418 results about "Key exchange" patented technology

The invention belongs to the technical field of digital information transmission, and relates to a vehicle-mounted ad hoc network security communication system and method based on an NTRU lattice cryptosystem, and the system comprises a message signature module, a message encryption module, a message decryption module, an identity authentication module, and a key exchange module. The message signature module carries out signature by utilizing a private key and a random polynomial dynamically generated by a pseudo-random number generator based on an NTRU lattice cryptosystem; the message encryption module encrypts a to-be-sent message by randomly selecting a temporary polynomial and combining a public key of a receiver; the message decryption module is used for decrypting the received ciphertext # imgabs1 # by using a private key and an inverse element # imgabs0 # of a module p of the private key; the identity authentication module is used for performing identity authentication; the key exchange module realizes secure key exchange between communication nodes in the vehicle-mounted ad hoc network through an improved Blom key distribution protocol. The system improves the security and communication efficiency of the vehicle-mounted network.

The invention relates to the technical field of commercial password detection methods, and discloses a high-security method for negotiating a temporary session key based on a national secret algorithm, and the commercial password detection method comprises the following steps: initialization and identity authentication: two communication parties generate an SM2 public and private key pair, and the identity is verified through a digital certificate and an SM2 signature; temporary key negotiation: generating a shared key point based on an SM2 key exchange protocol; session key derivation: generating a temporary session key by using an SM3 hash algorithm; key confirmation and encrypted communication: verifying the key through an SM4 algorithm and encrypting communication data; according to the high-security method for negotiating the temporary session key based on the national secret algorithm, efficient key negotiation of both communication parties in an unsecure channel is realized through an SM2 key exchange protocol, an SM3 hash algorithm and an SM4 symmetric encryption algorithm. The method combines digital certificate authentication, dynamic random numbers and timestamps, has forward security, replay attack resistance and man-in-the-middle attack resistance, and is suitable for high-security scenes such as finance and government affairs.

The invention discloses an anti-quantum security identity authentication method and system, a medium and equipment. The method comprises the following steps: S1, a client, a service server and a key distribution center perform key configuration by adopting a digital signature algorithm; s2, the client sends an authentication request to the authentication server, and receives an authentication response with a bill granted bill returned by the authentication server; s3, the client sends a bill request to the bill issuing server, and receives a bill response with the service bill returned by the bill issuing server; s4, the client generates a client key exchange public key by adopting a first key exchange algorithm and sends an access request, the service server calculates a shared key and a ciphertext after receiving the public key, generates an access response comprising the ciphertext and identity information encrypted by using the shared key, and returns the access response to the client; and S5, the client receives the access response and obtains the shared key, and performs encrypted communication with the service server by using the shared key. The method has forward safe quantum attack resistance and strong identity authentication.

The invention relates to the technical field of quantum key distribution, and discloses a communication protocol security verification method based on quantum key distribution, which comprises the following steps of: establishing a quantum communication channel framework, loading protocol parameters to generate an initial security verification model, configuring a security state transition rule, and performing cross-layer data fusion in combination with quantum entity parameters; and obtaining a whole-process safety tracking model. And executing security path deduction through the model, generating a key exchange trajectory chain, constructing security trajectory simulation data, establishing a quantum conflict resolution mechanism, training and generating a security policy optimization model, and outputting security governance parameters. Security increment simulation information is generated based on security governance parameters and the like, a multi-target decision model is constructed in combination with protocol evolution constraint conditions, optimal security path parameters are adjusted and generated, a security verification strategy is verified and updated through a real-time quantum mapping network, and a whole-process security matching target is achieved. According to the method, the comprehensiveness, the accuracy and the dynamic adaptability of quantum communication protocol security verification are effectively improved.

A method and system for optimizing compute runtime and memory footprint of a linear transformation process are provided. The method includes determining a set of optimal rotation parameters, wherein the optimal rotation parameters provide an optimal tradeoff between runtime compute resources and a memory footprint for a runtime execution of the linear transformation process; initializing the linear transformation process to run a boosting technique with the determined set of optimal rotation parameters, wherein the boosting technique, when executed at runtime as part of the linear transformation process, performs at least one iteration that yields rotated ciphertexts, and wherein the at least one iteration is based on the determined set optimal rotation parameters and at least one key switching key (KSK); and loading the initialized linear transformation process to an internal memory of a hardware accelerator.

The invention provides an IKE (Internet Key Exchange) protocol security enhancement method based on PUF (Physical Unclonable Function) dynamic authentication and a post-quantum mixed key, which organically combines a PUF, a post-quantum cryptographic algorithm (PQC, especially Kyber KEM) and an improved Internet Key Exchange Protocol (IKE) to realize key exchange of post-quantum security and enhanced identity authentication. The method comprises the following steps: generating a dynamic pre-shared key (PSK) by utilizing the PUF; the method comprises the following steps: integrating a Kyber KEM to an IKE protocol, and replacing traditional Diffie-Hellman key exchange; the PUF-driven dynamic PSK is used as an identity authentication method of the IKE; meanwhile, Kyber KEM and ECDH are adopted for key exchange, and a final session key is generated through joint participation of a Kyber negotiation key, an ECDH negotiation key and PSK derived by PUF; and an IKE protocol process is optimized, and Kyber key exchange and PUF (Physical Unclonable Function) authentication are completed in an IKESAINIT stage and an IKEINTERMEDIATE stage. According to the method, key exchange is post-quantum secure, identity authentication is also post-quantum secure, and the final key integrates three key components of Kyber, ECDH and PUF, so that triple security assurance is provided.

The invention discloses an IPSec (Internet Protocol Security) VPN (Virtual Private Network) security gateway communication method fused with a post quantum cryptography technology, which comprises the following steps of: S1, in a first-stage main mode of IKE (Internet Key Exchange) key agreement, replacing a traditional single SM2 algorithm and a digital certificate based on an SM2 cryptographic algorithm with an SM2 and PQC mixed algorithm and a mixed PQC digital certificate; s2, the initiator and the responder respectively use the PQC encryption key pair and the PQC signature key pair to carry out key exchange and data signature, and simultaneously use the SM2 encryption key pair and the SM2 signature key pair to carry out key exchange and data signature; s3, in the message 1, the initiator sends a security alliance load containing the attribute of the fused SM2 and PQC algorithm to the responder; s4, in the message 2, the responder feeds back a PQC series hybrid certificate and an SA proposal; and S5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification. According to the invention, the security of the IPSec VPN security gateway can be improved, and quantum computing attacks can be resisted.

A method and system of the device may include identifying, in an FHE program, key-switching operations occurring after a ModRaise operation. In addition, the device may include determining a first aggregated polynomial sum and a second aggregated polynomial sum; and configuring instructions for performing a MultSum operation based on the determined first aggregated polynomial sum and the second aggregated polynomial sum, the instructions are programmed to be executed during runtime, where the MultSum operation outputs two polynomials, each of which is an inner product between a single cyphertext polynomial and the first aggregated polynomial sum and a single cyphertext polynomial and the second aggregated polynomial sum, thereby reducing memory usage and computational overhead and enhancing key-switching efficiency.

The invention relates to the technical field of audio and video transmission, in particular to an internal and external network audio and video secure transmission method and system based on a cloud platform. By combining the load balancing technology with the real-time load state and the audio and video stream characteristics of the cloud platform, the encrypted traffic can be dynamically distributed to a plurality of back-end servers, and the calculation overhead in the encryption process can be effectively reduced through selection of the lightweight asymmetric encryption algorithm and the optimized key exchange process; in a handshake stage, by optimizing a key negotiation process and adjusting a key exchange process according to segmentation characteristics, the execution efficiency of a protocol is further improved, and by dynamically adjusting the execution opportunity of encryption operation, it is ensured that the encryption operation is executed at a proper opportunity, and the encryption efficiency is improved. By monitoring and adjusting the load distribution strategy and the encryption parameters in real time, the system operation mode can be dynamically adjusted according to the distortion degree and the transmission state of the audio and video streams, and the distortion degree of the audio and video streams is effectively reduced.

The invention discloses a network communication dynamic encryption method, an encryption and decryption system, equipment, a medium and a product, and relates to the technical field of communication. The method comprises the steps that a dynamic factor is obtained through a Berkley packet filter function, a key is generated based on the dynamic factor, the key generated based on the dynamic factor has high randomness and unpredictability, and the problem that a fixed key is adopted in a traditional encryption mode, and consequently the key is prone to being cracked can be solved; moreover, by using the execution environment of the Berkley packet filter function in the kernel mode, the risk that the key is stolen in the transmission and storage process is reduced, the influence on the network communication performance is small, and the network communication encryption efficiency and the network communication security are improved. Moreover, the information of network communication is used as the basis of key generation, additional key distribution and storage management processes are not needed, complex key exchange and certificate management mechanisms are not needed, the key management process is simplified, and the operation and maintenance cost of the system is reduced.

The invention discloses a cross-domain authentication bridging method and system oriented to industrial Internet of Things interconnection, and belongs to the technical field of Internet of Things security, and the method comprises the steps of system initialization, cross-domain bridging, certificate verification, key exchange and secure communication, dynamic certificate updating and management and the like. According to the method, technical means such as ChaCha20, Poly1305, BLAKE2s, Ed25519, an elliptic curve Diffie-Hellman and the like are comprehensively utilized, a Bloom filter and a Merkle tree are utilized to realize incremental updating and rapid verification of a revoked list, and dynamic key generation and seamless switching are completed through domain division management. Therefore, the system has the characteristics of low time delay, high safety and fault tolerance, is suitable for large-scale industrial scenes, can remarkably reduce the bandwidth and calculation overhead, improves the equipment interconnection efficiency, enhances the safety, and is suitable for industrial field multi-domain collaboration.

The invention relates to the technical field of communication security, in particular to a security authentication method and system and electronic equipment, and the method comprises the steps: sending an algorithm support list, a mixed key exchange parameter, a first random number and a first certificate request to a second terminal, and enabling the second terminal to generate a second handshake key and a ciphertext; and determining the first handshake key and verifying the target first certificate chain sent by the second terminal by using the first handshake key to obtain an authentication result. Identity authentication is performed based on the mixed key exchange parameter, so that the terminal has the security of quantum attack resistance, and in the whole identity authentication process, the authentication efficiency of the terminal is improved. The leakage of plaintext parameters in the initial handshake message is reduced, and subsequent messages are subjected to different encryption processing, so that the risk of leakage of an identity authentication key is reduced, and the security of identity authentication is improved. Meanwhile, the algorithm selection list is sent in a combined algorithm mode, the algorithm selection matching time of the second terminal can be effectively shortened, and the identity authentication efficiency is improved.

The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for Secure Node Exchange Attribute-based Keys (SNEAK) including secure exchange of sensitive message elements between sequential message nodes using attribute-based key management. Each message node can access none, one, some, or all encrypted message elements based on assigned attributes of that message node. A key management node provides key exchange for each Content Encryption Key (CEK) used to protect the message elements based on attributes of the message nodes.

The invention relates to the technical field of information security and intelligent transportation, and discloses an airport self-service luggage check-in data security and privacy protection method, which comprises the following steps that an encryption key is generated through a quantum key distribution technology, and the encryption key realizes secure sharing between communication equipment at two ends through quantum entanglement; the security of the key is ensured by using the quantum unclonable theorem; in the data transmission process, a homomorphic encryption algorithm is adopted to encrypt data, it is ensured that even if the data is operated in the encryption state, data content cannot be leaked, and homomorphic encryption allows addition and multiplication operations to be executed on the encrypted data without decryption. Key exchange is carried out through the quantum key distribution technology, high safety in the data transmission process is ensured, and compared with a key exchange mode depending on a traditional encryption algorithm in the prior art, the method adopts the quantum entanglement and quantum unclonable theorem.

The invention discloses an IPSec VPN security gateway communication method based on a post quantum cryptography technology, and the method comprises the following steps: S1, replacing a conventional SM2 algorithm and a certificate with a PQC algorithm and a digital certificate in a first-stage main mode of IKE key negotiation; s2, the initiator and the responder respectively use the PQC key pair to complete key exchange and signature; s3, in the message 1, the initiator sends a security alliance load containing a PQC public key algorithm attribute to the responder; s4, in the message 2, the responder sends an SA load containing a PQC signature certificate and an encryption certificate, and a received SA proposal sent by the initiator is marked; s5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification; and S6, in the message 5 and the message 6, the initiator and the responder encrypt the transmitted information by using a symmetric cryptographic algorithm, and identify the previous exchange process. According to the invention, the security of the IPSec VPN security gateway is improved, and quantum computing attacks can be resisted.

A key exchange system according to an aspect of the present disclosure includes: a plurality of quantum key distribution (QKD) apparatuses that executes a quantum key distribution protocol including at least error correction; and a plurality of hub apparatuses that performs encrypted communication with each other, in which each of the hub apparatuses includes a key generation unit configured to generate an encryption key for performing the encrypted communication with another hub apparatus based on information received from a corresponding one of the QKD apparatuses, and each of the QKD apparatuses includes a QKD processing unit configured to execute the quantum key distribution protocol with another QKD apparatus and generate a correction key from a ciphertext of random number information, and a first transmission unit configured to transmit information representing a result of basis reconciliation in the quantum key distribution protocol to a corresponding one of the hub apparatuses.

The invention relates to the technical field of Internet of Things equipment, particularly provides an Internet of Things equipment security authentication and data encryption transmission system and method, and solves the problems of limited equipment resources and difficult key management. The system comprises an equipment identity authentication component, a key management component and a lightweight encryption component. The method comprises the following steps: authenticating the legal identity of the Internet of Things equipment by adopting a lightweight symmetric key; the authority is dynamically adjusted according to factors such as equipment position, time and network state; the Internet of Things equipment generates and distributes a secret key after passing the access authority authentication; key exchange is carried out between the Internet of Things devices by adopting a key exchange protocol, and local key management is realized at an edge node in combination with edge calculation; and transmitting the data containing the key and the key exchange protocol to the target equipment, encrypting the transmitted data by adopting lightweight encryption and a Hash algorithm during transmission, and preventing a replay attack by using a timestamp and a random number. According to the invention, comprehensive safety protection of the Internet of Things equipment is realized.

A time sequence post-synchronization quantum key extraction penetration test method comprises the following steps: A) under the condition of penetration test, a QKD system operates normally, and a sending end and a receiving end smoothly complete key distribution; b) the man-in-the-middle selects an initial original key exchange period to establish synchronization and correlation so as to realize clock synchronization with a receiver; c) analyzing quantum bit error rate information obtained from a public channel by a man-in-the-middle, deducing a corresponding relation between a receiver detector and each quantum state, and establishing a mapping model of the quantum states and bit values; d) determining a quantum state type responded by the receiver in each response time slot in a subsequent original key exchange period by the middleman in combination with path information obtained by other sub penetration tests; and E) the intermediary obtains a final key which is the same as the two communication parties by implementing an error correction and privacy amplification process, the quantum bit error rate between the intermediary and the sender is maintained at a relatively low level and is lower than a security threshold, and a security alarm is not triggered in a penetration test process.

The invention provides a KEM-based anti-quantum TLCP protocol design method and system, and belongs to the technical field of information security. The method comprises the steps that a server side applies for a server side signature certificate and an encryption certificate from an issuing mechanism, a long-term server side signature public key is stored in the server side signature certificate, and a long-term server side encryption public key is stored in the encryption certificate; and in the TLCP handshake protocol, identity authentication and key exchange between the server and the client are realized based on the long-term server signature public key and the long-term server encryption public key. According to the method, the anti-quantum KEM is used for replacing signature and encrypted primitives to realize key exchange and identity authentication functions of the protocol, identity authentication does not depend on the signature of a message any more, and meanwhile, a client introduces a temporary public key to replace a long-term static public key to participate in a KEM key negotiation process, so that the forward security of the protocol is ensured, and the security of the protocol is improved. Therefore, the efficiency and the security of the TLCP protocol are improved.

The invention discloses a wireless audio transmission protocol optimization algorithm for a low-delay dynamic password, which comprises the following steps of: generating an initial encryption key: before audio data transmission starts, generating the initial encryption key according to a current network environment, equipment computing power and audio transmission requirements; the encryption key can be generated based on a timestamp, a random number or a key exchange protocol, the randomness and the safety of the encryption key are ensured, and a proper encryption algorithm is selected: according to equipment computing resources and network conditions, a proper low-delay encryption algorithm is selected. By selecting a low-delay encryption algorithm and dynamically adjusting the encryption complexity, the influence of the encryption process on transmission delay is remarkably reduced, the real-time performance of audio transmission is optimized, the reliability of key synchronization in a wireless network is ensured through a redundant synchronous data packet and a regular key synchronization mechanism, and even if signal loss or interference occurs, the reliability of key synchronization in the wireless network is ensured. And synchronization can be recovered in time, so that decryption failure caused by asynchronous keys is avoided.

The invention discloses a server cipher machine communication method and system based on an RDMA technology. According to the method, physical direct connection between a device end and an agent end is achieved by establishing an RDMA reliable connection channel; bidirectional authentication is carried out based on an SPDM protocol; a random challenge is generated after the device side verifies a proxy side certificate, and key exchange is triggered after a proxy side private key signature response and the verification of the device side are passed; the two parties adopt an SM2 public key algorithm to generate a shared key and derive a session key KEK; the proxy end encrypts the request data by using the KEK, and writes the encrypted data into the SMZ secure memory of the equipment end through the RDMA Write; the equipment end processes data through a hardware password engine, and directly writes an additional timestamp, a serial number and a result packet of MAC authentication to an appointed address of the agent end through RDMAWrite; and when the communication is finished, the device end erases the key and resets the engine. According to the invention, the problems of large delay, low throughput, low security, large CPU occupancy rate and the like in the prior art can be solved.

The invention discloses an access control authentication method based on multi-modal dynamic challenge and block chain auditing, and belongs to the technical field of access control authentication, and the access control authentication method comprises the following steps: collecting video, sound and motion data of a user, and carrying out dynamic living body detection; after detection is passed, face features, voiceprint features and gait features are extracted and subjected to fusion scoring, and after the score exceeds a threshold value, equipment trust chain verification is carried out according to a dynamic token generated after secret key exchange between the APP and the access control terminal; after the verification is passed, firstly performing deep counterfeiting detection on the whole face, and then performing deep counterfeiting detection on the details of the face; and finally, the authentication passing information is stored in the block chain, TxID verification is carried out when a receipt of certificate storage transaction success returned by the block chain is received, and the door is authorized to be opened after the verification is successful. According to the invention, forgery attacks can be effectively resisted, the false identification rate and the missed identification rate of the access control system are reduced, the auditing tracking and tamper-proof capabilities are greatly enhanced, and the identity authentication reliability in a high-security scene is guaranteed.

The invention discloses an anti-quantum key packaging method and device, a medium and equipment, and the method comprises the steps that a first node generates a first public key and a first private key based on an asymmetric encryption algorithm, and generates a second public key and a second private key based on an anti-quantum encryption algorithm; sending the first public key and the second public key to a second node, so that the second node encrypts a third public key based on the second public key to obtain a public key ciphertext, and generates a shared key based on the first public key and a third private key; receiving a public key ciphertext sent by the second node, and decrypting the public key ciphertext based on the second private key to obtain a third public key; generating the shared key based on a third public key and the first private key; wherein the third public key and the third private key are generated by the second node based on an asymmetric encryption algorithm. According to the invention, by combining an anti-quantum encryption algorithm and a widely used asymmetric encryption algorithm, a secure key exchange mechanism which can resist future quantum computing threats and has high compatibility is provided.

The present application relates to the field of cloud computing, and discloses a key exchange method and apparatus. The method is applied to a first communication party, the first communication party holds a first fixed private key fragment, and a server having a cooperative relationship with the first communication party holds a second fixed private key fragment. The method comprises: receiving a first fixed public key and a first ephemeral public key sent by a second communication party; generating a first key fragment on the basis of the first fixed public key, the first ephemeral public key and the first fixed private key fragment; sending a key exchange parameter to the server, wherein the key exchange parameter is related to the first fixed public key and the first ephemeral public key; receiving a second key fragment sent by the server, wherein the second key fragment is generated on the basis of the key exchange parameter and the second fixed private key fragment; and generating a shared key on the basis of the first key fragment and the second key fragment, wherein the shared key is used for deriving a session key for communication between the first communication party and the second communication party. The present application is used for effectively protecting private keys, thereby improving safety.

The invention discloses an active prevention measure and system based on individual emergency protection. The method comprises the steps of hardware module integration and test, core function logic development, cloud system architecture construction, power supply and industrial design and system integration and compliance authentication. The invention belongs to the technical field of campus safety, and particularly relates to an active prevention measure and system based on individual emergency protection, and the scheme adopts a magnetic latching relay to realize physical disconnection, adopts a dual authentication process, sets a one-way communication system, and carries out dynamic sound pressure adjustment based on environmental noise; an end-to-end encryption channel is developed, a double-encryption mode is adopted, a dynamic fragmentation storage technology is applied, an encryption channel is established, key exchange and video fragmentation hash verification are adopted, an equipment state vector is defined, and a 3D convolutional neural network is adopted to identify violent behaviors.

Systems and methods are disclosed for dual, simultaneous, single-session, proximity-based, secure authentication of a Digital Assisted Shopping (DAS) representative and a customer in an unsecured remote location. The method includes installing a mobile banking application on the customer's device and an enterprise application on the DAS representative's device, both with biometric verification. Proximity detection using Bluetooth Low Energy (BLE) initiates a secure session via push notifications. A secure communication channel is established through a secure local handshake, involving encryption key exchange and mutual authentication. The system exchanges data related to customer profiles and financial accounts, continuously monitors geolocation using GPS, Wi-Fi, and cellular data, and performs periodic background biometric re-verifications. AI / ML algorithms analyze customer data to propose financial products and services, which are securely shared with the customer for review and selection. The system facilitates real-time enrollment and transaction processing, terminating the session upon detecting security breaches.

The invention relates to the technical field of industrial communication, in particular to a Modbus credibility enhancement method based on a national cryptographic algorithm, which comprises the following steps: S1, a client sends identity authentication message information including a time factor, a random number, a client public key and an abstract to a server to complete public key exchange, identity authentication is carried out on the two communication parties through a transmission session identifier; s2, the client sends a key negotiation message to the server, and generates an exclusive key of the session after receiving a server key parameter returned after the server successfully verifies the key negotiation message; s3, key verification is carried out between the client and the server; and S4, the client encrypts a Modbus credible message carrying a time factor, a random number and a Modbus command through the exclusive key of the session, and then sends the Modbus credible message to the server, and the server analyzes and replies the Modbus credible message. According to the method, an identity verification process is added, so that other PLCs are prevented from being operated by mistake in a PLC login scene, and the replay resistance and tamper resistance of the message are ensured through a time factor, a random number and an abstract.

The invention discloses a self-adaptive authentication method for a space-air-ground cooperative NOMA communication system, which introduces a self-adaptive access authentication mechanism based on an NTRU encryption algorithm, designs a dual-security mechanism for trusted and untrusted NOMA relays, ensures data security through authentication and key exchange in a trusted mode, and improves the security of the communication system. And in an untrusted mode, data tampering and stealing are prevented through a temporary session key and a message authentication code, and flexible application guarantee is provided. Meanwhile, in combination with a certification authority (CA) and a digital certificate technology, it is ensured that the public key is not tampered in the transmission process, man-in-the-middle attack is avoided, and the reliability of communication node identity authentication is further improved.

The embodiment of the invention relates to the technical field of information security, and discloses a lightweight key exchange protocol method, electronic equipment and a storage medium. In the invention, in the process of realizing communication negotiation, the client and the server can realize double-end key exchange negotiation only by sending the elliptic curve point and through the ciphertext of the first public key and the anti-quantum key in the aspect of the national cryptographic algorithm, and the computing overhead is reduced as much as possible to adapt to a resource-limited communication environment; moreover, curvilinear equation verification is carried out on the first elliptic curve point sent by the client, data legality and security are ensured, negotiation is carried out based on a secret key generated by the device and a shared anti-quantum shared secret key, the anti-quantum capability is achieved, potential threats of quantum computing can be resisted, the communication security level is improved, and the method is suitable for popularization and application. And the security risk of key negotiation is reduced.

The invention relates to an IPSEC (Internet Protocol Security) key exchange method resistant to quantum computing. According to the invention, based on a lattice cryptographic algorithm and improved SM4-256 symmetric encryption, secure communication between a master mode and a fast mode is realized; in the main mode, an initiator sends an IKE first message through a UDP (User Datagram Protocol), negotiates SA parameters with a responder and exchanges a lattice password certificate; the two parties encapsulate a temporary 32-byte secret key by using the public key of the opposite party, generate a 512-bit random number through SM4-256 encryption, and sign and transmit the 512-bit random number to realize secure random number exchange and certificate verification; and the two parties calculate a first session key based on a PRF (Pseudo Random Function), and encrypt an exchange data HASH value to complete main mode key consistency confirmation. And after entering the fast mode, taking the main mode session key as an SM4-256 symmetric key to continue communication, sending an SA message carrying a 512-bit random number by the two parties, calculating to obtain a second session key, and establishing an ESP tunnel. According to the method, the security of IPSEC under the threat of quantum computing is improved through the lattice password.