the quantum-resistant identity token, ensuring that it has not been tampered with.

[0046] In some implementations, the resource access request includes a first signature value, and receiving the resource access request generated by the client based on the quantum-resistant access token and the quantum-resistant identity token, and confirming the access rights to the resource corresponding to the resource access request, so as to enable the client to access the server, includes:

[0047] The second post-quantum signature message is verified based on the post-quantum signature algorithm and the received second post-quantum public key;

[0048] The first classic signature message is verified according to the classic signature algorithm and the server's first classic public key;

[0049] If the second post-quantum signature message verification is successful and the first classical signature message verification is successful, the quantum-resistant identity token and the first signature value are verified.

[0050] Thus, the server verifies the second post-quantum signature message using the post-quantum signature algorithm and the received second post-quantum public key. Next, the server verifies the first classical signature message using the classical signature algorithm and the server's first classical public key. Only after both the second post-quantum signature message and the first classical signature message have passed verification is the server verified against the quantum identity token and the first signature value. In this way, through multiple signature verifications, the security and integrity of the identity token are ensured, preventing unauthorized access and potential attacks.

[0051] In some implementations, verifying the quantum-resistant identity token and the first signature value includes:

[0052] The first post-quantum signature message is verified based on the post-quantum signature algorithm and the server's first post-quantum public key;

[0053] The second classic signature message is verified based on the classic signature algorithm and the received second classic public key;

[0054] The first signature value is verified using the temporary public key of the encrypted temporary key pair;

[0055] If the first quantum signature message is verified successfully, the second classical signature message is verified successfully, and the first signature value is verified successfully, the client is allowed to access the resource corresponding to the resource access request.

[0056] Thus, the server verifies the first post-quantum signature message using the post-quantum signature algorithm and the server's first post-quantum public key, confirming its integrity and authenticity, and ensuring it has not been tampered with. Next, the server verifies the second classical signature message using the classical signature algorithm and the received second classical public key, confirming its integrity and authenticity, and ensuring it has not been tampered with. Then, the server verifies the first signature value using the temporary public key of the encrypted temporary key pair, confirming its validity, and ensuring it has not been tampered with. Finally, if the first post-quantum signature message, the second classical signature message, and the first signature value all pass verification, the server allows the client to access the resource corresponding to the access request. This multi-layered signature verification enhances communication security, prevents malicious attacks and data tampering, and ensures that the client can legitimately access the required resources.

[0057] In a second aspect, embodiments of this application provide a method for enhancing the quantum security of an open identity connection protocol in a communication network, the communication network including a server and a client, the method being used on the client, the method comprising:

[0058] After completing the communication preprocessing, a quantum-resistant token request message is sent to the server;

[0059] The server receives a quantum-resistant access token and a quantum-resistant identity token, wherein the quantum-resistant access token is generated by the server by encrypting the access token according to a post-quantum cryptography algorithm, and the quantum-resistant identity token is obtained by the server based on a temporary key pair, a quantum key identifier, a post-quantum cryptography algorithm, and an identity token. The access token and the identity token are generated by the server based on the quantum-resistant token request information.

[0060] The client sends a resource access request to the server based on the quantum-resistant access token and the quantum-resistant identity token. The server confirms the access permissions of the resource corresponding to the resource access request, so that the client can access the server's resources.

[0061] Thus, during the communication process where a client requests access to resources on the server, the client sends a quantum-resistant token request message to the server. Upon receiving the quantum-resistant token request message, the server requests a quantum key and uses the quantum key and a post-quantum cryptography algorithm to encrypt the access token and identity token generated based on the quantum-resistant token request message, generating quantum-resistant access tokens and quantum-resistant identity tokens that are resistant to quantum computing attacks. The post-quantum cryptography algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has strong resistance to quantum computing attacks. Next, the client receives the quantum-resistant access token and quantum-resistant identity token sent by the server and sends a resource access request generated based on the quantum-resistant access token and quantum-resistant identity token to the server. Then, the server verifies the validity of the quantum-resistant access token and quantum-resistant identity token to determine whether the server can access the resource corresponding to the resource access request. In this way, quantum key distribution technology and post-quantum cryptography algorithms enhance the resistance to quantum computing attacks in the communication process of the client requesting access to server resources.

[0062] In some embodiments, the method further includes:

[0063] Send a registration request to the server, the registration request including the client's second post-quantum public key and second classical public key;

[0064] Receive a registration response request generated by the server based on the registration request, the registration response request including the server's first post-quantum public key and first classical public key;

[0065] An authorization request is sent to the server based on the registration response request;

[0066] Receive the authorization code generated by the client based on the authorization request.

[0067] Thus, the client sends a registration request to the server, which includes the client's second post-quantum public key and second classical public key. Next, the client receives a registration response request generated by the server based on the registration request, which includes the server's first post-quantum public key and first classical public key. Then, the client sends an authorization request to the server based on the registration response request. Finally, the client receives an authorization code generated by itself based on the authorization request. In this way, the server and client can securely exchange keys, obtaining each other's post-quantum and classical public keys for subsequent signing and verification processes. The post-quantum public key has strong resistance to quantum computing attacks, ensuring that the transmitted data is well-protected against such attacks.

[0068] In some implementations, sending the quantum-resistant token request information to the server includes:

[0069] An initial token request information is generated based on the authorization code, and the initial token request information includes access token request information and identity token request information.

[0070] The access token request information and the access random number randomly generated by the client are subjected to post-quantum signature processing based on the client's second post-quantum private key to obtain a second post-quantum signature message.

[0071] The identity token request information and the identity random number randomly generated by the client are signed using the client's second classic private key to obtain a second classic signature message;

[0072] The access random number, the identity random number, the second post-quantum signature message, and the second classical signature message are stored in the initial token request information to obtain the quantum-resistant token request information;

[0073] The anti-quantum token request information is sent to the server.

[0074] Thus, the client generates an initial token request message based on the authorization code, which includes an access token request message and an identity token request message. Next, the client performs a post-quantum signature on the access token request message and a randomly generated access random number using its second post-quantum private key, obtaining a second post-quantum signed message. Then, the client signs the identity token request message and a randomly generated identity random number using its second classical private key, obtaining a second classical signed message. Finally, the client stores the access random number, identity random number, second post-quantum signed message, and second classical signed message in the initial token request message, obtaining a quantum-resistant token request message. This quantum-resistant token request message is then sent to the server. In this way, the client uses post-quantum cryptography algorithms to generate quantum-resistant token request messages, ensuring their security and integrity, giving them quantum-resistant capabilities to prevent unauthorized access and potential attacks. Furthermore, the use of both classical and post-quantum signature algorithms provides dual protection for the quantum-resistant token request message, enhancing its security.

[0075] In some implementations, the quantum-resistant access token includes a first classical signature message, the quantum-resistant identity token includes a first post-quantum signature message, and the method further includes:

[0076] The first classical signature message is verified using the first classical public key to confirm receipt of the correct quantum-resistant access token.

[0077] The first post-quantum signature message is verified using the first post-quantum public key to confirm receipt of the correct quantum-resistant identity token.

[0078] Thus, the client verifies the first classical signature message using the first classical public key to confirm receipt of the correct quantum-resistant access token. Next, the client verifies the first post-quantum signature message using the first post-quantum public key to confirm receipt of the correct quantum-resistant identity token. This ensures that the quantum-resistant access token and quantum-resistant identity token received by the client are secure and legitimately issued by the server.

[0079] In some implementations, the quantum-resistant identity token includes a quantum key identifier, and the method further includes:

[0080] The service node is used to inject multiple keys into the client's cryptographic module;

[0081] A quantum key request is sent to the service node according to the quantum key identifier. The quantum key request is protected by a protection key, which is one of a plurality of keys injected into the cryptographic module and used randomly.

[0082] The service node receives the quantum key encryption result obtained by encrypting the second quantum key according to the protection key. The second quantum key is generated and distributed to the service node by the first network node connected to the service node.

[0083] The second quantum key is obtained by decrypting the quantum key encryption result.

[0084] In this way, the client uses the service node to feed multiple keys into its cryptographic module. Next, the client sends a quantum key request to the service node based on the received quantum key identifier. This quantum key request is protected by a protection key, which is randomly selected from the multiple keys fed into the cryptographic module. Then, the client receives the quantum key encryption result obtained by the service node encrypting a second quantum key using the protection key. This second quantum key is generated and distributed to the service node by a second network node connected to the service node. Finally, the client decrypts the quantum key encryption result to obtain the second quantum key. Thus, the client obtains the second quantum key, which has good resistance to quantum computing attacks and can protect the communication between the server and the client.

[0085] In some implementations, the quantum-resistant access token includes an access random number, the quantum-resistant identity token includes an identity random number and a cryptographic temporary key pair, the cryptographic temporary key pair including a cryptographic temporary private key, and the method further includes:

[0086] The temporary private key is obtained by decrypting the encrypted temporary private key using the second quantum key;

[0087] The first concatenation is obtained by concatenating the verification random number, the access random number, and the identity random number generated by the client at any time.

[0088] The first concatenation is signed using the temporary private key to obtain the first signature value.

[0089] Thus, the client decrypts the encrypted temporary private key using the second quantum key to obtain the temporary private key. Next, the client concatenates the verification random number, access random number, and identity random number generated at any time to obtain the first concatenation. Finally, the client signs the first concatenation using the temporary private key to obtain the first signature value. In this way, the user client obtains the first signature value, enabling them to verify the integrity and authenticity of the first concatenation, ensuring it has not been tampered with and was indeed generated by the client.

[0090] In some implementations, sending a resource access request to the server based on the quantum-resistant access token and the quantum-resistant identity token includes:

[0091] A resource access request is sent to the server based on the first signature value, the quantum-resistant access token, and the quantum-resistant identity token.

[0092] Thus, the client sends a resource access request to the server based on the first signature value, a quantum-resistant access token, and a quantum-resistant identity token. In this way, the server can ensure that the resource access request is not accessed without authorization during transmission based on the first signature value sent by the client. The server then confirms the access permissions of the resource access request based on the quantum-resistant access token and the quantum-resistant identity token sent by the client.

[0093] Thirdly, embodiments of this application provide a computing processing device, comprising: a memory storing computer-readable code; and one or more processors, wherein when the computer-readable code is executed by the one or more processors, the computing processing device executes the quantum-resistant security enhancement method for the open identity connection protocol of the communication network as proposed in the first and second aspects above.

[0094] Fourthly, embodiments of this application provide a computer program including computer-readable code, which, when executed on a computing processing device, causes the computing processing device to execute the quantum-resistant security enhancement method for the open identity connection protocol of the communication network as described in the first and second aspects above.

[0095] Fifthly, this application proposes a computer-readable medium storing the computer program as described in the fourth aspect above.

[0096] Additional aspects and advantages of embodiments of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of embodiments of this application. Attached Figure Description

[0097] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, wherein:

[0098] Figure 1 is one of the flowcharts illustrating a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in an embodiment of this application;

[0099] Figure 2 is an architecture diagram of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in an embodiment of this application;

[0100] Figure 3 is a second schematic flowchart of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in an embodiment of this application;

[0101] Figure 4 is a flowchart of the third embodiment of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in this application.

[0102] Figure 5 is a flowchart of the fourth embodiment of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in this application.

[0103] Figure 6 is a fifth flowchart illustrating a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in an embodiment of this application.

[0104] Figure 7 is a flowchart of the sixth embodiment of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in this application.

[0105] Figure 8 is a flowchart of the seventh method for enhancing the quantum security of an open identity connection protocol for a communication network according to an embodiment of this application;

[0106] Figure 9 is the eighth flowchart illustrating a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in this application embodiment;

[0107] Figure 10 is a flowchart of the ninth embodiment of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in this application.

[0108] Figure 11 is a schematic flowchart of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in an embodiment of this application;

[0109] Figure 12 is an eleventh flowchart illustrating a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in an embodiment of this application;

[0110] Figure 13 is a schematic flowchart of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in an embodiment of this application.

[0111] Figure 14 is a flowchart of the method for enhancing the quantum security of an open identity connection protocol for a communication network according to an embodiment of this application.

[0112] Figure 15 is a flowchart of the fourteenth embodiment of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in this application.

[0113] Figure 16 is a flowchart of the fifteenth embodiment of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in this application.

[0114] Figure 17 is a schematic flowchart of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in an embodiment of this application.

[0115] Figure 18 is a flowchart of the seventeenth embodiment of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in this application.

[0116] Figure 19 is a signaling diagram of a quantum-resistant security enhancement method for an open identity connection protocol in a communication network proposed in an embodiment of this application;

[0117] Figure 20 is a schematic diagram of the structure of a computing device for a quantum-resistant security enhancement method of an open identity connection protocol for a communication network proposed in an embodiment of this application;

[0118] Figure 21 is a schematic diagram of the computer program structure of a quantum-resistant security enhancement method for an open identity connection protocol of a communication network proposed in an embodiment of this application. Detailed Implementation

[0119] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of this application, and should not be construed as limiting the embodiments of this application.

[0120] The leap in computing power, exemplified by quantum computing, has significantly impacted the security of algorithms in classical cryptography. In other words, quantum computing poses a more direct and pressing threat to classical cryptography. Classical algorithms such as Diffie-Hellman, RSA, and elliptic curve cryptography (ECC) face greater security risks because the number theory problems they are based on, such as large prime number factorization and discrete logarithms, are no longer difficult in the quantum era. Understandably, the realization of large-scale quantum computers will have some impact on applications of classical cryptography, such as key negotiation, encryption, and signatures.

[0121] Thus, the security of the internet, which uses classical cryptographic algorithms to protect communication processes, is heavily threatened by quantum computing attacks. For example, the OpenID Connect (OIDC) protocol, a secure authentication mechanism, allows third-party applications to connect to an identity service to obtain user information, which is then returned to the third-party application in a secure and reliable manner. OID Connect extends Open Authorization Protocol 2.0 by providing basic user identity information through an extended ID Token field. The ID Token is encapsulated in JSON Web Token (JWT) format, providing self-containment and tamper-proof mechanisms, allowing it to be securely transmitted to third-party applications and easily verified. JSON Web Tokens use JSON Web Encryption (JWE) and JSON Web Signature (JWS) to provide encryption and authentication security. Currently, JWE and JWS employ classic digital signatures and encryption / decryption / hash techniques, lacking resistance to quantum computing attacks.

[0122] Currently, international technologies for addressing quantum computing attacks mainly fall into two categories: one focuses on scenarios where (symmetric) key negotiation is performed using asymmetric algorithms, followed by encrypted transmission using symmetric algorithms. This involves researching the use of quantum key distribution (QKD) networks for symmetric key negotiation to protect key security. The other category researches post-quantum cryptography (PQC) algorithms to directly replace existing asymmetric algorithms. Quantum key distribution technology utilizes quantum mechanics principles to generate keys that cannot be intercepted by third parties, ensuring the security of key transmission. It is particularly suitable for key exchange scenarios and can replace existing asymmetric key negotiation algorithms, such as RSA or ECC, to improve key security. However, quantum key distribution technology cannot currently completely replace all applications of asymmetric algorithms. For example, in scenarios involving signature verification, integrity protection, and non-repudiation, asymmetric algorithms are still required.

[0123] Post-quantum cryptography algorithms are asymmetric cryptographic algorithms designed based on new mathematical problems, aiming to resist the potential threats posed by quantum computers. NIST has published the first batch of four proposed standardized post-quantum cryptographic algorithms: Kyber, Dilithium, Falcon, and SPHINCS+. These algorithms cover multiple technical approaches to reduce the risk of a single technique being compromised. Theoretically, post-quantum cryptography algorithms can replace all asymmetric algorithms and are more universal. However, the security of post-quantum cryptography algorithms still depends on the complexity of the computational problem, and they may face new methods of breaking them in the future or become insecure as computing power increases. Furthermore, post-quantum cryptography standards have not yet been officially published, and the production and certification of related products will take time; therefore, their large-scale application will require a considerable period.

[0124] Both post-quantum cryptography algorithms and quantum key distribution technologies have the ability to resist quantum computing attacks, but each has its limitations. Therefore, providing a relatively low-cost and highly secure cryptographic technology that can resist quantum computing attacks has become an urgent problem to be solved.

[0125] Based on the above problems, please refer to Figure 1. This application provides a method for enhancing the quantum security of an open identity connection protocol in a communication network. The communication network includes a server and a client. The method is used on the server and includes:

[0126] 011: After completing communication preprocessing, receive the anti-quantum token request information sent by the client;

[0127] 012: Generate access tokens and identity tokens based on the quantum-resistant token request information;

[0128] 013: Randomly generate a temporary key pair associated with the client. The temporary key pair includes a temporary public key and a temporary private key.

[0129] 014: Obtain the quantum key identifier from the first network node connected to the server;

[0130] 015: Encrypt the access token to generate a quantum-resistant access token;

[0131] 016: Obtain a quantum-resistant identity token based on the temporary key pair, quantum key identifier, post-quantum cryptography algorithm, and identity token;

[0132] 017: Send a quantum-resistant access token and a quantum-resistant identity token to the client;

[0133] 018: Receive resource access requests generated by clients based on quantum-resistant access tokens and quantum-resistant identity tokens, confirm the access permissions of the resources corresponding to the resource access requests, so that clients can access resources on the server.

[0134] This application also provides a server, including a memory and a processor. The method of this application can be implemented by the server of this application. Specifically, the memory stores a computer program, and the processor is used to receive quantum-resistant token request information sent by a client after completing communication preprocessing. The processor is also used to generate an access token and an identity token based on the quantum-resistant token request information, and to randomly generate a temporary key pair associated with the client, the temporary key pair including a temporary public key and a temporary private key. It also obtains a quantum key identifier from a first network node accessing the server. The processor is further used to encrypt the access token to generate a quantum-resistant access token, and to obtain a quantum-resistant identity token based on the temporary key pair, the quantum key identifier, a post-quantum cryptography algorithm, and the identity token. Finally, it sends the quantum-resistant access token and the quantum-resistant identity token to the client and receives a resource access request generated by the client based on the quantum-resistant access token and the quantum-resistant identity token, confirming the access permissions of the resource corresponding to the resource access request, so that the client can access the server's resources.

[0135] This application also provides a server security enhancement device. The method of this application can be implemented by the server security enhancement device of this application. Specifically, the server security enhancement device includes a receiving module, a sending module, a derivation module, an acquisition module, an encryption module, and a processing module. The receiving module is further configured to receive quantum-resistant token request information sent by the client after communication preprocessing is completed. The derivation module is configured to generate an access token and an identity token based on the quantum-resistant token request information. The derivation module is further configured to randomly generate a temporary key pair associated with the client, the temporary key pair including a temporary public key and a temporary private key. The acquisition module is configured to acquire a quantum key identifier from a first network node accessing the server. The encryption module is configured to encrypt the access token to generate a quantum-resistant access token. The processing module is configured to obtain a quantum-resistant identity token based on the temporary key pair, the quantum key identifier, the post-quantum cryptography algorithm, and the identity token. The sending module is configured to send the quantum-resistant access token and the quantum-resistant identity token to the client. The receiving module is configured to receive a resource access request generated by the client based on the quantum-resistant access token and the quantum-resistant identity token, and confirm the access permissions of the resource corresponding to the resource access request, so that the client can access the server resources.

[0136] This application provides a communication system based on an open identity connection protocol. The communication system includes a server, a client, and a quantum key distribution network as described in the above embodiments. The quantum key distribution network is configured to distribute quantum keys to the server or the client.

[0137] Specifically, a quantum key distribution network (QKD) includes network nodes and a quantum network link control center. Network nodes are used to store and distribute quantum keys. The quantum network link control center can establish quantum key distribution and relay links between network nodes according to their names. These links are used for data transfer and other functions. The QKD network provides services such as quantum key generation, quantum key relay, and quantum key provision.

[0138] Referring to Figure 2, in some implementations, the client sends an authorization request to the server, and the server responds to the client's authorization request. The server also sends an identity token request and an access token request to the client, and the client also responds to these requests. Through multiple request-response interactions, the server and client complete the generation and distribution of the identity token and access token. The client connects to a service node, which serves as a relay station for connecting to network nodes, used to supply keys to the client and to relay and store quantum keys. A simplified process for the server and client to obtain quantum keys is as follows: First, the server sends a quantum key request to the first network node connecting to the server. Then, the first network node distributes the quantum key generated according to the quantum key request to the server. Simultaneously, the quantum network link control center synchronously causes the second network node connecting to the client to generate a quantum key, but this quantum key is not immediately distributed to the connecting server; instead, it is first stored in the network node. The above correspondence between the server, client, service node, and network node is provided by the management platform.

[0139] It should be noted that this application uses the FIPS 203 Module-Lattice-based Key-Encapsulation Mechanism Standard as the PQC key encapsulation algorithm and the FIPS 204 Module-Lattice-Based Digital Signature Standard as the PQC digital signature algorithm for explanation and illustration. All subsequent descriptions of PQC algorithm-related operations refer to the aforementioned FIPS standards. Of course, in other embodiments, other algorithms such as the NewHope algorithm, Sidh algorithm, and HQC algorithm can also be used as the relevant PQC algorithms. It should also be noted that the embodiments of this application pertain to the OpenID Connect (OIDC) protocol, hereinafter referred to as the OIDC protocol.

[0140] Specifically, after completing communication preprocessing, the client sends a quantum-resistant token request to the server. The server receives the quantum-resistant token request from the client. The server then generates an access token and an identity token based on the quantum-resistant token request. It also randomly generates a temporary key pair associated with the client, including a temporary public key and a temporary private key. Then, it obtains a quantum key identifier from the first network node accessing the server. With the quantum key identifier obtained, the server encrypts the access token to generate a quantum-resistant access token. Based on the temporary key pair, the quantum key identifier, the post-quantum cryptography algorithm, and the identity token, it obtains a quantum-resistant identity token. Finally, the server sends the quantum-resistant access token and the quantum-resistant identity token to the client.

[0141] The client receives a quantum-resistant access token and a quantum-resistant identity token from the server. Then, the client sends a resource access request to the server based on these tokens. The server confirms the access permissions for the resource corresponding to the request, enabling the client to access the server's resources.

[0142] The server receives a resource access request generated by the client based on a quantum-resistant access token and a quantum-resistant identity token, confirms the access permissions of the resource corresponding to the resource access request, and enables the client to access the server's resources.

[0143] In summary, in the quantum-resistant security enhancement method, communication system, server, and client of the open identity connection protocol in the communication network of this application, for the communication process of a client requesting access to resources in the server, the client sends a quantum-resistant token request message to the server. Upon receiving the quantum-resistant token request message, the server requests a quantum key and uses the quantum key and a post-quantum cryptography algorithm to encrypt the access token and identity token generated based on the quantum-resistant token request message, generating a quantum-resistant access token and a quantum-resistant identity token capable of resisting quantum computing attacks. The post-quantum cryptography algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good resistance to quantum computing attacks. Next, the client receives the quantum-resistant access token and quantum-resistant identity token sent by the server and sends a resource access request generated based on the quantum-resistant access token and quantum-resistant identity token to the server. Then, the server verifies the validity of the quantum-resistant access token and quantum-resistant identity token to determine whether the server can access the resource corresponding to the resource access request. Thus, the quantum key distribution technology and the post-quantum cryptography algorithm enhance the resistance to quantum computing attacks in the communication process of the client requesting access to server resources.

[0144] Please refer to Figure 3. In some embodiments, the method further includes:

[0145] 019: Receive registration requests sent by clients;

[0146] 020: Send the registration response request generated based on the registration request;

[0147] 021: Receive the authorization request sent by the client based on the registration response request;

[0148] 022: Generate an authorization code based on the authorization request and send the authorization code to the client.

[0149] In some implementations, the receiving module is used to receive a registration request sent by the client. The sending module is used to send a registration response request generated based on the registration request. The receiving module is also used to receive an authorization request obtained from the registration response request sent by the client. The sending module is also used to generate an authorization code based on the authorization request and send the authorization code to the client.

[0150] In some implementations, the processor is further configured to receive a registration request sent by the client, and to send a registration response request generated based on the registration request. The processor is also configured to receive an authorization request from the client based on the registration response request, generate an authorization code based on the authorization request, and send the authorization code to the client.

[0151] Specifically, the server receives a registration request from the client, which includes the client's second post-quantum public key and second classical public key. Next, the server sends a registration response request generated based on the registration request, which includes the server's first post-quantum public key and first classical public key. Then, the server receives an authorization request from the client, obtained based on the registration response request. Finally, the server generates an authorization code based on the authorization request and sends the authorization code to the client.

[0152] In this way, the server and client can securely exchange keys. The server and client obtain each other's post-quantum public key and classical public key for subsequent signing and verification processes. The post-quantum public key has good resistance to quantum computing attacks, which enables the transmitted data to have good resistance to quantum computing attacks.

[0153] Referring to Figure 4, in some embodiments, the quantum-resistant token request information includes an access random number, an identity random number, access token request information, an identity token request information, a second post-quantum signature message, and a second classical signature message. The method further includes:

[0154] 023: Verify the second post-quantum signature message based on the received second post-quantum public key to confirm the correctness of the access token request information and the access random number;

[0155] 024: Verify the signature of the second classic signature message based on the received second classic public key to confirm the correctness of the identity token request information and the identity random number.

[0156] In some implementations, the verification module is used to verify the second post-quantum signature message based on the received second post-quantum public key to confirm the correctness of the access token request information and the access random number. The verification module is also used to verify the second classical signature message based on the received second classical public key to confirm the correctness of the identity token request information and the identity random number.

[0157] In some implementations, the processor is further configured to perform signature verification processing on the second post-quantum signature message based on the received second post-quantum public key to confirm the correctness of the access token request information and the access random number; and to perform signature verification processing on the second classical signature message based on the received second classical public key to confirm the correctness of the identity token request information and the identity random number.

[0158] Specifically, the server verifies the second post-quantum signature message using the received second post-quantum public key to confirm the correctness of the access token request information and access random number. Next, the server verifies the second classical signature message using the received second classical public key to confirm the correctness of the identity token request information and identity random number.

[0159] Thus, through signature verification, it is confirmed that the received access token request information, access random number, identity token request information, and identity random number all come from the client and have not been accessed without authorization.

[0160] Referring to Figure 5, in some embodiments, the quantum-resistant token request information includes an access random number, an identity random number, access token request information, and identity token request information. Step 012 (generating an access token and an identity token based on the quantum-resistant token request information) includes:

[0161] 0121: Generate an access token based on the access token request information. The access token includes an access random number.

[0162] 0122: Generate an identity token based on the identity token request information. The identity token includes a random number representing the identity.

[0163] In some implementations, the derived module is used to generate an access token based on access token request information, the access token including an access random number. The derived module is also used to generate an identity token based on identity token request information, the identity token including an identity random number.

[0164] In some implementations, the processor is further configured to generate an access token based on access token request information, the access token including an access random number; and to generate an identity token based on identity token request information, the identity token including an identity random number.

[0165] Specifically, the server generates an access token based on the access token request information, and the access token includes an access random number. Next, the server generates an identity token based on the identity token request information, and the identity token includes an identity random number.

[0166] Thus, both the access token and the identity token carry a corresponding random number to maintain their uniqueness and freshness.

[0167] Referring to Figure 6, in some embodiments, step 014 (obtaining the quantum key identifier from the first network node of the access server) includes:

[0168] 0141: Send a quantum key request to the first network node accessing the server;

[0169] 0142: Receive the first quantum key and quantum key identifier sent by the network node.

[0170] In some implementations, the sending module is used to send a quantum key request to a first network node accessing the server. The receiving module is used to receive the first quantum key and quantum key identifier sent by the network node.

[0171] In some implementations, the processor is also configured to send a quantum key request to a first network node accessing the server, and to receive a first quantum key and a quantum key identifier sent by the network node.

[0172] Specifically, the server sends a quantum key request to the first network node that has accessed the server. Then, the server receives the first quantum key and a quantum key identifier from the network node. The quantum key identifier is obtained by the first network node through identification processing of the first quantum key based on its own identification code.

[0173] In this way, the server obtains the first quantum key and the quantum key identifier. The first quantum key has good resistance to quantum computing attacks and can be used to make the communication between the server and the client highly confidential. The quantum key identifier helps in the management and use of the quantum key.

[0174] Referring to Figure 7, in some embodiments, the quantum-resistant token request information includes a second post-quantum signature message. Step 015 (encrypting the access token to generate a quantum-resistant access token) includes:

[0175] 0151: The access token is signed using the classic signature algorithm and the received first classic private key to obtain the first classic signature message;

[0176] 0152: Store the first classical signature message and the second post-quantum signature message in the access token to obtain a quantum-resistant access token.

[0177] In some implementations, the signature module is used to sign the access token according to a classical signature algorithm and the received first classical private key to obtain a first classical signature message. The storage module is used to store the first classical signature message and the second post-quantum signature message in the access token to obtain a quantum-resistant access token.

[0178] In some implementations, the processor is further configured to sign the access token according to a classical signature algorithm and the received first classical private key to obtain a first classical signature message, and to store the first classical signature message and the second post-quantum signature message in the access token to obtain a quantum-resistant access token.

[0179] Specifically, the server signs the access token using a classical signature algorithm and the received first classical private key to obtain a first classical signature message. Then, the server stores the first classical signature message and the second post-quantum signature message in the access token, resulting in a quantum-resistant access token.

[0180] In this way, the server obtains a quantum-resistant access token with good quantum resistance, which prevents unauthorized access to data during the transmission of the quantum-resistant access token.

[0181] Please refer to Figure 8. In some embodiments, the method further includes:

[0182] 025: The temporary private key is encrypted using the first quantum key;

[0183] 026: Replace the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair.

[0184] In some implementations, the encryption module is used to encrypt the temporary private key according to the first quantum key to obtain an encrypted temporary private key. The replacement module is used to replace the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair.

[0185] In some implementations, the processor is further configured to encrypt the temporary private key according to the first quantum key to obtain an encrypted temporary private key, and to replace the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair.

[0186] Specifically, the server encrypts the temporary private key using the first quantum key to obtain an encrypted temporary private key. Then, the server replaces the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair.

[0187] In this way, by encrypting the temporary private key in the generated temporary key pair, the security and confidentiality of the temporary key pair are ensured, preventing it from being obtained by unauthorized parties during transmission and storage.

[0188] Referring to Figure 9, in some embodiments, the quantum-resistant token request information includes a second classical signature message. Step 016 (obtaining a quantum-resistant identity token based on the temporary key pair, quantum key identifier, post-quantum cryptography algorithm, and identity token) includes:

[0189] 0161: Store the encrypted temporary key pair and the quantum key identifier in the identity token to obtain the intermediate identity token;

[0190] 0162: The intermediate identity token is processed by post-quantum signature based on the server's first post-quantum private key to obtain the first post-quantum signature message;

[0191] 0163: Store the first post-quantum signature message and the second classical signature message in the intermediate identity token to obtain the quantum-resistant identity token.

[0192] In some implementations, the storage module stores the encrypted temporary key pair and the quantum key identifier in the identity token to obtain an intermediate identity token. The signing module performs post-quantum signing processing on the intermediate identity token based on the server's first post-quantum private key to obtain a first post-quantum signed message. The storage module is also used to store the first post-quantum signed message and the second classical signed message in the intermediate identity token to obtain a quantum-resistant identity token.

[0193] In some implementations, the processor is further configured to store the encrypted temporary key pair and the quantum key identifier in the identity token to obtain an intermediate identity token; and to perform post-quantum signature processing on the intermediate identity token according to the server's first post-quantum private key to obtain a first post-quantum signed message; and to store the first post-quantum signed message and the second classical signature message in the intermediate identity token to obtain a quantum-resistant identity token.

[0194] Specifically, the server stores the encrypted temporary key pair and the quantum key identifier in the identity token to obtain an intermediate identity token. Next, the server performs post-quantum signature processing on the intermediate identity token using its first post-quantum private key to obtain a first post-quantum signed message. Finally, the server stores the first post-quantum signed message and the second classical signature message in the intermediate identity token to obtain a quantum-resistant identity token.

[0195] In this way, the server can generate a quantum-resistant identity token that is both secure and resistant to quantum computing attacks, and can verify the integrity and authenticity of the quantum-resistant identity token to ensure that it has not been tampered with.

[0196] Please refer to Figure 10. In some embodiments, the resource access request includes a first signature value. Step 018 (receiving the resource access request generated by the client based on the quantum-resistant access token and the quantum-resistant identity token, confirming the access permissions of the resource corresponding to the resource access request, so that the client can access the server for resources) includes:

[0197] 0181: Verify the second post-quantum signature message based on the post-quantum signature algorithm and the received second post-quantum public key;

[0198] 0182: Verify the first classic signature message based on the classic signature algorithm and the server's first classic public key;

[0199] 0183: If the second quantum signature message verification is successful and the first classical signature message verification is successful, verify the anti-quantum identity token and the first signature value.

[0200] In some implementations, the verification module is used to verify the second post-quantum signature message based on the post-quantum signature algorithm and the received second post-quantum public key, and to verify the first classical signature message based on the classical signature algorithm and the server's first classical public key. Furthermore, if both the second post-quantum signature message and the first classical signature message pass verification, the module verifies the anti-quantum identity token and the first signature value.

[0201] In some implementations, the processor is further configured to verify the second post-quantum signature message based on the post-quantum signature algorithm and the received second post-quantum public key; and to verify the first classical signature message based on the classical signature algorithm and the server's first classical public key; and, if the second post-quantum signature message and the first classical signature message are both verified, to verify the anti-quantum identity token and the first signature value.

[0202] Specifically, the server verifies the second post-quantum signature message using the post-quantum signature algorithm and the received second post-quantum public key. Next, the server verifies the first classical signature message using the classical signature algorithm and the server's first classical public key. Only if both the second post-quantum signature message and the first classical signature message pass verification does the server verify the anti-quantum identity token and the first signature value.

[0203] In this way, the security and integrity of the identity token are ensured through multiple signature verifications, preventing unauthorized access and potential attacks.

[0204] Please refer to Figure 11. In some implementations, step 0183 (verifying the adversarial quantum identity token and the first signature value) includes:

[0205] 01831: Verify the first post-quantum signed message based on the post-quantum signature algorithm and the server's first post-quantum public key;

[0206] 01832: Verify the second classic signature message based on the classic signature algorithm and the received second classic public key;

[0207] 01833: Verify the first signature value using the temporary public key of the encrypted temporary key pair;

[0208] 01834: If the first quantum signature message verification is successful, the second classical signature message verification is successful, and the first signature value verification is successful, the client is allowed to access the resource corresponding to the resource access request.

[0209] In some implementations, the verification module verifies a first post-quantum signature message based on a post-quantum signature algorithm and the server's first post-quantum public key; verifies a second classical signature message based on a classical signature algorithm and the received second classical public key; and verifies a first signature value based on the temporary public key of an encrypted temporary key pair. If the processing module verifies the first post-quantum signature message, the second classical signature message, and the first signature value, and all verifications are successful, the client is allowed to access the resource corresponding to the resource access request.

[0210] In some implementations, the processor is further configured to verify the first post-quantum signature message based on the post-quantum signature algorithm and the server's first post-quantum public key, and to verify the second classical signature message based on the classical signature algorithm and the received second classical public key. The processor is also configured to verify the first signature value based on the temporary public key of the encrypted temporary key pair. And, if the first post-quantum signature message is verified successfully, the second classical signature message is verified successfully, and the first signature value is verified successfully, the client is allowed to access the resource corresponding to the resource access request.

[0211] Specifically, the server verifies the first post-quantum signature message using the post-quantum signature algorithm and the server's first post-quantum public key to confirm its integrity and authenticity, ensuring it has not been tampered with. Next, the server verifies the second classical signature message using the classical signature algorithm and the received second classical public key, confirming its integrity and authenticity, ensuring it has not been tampered with. Then, the server verifies the first signature value using the temporary public key of the encrypted temporary key pair, confirming its validity, ensuring it has not been tampered with. Finally, if the first post-quantum signature message, the second classical signature message, and the first signature value all pass verification, the server allows the client to access the resource corresponding to the access request.

[0212] Thus, multi-layered signature verification can enhance security, prevent malicious attacks and data tampering, and ensure that clients can legitimately access the resources they need.

[0213] Please refer to Figure 12. This application provides a method for enhancing the quantum security of an open identity connection protocol in a communication network. The communication network includes a server and a client. The method is used on the client and includes:

[0214] 031: After completing communication preprocessing, send an anti-quantum token request message to the server;

[0215] 032: Receive the quantum-resistant access token and quantum-resistant identity token sent by the server;

[0216] 033: The client sends a resource access request to the server based on the quantum-resistant access token and the quantum-resistant identity token. The server confirms the access permissions of the resource corresponding to the resource access request, so that the client can access the server's resources.

[0217] This application also provides a client, including a memory and a processor. The method of this application can be implemented by the client of this application. Specifically, the memory stores a computer program, and the processor is used to send a quantum-resistant token request message to the server after completing communication preprocessing, and to receive a quantum-resistant access token and a quantum-resistant identity token sent by the server. Furthermore, the processor sends a resource access request to the server based on the quantum-resistant access token and the quantum-resistant identity token, and the server confirms the access permissions of the resource corresponding to the resource access request, so that the client can access the server's resources.

[0218] This application also provides a client-side security enhancement device. The method of this application can be implemented by the client-side security enhancement device. Specifically, the client-side security enhancement device includes a sending module and a receiving module. The sending module is used to send a quantum-resistant token request message to the server after completing communication preprocessing. The receiving module is used to receive a quantum-resistant access token and a quantum-resistant identity token sent by the server. The sending module is also used to send a resource access request to the server based on the quantum-resistant access token and the quantum-resistant identity token. The server confirms the access permissions of the resource corresponding to the resource access request, thereby enabling the client to access the server's resources.

[0219] This application provides a communication system based on an open identity connection protocol. The communication system includes a client, a server, and a quantum key distribution network as described in the above embodiments. The quantum key distribution network is configured to distribute quantum keys to the server or the client.

[0220] Specifically, the quantum security enhancement method of this embodiment is basically the same as the quantum security enhancement method of the aforementioned embodiment that uses the server as the execution target. For details, please refer to the explanation in the corresponding section. The difference is that this embodiment uses the client as the execution target, which will not be repeated here.

[0221] In summary, in the quantum-resistant security enhancement method, communication system, server, and client of the open identity connection protocol in the communication network of this application, for the communication process of a client requesting access to resources in the server, the client sends a quantum-resistant token request message to the server. Upon receiving the quantum-resistant token request message, the server requests a quantum key and uses the quantum key and a post-quantum cryptography algorithm to encrypt the access token and identity token generated based on the quantum-resistant token request message, generating a quantum-resistant access token and a quantum-resistant identity token capable of resisting quantum computing attacks. The post-quantum cryptography algorithm includes a series of encryption algorithms designed to resist quantum computing attacks, and the quantum key has good resistance to quantum computing attacks. Next, the client receives the quantum-resistant access token and quantum-resistant identity token sent by the server and sends a resource access request generated based on the quantum-resistant access token and quantum-resistant identity token to the server. Then, the server verifies the validity of the quantum-resistant access token and quantum-resistant identity token to determine whether the server can access the resource corresponding to the resource access request. Thus, the quantum key distribution technology and the post-quantum cryptography algorithm enhance the resistance to quantum computing attacks in the communication process of the client requesting access to server resources.

[0222] Please refer to Figure 13. In some embodiments, the method further includes:

[0223] 034: Send a registration request to the server;

[0224] 035: Receive the registration response request generated by the server based on the registration request;

[0225] 036: Send an authorization request to the server based on the registration response request;

[0226] 037: Receive the authorization code generated by the client based on the authorization request.

[0227] In some implementations, the sending module is used to send a registration request to the server. The receiving module is used to receive a registration response request generated by the server based on the registration request. The sending module is also used to send an authorization request to the server based on the registration response request. The receiving module is also used to receive an authorization code generated by the client based on the authorization request.

[0228] In some implementations, the processor is further configured to send a registration request to the server and receive a registration response request generated by the server based on the registration request. The processor is also configured to send an authorization request to the server based on the registration response request and receive an authorization code generated by the client based on the authorization request.

[0229] Specifically, the client sends a registration request to the server, which includes the client's second post-quantum public key and second classical public key. Next, the client receives a registration response request generated by the server based on the registration request, which includes the server's first post-quantum public key and first classical public key. Then, the client sends an authorization request to the server based on the registration response request. Finally, the client receives an authorization code generated by itself based on the authorization request.

[0230] In this way, the server and client can securely exchange keys. The server and client obtain each other's post-quantum public key and classical public key for subsequent signing and verification processes. The post-quantum public key has good resistance to quantum computing attacks, which enables the transmitted data to have good resistance to quantum computing attacks.

[0231] Please refer to Figure 14. In some embodiments, step 031 (sending a quantum-resistant token request message to the server) includes:

[0232] 0311: Generate initial token request information based on the authorization code. The initial token request information includes access token request information and identity token request information.

[0233] 0312: Based on the client's second post-quantum private key, perform post-quantum signature processing on the access token request information and the access random number randomly generated by the client to obtain the second post-quantum signature message;

[0234] 0313: The identity token request information and the random identity number randomly generated by the client are signed using the client's second classic private key to obtain the second classic signature message;

[0235] 0314: Store the access random number, identity random number, second post-quantum signature message and second classical signature message in the initial token request information to obtain the quantum-resistant token request information;

[0236] 0315: Send the anti-quantum token request information to the server.

[0237] In some implementations, the derivation module is used to generate initial token request information based on the authorization code. The signature module is used to perform post-quantum signature processing on the access token request information and the access random number randomly generated by the client based on the client's second post-quantum private key, obtaining a second post-quantum signed message. The signature module is also used to perform signature processing on the identity token request information and the identity random number randomly generated by the client based on the client's second classical private key, obtaining a second classical signed message. The storage module is used to store the access random number, identity random number, second post-quantum signed message, and second classical signed message in the initial token request information, obtaining quantum-resistant token request information. The sending module is used to send the quantum-resistant token request information to the server.

[0238] In some implementations, the processor is further configured to generate initial token request information based on the authorization code; and to perform post-quantum signature processing on the access token request information and the access random number randomly generated by the client based on the client's second post-quantum private key to obtain a second post-quantum signature message; and to perform signature processing on the identity token request information and the identity random number randomly generated by the client based on the client's second classical private key to obtain a second classical signature message. The processor is also configured to store the access random number, the identity random number, the second post-quantum signature message, and the second classical signature message in the initial token request information to obtain quantum-resistant token request information; and to send the quantum-resistant token request information to the server.

[0239] Specifically, the client generates an initial token request message based on the authorization code. This initial token request message includes an access token request message and an identity token request message. Next, the client performs post-quantum signature processing on the access token request message and a randomly generated access random number using its second post-quantum private key, obtaining a second post-quantum signed message. Then, the client performs signature processing on the identity token request message and a randomly generated identity random number using its second classical private key, obtaining a second classical signed message. Finally, the client stores the access random number, identity random number, second post-quantum signed message, and second classical signed message within the initial token request message, obtaining a quantum-resistant token request message. This quantum-resistant token request message is then sent to the server.

[0240] In this way, the client utilizes post-quantum cryptography algorithms to generate quantum-resistant token request messages, ensuring the security and integrity of these messages. This gives the quantum-resistant token request messages resistance to quantum computing, preventing unauthorized access and potential attacks. Furthermore, by employing both classical and post-quantum signature algorithms, the quantum-resistant token request messages receive dual protection, further enhancing security.

[0241] Referring to Figure 15, in some embodiments, the quantum-resistant access token includes a first classical signature message, and the quantum-resistant identity token includes a first post-quantum signature message. The method further includes:

[0242] 038: Verify the signature of the first classical signature message using the first classical public key to confirm receipt of the correct quantum-resistant access token;

[0243] 039: Verify the first post-quantum signature message using the first post-quantum public key to confirm receipt of the correct quantum-resistant identity token.

[0244] In some implementations, the signature verification module is used to verify the first classical signature message based on the first classical public key to confirm receipt of the correct quantum-resistant access token. The signature verification module is also used to verify the first post-quantum signature message based on the first post-quantum public key to confirm receipt of the correct quantum-resistant identity token.

[0245] In some implementations, the processor is further configured to perform signature verification processing on the first classical signature message based on the first classical public key to confirm receipt of the correct quantum-resistant access token, and to perform signature verification processing on the first post-quantum signature message based on the first post-quantum public key to confirm receipt of the correct quantum-resistant identity token.

[0246] Specifically, the client verifies the first classical signature message using the first classical public key to confirm receipt of the correct quantum-resistant access token. Then, the client verifies the first post-quantum signature message using the first post-quantum public key to confirm receipt of the correct quantum-resistant identity token.

[0247] This ensures that the quantum-resistant access token and quantum-resistant identity token received by the client are secure, tamper-proof, and legitimately issued by the server.

[0248] Referring to Figure 16, in some embodiments, the quantum-resistant identity token includes a quantum key identifier, and the method further includes:

[0249] 040: Use the service node to inject multiple keys into the client's cryptographic module;

[0250] 041: Send a quantum key request to the service node based on the quantum key identifier. The quantum key request is protected by a protection key, which is one of the multiple keys injected into the cryptographic module and used randomly.

[0251] 042: The receiving service node encrypts the second quantum key using the protection key to obtain the quantum key encryption result. The second quantum key is generated by the first network node connected to the service node and distributed to the service node.

[0252] 043: Decrypt the quantum key encryption result to obtain the second quantum key.

[0253] In some implementations, the charging module is also used to charge multiple keys into the client's cryptographic module using the service node. The sending module is used to send a quantum key request to the service node based on the quantum key identifier. The receiving module is used to receive the quantum key encryption result obtained by the service node encrypting the second quantum key according to the protection key. The decryption module is used to decrypt the quantum key encryption result to obtain the second quantum key.

[0254] In some implementations, the processor is further configured to use the service node to flood the client's cryptographic module with multiple keys, and to send a quantum key request to the service node based on a quantum key identifier. The processor is also configured to receive a quantum key encryption result obtained by the service node encrypting a second quantum key using a protection key, and to decrypt the quantum key encryption result to obtain the second quantum key.

[0255] Specifically, the client uses the service node to feed multiple keys into its cryptographic module. Next, the client sends a quantum key request to the service node based on a received quantum key identifier. This request is protected by a protection key, which is randomly selected from the multiple keys fed into the cryptographic module. Then, the client receives the encrypted quantum key obtained by the service node encrypting a second quantum key using the protection key. This second quantum key is generated and distributed to the service node by a second network node connected to the service node. Finally, the client decrypts the encrypted quantum key to obtain the second quantum key.

[0256] In this way, the client obtains the second quantum key, which has good resistance to quantum computing attacks and can protect the communication between the server and the client.

[0257] Referring to Figure 17, in some embodiments, the quantum-resistant access token includes an access random number, the quantum-resistant identity token includes an identity random number and a cryptographic temporary key pair, the cryptographic temporary key pair includes a cryptographic temporary private key, and the method further includes:

[0258] 044: Decrypt the temporary private key using the second quantum key to obtain the temporary private key;

[0259] 045: The first concatenation is obtained by concatenating the verification random number, access random number, and identity random number generated by the client at any time;

[0260] 046: The first concatenation is signed using the temporary private key to obtain the first signature value.

[0261] In some implementations, the decryption module is used to decrypt the encrypted temporary private key using the second quantum key to obtain a temporary private key. The concatenation module is also used to concatenate the verification random number, access random number, and identity random number generated by the client at any time to obtain a first concatenation. The signature module is also used to sign the first concatenation using the temporary private key to obtain a first signature value.

[0262] In some implementations, the processor is further configured to decrypt the encrypted temporary private key using the second quantum key to obtain a temporary private key; and to concatenate the verification random number, access random number, and identity random number generated by the client at any time to obtain a first concatenated body; and to sign the first concatenated body using the temporary private key to obtain a first signature value.

[0263] Specifically, the client decrypts the encrypted temporary private key using the second quantum key to obtain the temporary private key. Next, the client concatenates the verification random number, access random number, and identity random number generated at any time to obtain the first concatenation. Finally, the client signs the first concatenation using the temporary private key to obtain the first signature value.

[0264] In this way, the user obtains the first signature value, which can verify the integrity and authenticity of the first concatenation, ensuring that it has not been tampered with and was indeed generated by the client.

[0265] Referring to Figure 18, in some embodiments, step 033 (sending a resource access request to the server based on the quantum-resistant access token and the quantum-resistant identity token) includes:

[0266] 0331: Send a resource access request to the server based on the first signature value, the quantum-resistant access token, and the quantum-resistant identity token.

[0267] In some implementations, the sending module is used to send a resource access request to the server based on a first signature value, a quantum-resistant access token, and a quantum-resistant identity token.

[0268] In some implementations, the processor is also configured to send a resource access request to the server based on the first signature value, the quantum-resistant access token, and the quantum-resistant identity token.

[0269] Specifically, the client sends a resource access request to the server based on the first signature value, the quantum-resistant access token, and the quantum-resistant identity token.

[0270] In this way, the server can ensure that the resource access request is not accessed without authorization during transmission based on the initial signature value sent by the client. Access permissions for the resource access request are confirmed based on the quantum-resistant access token and quantum-resistant identity token sent by the client.

[0271] The following example illustrates the method of this application. In the embodiment described, the client is a client of the OIDC protocol, representing a third-party application that needs to access relevant resources in an OIDC application scenario. The client includes a resource owner, who, in an OIDC application scenario, authorizes access permissions to the resources they possess to the third-party application that needs to access those resources. The server includes an authentication server and a resource server. The authentication server, in an OIDC application scenario, is used to process authentication requests and issue tokens authorizing access to relevant resources and user identity tokens. The resource server is the server that provides the relevant resources and their services. The resource server and the authentication server can be the same server or different servers. Whether the servers are the same or different has no substantial impact on the quantum-resistant enhancement method of this application. In practical applications, the choice between the same server and different servers depends on specific needs, security considerations, and budget. In the embodiment described in this application, the resource server and the authentication server are deployed in different locations on the same server.

[0272] Quantum network nodes are network nodes that store and provide generated quantum keys to servers via trusted channels or to clients via key service nodes. Key service nodes are service nodes that connect to quantum network nodes and provide pre-shared key filling and quantum key services to multiple clients.

[0273] Please refer to Figure 19. The classic public key can be the public key of a classic encryption algorithm such as ECC or RSA. The implementation method in this application uses the ECC public key as an example. The access token request information is the main parameter for generating the access token, and the identity token request information is the main parameter for generating the identity token. The quantum-resistant token request information consists of the token request content and the client authentication content.

[0274] Before communication between the client and server, the authentication server connects to the nearest physically authorized first quantum network node via a trusted channel. A trusted channel refers to a mechanism or protocol that provides a secure communication path between two communicating entities. One method of establishing this channel is for the authentication server and the first quantum network node to be located within the same rack and directly connected by shielded network cables. This channel ensures the confidentiality, integrity, and availability of data during transmission, preventing unauthorized access, tampering, or eavesdropping. The client uses the key service node to pre-share a key to the resource owner's personal cryptographic module within the client. The total pre-shared key is 1M bits (128 bits). The personal cryptographic module includes, but is not limited to, a Smart Cryptographic Key (HSM) and a Virtual Security Module (VSM).

[0275] In addition, before sending an authorization request to the server, the client sends a registration request to the authentication server according to the standard document RFC 7591 (OAuth 2.0 Dynamic Registration) published by the Internet Engineering Task Force (IETF), submitting its own PQC public key and ECC public key in the registration request. Then, the client receives a registration response request generated by the authentication server based on the registration request. The successful registration response request carries the authentication server's ECC public key and PQC public key.

[0276] The client sends an Authorization Request to the authentication server to access resources on the resource server. Upon receiving the Authorization Request, the authentication server redirects it to the resource owner. If the resource owner approves the Authorization Request, the authentication server generates an Authorization Code and returns it to the client in an Authorization Response.

[0277] The client receives an Authorization Code generated from an Authorization Request sent by the authentication server, and generates a Token Request based on this Authorization Code. This Token Request includes Access Token Request and Identity Token Request information. Specifically, the client generates the main parameters of an Access Token (Access Token-1) based on the resource requirements, along with a randomly generated access random number R1. Alternatively, the main parameters and the access random number R1 can be concatenated. The client also generates the main parameters of an Identity Token (ID Token-1) based on the user's identity information, along with a randomly generated identity random number R2. Then, the client uses a post-quantum signature algorithm and its own second post-quantum signature private key to perform post-quantum signature processing on the main parameters of the generated Access Token (Access Token-1) and the accompanying access random number R1, obtaining a second post-quantum signature message M1. The client also uses an ECC signature algorithm and its own ECC signature private key to perform classical signature processing on the main parameters of the generated ID Token (ID Token-1) and the accompanying identity random number R2, obtaining a second classical signature message M2. Finally, the client sends the Token Request content and the client's authentication content to the authentication server. The token request includes the main parameters for generating the access token (Access Token-1), the accompanying access random number R1, the main parameters for generating the identity token (ID Token-1), and the accompanying identity random number R2. The client authentication includes the second post-quantum signature message M1 and the second classical signature message M2.

[0278] After receiving the token request and client authentication content from the client, the authentication server verifies the client's authentication content using the client's second post-quantum public key and second classical public key. Specifically, the authentication server verifies the second post-quantum signature message M1 using the second post-quantum public key and the second classical signature message M2 using the second classical public key, thereby confirming that the main parameters of the generated access token (Access Token-1), the accompanying access random number R1, the main parameters of the generated identity token (ID Token-1), and the accompanying identity random number R2 have not been accessed or tampered with during transmission. Then, the authentication server verifies the user's identity based on the main parameters of the generated identity token (ID Token-1) in the token request content, confirming that the user is legitimate. After confirming the user's legitimacy, the server confirms that the client's token parameters are authorized based on the user's identity information and the corresponding access control policy.

[0279] After the authentication server confirms that the client's token parameters are authorized, it generates an Access Token-1 based on the main parameters for generating the Access Token-1. During communication, the Access Token carries a random access number R1 to maintain its freshness. The authentication server then uses its own ECC private key to perform ECC algorithm signing on the Access Token, obtaining a first classical signature message M3. Subsequently, the authentication server stores the first classical signature message M3 and the second post-quantum signature message M1 within the Access Token-1, resulting in a quantum-resistant Access Token.

[0280] The authentication server randomly generates a temporary ECC key pair T_ECC. This temporary key pair T_ECC is bound to the client that initiated the token request, meaning it is only used when that client accesses resources. The authentication server sends a quantum key request to the first quantum network node it connects to. Next, the authentication server receives the first quantum key QK_UUID-1 (128 bits or more) and the quantum key identifier UUID_QK sent by the first quantum network node according to the quantum key request. The quantum key identifier UUID_QK is obtained by the first quantum network node identifying the first quantum key QK_UUID-1 using its unique universal identifier. After obtaining the first quantum key QK_UUID-1, the authentication server uses QK_UUID-1 to encrypt the private key T_ECC_priv in the temporary key T_ECC to obtain a temporary encrypted private key. This temporary encrypted private key replaces the private key T_ECC_priv, resulting in an encrypted temporary key pair.

[0281] The authentication server generates an identity token (ID Token-1) based on the main parameters of the generated identity token (ID Token-1). During communication, the identity token carries a random identity number R2 to maintain its freshness. The authentication server stores the encryption key pair and the quantum key identifier UUID_QK in the identity token to obtain an intermediate identity token. Then, using the authentication server's own first post-quantum private key, the intermediate identity token undergoes post-quantum signature processing to obtain the first post-quantum signature message M4. Next, the authentication server stores the first post-quantum signature message M4 and the second classical signature message M2 in the intermediate identity token to obtain a quantum-resistant identity token. Both the quantum-resistant identity token and the quantum-resistant access token are returned to the client.

[0282] After receiving the quantum-resistant identity token and quantum-resistant access token, the client verifies the quantum-resistant access token using the authentication server's first classical public key (ECC public key) to confirm its correctness. Then, it verifies the quantum-resistant identity token using the authentication server's first post-quantum public key to confirm its correctness.

[0283] After confirming receipt of the correct quantum-resistant identity token and quantum-resistant access token, the client sends a quantum key request to the key service node based on the quantum key identifier UUID_QK in the quantum-resistant identity token, and uses a randomly selected key from the smart cryptographic keys as the protection key. The client performs a hash operation (Hash-based Message Authentication Code, HMAC) on the key ID and request content using the SM3 algorithm and the protection key. Subsequently, the key service node also performs a hash operation on the key ID and request content using the SM3 algorithm and the protection key to verify the integrity and authenticity of the data. HMAC is a method that uses hash functions and keys to provide data integrity and source authentication.

[0284] After the quantum key application is successfully confirmed, the client receives the quantum key encryption result obtained by the key service node encrypting the second quantum key QK_UUID-2 according to the protection key. The second quantum key QK_UUID-2 is generated and distributed to the key service node by the second quantum network node connected to the key service node. The client then decrypts the quantum key encryption result according to the protection key to obtain the second quantum key QK_UUID-2.

[0285] After obtaining the second quantum key QK_UUID-2, the client uses QK_UUID-2 to decrypt the encrypted temporary key pair in the quantum-resistant identity token to obtain the ECC private key T_ECC_priv. Then, the client accesses protected resources on the resource server based on a resource access request generated from the quantum-resistant access token and the quantum-resistant identity token. This resource access request includes the client's first signature value, which is generated as follows: the client generates a 256-bit verification random number R3, and then uses the ECC private key T_ECC_priv to calculate an ECC signature by combining the verification random number R3, the access random number R1 from the access token, and the identity random number R2 from the identity token, thus obtaining the first signature value.

[0286] After receiving a resource access request, the resource server submits the first signature value, the quantum-resistant access token, and the quantum-resistant identity token (ID token) from the resource access request to the authentication server for verification.

[0287] The authentication server uses PQC and ECC algorithms to perform dual verification on the client's second post-quantum signature message M1 and the authentication server's first classical signature message M3 in the quantum-resistant access token. Similarly, it uses ECC and PQC algorithms to perform dual verification on the client's second classical signature message M2 and the authentication server's first post-quantum signature message M4 in the identity token. Afterward, the authentication server verifies the first signature value using the temporary public key of the encrypted temporary key pair. Once both tokens have passed dual verification and the first signature value is verified, the server notifies the resource server to allow the resource access request based on the authorization information of the quantum-resistant access token.

[0288] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the computing processing device according to the embodiments of this application. This application can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0289] For example, Figure 20 illustrates a computing processing device that can implement the methods according to this application. This computing processing device conventionally includes a processor 1010 and a computer program product or computer-readable medium in the form of a memory 1020. The memory 1020 can be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. The memory 1020 has a storage space 1030 for program code 1031 for performing any of the method steps described above. For example, the storage space 1030 for the program code may include various program codes 1031 for implementing the various steps in the methods described above. These program codes can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact discs (CDs), memory cards, or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to Figure 21. This storage unit may have storage segments, storage spaces, etc., arranged similarly to the memory 1020 in the computing processing device of Figure 20. The program code may be compressed, for example, in a suitable form. Typically, the storage unit includes computer-readable code 1031', which is code that can be read by a processor such as 1010, which, when run by a computing processing device, causes the computing processing device to perform the various steps in the method described above.

[0290] It is understood that a computer program includes computer program code. Computer program code can be in the form of source code, object code, executable files, or some intermediate form. Computer-readable storage media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, external hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc.

[0291] In this specification, the terms "specifically," "furthermore," "particularly," "understandably," etc., refer to specific features, structures, materials, or characteristics described in connection with embodiments or examples that are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0292] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as will be understood by those skilled in the art to which embodiments of this application pertain.

[0293] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

[0294] In this way, by verifying the signature of the ticket authorization ticket (TGT), the correctness of the ticket authorization ticket (TGT) is confirmed, thereby generating and distributing the subsequent service ticket (ST-2), confirming the identity of the user, and ensuring the security of resources in the authentication server.

[0295] It is understood that a computer program includes computer program code. Computer program code can be in the form of source code, object code, executable files, or some intermediate form. Computer-readable storage media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, external hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc.

[0296] In this specification, the terms "specifically," "furthermore," "particularly," "understandably," etc., refer to specific features, structures, materials, or characteristics described in connection with embodiments or examples that are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0297] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as will be understood by those skilled in the art to which embodiments of this application pertain.

[0298] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

A quantum-resistant security enhancement method for an open identity connection protocol in a communication network, wherein, The communication network includes a server and a client, and the method is used on the server, the method comprising: After completing communication preprocessing, receive the anti-quantum token request information sent by the client; Generate an access token and an identity token based on the quantum-resistant token request information; A temporary key pair is randomly generated and associated with the client, the temporary key pair including a temporary public key and a temporary private key; Obtain the quantum key identifier from the first network node connected to the server; The access token is encrypted to generate a quantum-resistant access token; A quantum-resistant identity token is obtained based on the temporary key pair, the quantum key identifier, the post-quantum cryptography algorithm, and the identity token; Send the quantum-resistant access token and the quantum-resistant identity token to the client; The server receives a resource access request generated by the client based on the quantum-resistant access token and the quantum-resistant identity token, and confirms the access permissions of the resource corresponding to the resource access request, so that the client can access the server for resources. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 1, wherein, The method further includes: Receive a registration request sent by the client, the registration request including the client's second post-quantum public key and second classical public key; Send a registration response request generated based on the registration request, the registration response request including the server's first post-quantum public key and first classical public key; Receive the authorization request sent by the client based on the registration response request; An authorization code is generated based on the authorization request, and the authorization code is sent to the client. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 1, wherein, The quantum-resistant token request information includes an access random number, an identity random number, access token request information, identity token request information, a second post-quantum signature message, and a second classical signature message. The method further includes: The second post-quantum signature message is verified using the received second post-quantum public key to confirm the correctness of the access token request information and the access random number; The second classic signature message is verified using the received second classic public key to confirm the correctness of the identity token request information and the identity random number. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 1, wherein, The quantum-resistant token request information includes an access random number, an identity random number, access token request information, and identity token request information. Generating the access token and identity token based on the quantum-resistant token request information includes: The access token is generated based on the access token request information, and the access token includes an access random number; The identity token is generated based on the identity token request information, and the identity token includes an identity random number. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 1, wherein, The process of obtaining the quantum key identifier from the first network node connected to the server includes: Send a quantum key request to the first network node connected to the server; The network node receives a first quantum key and a quantum key identifier, wherein the quantum key identifier is obtained by the first network node identifying the first quantum key according to the identification code of the first network node. The method for enhancing quantum security of an open identity connection protocol for a communication network according to claim 5, wherein, The quantum-resistant token request information includes a second post-quantum signature message, and the encryption of the access token to generate a quantum-resistant access token includes: The access token is signed using the classic signature algorithm and the received first classic private key to obtain a first classic signature message; The first classical signature message and the second post-quantum signature message are stored in the access token to obtain a quantum-resistant access token. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 6, wherein, The method further includes: The temporary private key is encrypted using the first quantum key to obtain an encrypted temporary private key; Replace the temporary private key with the encrypted temporary private key to obtain an encrypted temporary key pair. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 7, wherein, The quantum-resistant token request information includes a second classical signature message, and the process of obtaining a quantum-resistant identity token based on the temporary key pair, the quantum key identifier, the post-quantum cryptography algorithm, and the identity token includes: The encrypted temporary key pair and the quantum key identifier are stored in the identity token to obtain an intermediate identity token; The intermediate identity token is processed by post-quantum signature based on the server's first post-quantum private key to obtain a first post-quantum signature message. The first post-quantum signature message and the second classical signature message are stored in the intermediate identity token to obtain the quantum-resistant identity token. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 8, wherein, The resource access request includes a first signature value. Receiving the resource access request generated by the client based on the quantum-resistant access token and the quantum-resistant identity token, and confirming the access permissions of the resource corresponding to the resource access request, so that the client can access the server, includes: The second post-quantum signature message is verified based on the post-quantum signature algorithm and the received second post-quantum public key; The first classic signature message is verified according to the classic signature algorithm and the server's first classic public key; If the second post-quantum signature message verification is successful and the first classical signature message verification is successful, the quantum-resistant identity token and the first signature value are verified. The method for enhancing quantum security of an open identity connection protocol for a communication network according to claim 9, wherein, The verification of the quantum-resistant identity token and the first signature value includes: The first post-quantum signature message is verified based on the post-quantum signature algorithm and the server's first post-quantum public key; The second classic signature message is verified based on the classic signature algorithm and the received second classic public key; The first signature value is verified using the temporary public key of the encrypted temporary key pair; If the first quantum signature message is verified successfully, the second classical signature message is verified successfully, and the first signature value is verified successfully, the client is allowed to access the resource corresponding to the resource access request. A quantum-resistant security enhancement method for an open identity connection protocol in a communication network, wherein, The communication network includes a server and a client, and the method is used on the client, the method comprising: After completing the communication preprocessing, a quantum-resistant token request message is sent to the server; The server receives a quantum-resistant access token and a quantum-resistant identity token, wherein the quantum-resistant access token is generated by the server by encrypting the access token according to a post-quantum cryptography algorithm, and the quantum-resistant identity token is obtained by the server based on a temporary key pair, a quantum key identifier, a post-quantum cryptography algorithm, and an identity token. The access token and the identity token are generated by the server based on the quantum-resistant token request information. The client sends a resource access request to the server based on the quantum-resistant access token and the quantum-resistant identity token. The server confirms the access permissions of the resource corresponding to the resource access request, so that the client can access the server's resources. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 11, wherein, The method further includes: Send a registration request to the server, the registration request including the client's second post-quantum public key and second classical public key; Receive a registration response request generated by the server based on the registration request, the registration response request including the server's first post-quantum public key and first classical public key; An authorization request is sent to the server based on the registration response request; Receive the authorization code generated by the client based on the authorization request. The quantum-resistant security enhancement method for the open identity connection protocol of the communication network according to claim 12, wherein, Sending the anti-quantum token request information to the server includes: An initial token request information is generated based on the authorization code, and the initial token request information includes access token request information and identity token request information. The access token request information and the access random number randomly generated by the client are subjected to post-quantum signature processing based on the client's second post-quantum private key to obtain a second post-quantum signature message. The identity token request information and the identity random number randomly generated by the client are signed using the client's second classic private key to obtain a second classic signature message; The access random number, the identity random number, the second post-quantum signature message, and the second classical signature message are stored in the initial token request information to obtain the quantum-resistant token request information; The anti-quantum token request information is sent to the server. The quantum-resistant security enhancement method for the open identity connection protocol of the communication network according to claim 12, wherein, The quantum-resistant access token includes a first classical signature message, the quantum-resistant identity token includes a first post-quantum signature message, and the method further includes: The first classical signature message is verified using the first classical public key to confirm receipt of the correct quantum-resistant access token. The first post-quantum signature message is verified using the first post-quantum public key to confirm receipt of the correct quantum-resistant identity token. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 14, wherein, The quantum-resistant identity token includes a quantum key identifier, and the method further includes: The service node is used to inject multiple keys into the client's cryptographic module; A quantum key request is sent to the service node according to the quantum key identifier. The quantum key request is protected by a protection key, which is one of a plurality of keys injected into the cryptographic module and used randomly. The service node receives the quantum key encryption result obtained by encrypting the second quantum key according to the protection key. The second quantum key is generated and distributed to the service node by the first network node connected to the service node. The second quantum key is obtained by decrypting the quantum key encryption result. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 15, wherein, The quantum-resistant access token includes an access random number, the quantum-resistant identity token includes an identity random number and a cryptographic temporary key pair, the cryptographic temporary key pair includes a temporary public key and a cryptographic temporary private key, and the method further includes: The temporary private key is obtained by decrypting the encrypted temporary private key using the second quantum key; The first concatenation is obtained by concatenating the verification random number, the access random number, and the identity random number generated by the client at any time. The first concatenation is signed using the temporary private key to obtain the first signature value. The method for enhancing quantum-resistant security of an open identity connection protocol for a communication network according to claim 16, wherein, Sending a resource access request to the server based on the quantum-resistant access token and the quantum-resistant identity token includes: A resource access request is sent to the server based on the first signature value, the quantum-resistant access token, and the quantum-resistant identity token. A computing processing device, wherein, include: Memory containing computer-readable code; One or more processors, when the computer-readable code is executed by the one or more processors, the computing processing device executes a quantum-resistant security enhancement method for an open identity connection protocol of a communication network as described in any one of claims 1-10 or 11-17. A computer program comprising computer-readable code, which, when executed on a computing processing device, causes the computing processing device to perform a quantum-resistant security enhancement method for an open identity connection protocol of a communication network according to any one of claims 1-10 or 11-17. A computer-readable medium storing the computer program as described in claim 19.

Images