Post-quantum security enhancement method for online certificate issuance and key pair distribution

Abstract

Disclosed in the present application is a post-quantum security enhancement method for online certificate issuance and key pair distribution of a communication network. The method comprises: acquiring a first quantum key and a quantum key identifier from a first network node accessing a terminal; on the basis of the first quantum key, encrypting the quantum key identifier and a randomly generated terminal key pair, so as to obtain a first encrypted message; on the basis of the first encrypted message, the terminal key pair and the quantum key identifier, generating an application message, and sending the application message to a certificate authentication center; and receiving a response message sent by the certificate authentication center, such that the terminal can use the response message to communicate with other terminals other than the terminal in a communication network. By means of using Post-quantum cryptography and quantum key distribution technology to encrypt communication, the communication process by which a terminal acquires a security certificate from a certificate authentication center and acquires a key pair from a key management system is provided with significantly enhanced resistance to quantum computing attacks.

Description

Quantum-resistant security enhancement methods for online certificate issuance and key pair distribution

[0001] This application claims priority to Chinese Patent Application No. 202411191799.7, filed on August 28, 2024, entitled “Method for Enhancing Quantum Security of Online Certificate Issuance and Key Pair Distribution”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of network security, and more specifically, to a quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks. Background Technology

[0003] The leap in computing power, exemplified by quantum computing, has significantly impacted the security of algorithms in classical cryptography. Understandably, the realization of large-scale quantum computers will affect applications in classical cryptography such as key negotiation, encryption, and signature. Therefore, providing cryptographic techniques resistant to quantum computing attacks has become an urgent problem to solve. Summary of the Invention

[0004] This application provides a quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks.

[0005] In a first aspect, embodiments of this application provide a method for enhancing quantum security in online certificate issuance and key pair distribution for a communication network. The communication network includes a terminal, a certificate authentication center, and a key management system. The method is used on the terminal and includes:

[0006] The first quantum key and quantum key identifier are obtained from the first network node connected to the terminal;

[0007] The first encrypted message is obtained by encrypting the quantum key identifier and the randomly generated terminal key pair using the first quantum key;

[0008] An application message is generated based on the first encrypted message, the terminal key pair, and the quantum key identifier, and the application message is sent to the certificate authentication center.

[0009] The terminal receives a response message sent by the certificate authority, enabling it to communicate with other terminals in the communication network using the response message. The response message includes a key response packet and a security certificate. The key response packet is generated by the key management system based on a key request packet sent by the certificate authority, and the key request packet is generated by the certificate authority based on the request message. The security certificate is generated by the certificate authority based on the request message and the key response packet sent by the key management system.

[0010] Thus, in the communication process where the terminal obtains a security certificate from the certificate authority and a key pair from the key management system, the terminal requests a first quantum key and uses it to encrypt the quantum key identifier and the terminal key pair to generate a first encrypted message resistant to quantum computing attacks. The first quantum key has strong quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends this request message to the certificate authority. The certificate authority generates a key request packet based on the request message and sends it to the key management system. The key management system processes the key request packet using a post-quantum cryptography algorithm to obtain a key response packet, and then returns the key response packet to the certificate authority. The post-quantum cryptography algorithm is a series of encryption algorithms designed to resist quantum computing attacks. The certificate authority generates a security certificate based on the request message and the key response packet sent by the key management system, and generates a response message based on the security certificate and the key response packet, and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptography algorithms enhance the terminal's resistance to quantum computing attacks during the communication process of obtaining a security certificate from the certificate authority and a key pair from the key management system.

[0011] In some implementations, obtaining the first quantum key and quantum key identifier from the service node accessing the terminal includes:

[0012] The service node is used to fill the cryptographic module of the terminal with multiple keys;

[0013] A quantum key request is sent to the service node. The quantum key request is protected by a protection key, which is one of a plurality of keys randomly used from the cryptographic modules.

[0014] The service node receives a quantum key encryption result obtained by encrypting the first quantum key and the quantum key identifier according to the protection key. The first quantum key is generated and distributed to the service node by a first network node connected to the service node. The quantum key identifier is obtained by the first network node identifying the first quantum key according to the identification code of the first network node.

[0015] The quantum key encryption result is decrypted to obtain the first quantum key and the quantum key identifier.

[0016] In this way, the terminal uses the service node to fill its cryptographic module with multiple keys. Next, based on the authorization code received from the certificate authority, the terminal sends a quantum key request to the service node. This quantum key request is protected by a protection key, which is randomly selected from the multiple keys filled into the cryptographic module. Then, the terminal receives the quantum key encryption result obtained by the service node encrypting the first quantum key using the protection key. The first quantum key is generated and distributed to the service node by the first network node connected to the service node. Finally, the terminal decrypts the quantum key encryption result to obtain the first quantum key. The terminal obtains the first quantum key and a quantum key identifier, which can be used to generate keys with stronger resistance to quantum computing attacks.

[0017] In some implementations, the step of encrypting the quantum key identifier and the randomly generated terminal key pair using the first quantum key to obtain the first encrypted message includes:

[0018] The terminal key pair is randomly generated according to the cryptographic module of the terminal. The terminal key pair includes a terminal classical signature key pair, a terminal post-quantum signature key pair, and a terminal post-quantum encryption key pair.

[0019] The terminal public key and the quantum key identifier are concatenated to obtain the first concatenation. The terminal public key includes the terminal classical signature public key of the terminal classical signature key pair, the terminal post-quantum signature public key of the terminal post-quantum signature key pair, and the terminal temporary post-quantum encryption public key of the terminal post-quantum encryption key pair.

[0020] The first splice is encrypted using the first quantum key to obtain the first encrypted message.

[0021] Thus, the terminal randomly generates a terminal key pair based on its cryptographic module. This terminal key pair includes a classical signature key pair, a post-quantum signature key pair, and a post-quantum encryption key pair. Next, the terminal concatenates its public key and a quantum key identifier to obtain a first concatenated body. The terminal public key includes the classical signature public key of the classical signature key pair, the post-quantum signature public key of the post-quantum signature key pair, and the temporary post-quantum encryption public key of the post-quantum encryption key pair. Finally, the terminal encrypts the first concatenated body using the first quantum key to obtain a first encrypted message.

[0022] In some embodiments, the security certificate includes a classic encryption certificate, a first classic encryption certificate signature, and a second classic encryption certificate signature; the method further includes:

[0023] The signature verification result of the first classic encryption certificate is obtained by performing a signature verification process on the signature of the first classic encryption certificate based on the classic signature public key of the terminal.

[0024] The signature verification result of the second classical encryption certificate is obtained by performing a signature verification process on the signature of the second classical encryption certificate based on the quantum signature public key of the terminal.

[0025] If the verification results of the first and second classic encryption certificates are correct, the classic encryption certificate is confirmed to be correct.

[0026] Thus, the terminal verifies the signature of the first classical encryption certificate using its classical signature public key to obtain the verification result. Next, the terminal verifies the signature of the second classical encryption certificate using its post-quantum signature public key to obtain the verification result. Finally, if both the first and second classical encryption certificate verification results are correct, the classical encryption certificate is confirmed to be correct. In this way, the terminal verifies the signatures of both the first and second classical encryption certificates separately, and determines the correctness of the classical encryption certificate based on the verification results, ensuring that a correct classical encryption certificate is obtained and capable of encrypting the terminal's communications.

[0027] In some implementations, the security certificate includes a classic signature certificate, a first classic signature certificate signature, and a second classic signature certificate signature; the method further includes:

[0028] The signature verification process is performed on the first classic signature certificate based on the terminal's classic signature public key to obtain the signature verification result of the first classic signature certificate.

[0029] The second classical signature certificate is verified by using the quantum signature public key of the terminal to obtain the verification result of the second classical signature certificate.

[0030] If the verification results of the first classic signature certificate and the second classic signature certificate are correct, the classic signature certificate is confirmed to be correct.

[0031] Thus, the terminal verifies the signature of the first classic signature certificate using its classic signature public key to obtain the verification result. Next, the terminal verifies the signature of the second classic signature certificate using its post-classical signature public key to obtain the verification result. Finally, if both the first and second classic signature certificate verification results are correct, the classic signature certificate is confirmed to be correct. In this way, the terminal verifies both the first and second classic signature certificate signatures separately, and determines the correctness of the classic signature certificate based on the verification results, ensuring that a correct classic signature certificate is obtained and capable of encrypting the terminal's communications.

[0032] In some implementations, the security certificate includes a post-quantum encryption certificate, a first post-quantum encryption certificate signature, and a second post-quantum encryption certificate signature; the method further includes:

[0033] The signature verification result of the first post-quantum encryption certificate is obtained by performing a signature verification process on the signature of the first post-quantum encryption certificate based on the classical signature public key of the terminal.

[0034] The signature verification result of the second post-quantum encryption certificate is obtained by performing a signature verification process on the signature of the second post-quantum encryption certificate based on the terminal post-quantum signature public key.

[0035] If the verification results of the first and second post-quantum encryption certificates are correct, the post-quantum encryption certificate is confirmed to be correct.

[0036] Thus, the terminal verifies the signature of the first post-quantum encryption certificate using its classical signature public key to obtain the verification result. Next, the terminal verifies the signature of the second post-quantum encryption certificate using its post-quantum signature public key to obtain the verification result. Finally, if both the first and second post-quantum encryption certificate verification results are correct, the post-quantum encryption certificate is confirmed to be correct. In this way, the terminal verifies both the first and second post-quantum encryption certificate signatures separately, and determines the correctness of the post-quantum encryption certificate based on the verification results, ensuring that a correct post-quantum encryption certificate is obtained and capable of encrypting the terminal's communications.

[0037] In some embodiments, the security certificate includes a post-quantum signature certificate, a first post-quantum signature certificate signature, and a second post-quantum signature certificate signature; the method further includes:

[0038] The signature verification result of the first post-quantum signature certificate is obtained by performing a signature verification process on the signature of the first post-quantum signature certificate based on the classical signature public key of the terminal.

[0039] The signature verification result of the second post-quantum signature certificate is obtained by performing a signature verification process on the signature of the second post-quantum signature certificate based on the terminal post-quantum signature public key.

[0040] If the verification results of the first and second post-quantum signature certificates are correct, the post-quantum signature certificate is confirmed to be correct.

[0041] Thus, the terminal verifies the first post-quantum signature certificate using its classical signature public key to obtain the verification result. Next, the terminal verifies the second post-quantum signature certificate using its post-quantum signature public key to obtain the verification result. Finally, if both the first and second post-quantum signature certificate verification results are correct, the post-quantum signature certificate is confirmed to be correct. In this way, the terminal verifies both the first and second post-quantum signature certificates, determining the correctness of the post-quantum signature certificate based on the verification results, ensuring that a correct post-quantum signature certificate is obtained, which can then be used to encrypt the terminal's communications.

[0042] In some embodiments, the response message includes a first classical cryptographic envelope signature, a first classical cryptographic envelope followed by a quantum signature, a first post-quantum cryptographic envelope signature, a first post-quantum cryptographic envelope followed by a quantum signature, an encrypted classical cryptographic envelope, and an encrypted post-quantum cryptographic envelope. The method further includes:

[0043] The signature of the first classic cryptographic envelope is verified to obtain the signature verification result of the first terminal.

[0044] The quantum signature of the first classical cryptographic envelope is then verified to obtain the verification result of the second terminal.

[0045] The signature of the first quantum cryptographic envelope is verified to obtain the signature verification result of the third terminal.

[0046] The quantum signature of the first quantum cryptographic envelope is verified to obtain the verification result of the fourth terminal.

[0047] If the signature verification results of the first terminal, the second terminal, the third terminal, and the fourth terminal are all correct, the encrypted classical cryptographic envelope is decrypted using the first quantum key to obtain the classical cryptographic envelope.

[0048] The encrypted quantum cryptographic envelope is decrypted using the first quantum key to obtain the post-quantum cryptographic envelope.

[0049] Thus, the terminal verifies the signature of the first classical cryptographic envelope, obtaining the first terminal verification result. Next, the terminal verifies the quantum signature of the first classical cryptographic envelope, obtaining the second terminal verification result. The terminal then verifies the signature of the first post-quantum cryptographic envelope, obtaining the third terminal verification result. Finally, the terminal verifies the quantum signature of the first post-quantum cryptographic envelope, obtaining the fourth terminal verification result. Then, if the verification results of the first, second, third, and fourth terminals are all correct, the terminal decrypts the encrypted classical cryptographic envelope using the first quantum key to obtain the classical cryptographic envelope. Finally, the terminal decrypts the encrypted post-quantum cryptographic envelope using the first quantum key to obtain the post-quantum cryptographic envelope. In this way, through multiple verification processes, the terminal confirms that the obtained encrypted classical cryptographic envelope and encrypted post-quantum cryptographic envelope are correct. Then, based on the first quantum key, the encrypted classical cryptographic envelope and the encrypted post-quantum cryptographic envelope are decrypted to obtain the classical cryptographic envelope and the post-quantum cryptographic envelope, respectively. Based on the classical cryptographic envelope and the post-quantum cryptographic envelope, multiple private keys generated by the key management system for the terminal can be obtained in subsequent processes.

[0050] In some embodiments, the method further includes:

[0051] The temporary symmetric key is obtained by decrypting the encrypted temporary symmetric key in the classic cryptographic envelope using the private key in the classic signature key pair of the terminal.

[0052] The private key in the classic cryptographic envelope is decrypted using the temporary symmetric key to obtain the private key in the classic cryptographic key pair.

[0053] Thus, the terminal decrypts the temporary symmetric key in the classic cryptographic envelope using the private key from the terminal's classic signature key pair to obtain the temporary symmetric key. Next, the terminal decrypts the classic encryption private key in the classic cryptographic envelope using the temporary symmetric key to obtain the private key from the classic encryption key pair. In this way, the terminal obtains the private key from the classic encryption key pair, which can be used in the terminal's communication process to encrypt and decrypt data.

[0054] In some embodiments, the method further includes:

[0055] The first encapsulated message in the post-quantum cryptography envelope is decapsulated to obtain the second concatenation;

[0056] A fixed string is obtained based on the second concatenation to confirm the correctness of the post-quantum cryptographic envelope;

[0057] If the post-quantum cryptographic envelope is correct, perform post-quantum encryption on the first splice to obtain the first encryption key;

[0058] The post-quantum encryption private key in the post-quantum cryptographic envelope is decrypted using the first encryption key to obtain the private key in the post-quantum encryption key pair.

[0059] Thus, the terminal decapsulates the first encapsulated message in the post-quantum cryptography envelope to obtain the second concatenation. Next, the terminal uses the second concatenation to obtain a fixed string to verify the correctness of the post-quantum cryptography envelope. Then, if the post-quantum cryptography envelope is correct, the terminal performs post-quantum encryption on the first concatenation to obtain the first encryption key. It then decrypts the post-quantum encryption private key in the post-quantum cryptography envelope using the first encryption key to obtain the private key in the post-quantum encryption key pair. In this way, the terminal obtains the private key in the quantum encryption key pair, which can be used in the terminal's communication process to encrypt and decrypt data.

[0060] Secondly, embodiments of this application also provide a quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network, wherein the communication network includes a terminal, a certificate authentication center, and a key management system, and the method is used in the certificate authentication center, the method comprising:

[0061] The terminal receives an application message, wherein the application message is generated by the terminal based on a terminal key pair, a quantum key identifier, and a first encrypted message. The terminal key pair is randomly generated by the terminal, the quantum key identifier is obtained by the terminal from the first network node it accesses, and the first encrypted message is obtained by encrypting the quantum key identifier and the terminal key pair with a first quantum key pair. The first quantum key is obtained by the terminal from the first network node it accesses.

[0062] Generate a key request package based on the request message, and send the key request package to the key management system;

[0063] Receive a key response packet sent by the key management system, the key response packet being generated by the key management system based on the key request packet;

[0064] Generate a security certificate based on the application message and the key response packet;

[0065] A response message is generated based on the key response packet and the security certificate, and the response message is sent to the terminal so that the terminal can use the response message to communicate with other terminals in the communication network besides itself.

[0066] Thus, in the communication process where the terminal obtains a security certificate from the certificate authority and a key pair from the key management system, the terminal requests a first quantum key and uses it to encrypt the quantum key identifier and the terminal key pair to generate a first encrypted message resistant to quantum computing attacks. The first quantum key has strong quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends this request message to the certificate authority. The certificate authority generates a key request packet based on the request message and sends it to the key management system. The key management system processes the key request packet using a post-quantum cryptography algorithm to obtain a key response packet, and then returns the key response packet to the certificate authority. The post-quantum cryptography algorithm is a series of encryption algorithms designed to resist quantum computing attacks. The certificate authority generates a security certificate based on the request message and the key response packet sent by the key management system, and generates a response message based on the security certificate and the key response packet, and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptography algorithms enhance the terminal's resistance to quantum computing attacks during the communication process of obtaining a security certificate from the certificate authority and a key pair from the key management system.

[0067] In some embodiments, the method further includes:

[0068] Access to the second network node via a pre-established channel;

[0069] Issue security certificates to the aforementioned certificate authority.

[0070] In this way, the Certificate Authority (CA) accesses the second network node through a pre-established channel. Next, the CA issues its own security certificate. Thus, the CA, by accessing the network node through the channel, can obtain the second quantum key. Furthermore, the CA also issues its own security certificate, which can be used for encryption and decryption in subsequent processes.

[0071] In some embodiments, the method further includes:

[0072] The quantum key request is sent to the second network node connected to the certificate authentication center according to the quantum key identifier;

[0073] Receive the second quantum key distributed by the second network node according to the quantum key request.

[0074] Thus, the certificate authority sends a quantum key request to the second network node connected to the certificate authority based on the quantum key identifier. Next, the certificate authority receives the second quantum key distributed by the second network node according to the quantum key request. In this way, the certificate authority obtains the second quantum key, which has good quantum resistance and can be used in subsequent processes to enhance their quantum resistance.

[0075] In some implementations, the application message includes the first encrypted message, a terminal classical signature key pair, a terminal post-quantum signature key pair, a terminal post-quantum encryption key pair, and the quantum key identifier; the method further includes:

[0076] The terminal classical signature public key in the terminal classical signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier are concatenated to obtain a second concatenated body;

[0077] The second splice is encrypted using the second quantum key to obtain the second encrypted message;

[0078] The correctness of the received terminal classical signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key, and quantum key identifier is confirmed based on the second encrypted message and the first encrypted message.

[0079] Thus, the certificate authority concatenates the terminal's classical signature public key from the terminal's classical signature key pair, the terminal's post-quantum signature public key from the terminal's post-quantum signature key pair, and the terminal's temporary post-quantum encryption public key and quantum key identifier from the terminal's post-quantum encryption key pair to obtain a second concatenated body. Next, the certificate authority encrypts the second concatenated body using the second quantum key to obtain a second encrypted message. Finally, the certificate authority verifies the correctness of the received terminal's classical signature public key, terminal's post-quantum signature public key, terminal's temporary post-quantum encryption public key, and quantum key identifier based on the second encrypted message and the first encrypted message. In this way, the certificate authority can verify the accuracy of the message received by the certificate authority by comparing the second concatenated body generated by the certificate authority with the first concatenated body generated by the terminal.

[0080] In some implementations, generating a key request packet based on the request message and sending the key request packet to the key management system includes:

[0081] Generate the first temporary key request packet;

[0082] The terminal classic signature public key and the terminal temporary post-quantum encryption public key are stored in the first temporary key request package to obtain the second temporary key request package;

[0083] The classic signature identifier associated with the classic signature public key of the terminal and the post-quantum signature identifier associated with the post-quantum signature public key of the terminal are stored in the second temporary key request package to obtain the third temporary key request package;

[0084] The third temporary key request packet is signed using the classic signature algorithm associated with the classic signature public key of the terminal to obtain the first classic signature value;

[0085] The third temporary key application packet is signed using a post-quantum signature algorithm associated with the terminal's post-quantum signature public key to obtain a first post-quantum signature value;

[0086] The first classical signature value and the first post-quantum signature value are stored in the third temporary key request package to obtain the key request package;

[0087] The key request packet is sent to the key management system.

[0088] Thus, the Certificate Authority (CA) generates a first temporary key request packet. Next, the CA stores the terminal's classical signature public key and the terminal's temporary post-quantum encryption public key within the first temporary key request packet to obtain a second temporary key request packet. Then, the CA stores the classical signature identifier associated with the terminal's classical signature public key and the post-quantum signature identifier associated with the terminal's post-quantum signature public key within the second temporary key request packet to obtain a third temporary key request packet. Subsequently, the CA signs the third temporary key request packet using the classical signature algorithm associated with the terminal's classical signature public key to obtain a first classical signature value. Then, it signs the third temporary key request packet using the post-quantum signature algorithm associated with the terminal's post-quantum signature public key to obtain a first post-quantum signature value. Finally, the CA stores the first classical signature value and the first post-quantum signature value within the third temporary key request packet to obtain a key request packet. The key request packet is then sent to the key management system. In this way, a key request packet is obtained by processing the first temporary key request packet, which stores the terminal classical signature public key and the terminal temporary post-quantum encryption public key, layer by layer through the post-quantum cryptography algorithm. This key request packet has good quantum resistance, and the key management system can ensure that the key request packet is not accessed without authorization during transmission based on the first classical signature value and the first post-quantum signature value on the key request packet.

[0089] In some implementations, the key request packet includes a second classical signature message and a second post-quantum signature message, and the generation of a security certificate based on the request message and the key response packet includes:

[0090] Upon receiving a key response packet from the key management system, the second classic signature message is verified according to the classic signature algorithm to obtain the second classic signature verification result.

[0091] The second post-quantum signature message is verified according to the post-quantum signature algorithm to obtain the second post-quantum signature verification result.

[0092] If both the second classical signature verification result and the second post-quantum signature verification result are correct, the public key in the classical encryption key pair and the public key in the post-quantum encryption key pair are obtained from the key response packet.

[0093] Generate the classic signature certificate in the security certificate for the terminal based on the terminal's classic signature public key;

[0094] Generate the classic encryption certificate in the security certificate for the terminal based on the public key in the classic encryption key pair;

[0095] Generate the post-quantum signature certificate in the security certificate for the terminal based on the terminal's post-quantum signature public key;

[0096] The post-quantum encryption certificate in the security certificate is generated for the terminal based on the public key in the post-quantum encryption key pair.

[0097] Upon receiving a key response packet from the key management system, the Certificate Authority (CA) verifies the second classical signature message using the classical signature algorithm, obtaining a second classical verification result. Then, it verifies the second post-quantum signature message using the post-quantum signature algorithm, obtaining a second post-quantum verification result. Next, if both the second classical and post-quantum verification results are correct, the CA retrieves the public keys from the classical and post-quantum encryption key pairs from the key response packet. Then, the CA generates a classical signature certificate for the terminal's security certificate based on the terminal's classical signature public key, a classical encryption certificate for the terminal's security certificate based on the public keys in the classical encryption key pairs, a post-quantum signature certificate for the terminal's security certificate based on the terminal's post-quantum signature public key, and a post-quantum encryption certificate for the terminal's security certificate based on the public keys in the post-quantum encryption key pairs. In this way, after confirming the correctness of multiple verification results, the CA obtains the terminal's signature certificate, encryption certificate, post-quantum signature certificate, and post-quantum encryption certificate. These certificates can be used for the terminal's communication, protecting data during the terminal's communication process.

[0098] In some embodiments, the method further includes:

[0099] The first classic encryption certificate signature in the security certificate is obtained by signing the classic encryption certificate with the private key in the classic signature key pair of the terminal.

[0100] The classical encryption certificate is signed using the private key in the quantum signature key pair after the terminal is used to obtain the second classical encryption certificate signature in the security certificate.

[0101] Thus, the certificate authority signs the classic encryption certificate using the private key from the terminal's classic signature key pair to obtain the first classic encryption certificate signature in the security certificate. Next, the certificate authority signs the classic encryption certificate using the private key from the terminal's post-quantum signature key pair to obtain the second classic encryption certificate signature in the security certificate. In this way, the certificate authority obtains both the first and second classic encryption certificate signatures, which can be used to verify the accuracy of the classic encryption certificate and confirm that the classic encryption certificate has not been accessed without authorization during transmission. Furthermore, using the private key from the terminal's post-quantum signature key pair to sign the classic encryption certificate to obtain the second classic encryption certificate signature in the security certificate also provides good quantum resistance.

[0102] In some embodiments, the method further includes:

[0103] The first classic signature certificate signature in the security certificate is obtained by signing the classic signature certificate with the private key in the classic signature key pair of the terminal.

[0104] The classical signature certificate is signed using the private key in the quantum signature key pair after the terminal is used to obtain the second classical signature certificate signature in the security certificate.

[0105] Thus, the certificate authority signs the classic signature certificate using the private key from the terminal's classic signature key pair to obtain the first classic signature certificate signature in the security certificate. Next, the certificate authority signs the classic signature certificate using the private key from the terminal's post-quantum signature key pair to obtain the second classic signature certificate signature in the security certificate. In this way, the certificate authority obtains both the first and second classic signature certificate signatures, which can be used to verify the accuracy of the classic signature certificate and confirm that the classic signature certificate has not been accessed without authorization during transmission. Furthermore, using the private key from the terminal's post-quantum signature key pair to sign the classic signature certificate to obtain the second classic signature certificate signature in the security certificate also provides good quantum resistance.

[0106] In some embodiments, the method further includes:

[0107] The first post-quantum encryption certificate signature in the security certificate is obtained by signing the post-quantum encryption certificate with the private key in the terminal classic signature key pair.

[0108] The second post-quantum encryption certificate signature in the security certificate is obtained by signing the post-quantum encryption certificate with the private key in the terminal post-quantum signature key pair.

[0109] Thus, the certificate authority signs the post-quantum encryption certificate using the private key from the terminal's classical signature key pair to obtain the first post-quantum encryption certificate signature in the security certificate. Next, the certificate authority signs the post-quantum encryption certificate using the private key from the terminal's post-quantum signature key pair to obtain the second post-quantum encryption certificate signature in the security certificate. In this way, the certificate authority obtains both the first and second post-quantum encryption certificate signatures, which can be used to verify the accuracy of the post-quantum encryption certificate and confirm that the post-quantum encryption certificate has not been accessed without authorization during transmission. Furthermore, the second post-quantum encryption certificate signature obtained by signing the post-quantum encryption certificate using the private key from the terminal's post-quantum signature key pair also possesses good quantum resistance.

[0110] In some embodiments, the method further includes:

[0111] The first post-quantum signature certificate signature in the security certificate is obtained by signing the post-quantum signature certificate using the private key in the terminal classic signature key pair.

[0112] The second post-quantum signature certificate signature in the security certificate is obtained by signing the post-quantum signature certificate with the private key in the terminal post-quantum signature key pair.

[0113] Thus, the certificate authority signs the post-quantum signature certificate using the private key from the terminal's classical signature key pair to obtain the first post-quantum signature certificate signature in the security certificate. Next, the certificate authority signs the post-quantum signature certificate using the private key from the terminal's post-quantum signature key pair to obtain the second post-quantum signature certificate signature in the security certificate. In this way, the certificate authority obtains both the first and second post-quantum signature certificate signatures, which can be used to verify the accuracy of the post-quantum signature certificate and confirm that the post-quantum signature certificate has not been accessed without authorization during transmission. Furthermore, the second post-quantum signature certificate signature obtained by signing the post-quantum signature certificate using the private key from the terminal's post-quantum signature key pair also possesses good quantum resistance.

[0114] In some implementations, the key response packet includes a classical cryptographic envelope and a post-quantum cryptographic envelope. The step of generating a response message based on the key response packet and the security certificate, and sending the response message to the terminal, includes:

[0115] The classic cryptographic envelope is signed using the classic signature algorithm to obtain the first classic cryptographic envelope signature.

[0116] The classical cryptographic envelope is signed using the post-quantum signature algorithm to obtain the first classical cryptographic envelope post-quantum signature.

[0117] The post-quantum cryptographic envelope is signed using the classical signature algorithm to obtain the first post-quantum cryptographic envelope signature.

[0118] The post-quantum cryptographic envelope is signed using the post-quantum signature algorithm to obtain the first post-quantum cryptographic envelope post-quantum signature.

[0119] The classical cryptographic envelope is encrypted using the second quantum key to obtain an encrypted classical cryptographic envelope.

[0120] The encrypted quantum cryptographic envelope is obtained by encrypting the post-quantum cryptographic envelope using the second quantum key.

[0121] The security certificate, the signature of the first classical cryptographic envelope, the quantum signature of the first classical cryptographic envelope, the signature of the first quantum cryptographic envelope, the quantum signature of the first quantum cryptographic envelope, the encrypted classical cryptographic envelope, and the encrypted quantum cryptographic envelope are sent as a response message to the terminal.

[0122] Thus, the certificate authority signs the classical cryptographic envelope using the classical signature algorithm to obtain the first classical cryptographic envelope signature. Next, the certificate authority signs the classical cryptographic envelope using the post-quantum signature algorithm to obtain the first classical cryptographic envelope post-quantum signature. Then, the certificate authority signs the post-quantum cryptographic envelope using the classical signature algorithm to obtain the first post-quantum cryptographic envelope signature. The certificate authority then signs the post-quantum cryptographic envelope using the post-quantum signature algorithm to obtain the first post-quantum cryptographic envelope post-quantum signature. Subsequently, the certificate authority encrypts the classical cryptographic envelope using the second quantum key to obtain the encrypted classical cryptographic envelope. Furthermore, the certificate authority encrypts the post-quantum cryptographic envelope using the second quantum key to obtain the encrypted post-quantum cryptographic envelope. Finally, the certificate authority sends the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as a response message to the terminal. In this way, the certificate authority sends the corresponding message to the terminal, enabling the terminal to protect its communication data based on the security certificate in the response message. The first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, and the first post-quantum cryptographic envelope post-quantum signature in the response message can confirm that the response message has not been accessed without authorization during transmission. The encrypted classical cryptographic envelope and the encrypted post-quantum cryptographic envelope in the response message can protect the classical cryptographic envelope and the post-quantum cryptographic envelope.

[0123] Thirdly, embodiments of this application also provide a method for enhancing quantum security in online certificate issuance and key pair distribution for a communication network, wherein the communication network includes a terminal, a certificate authentication center, and a key management system, and the method is used in the key management system, the method comprising:

[0124] The terminal receives a key request packet sent by the certificate authentication center, wherein the key request packet is generated by the certificate authentication center based on a request message, the request message is generated by the terminal based on a terminal key pair, a quantum key identifier, and a first encrypted message, the terminal key pair is randomly generated by the terminal, the quantum key identifier is obtained by the terminal from the first network node it accesses, and the first encrypted message is obtained by encrypting the quantum key identifier and the terminal key pair with a first quantum key, the first quantum key being obtained by the terminal from the first network node it accesses.

[0125] A key response packet is generated based on the key request packet, and the key response packet is sent to the certificate authority. The certificate authority generates a security certificate based on the request message and the key response packet, and sends a response message generated based on the security certificate and the key response packet to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network besides itself.

[0126] Thus, in the communication process where the terminal obtains a security certificate from the certificate authority and a key pair from the key management system, the terminal requests a first quantum key and uses it to encrypt the quantum key identifier and the terminal key pair to generate a first encrypted message resistant to quantum computing attacks. The first quantum key has strong quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends this request message to the certificate authority. The certificate authority generates a key request packet based on the request message and sends it to the key management system. The key management system processes the key request packet using a post-quantum cryptography algorithm to obtain a key response packet, and then returns the key response packet to the certificate authority. The post-quantum cryptography algorithm is a series of encryption algorithms designed to resist quantum computing attacks. The certificate authority generates a security certificate based on the request message and the key response packet sent by the key management system, and generates a response message based on the security certificate and the key response packet, and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptography algorithms enhance the terminal's resistance to quantum computing attacks during the communication process of obtaining a security certificate from the certificate authority and a key pair from the key management system.

[0127] In some embodiments, the method further includes:

[0128] Obtain the management security certificate for the key management system from the certificate authentication center.

[0129] In this way, the key management system obtains its own management security certificate from the certificate authority. This gives the key management system its own management security certificate, which can be used for encryption and decryption in subsequent processes.

[0130] In some implementations, receiving the key request packet sent by the certificate authority includes:

[0131] The system receives a key request packet sent by the certificate authentication center. The key request packet includes a terminal classical signature public key, a terminal temporary post-quantum encryption public key, a classical signature identifier associated with the terminal classical signature public key, a post-quantum signature identifier associated with the terminal post-quantum signature public key, a first classical signature value, and a first post-quantum signature value.

[0132] Thus, the key management system receives a key request packet from the certificate authority. This packet includes the terminal's classical signature public key, the terminal's temporary post-quantum encryption public key, a classical signature identifier associated with the terminal's classical signature public key, a post-quantum signature identifier associated with the terminal's post-quantum signature public key, a first classical signature value, and a first post-quantum signature value. The key management system then receives these components, which can be used in subsequent processes.

[0133] In some embodiments, the method further includes:

[0134] The first classic signature value is verified using the classic signature algorithm associated with the classic signature public key of the terminal to obtain the first verification result;

[0135] The first post-quantum signature value is verified using the post-quantum signature algorithm associated with the post-quantum signature public key of the terminal to obtain a second verification result;

[0136] If both the first and second signature verification results are correct, a classic encryption key pair and a post-quantum encryption key pair are generated for the terminal.

[0137] Thus, the key management system verifies the first classical signature value using the classical signature algorithm associated with the terminal's classical signature public key, obtaining a first verification result. Next, the key management system verifies the first post-quantum signature value using the post-quantum signature algorithm associated with the terminal's post-quantum signature public key, obtaining a second verification result. Finally, if both the first and second verification results are correct, the key management system generates a classical encryption key pair and a post-quantum encryption key pair for the terminal. In this way, after multiple verification processes, the key management system confirms the correctness of the received key request packet and generates a classical encryption key pair and a post-quantum encryption key pair for the terminal, which can be used by a certificate authority to generate a security certificate based on the classical encryption key pair and the post-quantum encryption key pair.

[0138] In some implementations, generating a key response packet based on the key request packet and sending the key response packet to the certificate authority includes:

[0139] Generate a first temporary key response packet based on the key request packet;

[0140] A second temporary key response packet is generated based on the first temporary key response packet, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair;

[0141] A third temporary key response packet is generated based on the second temporary key response packet and the post-quantum encryption key pair;

[0142] The classical signature identifier and the post-quantum signature identifier are stored in the third temporary key response packet to obtain the fourth temporary key response packet;

[0143] The key response packet is obtained by processing the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm;

[0144] The key response packet is sent to the certificate authority.

[0145] Thus, the key management system generates a first temporary key response packet based on the key request packet. Next, it generates a second temporary key response packet based on the first temporary key response packet, a randomly generated temporary symmetric key, and a classical encryption key pair. Then, it generates a third temporary key response packet based on the second temporary key response packet and a post-quantum encryption key pair. The key management system then stores the classical signature identifier and the post-quantum signature identifier in the third temporary key response packet, resulting in a fourth temporary key response packet. Subsequently, the key management system processes the fourth temporary key response packet using classical and post-quantum signature algorithms to obtain the final key response packet. Finally, the key management system sends the key response packet to the certificate authority. In this way, the key management system generates key response packets by performing various operations based on post-quantum cryptography algorithms, classical cryptography algorithms, and other data information, and the certificate authority can generate security certificates based on these key response packets.

[0146] In some implementations, generating a second temporary key response packet based on the first temporary key response packet, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair includes:

[0147] The private key in the classic encryption key pair is encrypted using the temporary symmetric key to obtain the classic encryption private key in the classic cipher envelope.

[0148] The temporary symmetric key is signed using the terminal signature public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope;

[0149] The public key of the classic encryption key pair and the classic cryptographic envelope are stored in the first temporary key response packet to obtain the second temporary key response packet.

[0150] Thus, the key management system encrypts the private key in the classic encryption key pair using the temporary symmetric key, obtaining the classic encryption private key in the classic cryptographic envelope. Next, the key management system signs the temporary symmetric key using the terminal's signing public key, obtaining the encrypted temporary symmetric key in the classic cryptographic envelope. Finally, the key management system stores the public key from the classic encryption key pair and the classic cryptographic envelope in a first temporary key response packet, obtaining a second temporary key response packet. In this way, the key management system ensures the security of the private key in the classic encryption key pair during transmission and ensures that only terminals holding the corresponding private key can decrypt and use the temporary symmetric key.

[0151] In some implementations, generating a third temporary key response packet based on the second temporary key response packet and the post-quantum encryption key pair includes:

[0152] The third concatenation is obtained by concatenating the random number randomly generated by the key management system with a fixed string.

[0153] The first encryption key is obtained by performing post-quantum encryption processing on the third splice;

[0154] The third splice is subjected to post-quantum encryption encapsulation processing to obtain the first encapsulated message in the post-quantum cryptographic envelope;

[0155] The post-quantum encryption private key in the post-quantum encryption key pair is obtained by encrypting the private key in the post-quantum cryptographic envelope using the first encryption key.

[0156] The public key in the post-quantum cryptographic key pair and the post-quantum cryptographic envelope are stored in the second temporary key response packet to obtain the third temporary key response packet.

[0157] Thus, the key management system concatenates a randomly generated number with a fixed string to obtain a third concatenated body. Next, the key management system performs post-quantum encryption on the third concatenated body to obtain the first encryption key. The key management system then performs post-quantum encryption encapsulation on the third concatenated body to obtain the first encapsulated message in the post-quantum cryptographic envelope. Then, the key management system encrypts the private key in the post-quantum encryption key pair using the first encryption key to obtain the post-quantum encryption private key in the post-quantum cryptographic envelope. Finally, the key management system stores the public key in the post-quantum encryption key pair and the post-quantum cryptographic envelope in a second temporary key response packet to obtain the third temporary key response packet. In this way, the key management system uses the first encryption key generated by the post-quantum encryption algorithm to encrypt the private key in the post-quantum encryption key pair, ensuring the security of the private key in the post-quantum encryption key pair during transmission.

[0158] In some embodiments, the step of processing the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm to obtain the key response packet includes:

[0159] The second classic signature message is obtained by signing the fourth temporary key response packet according to the classic signature algorithm.

[0160] The fourth temporary key response packet is processed using the post-quantum signature algorithm to obtain the second post-quantum signature message.

[0161] The second classical signature message and the second post-quantum signature message are stored in the fourth temporary key response packet to obtain the key response packet.

[0162] Thus, the key management center signs the fourth temporary key response packet using a classical signature algorithm to obtain the second classical signature message. Next, the key management center performs post-quantum signature processing on the fourth temporary key response packet using a post-quantum signature algorithm to obtain the second post-quantum signature message. Finally, the key management center stores the second classical signature message and the second post-quantum signature message in the fourth temporary key response packet to obtain the key response packet. In this way, the key management center's processing of the fourth temporary key response packet using both post-quantum and classical algorithms ensures that the key request packet is not accessed without authorization during transmission.

[0163] Fourthly, embodiments of this application provide a computing processing device, comprising: a memory storing computer-readable code; and one or more processors, wherein when the computer-readable code is executed by the one or more processors, the computing processing device executes the online certificate issuance and key pair distribution quantum-resistant security enhancement method as described in the first and second aspects above.

[0164] Fifthly, embodiments of this application provide a computer program including computer-readable code, which, when executed on a computing processing device, causes the computing processing device to perform the quantum-resistant security enhancement method for online certificate issuance and key pair distribution as described in the first and second aspects above.

[0165] Sixthly, this application proposes a computer-readable medium storing the computer program as described in the fourth aspect above.

[0166] Additional aspects and advantages of embodiments of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of embodiments of this application. Attached Figure Description

[0167] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, wherein:

[0168] Figure 1 is a flowchart illustrating one of the quantum-resistant security enhancement methods for online certificate issuance and key pair distribution proposed in this application.

[0169] Figure 2 is an architecture diagram of a quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in an embodiment of this application;

[0170] Figure 3 is a second schematic flowchart of an online certificate issuance and key pair distribution method for enhancing quantum security proposed in an embodiment of this application;

[0171] Figure 4 is a schematic flowchart of the third embodiment of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application.

[0172] Figure 5 is a fourth flowchart illustrating an online certificate issuance and key pair distribution method for enhancing quantum security proposed in this application.

[0173] Figure 6 is a fifth flowchart illustrating an online certificate issuance and key pair distribution method for enhancing quantum security proposed in this application.

[0174] Figure 7 is a flowchart of the sixth embodiment of an online certificate issuance and key pair distribution method for enhancing quantum security.

[0175] Figure 8 is a flowchart of the seventh method for enhancing quantum-resistant security of online certificate issuance and key pair distribution proposed in this application embodiment;

[0176] Figure 9 is the eighth flowchart of an online certificate issuance and key pair distribution method for enhancing quantum security proposed in this application embodiment;

[0177] Figure 10 is a flowchart of the ninth embodiment of a quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application.

[0178] Figure 11 is a flowchart of the tenth of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in the embodiments of this application;

[0179] Figure 12 is an eleventh flowchart illustrating an online certificate issuance and key pair distribution method for enhancing quantum security proposed in an embodiment of this application;

[0180] Figure 13 is a schematic flowchart of an online certificate issuance and key pair distribution method for enhancing quantum security proposed in an embodiment of this application.

[0181] Figure 14 is a flowchart of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application embodiment;

[0182] Figure 15 is a flowchart of the fourteenth of the embodiments of this application of a quantum-resistant security enhancement method for online certificate issuance and key pair distribution;

[0183] Figure 16 is a flowchart of the fifteenth embodiment of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application.

[0184] Figure 17 is a flowchart of the sixteenth embodiment of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application.

[0185] Figure 18 is a flowchart of the seventeenth embodiment of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application.

[0186] Figure 19 is a flowchart of the eighteenth embodiment of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application;

[0187] Figure 20 is a flowchart of the nineteenth embodiment of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application.

[0188] Figure 21 is a schematic flowchart of a quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in an embodiment of this application;

[0189] Figure 22 is a flowchart of the twenty-first embodiment of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application.

[0190] Figure 23 is a flowchart of the twenty-second embodiment of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application.

[0191] Figure 24 is a flowchart of the twenty-third embodiment of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application.

[0192] Figure 25 is a flowchart of the twenty-fourth embodiment of the quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application.

[0193] Figure 26 is a flowchart of the twenty-fifth of the embodiments of this application of a quantum-resistant security enhancement method for online certificate issuance and key pair distribution;

[0194] Figure 27 is a schematic flowchart of a quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application embodiment;

[0195] Figure 28 is a flowchart of a quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application embodiment (Figure 27).

[0196] Figure 29 is a flowchart of the twenty-eighth of an embodiment of the present application of a quantum-resistant security enhancement method for online certificate issuance and key pair distribution;

[0197] Figure 30 is a flowchart of a quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in this application embodiment (Figure 29).

[0198] Figure 31 is a signaling diagram of a quantum-resistant security enhancement method for online certificate issuance and key pair distribution proposed in an embodiment of this application;

[0199] Figure 32 is a schematic diagram of the structure of a computing device for an online certificate issuance and key pair distribution method for enhancing quantum security proposed in an embodiment of this application;

[0200] Figure 33 is a schematic diagram of the computer program structure of an online certificate issuance and key pair distribution method for enhancing quantum security proposed in an embodiment of this application. Detailed Implementation

[0201] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of this application, and should not be construed as limiting the embodiments of this application.

[0202] The leap in computing power, exemplified by quantum computing, has significantly impacted the security of algorithms in classical cryptography. In other words, quantum computing poses a more direct and pressing threat to classical cryptography. For instance, Shor's quantum algorithm can solve complex mathematical problems such as large integer factorization and discrete logarithm solving in polynomial time, and can quickly break widely used public-key cryptographic algorithms such as RSA, ECC, DSA, and ElGamal. Understandably, as large-scale quantum computers become available, they will have some impact on applications of classical cryptography such as key negotiation, encryption, and signatures.

[0203] Thus, the security of the Internet, which uses classical cryptographic algorithms to protect communication processes, is heavily threatened by quantum computing attacks. For example, GM / T0014, the "Cryptographic Protocol Specification for Digital Certificate Authentication Systems," defines security protocols involving cryptographic technologies in digital certificate authentication systems. These protocols include: security protocols between user terminals and Registration Authorities (RAs); security protocols between RAs and Certificate Authorities (CAs); security protocols between CAs and Key Management Centers (KMs); security protocols between CAs and Lightweight Directory Access Protocol (LDAP); security protocols between CAs and Online Certificate Status Protocol (OCSP); security protocols between user terminals and LDAP services; and security protocols between user terminals and OCSP services. Among these, the security protocol between CAs and KMs is particularly important because it protects the transmission of encrypted key pairs. Currently, the security protocol between Certificate Authorities (CAs) and Key Management Centers (KMs) as defined in GM / T0014 can only distribute SM2 algorithm-based encryption key pairs, i.e., ECC elliptic curve cryptography. The protocol interaction process is also limited to digital signatures and asymmetric encryption / decryption protection based on the SM2 algorithm, lacking resistance to quantum computing. If we follow the ECC elliptic curve cryptography key pair distribution method, the signature algorithm itself needs to be usable for asymmetric encryption / decryption key encapsulation; that is, the signature public key is used to protect the private key in the encryption key pair. The common method is to generate a temporary symmetric key to encrypt the private key, and then use the signature public key to encrypt the temporary symmetric key. This approach is unsuitable for post-quantum cryptographic systems where the signature algorithm and key encapsulation algorithm are completely different.

[0204] Currently, international technologies for addressing quantum computing attacks mainly fall into two categories: one focuses on scenarios where (symmetric) key negotiation is performed using asymmetric algorithms, followed by encrypted transmission using symmetric algorithms. This involves researching the use of quantum key distribution (QKD) networks for symmetric key negotiation to protect key security. The other category researches post-quantum cryptography (PQC) algorithms to directly replace existing asymmetric algorithms. Quantum key distribution technology utilizes quantum mechanics principles to generate keys that cannot be intercepted by third parties, ensuring the security of key transmission. It is particularly suitable for key exchange scenarios and can replace existing asymmetric key negotiation algorithms, such as RSA or ECC, to improve key security. However, quantum key distribution technology cannot currently completely replace all applications of asymmetric algorithms. For example, in scenarios involving signature verification, integrity protection, and non-repudiation, asymmetric algorithms are still required.

[0205] Post-quantum cryptography algorithms are asymmetric cryptographic algorithms designed based on new mathematical problems, aiming to resist the potential threats posed by quantum computers. NIST has published the first batch of four proposed standardized post-quantum cryptographic algorithms: Kyber, Dilithium, Falcon, and SPHINCS+. These algorithms cover multiple technical approaches to reduce the risk of a single technique being compromised. Theoretically, post-quantum cryptography algorithms can replace all asymmetric algorithms and are more universal. However, the security of post-quantum cryptography algorithms still depends on the complexity of the computational problem, and they may face new methods of breaking them in the future or become insecure as computing power increases. Furthermore, post-quantum cryptography standards have not yet been officially published, and the production and certification of related products will take time; therefore, their large-scale application will require a considerable period.

[0206] Both post-quantum cryptography algorithms and quantum key distribution technologies have the ability to resist quantum computing attacks, but each has its limitations. Therefore, providing a relatively low-cost and highly secure cryptographic technology that can resist quantum computing attacks has become an urgent problem to be solved.

[0207] Based on the above problems, please refer to Figure 1. This application provides a quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network. The communication network includes a terminal, a certificate authentication center, and a key management system. The method is used on the terminal and includes:

[0208] 011: Obtain the first quantum key and quantum key identifier from the first network node of the access terminal;

[0209] 012: The first encrypted message is obtained by encrypting the quantum key identifier and the randomly generated terminal key pair using the first quantum key pair;

[0210] 013: Generate an application message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and send the application message to the certificate authentication center;

[0211] 014: Receive response messages from the Certificate Authority so that the terminal can use the response messages to communicate with other terminals in the communication network.

[0212] This application also provides a terminal, including a memory and a processor. The method of this application can be implemented by the terminal of this application. Specifically, the memory stores a computer program, and the processor is used to obtain a first quantum key and a quantum key identifier from a first network node accessing the terminal; to encrypt the quantum key identifier and a randomly generated terminal key pair according to the first quantum key to obtain a first encrypted message; and to generate an application message according to the first encrypted message, the terminal key pair, and the quantum key identifier, and send the application message to a certificate authentication center. The processor is also used to receive a response message sent by the certificate authentication center, so that the terminal can use the response message to communicate with other terminals in the communication network besides the terminal itself.

[0213] This application also provides a terminal quantum security enhancement device. The method of this application can be implemented by the terminal quantum security enhancement device of this application. Specifically, the terminal quantum security enhancement device includes an acquisition module, an encryption module, a derivation module, and a receiving module. The acquisition module is used to acquire a first quantum key and a quantum key identifier from a first network node accessing the terminal. The encryption module is used to encrypt the quantum key identifier and a randomly generated terminal key pair according to the first quantum key to obtain a first encrypted message. The derivation module is used to generate an application message according to the first encrypted message, the terminal key pair, and the quantum key identifier, and send the application message to a certificate authentication center. The receiving module is used to receive a response message sent by the certificate authentication center, so that the terminal can use the response message to communicate with other terminals in the communication network besides the terminal.

[0214] This application provides a communication system based on online certificate issuance and key pair distribution. The communication system includes a terminal, a certificate authentication center, a key management system, and a quantum key distribution network as described in the above embodiments. The quantum key distribution network is configured to distribute quantum keys to the terminal or the certificate authentication center.

[0215] Specifically, a quantum key distribution network (QKD) includes network nodes and a quantum network link control center. Network nodes are used to store and distribute quantum keys. The quantum network link control center can establish quantum key distribution and relay links between network nodes according to their names. These links are used for data transfer and other functions. The QKD network provides services such as quantum key generation, quantum key relay, and quantum key provision.

[0216] Referring to Figure 2, in some implementations, the terminal and the certificate authority communicate through a secure channel. A secure channel is an encrypted communication path used to securely transmit data, instructions, and control information between the terminal and the certificate authority. This channel ensures the confidentiality, integrity, and authenticity of data during transmission, preventing unauthorized access and data leakage. The terminal connects to a service node, which acts as a relay station for connecting to network nodes, used to supply keys to the terminal and relay and store quantum keys. When the terminal sends a quantum key request, the network node sends the quantum key generated by the quantum key distribution network to the service node connected to the terminal, and the service node then sends the quantum key back to the terminal. The simplified process of the terminal and certificate authority obtaining the quantum key is as follows: First, the terminal sends a quantum key request to the service node connected to the terminal. Then, the service node requests a quantum key from the first network node connected to the service node. Next, the first network node distributes the quantum key generated according to the quantum key request to the service node, and the service node then distributes the quantum key to the terminal. Simultaneously, the quantum network link control center enables the second network node connected to the certificate authentication center to generate a quantum key. However, this quantum key is not immediately distributed to the certificate authentication center; instead, it is first stored in the network node. The correspondence between the aforementioned terminal, certificate authentication center, service node, and network node is provided by the management and control platform.

[0217] It should be noted that this application uses the FIPS203 Module-Lattice-based Key-Encapsulation Mechanism Standard as the PQC key encapsulation algorithm and the FIPS204 Module-Lattice-Based Digital Signature Standard as the PQC digital signature algorithm for explanation and illustration. All subsequent descriptions of PQC algorithm-related operations refer to the aforementioned FIPS standards. Of course, in other embodiments, other algorithms such as the NewHope algorithm, Sidh algorithm, and HQC algorithm can also be used as the relevant PQC algorithms. It should also be noted that the embodiments of this application address the process of a terminal obtaining a security certificate from a Certificate Authority (CA), and the security protocol between the Certificate Authority (CA) and the Key Management System (KM) as defined in GM / T0050 "Technical Specification for Cryptographic Device Management," hereinafter referred to as the KM security protocol.

[0218] Specifically, the terminal obtains a first quantum key and a quantum key identifier from the first network node accessing the terminal. Then, the terminal encrypts the quantum key identifier and a randomly generated terminal key pair using the first quantum key to obtain a first encrypted message. Afterward, the terminal generates an application message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends the application message to the certificate authentication center.

[0219] After receiving the application message from the terminal, the certificate authentication center processes the application message, generates a key application package based on the application message, and sends the key application package to the key management system.

[0220] After receiving the key request packet from the certificate authority, the management system generates a key response packet based on the key request packet and sends the key response packet to the certificate authority.

[0221] After receiving the key response packet from the key management system, the certificate authority generates a security certificate based on the application message sent by the terminal and the key response packet. Then, based on the key response packet and the security certificate generated by the certificate authority in the above process, it generates a response message and sends it to the terminal, enabling the terminal to communicate with other terminals in the communication network.

[0222] Subsequently, the terminal receives a response message from the certificate authority, enabling it to communicate with other terminals in the communication network.

[0223] In summary, in the quantum-resistant security enhancement method, communication system, terminal, certificate authority, and key management system for online certificate issuance and key pair distribution in the communication network of this application, during the communication process where the terminal obtains a security certificate from the certificate authority and a key pair from the key management system, the terminal requests a first quantum key and uses the first quantum key to encrypt a quantum key identifier and a terminal key pair to generate a first encrypted message resistant to quantum computing attacks. The first quantum key has good quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends the request message to the certificate authority. The certificate authority generates a key request packet based on the request message and sends the key request packet to the key management system. The key management system processes the key request packet using a post-quantum cryptography algorithm to obtain a key response packet, and then returns the key response packet to the certificate authority. The post-quantum cryptography algorithm is a series of encryption algorithms designed to resist quantum computing attacks. The certificate authority generates a security certificate based on the request message and the key response packet sent by the key management system, generates a response message based on the security certificate and the key response packet, and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptography algorithms enhance the terminal's ability to resist quantum computing attacks during the communication process of obtaining security certificates from certificate authentication centers and key pairs from key management systems.

[0224] Please refer to Figure 3. In some embodiments, step 011 (obtaining the first quantum key and quantum key identifier from the first network node of the access terminal) includes:

[0225] 0111: Using a service node to fill the terminal's cryptographic module with multiple keys;

[0226] 0112: Send a quantum key request to the service node;

[0227] 0113: The quantum key encryption result obtained by the receiving service node encrypting the first quantum key and the quantum key identifier according to the protection key;

[0228] 0114: Decrypt the quantum key encryption result to obtain the first quantum key and quantum key identifier.

[0229] In some implementations, the charging module is used to charge multiple keys into the terminal's cryptographic module using the service node. The sending module is used to send a quantum key request to the service node. The receiving module is used to receive the quantum key encryption result obtained by the service node encrypting the first quantum key and the quantum key identifier according to the protection key. The decryption module is used to decrypt the quantum key encryption result to obtain the first quantum key and the quantum key identifier.

[0230] In some implementations, the processor is further configured to use the service node to fuel the terminal's cryptographic module with multiple keys, and to send a quantum key request to the service node. The processor is also configured to receive a quantum key encryption result obtained by the service node encrypting a first quantum key and a quantum key identifier using a protection key, and to decrypt the quantum key encryption result to obtain the first quantum key and the quantum key identifier.

[0231] Specifically, the terminal uses the service node to feed multiple keys into its cryptographic module. Next, based on the authorization code received from the certificate authority, the terminal sends a quantum key request to the service node. This quantum key request is protected by a protection key, which is randomly selected from the multiple keys fed into the cryptographic module. Then, the terminal receives the quantum key encryption result obtained by the service node encrypting the first quantum key using the protection key. The first quantum key is generated and distributed to the service node by the first network node connected to the service node. Finally, the terminal decrypts the quantum key encryption result to obtain the first quantum key.

[0232] In this way, the terminal obtains the first quantum key and quantum key identifier, which can be used to generate keys with stronger resistance to quantum computing attacks.

[0233] Referring to Figure 4, in some embodiments, step 012 (encrypting the first quantum key pair (quantum key identifier) ​​and the randomly generated terminal key pair to obtain the first encrypted message) includes:

[0234] 0121: Randomly generate a terminal key pair based on the terminal's cryptographic module;

[0235] 0122: The terminal public key and the quantum key identifier are concatenated to obtain the first concatenation;

[0236] 0123: The first concatenation is encrypted using the first quantum key to obtain the first encrypted message.

[0237] In some implementations, the derivation module is used to randomly generate a terminal key pair based on the terminal's cryptographic module. The concatenation module is used to concatenate the terminal public key and the quantum key identifier to obtain a first concatenation. The encryption module is used to encrypt the first concatenation based on the first quantum key to obtain a first encrypted message.

[0238] In some implementations, the processor is further configured to randomly generate a terminal key pair based on the terminal's cryptographic module; concatenate the terminal public key and the quantum key identifier to obtain a first concatenated body; and encrypt the first concatenated body using the first quantum key to obtain a first encrypted message.

[0239] Specifically, the terminal randomly generates a terminal key pair based on its cryptographic module. This terminal key pair includes a classical signature key pair, a post-quantum signature key pair, and a post-quantum encryption key pair. Next, the terminal concatenates its public key and a quantum key identifier to obtain a first concatenated body. The terminal public key includes the classical signature public key of the classical signature key pair, the post-quantum signature public key of the post-quantum signature key pair, and the temporary post-quantum encryption public key of the post-quantum encryption key pair. Finally, the terminal encrypts the first concatenated body using the first quantum key to obtain a first encrypted message.

[0240] In this way, the terminal randomly generates a terminal key pair through its cryptographic module, which can be used for various subsequent signature processes and can also be used to generate a security certificate. It also obtains the first encrypted message, which can be used by a certificate authority to verify the accuracy of the data sent by the terminal.

[0241] Please refer to Figure 5. In some implementations, the security certificate includes a classic encryption certificate, a first classic encryption certificate signature, and a second classic encryption certificate signature. The method further includes:

[0242] 015: Verify the signature of the first classic encryption certificate using the terminal's classic signature public key to obtain the signature verification result of the first classic encryption certificate;

[0243] 016: Verify the signature of the second classical encryption certificate using the quantum signature public key after the terminal is used to obtain the signature verification result of the second classical encryption certificate;

[0244] 017: If the verification results of the first and second classic encryption certificates are correct, the classic encryption certificate is confirmed to be correct.

[0245] In some implementations, the signature verification module is used to verify the signature of the first classical encryption certificate based on the terminal's classical signature public key to obtain a signature verification result for the first classical encryption certificate. It also verifies the signature of the second classical encryption certificate based on the terminal's post-quantum signature public key to obtain a signature verification result for the second classical encryption certificate. The confirmation module is further used to confirm the correctness of the classical encryption certificate if the signature verification results of the first and second classical encryption certificates are correct.

[0246] In some implementations, the processor is further configured to verify the signature of the first classical encryption certificate based on the terminal's classical signature public key to obtain a verification result for the first classical encryption certificate; and to verify the signature of the second classical encryption certificate based on the terminal's post-quantum signature public key to obtain a verification result for the second classical encryption certificate; and, if the verification results of the first and second classical encryption certificates are correct, to confirm that the classical encryption certificate is correct.

[0247] Specifically, the terminal verifies the signature of the first classical encryption certificate using its classical signature public key to obtain the verification result. Next, the terminal verifies the signature of the second classical encryption certificate using its post-quantum signature public key to obtain the verification result. Finally, if both the first and second classical encryption certificate verification results are correct, the classical encryption certificate is confirmed to be correct.

[0248] Thus, the terminal verifies the signatures of the first and second classic encryption certificates respectively, and determines the correctness of the classic encryption certificates based on the verification results, ensuring that a correct classic encryption certificate is obtained and that the terminal's communication can be encrypted.

[0249] Please refer to Figure 6. In some embodiments, the security certificate includes a classic signature certificate, a first classic signature certificate signature, and a second classic signature certificate signature. The method further includes:

[0250] 018: Verify the signature of the first classic signature certificate based on the terminal's classic signature public key to obtain the signature verification result of the first classic signature certificate;

[0251] 019: Verify the signature of the second classical signature certificate using the quantum signature public key after the terminal is used to obtain the signature verification result of the second classical signature certificate;

[0252] 020: If the verification results of the first and second classic signature certificates are correct, then the classic signature certificate is confirmed to be correct.

[0253] In some implementations, the signature verification module is used to verify the signature of a first classic signature certificate based on the terminal's classic signature public key to obtain a signature verification result for the first classic signature certificate. It is also used to verify the signature of a second classic signature certificate based on the terminal's post-quantum signature public key to obtain a signature verification result for the second classic signature certificate. The confirmation module is further used to confirm the correctness of the classic signature certificate if the signature verification results of the first and second classic signature certificates are correct.

[0254] In some implementations, the processor is further configured to perform signature verification processing on the first classic signature certificate based on the terminal's classic signature public key to obtain a signature verification result for the first classic signature certificate; and to perform signature verification processing on the second classic signature certificate based on the terminal's post-quantum signature public key to obtain a signature verification result for the second classic signature certificate; and, if the signature verification results of the first and second classic signature certificates are correct, to confirm that the classic signature certificate is correct.

[0255] Specifically, the terminal verifies the signature of the first classic signature certificate using its classic signature public key to obtain the verification result. Next, the terminal verifies the signature of the second classic signature certificate using its post-classical signature public key to obtain the verification result. Finally, if both the first and second classic signature certificate verification results are correct, the classic signature certificate is confirmed to be correct.

[0256] Thus, the terminal verifies the signatures of the first and second classic signature certificates respectively, and determines the correctness of the classic signature certificate based on the verification results, ensuring that a correct classic signature certificate is obtained, which can encrypt the terminal's communication.

[0257] Referring to Figure 7, in some embodiments, the security certificate includes a post-quantum encryption certificate, a first post-quantum encryption certificate signature, and a second post-quantum encryption certificate signature. The method further includes:

[0258] 021: Verify the signature of the first post-quantum encryption certificate using the terminal's classical signature public key to obtain the verification result of the first post-quantum encryption certificate;

[0259] 022: Verify the signature of the second post-quantum encryption certificate using the terminal's post-quantum signature public key to obtain the verification result of the second post-quantum encryption certificate;

[0260] 023: If the verification results of the first and second post-quantum encryption certificates are correct, the post-quantum encryption certificate is confirmed to be correct.

[0261] In some implementations, the signature verification module is used to verify the signature of the first post-quantum encryption certificate based on the terminal's classical signature public key to obtain the signature verification result of the first post-quantum encryption certificate. It is also used to verify the signature of the second post-quantum encryption certificate based on the terminal's post-quantum signature public key to obtain the signature verification result of the second post-quantum encryption certificate. The confirmation module is further used to confirm the correctness of the post-quantum encryption certificate if the signature verification results of the first and second post-quantum encryption certificates are correct.

[0262] In some implementations, the processor is further configured to verify the signature of the first post-quantum encryption certificate using the terminal's classical signature public key to obtain a verification result for the first post-quantum encryption certificate; and to verify the signature of the second post-quantum encryption certificate using the terminal's post-quantum signature public key to obtain a verification result for the second post-quantum encryption certificate; and, if the verification results of the first and second post-quantum encryption certificates are correct, to confirm that the post-quantum encryption certificate is correct.

[0263] Specifically, the terminal verifies the signature of the first post-quantum encryption certificate using its classical signature public key to obtain the verification result. Next, the terminal verifies the signature of the second post-quantum encryption certificate using its post-quantum signature public key to obtain the verification result. Finally, if both the first and second post-quantum encryption certificate verification results are correct, the post-quantum encryption certificate is confirmed to be correct.

[0264] Thus, the terminal verifies the signatures of the first and second post-quantum encryption certificates respectively, and determines the correctness of the post-quantum encryption certificate based on the verification results, ensuring that a correct post-quantum encryption certificate is obtained, which can encrypt the terminal's communication.

[0265] Referring to Figure 8, in some embodiments, the security certificate includes a post-quantum signature certificate, a first post-quantum signature certificate signature, and a second post-quantum signature certificate signature. The method further includes:

[0266] 024: Verify the signature of the first post-quantum signature certificate using the terminal's classical signature public key to obtain the verification result of the first post-quantum signature certificate;

[0267] 025: Verify the signature of the second post-quantum signature certificate using the terminal's post-quantum signature public key to obtain the verification result of the second post-quantum signature certificate;

[0268] 026: If the verification results of the first and second post-quantum signature certificates are correct, the post-quantum signature certificate is confirmed to be correct.

[0269] In some implementations, the signature verification module is used to verify the signature of the first post-quantum signature certificate based on the terminal's classical signature public key to obtain the signature verification result of the first post-quantum signature certificate. It is also used to verify the signature of the second post-quantum signature certificate based on the terminal's post-quantum signature public key to obtain the signature verification result of the second post-quantum signature certificate. The confirmation module is further used to confirm the correctness of the post-quantum signature certificate if the signature verification results of the first and second post-quantum signature certificates are correct.

[0270] In some implementations, the processor is further configured to perform signature verification processing on the first post-quantum signature certificate based on the terminal's classical signature public key to obtain a signature verification result for the first post-quantum signature certificate; and to perform signature verification processing on the second post-quantum signature certificate based on the terminal's post-quantum signature public key to obtain a signature verification result for the second post-quantum signature certificate; and, if the signature verification results of the first and second post-quantum signature certificates are correct, to confirm that the post-quantum signature certificate is correct.

[0271] Specifically, the terminal verifies the first post-quantum signature certificate using its classical signature public key to obtain the verification result. Next, the terminal verifies the second post-quantum signature certificate using its post-quantum signature public key to obtain the verification result. Finally, if both the first and second post-quantum signature certificate verification results are correct, the post-quantum signature certificate is confirmed to be correct.

[0272] In this way, the terminal verifies the signatures of the first and second post-quantum signature certificates respectively, and determines the correctness of the post-quantum signature certificate based on the verification results, ensuring that a correct post-quantum signature certificate is obtained, which can encrypt the terminal's communication.

[0273] Referring to Figure 9, in some embodiments, the response message includes a first classical cryptographic envelope signature, a first classical cryptographic envelope followed by a quantum signature, a first post-quantum cryptographic envelope signature, a first post-quantum cryptographic envelope followed by a quantum signature, an encrypted classical cryptographic envelope, and an encrypted post-quantum cryptographic envelope. The method further includes:

[0274] 027: Verify the signature on the first classic cryptographic envelope to obtain the signature verification result from the first terminal;

[0275] 028: Perform signature verification on the quantum signature of the first classical cryptographic envelope to obtain the signature verification result of the second terminal;

[0276] 029: Verify the signature of the first post-quantum cryptographic envelope to obtain the signature verification result of the third terminal;

[0277] 030: Verify the quantum signature of the first post-quantum cryptographic envelope to obtain the verification result of the fourth terminal;

[0278] 031: If the signature verification results of the first terminal, the second terminal, the third terminal, and the fourth terminal are all correct, the encrypted classical cryptographic envelope is decrypted using the first quantum key to obtain the classical cryptographic envelope.

[0279] 032: The encrypted quantum cryptographic envelope is decrypted using the first quantum key to obtain the post-quantum cryptographic envelope.

[0280] In some embodiments, the signature verification module is further used to verify the signature of the first classical cryptographic envelope to obtain a first terminal signature verification result; to verify the quantum signature of the first classical cryptographic envelope to obtain a second terminal signature verification result; to verify the signature of the first post-quantum cryptographic envelope to obtain a third terminal signature verification result; and to verify the quantum signature of the first post-quantum cryptographic envelope to obtain a fourth terminal signature verification result. The decryption module is used to, if the signature verification results of the first, second, third, and fourth terminals are all correct, to decrypt the encrypted classical cryptographic envelope using the first quantum key to obtain a classical cryptographic envelope; and to decrypt the encrypted post-quantum cryptographic envelope using the first quantum key to obtain a post-quantum cryptographic envelope.

[0281] In some embodiments, the processor is further configured to verify the signature of the first classical cryptographic envelope to obtain a first terminal verification result; verify the quantum signature of the first classical cryptographic envelope to obtain a second terminal verification result; verify the signature of the first quantum cryptographic envelope to obtain a third terminal verification result; and verify the quantum signature of the first quantum cryptographic envelope to obtain a fourth terminal verification result. The processor is also configured to, if the verification results of the first, second, third, and fourth terminals are all correct, decrypt the encrypted classical cryptographic envelope using the first quantum key to obtain a classical cryptographic envelope; and decrypt the encrypted quantum cryptographic envelope using the first quantum key to obtain a post-quantum cryptographic envelope.

[0282] Specifically, the terminal verifies the signature of the first classical cryptographic envelope, obtaining a first terminal verification result. Next, the terminal verifies the quantum signature of the first classical cryptographic envelope, obtaining a second terminal verification result. The terminal then verifies the signature of the first post-quantum cryptographic envelope, obtaining a third terminal verification result. Finally, the terminal verifies the quantum signature of the first post-quantum cryptographic envelope, obtaining a fourth terminal verification result. Then, if the verification results of the first, second, third, and fourth terminals are all correct, the terminal decrypts the encrypted classical cryptographic envelope using the first quantum key to obtain the classical cryptographic envelope. Finally, the terminal decrypts the encrypted post-quantum cryptographic envelope using the first quantum key to obtain the post-quantum cryptographic envelope.

[0283] Thus, after multiple signature verification processes, the terminal confirms the correctness of the obtained encrypted classical cryptographic envelope and encrypted quantum cryptographic envelope. Then, using the first quantum key, it decrypts the encrypted classical cryptographic envelope and encrypted quantum cryptographic envelope respectively to obtain the classical cryptographic envelope and the quantum cryptographic envelope. Based on the classical cryptographic envelope and the quantum cryptographic envelope, it can obtain multiple private keys generated for the terminal by the key management system in subsequent processes.

[0284] Please refer to Figure 10. In some embodiments, the method further includes:

[0285] 033: Decrypt the encrypted temporary symmetric key in the classic cryptographic envelope using the private key in the terminal's classic signature key pair to obtain the temporary symmetric key;

[0286] 034: Decrypt the classic encryption private key in the classic cryptographic envelope using the temporary symmetric key to obtain the private key in the classic encryption key pair.

[0287] In some implementations, the decryption module is further configured to decrypt the encrypted temporary symmetric key in the classic cryptographic envelope using the private key in the terminal's classic signature key pair to obtain a temporary symmetric key, and to decrypt the classic encrypted private key in the classic cryptographic envelope using the temporary symmetric key to obtain the private key in the classic cryptographic key pair.

[0288] In some implementations, the processor is further configured to decrypt the encrypted temporary symmetric key in the classic cryptographic envelope using the private key in the classic signature key pair of the terminal to obtain a temporary symmetric key, and to decrypt the classic encrypted private key in the classic cryptographic envelope using the temporary symmetric key to obtain the private key in the classic cryptographic key pair.

[0289] Specifically, the terminal decrypts the encrypted temporary symmetric key in the classic cryptographic envelope using the private key in the terminal's classic signature key pair to obtain the temporary symmetric key. Then, the terminal decrypts the classic encrypted private key in the classic cryptographic envelope using the temporary symmetric key to obtain the private key in the classic encryption key pair.

[0290] In this way, the terminal obtains the private key from the classic encryption key pair, which can be used in the terminal's communication process to encrypt and decrypt data.

[0291] Please refer to Figure 11. In some embodiments, the method further includes:

[0292] 035: Decapsulate the first encapsulated message in the post-quantum cryptography envelope to obtain the second concatenation;

[0293] 036: Obtain a fixed string based on the second concatenation to confirm the correctness of the subsequent quantum cryptographic envelope;

[0294] 037: If the post-quantum cryptographic envelope is correct, perform post-quantum encryption on the first splice to obtain the first encryption key;

[0295] 038: Decrypt the private key in the post-quantum cryptography envelope using the first encryption key pair to obtain the private key in the post-quantum cryptography key pair.

[0296] In some implementations, the desealing module is further configured to deseale the first encapsulated message in the post-quantum cryptography envelope to obtain a second concatenated body. The processing module is configured to obtain a fixed string based on the second concatenated body to verify the correctness of the post-quantum cryptography envelope. The encryption module is further configured to perform post-quantum encryption processing on the first concatenated body, if the post-quantum cryptography envelope is correct, to obtain a first encryption key. The decryption module is configured to decrypt the post-quantum encryption private key in the post-quantum cryptography envelope based on the first encryption key to obtain the private key in the post-quantum encryption key pair.

[0297] In some embodiments, the processor is further configured to decapsulate the first encapsulated message in the post-quantum cryptography envelope to obtain a second concatenation. A fixed string is obtained from the second concatenation to verify the correctness of the post-quantum cryptography envelope. If the post-quantum cryptography envelope is correct, the processor is further configured to perform post-quantum encryption on the first concatenation to obtain a first encryption key. The processor then decrypts the post-quantum encryption private key in the post-quantum cryptography envelope using the first encryption key to obtain the private key in the post-quantum encryption key pair.

[0298] Specifically, the terminal decapsulates the first encapsulated message in the post-quantum cryptography envelope to obtain a second concatenated body. Next, the terminal uses the second concatenated body to obtain a fixed string to verify the correctness of the post-quantum cryptography envelope. Then, if the post-quantum cryptography envelope is correct, the terminal performs post-quantum encryption on the first concatenated body to obtain a first encryption key. Finally, the terminal decrypts the post-quantum encryption private key in the post-quantum cryptography envelope using the first encryption key to obtain the private key in the post-quantum encryption key pair.

[0299] In this way, the terminal obtains the private key from the quantum encryption key pair, which can be used in the terminal's communication process to encrypt and decrypt data.

[0300] Please refer to Figure 12. This application provides a quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network. The communication network includes a terminal, a certificate authentication center, and a key management system. The method is used by the certificate authentication center and includes:

[0301] 040: Receive the application message sent by the terminal;

[0302] 041: Generate a key request package based on the request message and send the key request package to the key management system;

[0303] 042: Receive key response packets sent by the key management system;

[0304] 043: Generate a security certificate based on the application message and key response packet;

[0305] 044: Generate a response message based on the key response packet and security certificate, and send the response message to the terminal so that the terminal can use the response message to communicate with other terminals in the communication network besides the terminal itself.

[0306] This application also provides a certificate authentication center, including a memory and a processor. The method of this application can be implemented by the certificate authentication center of this application. Specifically, the memory stores a computer program, and the processor is used to receive an application message sent by a terminal, generate a key application packet based on the application message, and send the key application packet to a key management system. The processor is also used to receive a key response packet sent by the key management system, generate a security certificate based on the application message and the key response packet, generate a response message based on the key response packet and the security certificate, and send the response message to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network besides itself.

[0307] This application also provides a certificate authentication center quantum security enhancement device. The method of this application can be implemented by the certificate authentication center quantum security enhancement device of this application. Specifically, the certificate authentication center quantum security enhancement device includes a receiving module and a derived module. The receiving module is used to receive an application message sent by a terminal. The receiving module is used to receive the first encryption result of the terminal performing post-quantum cryptographic encryption processing on the quantum key identifier. The derived module is used to generate a key application packet based on the application message. The receiving module is also used to receive a key response packet sent by a key management system, which is generated by the key management system based on the key application packet. The derived module is used to generate a security certificate based on the application message and the key response packet. And it generates a response message based on the key response packet and the security certificate, and sends the response message to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network besides itself.

[0308] Specifically, the quantum security enhancement method of this embodiment is basically the same as the quantum security enhancement method of the aforementioned embodiment that takes the terminal as the execution target. For details, please refer to the explanation of the corresponding section. The difference is that this embodiment takes the certificate authentication center as the execution target, which will not be repeated here.

[0309] In summary, in the quantum-resistant security enhancement method, communication system, terminal, certificate authority, and key management system for online certificate issuance and key pair distribution in the communication network of this application, during the communication process where the terminal obtains a security certificate from the certificate authority and a key pair from the key management system, the terminal requests a first quantum key and uses the first quantum key to encrypt a quantum key identifier and a terminal key pair to generate a first encrypted message resistant to quantum computing attacks. The first quantum key has good quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends the request message to the certificate authority. The certificate authority generates a key request packet based on the request message and sends the key request packet to the key management system. The key management system processes the key request packet using a post-quantum cryptography algorithm to obtain a key response packet, and then returns the key response packet to the certificate authority. The post-quantum cryptography algorithm is a series of encryption algorithms designed to resist quantum computing attacks. The certificate authority generates a security certificate based on the request message and the key response packet sent by the key management system, generates a response message based on the security certificate and the key response packet, and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptography algorithms enhance the terminal's ability to resist quantum computing attacks during the communication process of obtaining security certificates from certificate authentication centers and key pairs from key management systems.

[0310] Please refer to Figure 13. In some embodiments, the method further includes:

[0311] 045: Access the second network node via a pre-established channel;

[0312] 046: Issue security certificates to the Certificate Authority.

[0313] In some implementations, the access module is used to access a second network node via a pre-established channel. The issuance module is used to issue security certificates from a certificate authority.

[0314] In some implementations, the processor is also used to access a second network node via a pre-established channel and to issue security certificates from a certificate authority.

[0315] Specifically, the Certificate Authority (CA) connects to the second network node through a pre-established channel. Then, the CA issues its own security certificate.

[0316] In this way, the certificate authority can obtain the second quantum key by accessing the network node through the channel. Furthermore, the certificate authority also issues its own security certificate, which can be used for encryption and decryption in subsequent processes.

[0317] Please refer to Figure 14. In some embodiments, the method further includes:

[0318] 047: Send a quantum key request to the second network node of the access certificate authentication center based on the quantum key identifier;

[0319] 048: Receive the second quantum key distributed by the second network node according to the quantum key request.

[0320] In some implementations, the sending module is further configured to send a quantum key request to a second network node accessing the certificate authority based on the quantum key identifier. The receiving module is further configured to receive a second quantum key distributed by the second network node based on the quantum key request.

[0321] In some implementations, the processor is also configured to send a quantum key request to a second network node accessing the certificate authority based on a quantum key identifier, and to receive a second quantum key distributed by the second network node based on the quantum key request.

[0322] Specifically, the certificate authority sends a quantum key request to the second network node connected to the certificate authority based on the quantum key identifier. Then, the certificate authority receives the second quantum key distributed by the second network node according to the quantum key request.

[0323] In this way, the certificate authentication center obtains the second quantum key, which has good quantum resistance and can be used in subsequent processes to make it have good quantum resistance.

[0324] Referring to Figure 15, in some embodiments, the application message includes a first encrypted message, a terminal classical signature key pair, a terminal post-quantum signature key pair, a terminal post-quantum encryption key pair, and a quantum key identifier. The method further includes:

[0325] 049: The terminal classical signature public key in the terminal classical signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier are concatenated to obtain the second concatenation;

[0326] 050: The second concatenation is encrypted using the second quantum key to obtain the second encrypted message;

[0327] 051: Confirm the correctness of the received terminal classical signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key, and quantum key identifier based on the second encrypted message and the first encrypted message.

[0328] In some implementations, the concatenation module is further configured to concatenate the terminal classical signature public key from the terminal classical signature key pair, the terminal post-quantum signature public key from the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key from the terminal post-quantum encryption key pair, and the quantum key identifier to obtain a second concatenation. The encryption module is further configured to encrypt the second concatenation according to the second quantum key to obtain a second encrypted message. The verification module is configured to verify the correctness of the received terminal classical signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key, and quantum key identifier based on the second encrypted message and the first encrypted message.

[0329] In some implementations, the processor is further configured to concatenate the terminal classical signature public key in the terminal classical signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier to obtain a second concatenated body. The processor then encrypts the second concatenated body using the second quantum key to obtain a second encrypted message. Finally, the processor verifies the correctness of the received terminal classical signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key, and quantum key identifier based on the second encrypted message and the first encrypted message.

[0330] Specifically, the certificate authentication center concatenates the terminal classical signature public key from the terminal classical signature key pair, the terminal post-quantum signature public key from the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key from the terminal post-quantum encryption key pair, and the quantum key identifier to obtain a second concatenated body. Next, the certificate authentication center encrypts the second concatenated body using the second quantum key to obtain a second encrypted message. Finally, the certificate authentication center verifies the correctness of the received terminal classical signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key, and quantum key identifier based on the second encrypted message and the first encrypted message.

[0331] In this way, the Certificate Authority can confirm the accuracy of the message received by the Certificate Authority by comparing the second concatenation generated by the Certificate Authority with the first concatenation generated by the terminal.

[0332] Referring to Figure 16, in some embodiments, step 041 (generating a key request packet based on the request message and sending the key request packet to the key management system) includes:

[0333] 0411: Generate the first temporary key request packet;

[0334] 0412: Store the terminal's classical signature public key and the terminal's temporary post-quantum encryption public key in the first temporary key request package to obtain the second temporary key request package;

[0335] 0413: Store the classical signature identifier associated with the terminal's classical signature public key and the post-quantum signature identifier associated with the terminal's post-quantum signature public key in the second temporary key request packet to obtain the third temporary key request packet;

[0336] 0414: The third temporary key request packet is signed using the classic signature algorithm associated with the terminal's classic signature public key to obtain the first classic signature value;

[0337] 0415: The third temporary key request packet is signed using the post-quantum signature algorithm associated with the terminal's post-quantum signature public key to obtain the first post-quantum signature value;

[0338] 0416: Store the first classical signature value and the first post-quantum signature value in the third temporary key request packet to obtain the key request packet;

[0339] 0417: Send the key request packet to the key management system.

[0340] In some implementations, the derivation module is used to generate a first temporary key request packet. The storage module is used to store the terminal's classical signature public key and the terminal's temporary post-quantum encryption public key in the first temporary key request packet to obtain a second temporary key request packet. It also stores a classical signature identifier associated with the terminal's classical signature public key and a post-quantum signature identifier associated with the terminal's post-quantum signature public key in the second temporary key request packet to obtain a third temporary key request packet. The signing module is used to sign the third temporary key request packet according to a classical signature algorithm associated with the terminal's classical signature public key to obtain a first classical signature value. It also signs the third temporary key request packet according to a post-quantum signature algorithm associated with the terminal's post-quantum signature public key to obtain a first post-quantum signature value. The storage module is also used to store the first classical signature value and the first post-quantum signature value in the third temporary key request packet to obtain a key request packet. The sending module is also used to send the key request packet to the key management system.

[0341] In some implementations, the processor is further configured to generate a first temporary key request packet, and store the terminal's classical signature public key and the terminal's temporary post-quantum encryption public key in the first temporary key request packet to obtain a second temporary key request packet. The processor is also configured to store a classical signature identifier associated with the terminal's classical signature public key and a post-quantum signature identifier associated with the terminal's post-quantum signature public key in the second temporary key request packet to obtain a third temporary key request packet. The processor is further configured to sign the third temporary key request packet according to a classical signature algorithm associated with the terminal's classical signature public key to obtain a first classical signature value, and to sign the third temporary key request packet according to a post-quantum signature algorithm associated with the terminal's post-quantum signature public key to obtain a first post-quantum signature value. Finally, the processor stores the first classical signature value and the first post-quantum signature value in the third temporary key request packet to obtain a key request packet and sends the key request packet to the key management system.

[0342] Specifically, the Certificate Authority (CA) generates a first temporary key request packet. Next, the CA stores the terminal's classical signature public key and the terminal's temporary post-quantum encryption public key within the first temporary key request packet to obtain a second temporary key request packet. Then, the CA stores the classical signature identifier associated with the terminal's classical signature public key and the post-quantum signature identifier associated with the terminal's post-quantum signature public key within the second temporary key request packet to obtain a third temporary key request packet. Subsequently, the CA signs the third temporary key request packet using the classical signature algorithm associated with the terminal's classical signature public key to obtain a first classical signature value. Then, it signs the third temporary key request packet using the post-quantum signature algorithm associated with the terminal's post-quantum signature public key to obtain a first post-quantum signature value. Finally, the CA stores the first classical signature value and the first post-quantum signature value within the third temporary key request packet to obtain a key request packet. The key request packet is then sent to the key management system.

[0343] Thus, a key request packet is obtained by processing the first temporary key request packet, which stores the terminal classical signature public key and the terminal temporary post-quantum encryption public key, layer by layer through the post-quantum cryptography algorithm. This key request packet has good quantum resistance, and the key management system can ensure that the key request packet is not accessed without authorization during transmission based on the first classical signature value and the first post-quantum signature value on the key request packet.

[0344] Referring to Figure 17, in some implementations, the key request packet includes a second classical signature message and a second post-quantum signature message. Step 043 (generating a security certificate based on the request message and the key response packet) includes:

[0345] 0431: Upon receiving a key response packet from the key management system, the second classic signature message is verified according to the classic signature algorithm to obtain the second classic signature verification result;

[0346] 0432: Verify the second post-quantum signature message according to the post-quantum signature algorithm to obtain the second post-quantum signature verification result;

[0347] 0433: If both the second classical verification result and the second post-quantum verification result are correct, obtain the public key from the classical encryption key pair and the public key from the post-quantum encryption key pair from the key response packet;

[0348] 0434: Generate the classic signature certificate for the terminal's security certificate based on the terminal's classic signature public key;

[0349] 0435: Generate the classic encryption certificate for the terminal based on the public key in the classic encryption key pair;

[0350] 0436: Generate the post-quantum signature certificate for the terminal's security certificate based on the terminal's post-quantum signature public key;

[0351] 0437: Generate the post-quantum encryption certificate for the terminal security certificate based on the public key in the post-quantum encryption key pair.

[0352] In some implementations, the signature verification module is used to verify the second classical signature message according to the classical signature algorithm upon receiving a key response packet from the key management system, obtaining a second classical signature verification result. It also verifies the second post-quantum signature message according to the post-quantum signature algorithm, obtaining a second post-quantum signature verification result. The acquisition module is used to retrieve the public key from the classical encryption key pair and the public key from the post-quantum encryption key pair from the key response packet, provided both the second classical signature result and the second post-quantum signature result are correct. The derivation module is used to generate a classical signature certificate for the terminal in the security certificate based on the terminal's classical signature public key, and a classical encryption certificate for the terminal in the security certificate based on the public key in the classical encryption key pair. It also generates a post-quantum signature certificate for the terminal in the security certificate based on the terminal's post-quantum signature public key and a post-quantum encryption certificate for the terminal in the security certificate based on the public key in the post-quantum encryption key pair.

[0353] In some embodiments, the processor is further configured to, upon receiving a key response packet sent by the key management system, perform signature verification processing on the second classical signature message according to the classical signature algorithm to obtain a second classical signature verification result; and perform signature verification processing on the second post-quantum signature message according to the post-quantum signature algorithm to obtain a second post-quantum signature verification result; and, if both the second classical signature verification result and the second post-quantum signature verification result are correct, retrieve the public key from the classical encryption key pair and the public key from the post-quantum encryption key pair from the key response packet. The processor is also configured to generate a classical signature certificate for the terminal in the security certificate based on the terminal's classical signature public key; generate a classical encryption certificate for the terminal in the security certificate based on the public key from the classical encryption key pair; and generate a post-quantum signature certificate for the terminal in the security certificate based on the terminal's post-quantum signature public key and a post-quantum encryption certificate for the terminal in the security certificate based on the public key from the post-quantum encryption key pair.

[0354] Specifically, upon receiving a key response packet from the key management system, the Certificate Authority (CA) verifies the second classical signature message using the classical signature algorithm to obtain a second classical verification result. Then, it verifies the second post-quantum signature message using the post-quantum signature algorithm to obtain a second post-quantum verification result. Next, if both the second classical and post-quantum verification results are correct, the CA retrieves the public key from the classical encryption key pair and the public key from the post-quantum encryption key pair from the key response packet. Then, the CA generates a classical signature certificate for the terminal's security certificate based on the terminal's classical signature public key, and a classical encryption certificate for the terminal's security certificate based on the public key from the classical encryption key pair. Finally, it generates a post-quantum signature certificate for the terminal's security certificate based on the terminal's post-quantum signature public key, and a post-quantum encryption certificate for the terminal's security certificate based on the public key from the post-quantum encryption key pair.

[0355] In this way, after confirming that the signature verification results are correct, the certificate authentication center obtains the terminal's signature certificate, encryption certificate, post-quantum signature certificate, and post-quantum encryption certificate. These certificates can be used for the terminal's communication to protect the data during the terminal's communication process.

[0356] Please refer to Figure 18. In some embodiments, the method further includes:

[0357] 052: Sign the classic encryption certificate using the private key in the terminal's classic signature key pair to obtain the first classic encryption certificate signature in the security certificate;

[0358] 053: Sign the classical encryption certificate using the private key in the quantum signature key pair after the terminal to obtain the second classical encryption certificate signature in the security certificate.

[0359] In some implementations, the signature module is used to sign the classic encryption certificate using the private key in the terminal's classic signature key pair to obtain a first classic encryption certificate signature in the security certificate. The signature module is also used to sign the classic encryption certificate using the private key in the terminal's post-quantum signature key pair to obtain a second classic encryption certificate signature in the security certificate.

[0360] In some implementations, the processor is further configured to sign the classic encryption certificate using the private key in the terminal's classic signature key pair to obtain a first classic encryption certificate signature in the security certificate, and to sign the classic encryption certificate using the private key in the terminal's post-quantum signature key pair to obtain a second classic encryption certificate signature in the security certificate.

[0361] Specifically, the certificate authority signs the classic encryption certificate using the private key from the terminal's classic signature key pair to obtain the first classic encryption certificate signature in the security certificate. Then, the certificate authority signs the classic encryption certificate using the private key from the terminal's post-quantum signature key pair to obtain the second classic encryption certificate signature in the security certificate.

[0362] In this way, the certificate authority obtains a first classical encryption certificate signature and a second classical encryption certificate signature that can be used to verify the accuracy of the classical encryption certificate and confirm that the classical encryption certificate has not been accessed without authorization during transmission. Furthermore, the second classical encryption certificate signature obtained by signing the classical encryption certificate with the private key from the quantum signature key pair after the terminal has good quantum resistance.

[0363] Please refer to Figure 19. In some embodiments, the method further includes:

[0364] 054: Sign the classic signature certificate using the private key in the terminal's classic signature key pair to obtain the first classic signature certificate signature in the security certificate;

[0365] 055: Sign the classical signature certificate using the private key in the quantum signature key pair after the terminal to obtain the second classical signature certificate signature in the security certificate.

[0366] In some implementations, the signature module is used to sign the classic signature certificate using the private key in the terminal's classic signature key pair to obtain a first classic signature certificate signature in the security certificate. The signature module is also used to sign the classic signature certificate using the private key in the terminal's post-quantum signature key pair to obtain a second classic signature certificate signature in the security certificate.

[0367] In some implementations, the processor is further configured to sign the classic signature certificate using the private key in the terminal's classic signature key pair to obtain a first classic signature certificate signature in the security certificate, and to sign the classic signature certificate using the private key in the terminal's post-quantum signature key pair to obtain a second classic signature certificate signature in the security certificate.

[0368] Specifically, the Certificate Authority (CA) signs the classic signature certificate using the private key from the terminal's classic signature key pair to obtain the first classic signature certificate signature in the security certificate. Then, the CA signs the classic signature certificate using the private key from the terminal's post-quantum signature key pair to obtain the second classic signature certificate signature in the security certificate.

[0369] In this way, the certificate authority obtains a first classical signature certificate signature and a second classical signature certificate signature that can be used to verify the accuracy of the classical signature certificate and confirm that the classical signature certificate has not been signed by unauthorized access during transmission. Furthermore, the second classical signature certificate signature obtained by signing the classical signature certificate with the private key from the quantum signature key pair after the terminal has good quantum resistance.

[0370] Please refer to Figure 20. In some embodiments, the method further includes:

[0371] 056: Sign the post-quantum encryption certificate using the private key in the terminal's classic signature key pair to obtain the first post-quantum encryption certificate signature in the security certificate;

[0372] 057: Sign the post-quantum encryption certificate using the private key in the terminal post-quantum signature key pair to obtain the second post-quantum encryption certificate signature in the security certificate.

[0373] In some implementations, the signature module is used to sign the post-quantum encryption certificate using the private key in the terminal's classical signature key pair to obtain a first post-quantum encryption certificate signature in the security certificate. The signature module is also used to sign the post-quantum encryption certificate using the private key in the terminal's post-quantum signature key pair to obtain a second post-quantum encryption certificate signature in the security certificate.

[0374] In some implementations, the processor is further configured to sign the post-quantum cryptographic certificate using the private key in the terminal's classical signature key pair to obtain a first post-quantum cryptographic certificate signature in the security certificate, and to sign the post-quantum cryptographic certificate using the private key in the terminal's post-quantum signature key pair to obtain a second post-quantum cryptographic certificate signature in the security certificate.

[0375] Specifically, the certificate authority signs the post-quantum encryption certificate using the private key from the terminal's classical signature key pair to obtain the first post-quantum encryption certificate signature in the security certificate. Then, the certificate authority signs the post-quantum encryption certificate using the private key from the terminal's post-quantum signature key pair to obtain the second post-quantum encryption certificate signature in the security certificate.

[0376] In this way, the certificate authority obtains a first post-quantum encryption certificate signature and a second post-quantum encryption certificate signature that can be used to verify the accuracy of the post-quantum encryption certificate and confirm that the post-quantum encryption certificate has not been accessed without authorization during transmission. Furthermore, the second post-quantum encryption certificate signature obtained by signing the post-quantum encryption certificate using the private key from the terminal's post-quantum signature key pair also possesses good quantum resistance.

[0377] Please refer to Figure 21. In some embodiments, the method further includes:

[0378] 058: Sign the post-quantum signature certificate using the private key in the terminal's classic signature key pair to obtain the first post-quantum signature certificate signature in the security certificate;

[0379] 059: Sign the post-quantum signature certificate using the private key in the terminal post-quantum signature key pair to obtain the second post-quantum signature certificate signature in the security certificate.

[0380] In some implementations, the signature module is used to sign the post-quantum signature certificate using the private key in the terminal's classical signature key pair to obtain a first post-quantum signature certificate signature in the security certificate. The signature module is also used to sign the post-quantum signature certificate using the private key in the terminal's post-quantum signature key pair to obtain a second post-quantum signature certificate signature in the security certificate.

[0381] In some implementations, the processor is further configured to sign the post-quantum signature certificate using the private key in the terminal's classical signature key pair to obtain a first post-quantum signature certificate signature in the security certificate, and to sign the post-quantum signature certificate using the private key in the terminal's post-quantum signature key pair to obtain a second post-quantum signature certificate signature in the security certificate.

[0382] Specifically, the certificate authority signs the post-quantum signature certificate using the private key from the terminal's classical signature key pair to obtain the first post-quantum signature certificate signature in the security certificate. Then, the certificate authority signs the post-quantum signature certificate using the private key from the terminal's post-quantum signature key pair to obtain the second post-quantum signature certificate signature in the security certificate.

[0383] In this way, the certificate authority obtains a signature that can be used to verify the accuracy of the post-quantum signature certificate and to confirm that the post-quantum signature certificate has not been signed by a first post-quantum signature certificate or a second post-quantum signature certificate without authorization during transmission. Furthermore, the second post-quantum signature certificate signature obtained by signing the post-quantum signature certificate using the private key from the terminal's post-quantum signature key pair also possesses good quantum resistance.

[0384] Referring to Figure 22, in some embodiments, the key response packet includes a classical cryptographic envelope and a post-quantum cryptographic envelope. Step 044 (generating a response message based on the key response packet and the security certificate, and sending the response message to the terminal) includes:

[0385] 0441: The first classical cryptographic envelope signature is obtained by signing the classical cryptographic envelope according to the classical signature algorithm;

[0386] 0442: The classical cryptographic envelope is signed using the post-quantum signature algorithm to obtain the post-quantum signature of the first classical cryptographic envelope;

[0387] 0443: The first post-quantum cryptographic envelope signature is obtained by performing signature processing on the post-quantum cryptographic envelope according to the classical signature algorithm;

[0388] 0444: The post-quantum cryptographic envelope is signed using the post-quantum signature algorithm to obtain the post-quantum signature of the first post-quantum cryptographic envelope;

[0389] 0445: The classical cryptographic envelope is encrypted using the second quantum key to obtain the encrypted classical cryptographic envelope;

[0390] 0446: The encrypted quantum cryptographic envelope is obtained by encrypting the post-quantum cryptographic envelope using the second quantum key;

[0391] 0447: Send the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as a response message to the terminal.

[0392] In some implementations, the signature module is used to sign the classical cryptographic envelope according to a classical signature algorithm to obtain a first classical cryptographic envelope signature, and to sign the classical cryptographic envelope according to a post-quantum signature algorithm to obtain a post-quantum signature for the first classical cryptographic envelope. The module also handles signing the post-quantum cryptographic envelope according to both the classical signature algorithm and the post-quantum signature. The encryption module is used to encrypt the classical cryptographic envelope according to a second quantum key to obtain an encrypted classical cryptographic envelope, and to encrypt the post-quantum cryptographic envelope according to the second quantum key to obtain an encrypted post-quantum cryptographic envelope. The processing module sends the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as a response message to the terminal.

[0393] In some embodiments, the processor is further configured to: 1) Sign the classical cryptographic envelope according to a classical signature algorithm to obtain a first classical cryptographic envelope signature; 2) Sign the classical cryptographic envelope according to a post-quantum signature algorithm to obtain a first classical cryptographic envelope post-quantum signature; 3) Sign the post-quantum cryptographic envelope according to a classical signature algorithm to obtain a first post-quantum cryptographic envelope signature and a post-quantum cryptographic envelope post-quantum signature. The processor is also configured to: 1) Encrypt the classical cryptographic envelope according to a second quantum key to obtain an encrypted classical cryptographic envelope; 2) Encrypt the post-quantum cryptographic envelope according to the second quantum key to obtain an encrypted post-quantum cryptographic envelope; 3) Send the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as a response message to the terminal.

[0394] Specifically, the certificate authority (CA) signs the classical cryptographic envelope using a classical signature algorithm to obtain a first classical cryptographic envelope signature. Next, the CA performs the same process on the classical cryptographic envelope using a post-quantum signature algorithm to obtain a post-quantum signature for the first classical cryptographic envelope. Then, the CA performs the same process on the post-quantum cryptographic envelope using the same algorithm to obtain a first post-quantum cryptographic envelope signature. The CA then performs the same process on the post-quantum cryptographic envelope using the same algorithm to obtain a post-quantum signature for the first post-quantum cryptographic envelope. Subsequently, the CA encrypts the classical cryptographic envelope using a second quantum key to obtain an encrypted classical cryptographic envelope. Furthermore, the CA encrypts the post-quantum cryptographic envelope using the second quantum key to obtain an encrypted post-quantum cryptographic envelope. Finally, the CA sends the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as a response message to the terminal.

[0395] Thus, the certificate authority sends the corresponding message to the terminal, enabling the terminal to protect its communication data based on the security certificate in the response message. The first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, and the first post-quantum cryptographic envelope post-quantum signature in the response message can confirm that the response message has not been accessed without authorization during transmission. The encrypted classical cryptographic envelope and the encrypted post-quantum cryptographic envelope in the response message can protect the classical cryptographic envelope and the post-quantum cryptographic envelope.

[0396] Please refer to Figure 23. This application provides a quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network. The communication network includes a terminal, a certificate authentication center, and a key management system. The method is used in the key management system and includes:

[0397] 060: Receive a key request packet from the Certificate Authority;

[0398] 061: Generate a key response packet based on the key request packet and send the key response packet to the certificate authority.

[0399] This application also provides a key management system, including a memory and a processor. The method of this application can be implemented by the key management system of this application. Specifically, the memory stores a computer program, and the processor is used to receive key request packets sent by a certificate authority, generate key response packets based on the key request packets, and send the key response packets to the certificate authority.

[0400] This application also provides a quantum-security-enhancing device for a key management system. The method of this application can be implemented by the quantum-security-enhancing device for a key management system. Specifically, the quantum-security-enhancing device for a key management system includes a receiving module and a processing module. The receiving module receives key request packets sent by a certificate authority. The processing module generates a key response packet based on the key request packet and sends the key response packet to the certificate authority.

[0401] Specifically, the quantum security enhancement method of this embodiment is basically the same as the quantum security enhancement method of the aforementioned embodiment that takes the terminal as the execution target. For details, please refer to the explanation of the corresponding section. The difference is that this embodiment takes the key management system as the execution target, which will not be repeated here.

[0402] In summary, in the quantum-resistant security enhancement method, communication system, terminal, certificate authority, and key management system for online certificate issuance and key pair distribution in the communication network of this application, during the communication process where the terminal obtains a security certificate from the certificate authority and a key pair from the key management system, the terminal requests a first quantum key and uses the first quantum key to encrypt a quantum key identifier and a terminal key pair to generate a first encrypted message resistant to quantum computing attacks. The first quantum key has good quantum resistance. Next, the terminal generates a request message based on the first encrypted message, the terminal key pair, and the quantum key identifier, and sends the request message to the certificate authority. The certificate authority generates a key request packet based on the request message and sends the key request packet to the key management system. The key management system processes the key request packet using a post-quantum cryptography algorithm to obtain a key response packet, and then returns the key response packet to the certificate authority. The post-quantum cryptography algorithm is a series of encryption algorithms designed to resist quantum computing attacks. The certificate authority generates a security certificate based on the request message and the key response packet sent by the key management system, generates a response message based on the security certificate and the key response packet, and sends it to the terminal. In this way, quantum key distribution technology and post-quantum cryptography algorithms enhance the terminal's ability to resist quantum computing attacks during the communication process of obtaining security certificates from certificate authentication centers and key pairs from key management systems.

[0403] Please refer to Figure 24. In some embodiments, the method further includes:

[0404] 062: Obtain the management security certificate for the key management system from the certificate authority.

[0405] In some implementations, the acquisition module is used to obtain the management security certificate of the key management system from the certificate authority.

[0406] In some implementations, the processor is also used to obtain the management security certificate of the key management system from the certificate authority.

[0407] Specifically, the key management system obtains its management security certificate from the certificate authority.

[0408] In this way, the key management system obtains its own management security certificate, which can be used for encryption and decryption of subsequent processes.

[0409] Please refer to Figure 25. In some implementations, step 060 (receiving the key request packet sent by the certificate authority) includes:

[0410] 0601: Receive a key request packet sent by the Certificate Authority. The key request packet includes the terminal's classical signature public key, the terminal's temporary post-quantum encryption public key, the classical signature identifier associated with the terminal's classical signature public key, the post-quantum signature identifier associated with the terminal's post-quantum signature public key, the first classical signature value, and the first post-quantum signature value.

[0411] In some implementations, the receiving module is used to receive a key request package sent by the certificate authority. The key request package includes a terminal classical signature public key, a terminal temporary post-quantum encryption public key, a classical signature identifier associated with the terminal classical signature public key, a post-quantum signature identifier associated with the terminal post-quantum signature public key, a first classical signature value, and a first post-quantum signature value.

[0412] In some implementations, the processor is also configured to receive a key request packet sent by a certificate authority, the key request packet including a terminal classical signature public key, a terminal temporary post-quantum encryption public key, a classical signature identifier associated with the terminal classical signature public key, a post-quantum signature identifier associated with the terminal post-quantum signature public key, a first classical signature value, and a first post-quantum signature value.

[0413] Specifically, the key management system receives a key application package sent by the certificate authentication center. The key application package includes a terminal classical signature public key, a terminal temporary post-quantum encryption public key, a classical signature identifier associated with the terminal classical signature public key, a post-quantum signature identifier associated with the terminal post-quantum signature public key, a first classical signature value, and a first post-quantum signature value.

[0414] Thus, the key management system receives the terminal's classical signature public key, the terminal's temporary post-quantum encryption public key, the classical signature identifier associated with the terminal's classical signature public key, the post-quantum signature identifier associated with the terminal's post-quantum signature public key, the first classical signature value, and the first post-quantum signature value, which can be used for subsequent processes.

[0415] Please refer to Figure 26. In some embodiments, the method further includes:

[0416] 063: Verify the first classic signature value using the classic signature algorithm associated with the terminal's classic signature public key to obtain the first verification result;

[0417] 064: Verify the first post-quantum signature value using the post-quantum signature algorithm associated with the terminal's post-quantum signature public key to obtain the second verification result;

[0418] If both the first and second signature verification results are correct, generate a classical encryption key pair and a post-quantum encryption key pair for the terminal.

[0419] In some implementations, the signature verification module verifies the first classical signature value using a classical signature algorithm associated with the terminal's classical signature public key to obtain a first verification result. The signature verification module also verifies the first post-quantum signature value using a post-quantum signature algorithm associated with the terminal's post-quantum signature public key to obtain a second verification result. The derivation module generates a classical encryption key pair and a post-quantum encryption key pair for the terminal if both the first and second verification results are correct.

[0420] In some implementations, the processor is further configured to verify the first classical signature value using a classical signature algorithm associated with the terminal's classical signature public key, to obtain a first verification result; and to verify the first post-quantum signature value using a post-quantum signature algorithm associated with the terminal's post-quantum signature public key, to obtain a second verification result; and, if both the first and second verification results are correct, to generate a classical encryption key pair and a post-quantum encryption key pair for the terminal.

[0421] Specifically, the key management system verifies the first classical signature value using the classical signature algorithm associated with the terminal's classical signature public key, obtaining a first verification result. Next, the key management system verifies the first post-quantum signature value using the post-quantum signature algorithm associated with the terminal's post-quantum signature public key, obtaining a second verification result. Finally, if both the first and second verification results are correct, the key management system generates a classical encryption key pair and a post-quantum encryption key pair for the terminal.

[0422] In this way, after multiple signature verification processes, the key management system confirms that the received key application packet is correct, and then generates a classic encryption key pair and a post-quantum encryption key pair for the terminal. These can be used by the certificate authentication center to generate security certificates based on the classic encryption key pair and the post-quantum encryption key pair.

[0423] Referring to Figure 27, in some embodiments, step 061 (generating a key response packet based on the key request packet and sending the key response packet to the certificate authority) includes:

[0424] 0611: Generate a first temporary key response packet based on the key request packet;

[0425] 0612: Generate a second temporary key response packet based on the first temporary key response packet, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair;

[0426] 0613: Generate a third temporary key response packet based on the second temporary key response packet and the post-quantum encryption key pair;

[0427] 0614: Store the classical signature identifier and the post-quantum signature identifier in the third temporary key response packet to obtain the fourth temporary key response packet;

[0428] 0615: The fourth temporary key response packet is processed according to the classical signature algorithm and the post-quantum signature algorithm to obtain the key response packet;

[0429] 0616: Send the key response packet to the Certificate Authority.

[0430] In some implementations, the derivation module is used to generate a first temporary key response packet based on the key request packet, and a second temporary key response packet based on the first temporary key response packet, a temporary symmetric key randomly generated by the key management system, and a classical encryption key pair. A third temporary key response packet is generated based on the second temporary key response packet and a post-quantum encryption key pair. The storage module is further used to store the classical signature identifier and the post-quantum signature identifier in the third temporary key response packet, resulting in a fourth temporary key response packet. The processing module is used to process the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm to obtain a key response packet. The sending module is used to send the key response packet to a certificate authority.

[0431] In some implementations, the processor is further configured to generate a first temporary key response packet based on the key request packet; generate a second temporary key response packet based on the first temporary key response packet, a temporary symmetric key randomly generated by the key management system, and a classical encryption key pair; and generate a third temporary key response packet based on the second temporary key response packet and a post-quantum encryption key pair. The processor is also configured to store a classical signature identifier and a post-quantum signature identifier in the third temporary key response packet to obtain a fourth temporary key response packet; process the fourth temporary key response packet according to a classical signature algorithm and a post-quantum signature algorithm to obtain a key response packet; and send the key response packet to a certificate authority.

[0432] Specifically, the key management system generates a first temporary key response packet based on the key request packet. Next, it generates a second temporary key response packet based on the first temporary key response packet, a randomly generated temporary symmetric key, and a classical encryption key pair. Then, it generates a third temporary key response packet based on the second temporary key response packet and a post-quantum encryption key pair. The key management system then stores the classical signature identifier and the post-quantum signature identifier in the third temporary key response packet, resulting in a fourth temporary key response packet. Subsequently, the key management system processes the fourth temporary key response packet using classical and post-quantum signature algorithms to obtain the final key response packet. Finally, the key management system sends the key response packet to the certificate authority.

[0433] In this way, the key management system performs various operations based on post-quantum cryptography algorithms, classical cryptography algorithms, and other data information to generate a key response packet, and the certificate authentication system can generate a security certificate based on the key response packet.

[0434] Referring to Figure 28, in some embodiments, step 0612 (generating a second temporary key response packet based on the first temporary key response packet, a temporary symmetric key randomly generated by the key management system, and a classic encryption key pair) includes:

[0435] 06121: Encrypt the private key in the classic encryption key pair using the temporary symmetric key pair to obtain the classic encryption private key in the classic cryptographic envelope;

[0436] 06122: Sign the temporary symmetric key using the terminal's signature public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope;

[0437] 06123: Store the public key and classic cryptographic envelope from the classic encryption key pair in the first temporary key response packet to obtain the second temporary key response packet.

[0438] In some implementations, the encryption module is used to encrypt the private key in the classic encryption key pair using a temporary symmetric key to obtain the classic encryption private key in the classic cryptographic envelope. The signature module is also used to sign the temporary symmetric key using the terminal signing public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope. The storage module is used to store the public key in the classic encryption key pair and the classic cryptographic envelope in a first temporary key response packet to obtain a second temporary key response packet.

[0439] In some implementations, the processor is further configured to encrypt the private key in the classic encryption key pair using a temporary symmetric key to obtain the classic encryption private key in the classic cryptographic envelope; and to sign the temporary symmetric key using the terminal signing public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope; and to store the public key in the classic encryption key pair and the classic cryptographic envelope in a first temporary key response packet to obtain a second temporary key response packet.

[0440] Specifically, the key management system encrypts the private key in the classic encryption key pair using the temporary symmetric key to obtain the classic encryption private key in the classic cryptographic envelope. Next, the key management system signs the temporary symmetric key using the terminal signing public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope. Finally, the key management system stores the public key from the classic encryption key pair and the classic cryptographic envelope in the first temporary key response packet, resulting in the second temporary key response packet.

[0441] In this way, the key management system ensures the security of the private key in a classic encryption key pair during transmission, and ensures that only the terminal holding the corresponding private key can decrypt and use the temporary symmetric key.

[0442] Referring to Figure 29, in some embodiments, step 0613 (generating a third temporary key response packet based on the second temporary key response packet and the post-quantum encryption key pair) includes:

[0443] 06131: The third concatenation is obtained by concatenating a random number randomly generated by the key management system with a fixed string;

[0444] 06132: The first encryption key is obtained by performing post-quantum encryption on the third splice;

[0445] 06133: Perform post-quantum encryption encapsulation on the third splice to obtain the first encapsulated message in the post-quantum cryptographic envelope;

[0446] 06134: The private key in the post-quantum encryption key pair is encrypted using the first encryption key pair to obtain the post-quantum encryption private key in the post-quantum cryptographic envelope;

[0447] 06135: Store the public key and the post-quantum cryptographic envelope from the post-quantum cryptographic key pair in the second temporary key response packet to obtain the third temporary key response packet.

[0448] In some implementations, the concatenation module concatenates a random number randomly generated by the key management system with a fixed string to obtain a third concatenated body. The encryption module further performs post-quantum encryption on the third concatenated body to obtain a first encryption key. The encryption encapsulation module performs post-quantum encryption encapsulation on the third concatenated body to obtain a first encapsulated message in a post-quantum cryptographic envelope. The encryption module encrypts the private key in the post-quantum encryption key pair according to the first encryption key to obtain the post-quantum encryption private key in the post-quantum cryptographic envelope. The storage module stores the public key in the post-quantum encryption key pair and the post-quantum cryptographic envelope in a second temporary key response packet to obtain a third temporary key response packet.

[0449] In some implementations, the processor is further configured to concatenate a random number randomly generated by the key management system and a fixed string to obtain a third concatenated body; perform post-quantum encryption processing on the third concatenated body to obtain a first encryption key; and perform post-quantum encryption encapsulation processing on the third concatenated body to obtain a first encapsulated message in a post-quantum cryptographic envelope. The processor is further configured to encrypt the private key in the post-quantum encryption key pair according to the first encryption key to obtain a post-quantum encryption private key in the post-quantum cryptographic envelope; and store the public key in the post-quantum encryption key pair and the post-quantum cryptographic envelope in a second temporary key response packet to obtain a third temporary key response packet.

[0450] Specifically, the key management system concatenates a randomly generated number with a fixed string to obtain a third concatenated body. Next, the key management system performs post-quantum encryption on the third concatenated body to obtain a first encryption key. The key management system then performs post-quantum encryption encapsulation on the third concatenated body to obtain a first encapsulated message in a post-quantum cryptographic envelope. Then, the key management system encrypts the private key in the post-quantum encryption key pair using the first encryption key to obtain the post-quantum encryption private key in the post-quantum cryptographic envelope. Finally, the key management system stores the public key in the post-quantum encryption key pair and the post-quantum cryptographic envelope in a second temporary key response packet to obtain a third temporary key response packet.

[0451] Thus, the key management system uses the first encryption key generated by the post-quantum encryption algorithm to encrypt the private key in the post-quantum encryption key pair, ensuring the security of the private key in the post-quantum encryption key pair during transmission.

[0452] Referring to Figure 30, in some embodiments, step 0615 (processing the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm to obtain the key response packet) includes:

[0453] 06151: The second classic signature message is obtained by signing the fourth temporary key response packet according to the classic signature algorithm;

[0454] 06152: The second post-quantum signature message is obtained by performing post-quantum signature processing on the fourth temporary key response packet according to the post-quantum signature algorithm;

[0455] 06153: Store the second classical signature message and the second post-quantum signature message in the fourth temporary key response packet to obtain the key response packet.

[0456] In some implementations, the signature module is used to sign the fourth temporary key response packet according to a classical signature algorithm to obtain a second classical signature message, and to perform post-quantum signature processing on the fourth temporary key response packet according to a post-quantum signature algorithm to obtain a second post-quantum signature message. The storage module is further used to store the second classical signature message and the second post-quantum signature message in the fourth temporary key response packet to obtain a key response packet.

[0457] In some embodiments, the processor is further configured to perform signature processing on the fourth temporary key response packet according to a classical signature algorithm to obtain a second classical signature message; and to perform post-quantum signature processing on the fourth temporary key response packet according to a post-quantum signature algorithm to obtain a second post-quantum signature message; and to store the second classical signature message and the second post-quantum signature message in the fourth temporary key response packet to obtain a key response packet.

[0458] Specifically, the key management center signs the fourth temporary key response packet using a classical signature algorithm to obtain a second classical signature message. Next, the key management center performs post-quantum signature processing on the fourth temporary key response packet using a post-quantum signature algorithm to obtain a second post-quantum signature message. Finally, the key management center stores the second classical signature message and the second post-quantum signature message within the fourth temporary key response packet to obtain the key response packet.

[0459] In this way, the key management center processes the fourth temporary key response packet according to the post-quantum cryptography algorithm and the classical algorithm to obtain the key response packet, which can ensure that the key request packet is not accessed by unauthorized persons during transmission.

[0460] The following example illustrates the method of this application. In the embodiment described in this application, the terminal is a user terminal device using a user digital certificate issued by a Certificate Authority (CA) and a user key pair distributed by a key management system (KM). The CA issues a digital certificate to the user, including a signature certificate and an encryption certificate, and applies to the KM for the user's encryption key pair. The CA is typically directly connected to a cryptographic device, which performs the relevant cryptographic operations. In this embodiment, the CA and the cryptographic device are treated as a single entity, hereinafter referred to as the CA. The KM generates and distributes the encryption key pair of the terminal to the CA. The KM is also typically directly connected to the cryptographic device, which performs the relevant cryptographic and key operations. In this embodiment, the KM and the cryptographic device are treated as a single entity, hereinafter referred to as the KM. The quantum network node is a network node that stores and provides the generated quantum key to the device management center through a trusted channel or to the cryptographic device through a key service node. The key service node is a service node that connects to the quantum network node and provides pre-shared key injection and quantum key services to multiple cryptographic devices.

[0461] Please refer to Figure 31. The terminal's classic signature key pair is the user's SM2 signature key pair, the terminal's post-quantum signature key pair is the user's PQC signature key pair, and the terminal's post-quantum encryption key pair is the user's PQC temporary encryption key pair. The request message is an online certificate and key request message. The classic signature identifier associated with the terminal's classic signature public key is the SM2 algorithm identifier, and the post-quantum signature identifier associated with the terminal's post-quantum signature public key is the PQC signature algorithm identifier.

[0462] Before communication begins, the CA connects to the nearest authorized second quantum network node via a trusted channel. A trusted channel is a mechanism or protocol that provides a secure communication path between two entities. One way to establish this channel is for the authentication server and the second quantum network node to be located in the same rack and directly connected with shielded network cables. This channel ensures the confidentiality, integrity, and availability of data during transmission, preventing unauthorized access, tampering, or eavesdropping. Furthermore, the CA generates and issues SM2 and PQC signature root certificates. With these root certificates, the CA can issue various other certificates. Additionally, the CA issues SM2 and PQC signature certificates to the KM.

[0463] The terminal uses a key service node to pre-share a key to its personal cryptographic module, injecting a total of 1M bits of 128-bit key. The personal cryptographic module includes, but is not limited to, a Smart Cryptographic Key (HSM) and a Virtual Security Module (VSM). Next, the terminal sends a quantum key request to the key service node and randomly selects one of the Smart Cryptographic Keys as its protection key. The terminal then performs a hash operation (Hash-based Message Authentication Code, HMAC) on the key ID and request content using the SM3 algorithm and the protection key. Subsequently, the key service node also performs a hash operation on the key ID and request content using the SM3 algorithm and the protection key to verify the integrity and authenticity of the data. HMAC is a method that uses hash functions and keys to provide data integrity and source authentication.

[0464] After the quantum key application is successfully confirmed, the terminal receives the quantum key encryption result obtained by the key service node through encryption of the first quantum key QK_UUID-1 and the quantum key identifier UUID_QK using the protection key. The first quantum key QK_UUID-1 is generated and distributed to the key service node by the first quantum network node connected to the key service node. The quantum key identifier UUID_QK is obtained by the first quantum network node identifying the first quantum key QK_UUID-1 using its unique universal identifier. The terminal then decrypts the quantum key encryption result using the protection key to obtain the first quantum key QK_UUID-1 and the quantum key identifier UUID_QK.

[0465] The terminal uses personal cryptographic modules such as smart cryptographic keys to generate a user SM2 signature key pair, a user PQC signature key pair, and a user PQC temporary encryption key pair. Next, the terminal concatenates the public keys of the user SM2 signature key pair, the user PQC signature key pair, the user PQC temporary encryption key pair, and the quantum key identifier UUID_QK to obtain a first concatenated body T1. The terminal then uses the SM3 cryptographic hash algorithm and the first quantum key QK_UUID-1 to calculate the first encrypted message M1. Finally, the terminal sends the public keys of the user SM2 signature key pair, the user PQC signature key pair, the user PQC temporary encryption key pair, the quantum key identifier UUID_QK, and the first encrypted message M1 online as an online certificate and key request message to the CA.

[0466] Upon receiving the certificate and key request message from the terminal, the CA first sends a quantum key request to the second quantum network node directly connected to the CA, based on the quantum key identifier UUID_QK. After the quantum key request is approved, the second quantum network node sends a second quantum key QK_UUID-2 to the CA. The CA concatenates the public keys of the received user SM2 signature key pair, user PQC signature key pair, user PQC temporary encryption key pair, and quantum key identifier UUID_QK to obtain a second concatenated body T2. Then, it encrypts the second concatenated body T2 using the SM3 cryptographic hash algorithm and the second quantum key QK_UUID-2 to obtain a second encrypted message M2. The first encrypted message M1 and the second encrypted message M2 are then compared to confirm their consistency. If the first encrypted message M1 and the second encrypted message M2 are consistent, the CA is deemed to have received a correct request message.

[0467] Upon receiving the second quantum key QK_UUID-2 from the second quantum network node and confirming the correctness of the application message received by the CA, the CA generates a first temporary key request packet CARequest-1 according to the KM security protocol. Next, the CA stores the user's SM2 signature key pair and the user's PQC temporary encryption key pair in the user information substructure (userPubKey) of the user information substructure (AppUserInfo) of the key request structure (KSRequest) of the first temporary key request packet CARequest-1, thus obtaining the second temporary key request packet CARequest-2. Then, the CA stores the SM2 algorithm identifier and the PQC algorithm identifier in the signature algorithm structure signatureAlgorithm of the CARequest-2 structure, thus obtaining the third temporary key request packet CARequest-3. Finally, the CA uses the SM2 algorithm and the PQC algorithm to sign the third temporary key request packet CARequest-3 respectively, obtaining the first classical signature value and the first post-quantum signature value, and stores the first classical signature value and the first post-quantum signature value in the signature value of the third temporary key request packet CARequest-3, thus obtaining the key request packet CARequest. Finally, the CA sends the key request packet CARequest to the KM.

[0468] After receiving the key request packet CARequest from the CA, KM verifies the first classical signature value in the key request packet using the CA's SM2 signature root certificate to obtain a first verification result, and verifies the first post-quantum signature value using the PQC signature root certificate to obtain a second verification result. If both the first and second verification results are correct, KM generates an SM2 encryption key pair and a PQC encryption key pair for the terminal. KM generates a first temporary key response packet KMRespond-1 according to the KM security protocol. The ksRespond substructure of this first temporary key response packet KMRespond-1 contains at least two Respond response sub-packets, storing the public key from the SM2 encryption key pair and the classical cryptographic envelope in one Respond response sub-packet, resulting in the second temporary response packet KMRespond-2. In some implementations, the classical cryptographic envelope is generated as follows: KM uses a randomly generated temporary symmetric key to encrypt the private key in the SM2 encryption key pair to obtain the classical encryption private key in the classical cryptographic envelope, and then uses the public key from the SM2 signature key pair to encrypt the temporary symmetric key in the classical cryptographic envelope. The public key from the PQC encryption key pair and the post-quantum cryptographic envelope are stored in a Respond sub-packet to obtain the third temporary response packet KMRespond-3. In some implementations, the post-quantum cryptographic envelope is generated as follows: KM randomly generates a 256-bit random number R, and concatenates R with a 256-bit fixed string S agreed upon by KM and CA to obtain a third concatenated body P3, i.e., R|S. The third concatenated body P3 is encrypted using the PQC key encapsulation algorithm to obtain the first encryption key K. Then, the public key from the user's PQC temporary encryption key pair is used to encapsulate the third concatenated body P3 to obtain the first encapsulated message F1 in the post-quantum cryptographic envelope. Finally, KM uses the first encryption key K and the SM4 block cipher algorithm to encrypt the private key in the PQC encryption key pair to obtain the post-quantum encryption private key in the post-quantum cryptographic envelope.

[0469] Furthermore, KM stores the SM2 algorithm identifier and PQC algorithm identifier in the signatureAlgorithm structure within the KMRequest structure, resulting in the fourth temporary key response packet KMRespond-4. KM then signs the fourth temporary key response packet using the SM2 and PQC algorithms respectively, obtaining the second classical signature message and the second post-quantum signature message. These are then stored in the signatureValue field within the fourth temporary key response packet KMRespond-4, resulting in the key response packet KMRespond. KM then sends the key response packet KMRespond to the CA.

[0470] After receiving the key response packet KMRespond from KM, CA verifies the second classical signature message using KM's SM2 signing certificate to obtain the second classical verification result, and then verifies the second post-quantum signature message using KM's PQC signing certificate to obtain the second post-quantum verification result. If both the second classical and post-quantum verification results are correct, CA extracts the public key from the SM2 encryption key pair and the public key from the PQC encryption key pair from the Respond sub-packet within the key response packet KMRespond.

[0471] Then, the CA generates a classic signature certificate in the security certificate based on the public key in the user's SM2 signature key pair, a classic encryption certificate in the security certificate based on the public key in the SM2 encryption key pair, a post-quantum signature certificate in the security certificate based on the public key in the user's PQC signature key pair, and a post-quantum encryption certificate in the security certificate based on the public key in the PQC encryption key pair. Simultaneously with certificate issuance, the CA uses the SM2 signature algorithm to sign the classic signature certificate, classic encryption certificate, post-quantum signature certificate, and post-quantum encryption certificate respectively, obtaining the first classic signature certificate signature, the first classic encryption certificate signature, the first post-quantum signature certificate signature, and the first post-quantum encryption certificate signature in the classic signature certificate, the first post-quantum signature certificate signature, and the first post-quantum encryption certificate signature in the post-quantum signature certificate. Then, the PQC signature algorithm is used to sign the classic signature certificate, classic encryption certificate, post-quantum signature certificate, and post-quantum encryption certificate respectively, obtaining the second classic signature certificate signature, the second classic encryption certificate signature, the second post-quantum signature certificate signature, and the second post-quantum encryption certificate signature in the post-quantum encryption certificate.

[0472] Subsequently, the CA uses the SM2 signature algorithm and the PQC signature algorithm to sign the classical cryptographic envelope, obtaining the first classical cryptographic envelope signature and the first classical cryptographic envelope post-quantum signature. Then, the CA uses the SM2 signature algorithm and the PQC signature algorithm to sign the post-quantum cryptographic envelope, obtaining the first post-quantum cryptographic envelope signature and the first post-quantum cryptographic envelope post-quantum signature. Next, the CA encrypts the classical cryptographic envelope using the second quantum key and the SM4 block cipher algorithm, obtaining the encrypted classical cryptographic envelope. Finally, the CA encrypts the post-quantum cryptographic envelope using the second quantum key and the SM4 block cipher algorithm, obtaining the encrypted post-quantum cryptographic envelope. The CA sends the security certificate, the first classical cryptographic envelope signature, the first classical cryptographic envelope post-quantum signature, the first post-quantum cryptographic envelope signature, the first post-quantum cryptographic envelope post-quantum signature, the encrypted classical cryptographic envelope, and the encrypted post-quantum cryptographic envelope as a response message to the terminal.

[0473] Upon receiving the response message from the CA, the terminal first verifies the signature of the first classic signature certificate in the classic signature certificate issued by the CA using the CA's SM2 signature root certificate, and verifies the signature of the second classic signature certificate in the classic signature certificate issued by the CA using the PQC signature root certificate, confirming that the received classic signature certificate is correct. The terminal then verifies the signature of the first classic encryption certificate in the classic encryption certificate issued by the CA using the CA's SM2 signature root certificate, and verifies the signature of the second classic encryption certificate in the classic encryption certificate issued by the CA using the PQC signature root certificate, confirming that the received classic encryption certificate is correct. Finally, the terminal verifies the signature of the first post-quantum encryption certificate in the post-quantum encryption certificate issued by the CA using the CA's SM2 signature root certificate, and verifies the signature of the second post-quantum encryption certificate in the post-quantum encryption certificate issued by the CA using the PQC signature root certificate, confirming that the received post-quantum encryption certificate is correct. The terminal uses the CA's SM2 signature root certificate to verify the signature of the first post-quantum signature certificate in the post-quantum signature certificate issued by the CA, and uses the PQC signature root certificate to verify the signature of the second post-quantum signature certificate in the post-quantum signature certificate issued by the CA, to confirm that the received post-quantum signature certificate is correct.

[0474] Next, the terminal verifies the signature on the first classical cryptographic envelope using an SM2 signature certificate to obtain the first terminal verification result, and then verifies the post-quantum signature on the first classical cryptographic envelope using the PQC signature algorithm to obtain the second terminal verification result. If the first and second terminal verification results are correct, the terminal decrypts the encrypted classical cryptographic envelope using the first quantum key QK_UUID-1 and the SM4 block encryption algorithm to obtain the classical cryptographic envelope. Subsequently, the terminal verifies the signature on the first post-quantum cryptographic envelope using an SM2 signature certificate to obtain the third terminal verification result, and then verifies the post-quantum signature on the first post-quantum cryptographic envelope using the PQC signature algorithm to obtain the fourth terminal verification result. If the third and fourth terminal verification results are correct, the terminal decrypts the encrypted post-quantum cryptographic envelope using the first quantum key QK_UUID-1 and the SM4 block encryption algorithm to obtain the post-quantum cryptographic envelope.

[0475] Next, the terminal decrypts the temporary symmetric key in the classical cryptographic envelope using the private key from the terminal signature key pair to obtain the temporary symmetric key. Then, it decrypts the classical cryptographic private key using the temporary symmetric key to obtain the private key in the classical cryptographic key pair. Next, the terminal decapsulates the first encapsulated message F1 in the post-quantum cryptographic envelope to obtain the second concatenation. Then, the terminal obtains a fixed string S from the second concatenation to verify the correctness of the post-quantum cryptographic envelope. Then, if the post-quantum cryptographic envelope is correct, the terminal performs post-quantum encryption on the first concatenation to obtain the first encryption key K. Finally, it decrypts the post-quantum encryption private key in the post-quantum cryptographic envelope using the first encryption key K to obtain the private key in the post-quantum encryption key pair.

[0476] Ultimately, the terminal obtains the public and private keys from the classical encryption key pair, the public and private keys from the post-quantum encryption key pair, the classical encryption certificate, the classical signature certificate, the post-quantum encryption certificate, and the post-quantum signature certificate, which can be used in various communication processes of the terminal.

[0477] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0478] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the computing processing device according to the embodiments of this application. This application can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0479] For example, Figure 32 illustrates a computing processing device that can implement the method according to this application. This computing processing device conventionally includes a processor 1010 and a computer program product or computer-readable medium in the form of a memory 1020. The memory 1020 can be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. The memory 1020 has storage space 1030 for program code 1031 for performing any of the method steps described above. For example, the storage space 1030 for the program code can include various program codes 1031 respectively for implementing the various steps in the above method. These program codes can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact discs (CDs), memory cards, or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to Figure 33. The storage unit can have storage segments, storage spaces, etc., arranged similarly to the memory 1020 in the computing processing device of Figure 32. The program code can be compressed, for example, in a suitable form. Typically, the storage unit includes computer-readable code 1031', which is code that can be read by a processor such as 1010, which, when run by a computing processing device, causes the computing processing device to perform the various steps in the method described above.

[0480] It is understood that a computer program includes computer program code. Computer program code can be in the form of source code, object code, executable files, or some intermediate form. Computer-readable storage media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, external hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc.

[0481] In this specification, the terms "specifically," "furthermore," "particularly," "understandably," etc., refer to specific features, structures, materials, or characteristics described in connection with embodiments or examples that are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0482] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as will be understood by those skilled in the art to which embodiments of this application pertain.

[0483] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

A quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks, wherein, The communication network includes a terminal, a certificate authentication center, and a key management system. The method is used on the terminal and includes: The first quantum key and quantum key identifier are obtained from the first network node connected to the terminal; The first encrypted message is obtained by encrypting the quantum key identifier and the randomly generated terminal key pair using the first quantum key; An application message is generated based on the first encrypted message, the terminal key pair, and the quantum key identifier, and the application message is sent to the certificate authentication center. The terminal receives a response message sent by the certificate authority, enabling it to communicate with other terminals in the communication network using the response message. The response message includes a key response packet and a security certificate. The key response packet is generated by the key management system based on a key request packet sent by the certificate authority, and the key request packet is generated by the certificate authority based on the request message. The security certificate is generated by the certificate authority based on the request message and the key response packet sent by the key management system. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks according to claim 1, wherein, The method for obtaining the first key and quantum key identifier from the first network node connected to the terminal includes: The service node is used to fill the cryptographic module of the terminal with multiple keys; A quantum key request is sent to the service node. The quantum key request is protected by a protection key, which is one of a plurality of keys randomly used from the cryptographic modules. The service node receives a quantum key encryption result obtained by encrypting the first quantum key and the quantum key identifier according to the protection key. The first quantum key is generated and distributed to the service node by a first network node connected to the service node. The quantum key identifier is obtained by the first network node identifying the first quantum key according to the identification code of the first network node. The quantum key encryption result is decrypted to obtain the first quantum key and the quantum key identifier. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks according to claim 2, wherein, The step of encrypting the quantum key identifier and the randomly generated terminal key pair according to the first quantum key to obtain the first encrypted message includes: The terminal key pair is randomly generated according to the cryptographic module of the terminal. The terminal key pair includes a terminal classical signature key pair, a terminal post-quantum signature key pair, and a terminal post-quantum encryption key pair. The terminal public key and the quantum key identifier are concatenated to obtain the first concatenation. The terminal public key includes the terminal classical signature public key of the terminal classical signature key pair, the terminal post-quantum signature public key of the terminal post-quantum signature key pair, and the terminal temporary post-quantum encryption public key of the terminal post-quantum encryption key pair. The first splice is encrypted using the first quantum key to obtain the first encrypted message. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks according to claim 3, wherein, The security certificate includes a classic encryption certificate, a first classic encryption certificate signature, and a second classic encryption certificate signature. The method further includes: The signature verification result of the first classic encryption certificate is obtained by performing a signature verification process on the signature of the first classic encryption certificate based on the classic signature public key of the terminal. The signature verification result of the second classical encryption certificate is obtained by performing a signature verification process on the signature of the second classical encryption certificate based on the quantum signature public key of the terminal. If the verification results of the first and second classic encryption certificates are correct, the classic encryption certificate is confirmed to be correct. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks according to claim 3, wherein, The security certificate includes a classic signature certificate, a first classic signature certificate signature, and a second classic signature certificate signature. The method further includes: The signature verification process is performed on the first classic signature certificate based on the terminal's classic signature public key to obtain the signature verification result of the first classic signature certificate. The second classical signature certificate is verified by using the quantum signature public key of the terminal to obtain the verification result of the second classical signature certificate. If the verification results of the first classic signature certificate and the second classic signature certificate are correct, the classic signature certificate is confirmed to be correct. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks according to claim 3, wherein, The security certificate includes a post-quantum encryption certificate, a first post-quantum encryption certificate signature, and a second post-quantum encryption certificate signature; the method further includes: The signature of the first post-quantum encryption certificate is verified using the terminal's classical signature public key to obtain the signature verification result of the first post-quantum encryption certificate. The signature verification result of the second post-quantum encryption certificate is obtained by performing a signature verification process on the signature of the second post-quantum encryption certificate based on the terminal post-quantum signature public key. If the verification results of the first and second post-quantum encryption certificates are correct, the post-quantum encryption certificate is confirmed to be correct. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks according to claim 3, wherein, The security certificate includes a post-quantum signature certificate, a first post-quantum signature certificate signature, and a second post-quantum signature certificate signature; the method further includes: The signature verification result of the first post-quantum signature certificate is obtained by performing a signature verification process on the signature of the first post-quantum signature certificate based on the classical signature public key of the terminal. The signature verification result of the second post-quantum signature certificate is obtained by performing a signature verification process on the signature of the second post-quantum signature certificate based on the terminal post-quantum signature public key. If the verification results of the first and second post-quantum signature certificates are correct, the post-quantum signature certificate is confirmed to be correct. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks according to claim 3, wherein, The response message includes a first classical cryptographic envelope signature, a first classical cryptographic envelope followed by a quantum signature, a first post-quantum cryptographic envelope signature, a first post-quantum cryptographic envelope followed by a quantum signature, an encrypted classical cryptographic envelope, and an encrypted post-quantum cryptographic envelope. The method further includes: The signature of the first classic cryptographic envelope is verified to obtain the signature verification result of the first terminal. The quantum signature of the first classical cryptographic envelope is then verified to obtain the verification result of the second terminal. The signature of the first quantum cryptographic envelope is verified to obtain the signature verification result of the third terminal. The quantum signature of the first quantum cryptographic envelope is verified to obtain the verification result of the fourth terminal. If the signature verification results of the first terminal, the second terminal, the third terminal, and the fourth terminal are all correct, the encrypted classical cryptographic envelope is decrypted using the first quantum key to obtain the classical cryptographic envelope. The encrypted quantum cryptographic envelope is decrypted using the first quantum key to obtain the post-quantum cryptographic envelope. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 8, wherein, The method further includes: The temporary symmetric key is obtained by decrypting the encrypted temporary symmetric key in the classic cryptographic envelope using the private key in the classic signature key pair of the terminal. The private key in the classic cryptographic envelope is decrypted using the temporary symmetric key to obtain the private key in the classic cryptographic key pair. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 8, wherein, The method further includes: The first encapsulated message in the post-quantum cryptography envelope is decapsulated to obtain the second concatenation; A fixed string is obtained based on the second concatenation to confirm the correctness of the post-quantum cryptographic envelope; If the post-quantum cryptographic envelope is correct, perform post-quantum encryption on the first splice to obtain the first encryption key; The post-quantum encryption private key in the post-quantum cryptographic envelope is decrypted using the first encryption key to obtain the private key in the post-quantum encryption key pair. A quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks, wherein, The communication network includes a terminal, a certificate authentication center, and a key management system. The method is used by the certificate authentication center and includes: The terminal receives an application message, wherein the application message is generated by the terminal based on a terminal key pair, a quantum key identifier, and a first encrypted message. The terminal key pair is randomly generated by the terminal, the quantum key identifier is obtained by the terminal from the first network node it accesses, and the first encrypted message is obtained by encrypting the quantum key identifier and the terminal key pair with a first quantum key pair. The first quantum key is obtained by the terminal from the first network node it accesses. Generate a key request package based on the request message, and send the key request package to the key management system; Receive a key response packet sent by the key management system, the key response packet being generated by the key management system based on the key request packet; Generate a security certificate based on the application message and the key response packet; A response message is generated based on the key response packet and the security certificate, and the response message is sent to the terminal so that the terminal can use the response message to communicate with other terminals in the communication network besides itself. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 11, wherein, The method further includes: Access to the second network node via a pre-established channel; Issue security certificates to the aforementioned certificate authority. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 11, wherein, The method further includes: The quantum key request is sent to the second network node connected to the certificate authentication center according to the quantum key identifier; Receive the second quantum key distributed by the second network node according to the quantum key request. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 13, wherein, The application message includes the first encrypted message, a terminal classical signature key pair, a terminal post-quantum signature key pair, a terminal post-quantum encryption key pair, and the quantum key identifier. The method further includes: The terminal classical signature public key in the terminal classical signature key pair, the terminal post-quantum signature public key in the terminal post-quantum signature key pair, the terminal temporary post-quantum encryption public key in the terminal post-quantum encryption key pair, and the quantum key identifier are concatenated to obtain a second concatenated body; The second splice is encrypted using the second quantum key to obtain the second encrypted message; The correctness of the received terminal classical signature public key, terminal post-quantum signature public key, terminal temporary post-quantum encryption public key, and quantum key identifier is confirmed based on the second encrypted message and the first encrypted message. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 14, wherein, The step of generating a key request package based on the request message and sending the key request package to the key management system includes: Generate a first temporary key request packet based on the terminal key pair; The terminal classical signature public key and the terminal temporary post-quantum encryption public key are stored in the first temporary key request package to obtain the second temporary key request package; The classic signature identifier associated with the classic signature public key of the terminal and the post-quantum signature identifier associated with the post-quantum signature public key of the terminal are stored in the second temporary key request package to obtain the third temporary key request package; The third temporary key request packet is signed using the classic signature algorithm associated with the classic signature public key of the terminal to obtain the first classic signature value; The third temporary key application packet is signed using a post-quantum signature algorithm associated with the post-quantum signature public key of the terminal to obtain a first post-quantum signature value; The first classical signature value and the first post-quantum signature value are stored in the third temporary key request package to obtain the key request package; The key request packet is sent to the key management system. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 15, wherein, The key request packet includes a second classical signature message and a second post-quantum signature message. The step of generating a security certificate based on the request message and the key response packet includes: Upon receiving a key response packet from the key management system, the second classic signature message is verified according to the classic signature algorithm to obtain the second classic signature verification result. The second post-quantum signature message is verified according to the post-quantum signature algorithm to obtain the second post-quantum signature verification result. If both the second classical signature verification result and the second post-quantum signature verification result are correct, the public key in the classical encryption key pair and the public key in the post-quantum encryption key pair are obtained from the key response packet. Generate the classic signature certificate in the security certificate for the terminal based on the terminal's classic signature public key; Generate the classic encryption certificate in the security certificate for the terminal based on the public key in the classic encryption key pair; Generate the post-quantum signature certificate in the security certificate for the terminal based on the terminal's post-quantum signature public key; The post-quantum encryption certificate in the security certificate is generated for the terminal based on the public key in the post-quantum encryption key pair. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 16, wherein, The method further includes: The first classic encryption certificate signature in the security certificate is obtained by signing the classic encryption certificate with the private key in the classic signature key pair of the terminal. The classical encryption certificate is signed using the private key in the quantum signature key pair after the terminal is used to obtain the second classical encryption certificate signature in the security certificate. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 16, wherein, The method further includes: The first classic signature certificate signature in the security certificate is obtained by signing the classic signature certificate with the private key in the classic signature key pair of the terminal. The classical signature certificate is signed using the private key in the quantum signature key pair after the terminal is used to obtain the second classical signature certificate signature in the security certificate. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 16, wherein, The method further includes: The first post-quantum encryption certificate signature in the security certificate is obtained by signing the post-quantum encryption certificate with the private key in the terminal classic signature key pair. The second post-quantum encryption certificate signature in the security certificate is obtained by signing the post-quantum encryption certificate with the private key in the terminal post-quantum signature key pair. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 16, wherein, The method further includes: The first post-quantum signature certificate signature in the security certificate is obtained by signing the post-quantum signature certificate using the private key in the terminal classic signature key pair. The second post-quantum signature certificate signature in the security certificate is obtained by signing the post-quantum signature certificate with the private key in the terminal post-quantum signature key pair. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 15, wherein, The key response packet includes a classical cryptographic envelope and a post-quantum cryptographic envelope. The step of generating a response message based on the key response packet and the security certificate, and sending the response message to the terminal, includes: The classic cryptographic envelope is signed using the classic signature algorithm to obtain the first classic cryptographic envelope signature. The classical cryptographic envelope is signed using the post-quantum signature algorithm to obtain the first classical cryptographic envelope post-quantum signature. The post-quantum cryptographic envelope is signed using the classical signature algorithm to obtain the first post-quantum cryptographic envelope signature. The post-quantum cryptographic envelope is signed using the post-quantum signature algorithm to obtain the first post-quantum cryptographic envelope post-quantum signature. The classical cryptographic envelope is encrypted using the second quantum key to obtain an encrypted classical cryptographic envelope. The encrypted quantum cryptographic envelope is obtained by encrypting the post-quantum cryptographic envelope using the second quantum key. The security certificate, the signature of the first classical cryptographic envelope, the quantum signature of the first classical cryptographic envelope, the signature of the first quantum cryptographic envelope, the quantum signature of the first quantum cryptographic envelope, the encrypted classical cryptographic envelope, and the encrypted quantum cryptographic envelope are sent as a response message to the terminal. A quantum-resistant security enhancement method for online certificate issuance and key pair distribution in communication networks, wherein, The communication network includes a terminal, a certificate authentication center, and a key management system. The method is used in the key management system and includes: The terminal receives a key request packet sent by the certificate authentication center, wherein the key request packet is generated by the certificate authentication center based on a request message, the request message is generated by the terminal based on a terminal key pair, a quantum key identifier, and a first encrypted message, the terminal key pair is randomly generated by the terminal, the quantum key identifier is obtained by the terminal from the first network node it accesses, and the first encrypted message is obtained by encrypting the quantum key identifier and the terminal key pair with a first quantum key, the first quantum key being obtained by the terminal from the first network node it accesses. A key response packet is generated based on the key request packet, and the key response packet is sent to the certificate authority. The certificate authority generates a security certificate based on the request message and the key response packet, and sends a response message generated based on the security certificate and the key response packet to the terminal, so that the terminal can use the response message to communicate with other terminals in the communication network besides itself. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 22, wherein, The method further includes: Obtain the management security certificate for the key management system from the certificate authentication center. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 22, wherein, The receipt of the key request packet sent by the certificate authentication center includes: The system receives a key request packet sent by the certificate authentication center. The key request packet includes a terminal classical signature public key, a terminal temporary post-quantum encryption public key, a classical signature identifier associated with the terminal classical signature public key, a post-quantum signature identifier associated with the terminal post-quantum signature public key, a first classical signature value, and a first post-quantum signature value. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 24, wherein, The method further includes: The first classic signature value is verified using the classic signature algorithm associated with the classic signature public key of the terminal to obtain the first verification result; The first post-quantum signature value is verified using the post-quantum signature algorithm associated with the post-quantum signature public key of the terminal to obtain a second verification result; If both the first and second signature verification results are correct, a classic encryption key pair and a post-quantum encryption key pair are generated for the terminal. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 25, wherein, The step of generating a key response packet based on the key request packet and sending the key response packet to the certificate authentication center includes: Generate a first temporary key response packet based on the key request packet; A second temporary key response packet is generated based on the first temporary key response packet, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair; A third temporary key response packet is generated based on the second temporary key response packet and the post-quantum encryption key pair; The classical signature identifier and the post-quantum signature identifier are stored in the third temporary key response packet to obtain the fourth temporary key response packet; The key response packet is obtained by processing the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm; The key response packet is sent to the certificate authority. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 26, wherein, The step of generating a second temporary key response packet based on the first temporary key response packet, the temporary symmetric key randomly generated by the key management system, and the classic encryption key pair includes: The private key in the classic encryption key pair is encrypted using the temporary symmetric key to obtain the classic encryption private key in the classic cipher envelope. The temporary symmetric key is signed using the terminal signature public key to obtain the encrypted temporary symmetric key in the classic cryptographic envelope; The public key of the classic encryption key pair and the classic cryptographic envelope are stored in the first temporary key response packet to obtain the second temporary key response packet. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 26, wherein, The step of generating a third temporary key response packet based on the second temporary key response packet and the post-quantum encryption key pair includes: The third concatenation is obtained by concatenating the random number randomly generated by the key management system with a fixed string. The first encryption key is obtained by performing post-quantum encryption processing on the third splice; The third splice is subjected to post-quantum encryption encapsulation processing to obtain the first encapsulated message in the post-quantum cryptographic envelope; The post-quantum encryption private key in the post-quantum encryption key pair is obtained by encrypting the private key in the post-quantum cryptographic envelope using the first encryption key. The public key in the post-quantum cryptographic key pair and the post-quantum cryptographic envelope are stored in the second temporary key response packet to obtain the third temporary key response packet. The quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to claim 26, wherein, The step of processing the fourth temporary key response packet according to the classical signature algorithm and the post-quantum signature algorithm to obtain the key response packet includes: The second classic signature message is obtained by signing the fourth temporary key response packet according to the classic signature algorithm. The fourth temporary key response packet is processed using the post-quantum signature algorithm to obtain the second post-quantum signature message. The second classical signature message and the second post-quantum signature message are stored in the fourth temporary key response packet to obtain the key response packet. A computing processing device, wherein, include: Memory containing computer-readable code; One or more processors, when the computer-readable code is executed by the one or more processors, the computing processing device performs a quantum-resistant security enhancement method for online certificate issuance and key pair distribution of a communication network as described in any one of claims 1-10, 11-21, or 22-29. A computer program comprising computer-readable code, which, when executed on a computing processing device, causes the computing processing device to perform a quantum-resistant security enhancement method for online certificate issuance and key pair distribution in a communication network according to any one of claims 1-10, 11-21, or 22-29. A computer-readable medium storing the computer program as described in claim 31.

Images