WO2025236608A1 - Information verification method and related device - Google Patents

Abstract

An information verification method, applied to a terminal, and comprising: generating a random number, and encrypting same on the basis of a post-quantum public key to determine an encrypted random number; determining a session key on the basis of a first shared key and the random number, wherein the first shared key is determined on the basis of a server public key and a terminal public key; determining encrypted signaling data on the basis of the session key and the signaling data; and sending a signaling packet to a server, so that the server verifies the signaling packet, wherein the signaling packet comprises the encrypted signaling data and the encrypted random number.

Description

Information verification methods and related equipment

This disclosure is based on and claims priority to Chinese Patent Application No. 202410594835.8, filed on May 14, 2024, entitled "Information Verification Method and Related Equipment", the entire contents of which are incorporated herein by reference.

Technical Field

This disclosure relates to the field of information security technology, and in particular to an information verification method and related equipment.

Background Technology

The rapidly developing Internet has brought tremendous convenience to people's lives and work, allowing them to send and receive emails, make phone calls, shop online, and transfer money via bank transfer from the comfort of their homes. However, network information security has also gradually become a potentially significant problem. Generally, network information faces several security risks: theft, tampering, impersonation, and malicious damage. Information verification is one means of protecting people's network information, ensuring the security of systems and data, and safeguarding the legitimate interests of authorized users. Currently, information verification primarily relies on cryptographic techniques. In the field of cryptography today, there are two main types of cryptographic systems: symmetric-key cryptography, where the encryption and decryption keys are the same, and public-key cryptography, where the encryption and decryption keys are different, with one being publicly disclosed. Most information verification algorithms currently rely on public-key cryptography.

However, with the development of quantum computers, classical asymmetric key encryption algorithms will no longer be secure. Regardless of encryption/decryption or key exchange methods, quantum computers can calculate the private key from the public key. Therefore, commonly used asymmetric keys will become extremely vulnerable in the quantum era. Thus, relying solely on asymmetric algorithms is insufficient to guarantee the security of information verification processes.

Summary of the Invention

This disclosure provides an information verification method and related equipment, which at least to some extent overcomes the problem that asymmetric algorithms in related technologies cannot guarantee the security of the information verification process.

According to one aspect of this disclosure, an information verification method is provided, applied to a terminal, comprising: generating a random number and encrypting it using a quantum-resistant public key to determine an encrypted random number; determining a session key based on a first shared key and the random number, wherein the first shared key is determined based on a server public key and a terminal public key; determining encrypted signaling data based on the session key and signaling data; and sending a signaling message to a server to enable the server to verify the signaling message, wherein the signaling message includes the encrypted signaling data and the encrypted random number.

In some embodiments, before generating a random number and encrypting it using a quantum-resistant public key to determine the encrypted random number, the method further includes: determining a first shared key based on the server public key and the terminal public key; encrypting the user's login information using the first shared key to determine the user's encrypted login information; and sending the user's encrypted login information and the terminal public key to the server for user registration.

In some embodiments, the signaling message further includes: the terminal login information and a hash message authentication code, wherein the hash message authentication code is generated based on the session key.

According to one aspect of this disclosure, an information verification method is provided, applied to a server, comprising: acquiring a signaling message sent by a terminal, wherein the signaling message includes an encrypted random number and encrypted signaling data; decrypting the encrypted random number using a quantum-resistant private key to determine a random number; determining a session key based on a first shared key and the random number, wherein the first shared key is determined based on a server public key and a terminal public key; and decrypting the encrypted signaling data using the session key.

In some embodiments, the signaling message further includes: the terminal login information and a hash message authentication code, wherein the hash message authentication code is generated based on a session key; before decrypting the encrypted signaling data based on the session key, the method further includes: verifying the hash message authentication code based on the session key; if the verification is successful, decrypting the encrypted signaling data based on the session key.

According to one aspect of this disclosure, an information verification device is provided, applied to a terminal, comprising: an encrypted random number determination module, configured to generate a random number and encrypt it using a quantum-resistant public key to determine the encrypted random number; a session key first determination module, configured to determine a session key based on a first shared key and the random number, wherein the first shared key is determined based on a server public key and a terminal public key; an encrypted signaling data determination module, configured to determine encrypted signaling data based on the session key and the signaling data; and a signaling message sending module, configured to send a signaling message to a server so that the server can verify the signaling message, wherein the signaling message includes the encrypted signaling data and the encrypted random number.

According to one aspect of this disclosure, an information verification device is provided, applied to a server, comprising: a signaling message acquisition module, configured to acquire a signaling message sent by a terminal, wherein the signaling message includes an encrypted random number and encrypted signaling data; a random number determination module, configured to decrypt the encrypted random number using a quantum-resistant private key to determine a random number; a session key second determination module, configured to determine a session key based on a first shared key and the random number, wherein the first shared key is determined based on a server public key and a terminal public key; and a signaling data decryption module, configured to decrypt the encrypted signaling data using the session key.

According to one aspect of this disclosure, an information verification system is provided, comprising: a terminal generating a random number and encrypting it using a quantum-resistant public key to determine an encrypted random number; the terminal determining a session key based on a first shared key and the random number, wherein the first shared key is determined based on a server public key and a terminal public key; the terminal determining encrypted signaling data based on the session key and signaling data; the terminal sending a signaling message to a server, wherein the signaling message includes the encrypted signaling data and the encrypted random number; the server acquiring the signaling message sent by the terminal; the server decrypting the encrypted random number using a quantum-resistant private key to determine a random number; the server determining a session key based on the first shared key and the random number; and the server decrypting the encrypted signaling data using the session key.

According to another aspect of this disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the information verification method described in any one of the preceding claims by executing the executable instructions.

According to another aspect of this disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the information verification method described in any one of the preceding claims.

According to another aspect of this disclosure, a computer program product is also provided, including a computer program that, when executed by a processor, implements the information verification method described above.

This disclosure, by processing the key generated by the traditional key negotiation algorithm with the key encapsulated in a quantum-resistant algorithm, can resist quantum computing attacks and ensure information security.

Specific embodiments of the invention are disclosed in detail with reference to the following description and accompanying drawings, indicating how the principles of the invention can be employed. It should be understood that the embodiments of the invention are not therefore limited in scope. Within the spirit and scope of the appended claims, embodiments of the invention include many changes, modifications, and equivalents.

Features described and/or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, combined with features in other embodiments, or substituted for features in other embodiments.

It should be emphasized that the term "including/comprises" as used herein refers to the presence of a feature, whole, step, or component, but does not exclude the presence or addition of one or more other features, wholes, steps, or components.

Attached Figure Description

The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

Figure 1 shows a schematic diagram of an information verification system structure according to an embodiment of the present disclosure;

Figure 2 shows a flowchart of an information verification method applied to a terminal according to an embodiment of the present disclosure;

Figure 3 shows a flowchart of a specific example of an information verification method applied to a terminal according to an embodiment of the present disclosure;

Figure 4 shows a flowchart of an information verification method applied to the server in an embodiment of this disclosure;

Figure 5 shows a flowchart of a specific example of an information verification method applied to a server in this disclosure embodiment;

Figure 6 shows a schematic flowchart of an information verification method applied between a terminal and a server in an embodiment of this disclosure.

Figure 7 shows a schematic diagram of an information verification device applied to a terminal in an embodiment of the present disclosure;

Figure 8 shows a schematic diagram of an information verification device applied to a server in an embodiment of this disclosure;

Figure 9 shows a structural block diagram of a computer device according to an embodiment of the present disclosure.

Detailed Implementation

Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and/or processor devices and/or microcontroller devices.

To facilitate understanding, before introducing the embodiments of this disclosure, the following explanations are provided for several terms involved in the embodiments of this disclosure:

Quantum-resistant cryptography: PQC, Post-Quantum cryptography;

Hash-based Message Authentication Code (Hmac).

The specific implementation methods of the embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

Figure 1 illustrates an exemplary application system architecture for which the information verification method of this disclosure can be applied. As shown in Figure 1, the system architecture may include a terminal device 101, a network 102, and a server 103.

Network 102 is a medium used to provide a communication link between terminal device 101 and server 103, and can be a wired network or a wireless network.

Optionally, the aforementioned wireless or wired networks use standard communication technologies and/or protocols. The network is typically the Internet, but can also be any network, including but not limited to Local Area Network (LAN), Metropolitan Area Network (MAN), Wide Area Network (WAN), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some embodiments, technologies and/or formats including Hypertext Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), and Internet Protocol Security (IPSec) can be used to encrypt all or some links. In other embodiments, customized and/or dedicated data communication technologies may be used to replace or supplement the aforementioned data communication technologies.

Terminal device 101 can be various electronic devices, including but not limited to smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, wearable devices, augmented reality devices, virtual reality devices, etc.

Optionally, the client of the application installed on different terminal devices 101 may be the same, or the client of the same type of application based on different operating systems. Depending on the terminal platform, the specific form of the application client may also be different; for example, the application client may be a mobile client, a PC client, etc.

Server 103 can be a server that provides various services, such as a backend management server that supports the device operated by the user using terminal device 101. The backend management server can analyze and process received requests and other data, and feed the processing results back to the terminal device.

Optionally, the server can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

In one embodiment of this disclosure, the terminal generates a random number and encrypts it using a quantum-resistant public key to determine an encrypted random number; the terminal determines a session key based on a first shared key and the random number, wherein the first shared key is determined based on the server's public key and the terminal's public key; the terminal determines encrypted signaling data based on the session key and signaling data; the terminal sends a signaling message to the server, wherein the signaling message includes encrypted signaling data and an encrypted random number; the server receives the signaling message sent by the terminal; the server decrypts the encrypted random number using a quantum-resistant private key to determine a random number; the server determines a session key based on the first shared key and the random number; and the server decrypts the encrypted signaling data using the session key.

Those skilled in the art will understand that the number of terminal devices, networks, and servers shown in Figure 1 is merely illustrative, and any number of terminal devices, networks, and servers can be used as needed. This disclosure does not limit the scope of the embodiments.

Figure 2 shows a flowchart of an information verification method applied to a terminal according to an embodiment of the present disclosure. As shown in Figure 2, the information verification method applied to a terminal provided in this embodiment of the present disclosure includes the following steps:

S202, generate a random number and encrypt it using a quantum-resistant public key to determine the encrypted random number.

It should be noted that the aforementioned random numbers can be numbers that are random and unpredictable within a certain range. For example, the generated numbers may be completely unrelated to the preceding numbers. In encryption algorithms, random numbers can be used to generate key parameters such as keys and initialization vectors to ensure the security of the encryption process. For example, in secure communication, random numbers play a crucial role in key exchange and protocol handshakes; in cryptographic hash functions, hash functions map random number inputs of arbitrary length to fixed-length outputs, possessing collision resistance and irreversibility. In scenarios such as encrypted storage and digital signatures, hash functions and random numbers work together to ensure data security. Random numbers can be generated by random number generators, such as true random number generators, which can ensure that the generated random numbers are highly random and unpredictable.

The aforementioned quantum-resistant cryptography, also known as post-quantum cryptography, is a new generation of cryptographic algorithms capable of resisting quantum computing attacks on existing cryptographic algorithms. It ensures the security of cryptographic algorithms in a quantum environment. PQC primarily focuses on asymmetric cryptographic algorithms, which can run on classical computers but cannot be broken by quantum computers. Currently released PQC algorithms awaiting standardization include public-key encryption and key exchange algorithms (CRYSTALS-KYBER) and digital signature algorithms (CRYSTALS-Dilithium, FALCON, SPHINCS+).

The public key mentioned above can be the non-secret half of a key pair, which can be used to encrypt information. Specifically, a public key and a private key are a key pair (i.e., a public key and a private key) obtained through an algorithm. One of them is made public and is called the public key; the other is kept secret and is called the private key. The key pair obtained through this algorithm is guaranteed to be unique worldwide. When using this key pair, if data is encrypted with one key, it must be decrypted with the other key. That is, if data is encrypted with the public key, it must be decrypted with the private key, and vice versa; otherwise, decryption will fail.

For example, the terminal generates random numbers and encrypts them using the platform's (server's) Kyber public key.

S204, determine the session key based on the first shared key and the random number, wherein the first shared key is determined based on the server public key and the terminal public key.

It should be noted that the above methods for determining the session key can include XOR, concatenation, alternating merging, misalignment rearrangement, etc.

For example, the terminal generates a terminal public key, calculates a first shared key through a key negotiation algorithm, and performs an XOR operation on the first shared key and a random number to generate a session key.

S206, Determine the encrypted signaling data based on the session key and signaling data.

For example, signaling data can be encrypted using a session key to obtain encrypted signaling data.

S208, a signaling message is sent to the server so that the server can verify the signaling message. The signaling message includes encrypted signaling data and an encrypted random number.

It should be noted that the above-mentioned server-side verification of signaling messages is a process of decrypting the encrypted data in the signaling messages and comparing it with the pre-stored data.

This disclosure, by processing the key generated by the traditional key negotiation algorithm with the key encapsulated in a quantum-resistant algorithm, can resist quantum computing attacks and ensure information security.

In one embodiment of this disclosure, as shown in FIG3, the information verification method provided in this embodiment can register the terminal on the server through the following steps before generating a random number and encrypting it according to a quantum-resistant public key, and determining the encrypted random number, so that the server can verify the user's login information in the future:

S302, determine the first shared key based on the server public key and the terminal public key;

S304, encrypt the user's login information according to the first shared key, and determine the user's encrypted login information;

S306 sends the user's encrypted login information and terminal public key to the server for user registration.

It should be noted that the login information for the aforementioned users includes their account and password information. Each user's encrypted login information corresponds one-to-one with the terminal's public key.

In one example of this disclosure, the aforementioned signaling message also includes: terminal login information and a hash message authentication code, wherein the hash message authentication code is generated based on the session key.

Figure 4 shows a flowchart of an information verification method applied to the server in an embodiment of this disclosure. As shown in Figure 4, the information verification method applied to the server provided in this embodiment of the disclosure includes the following steps:

S402, Obtain the signaling message sent by the terminal, wherein the signaling message includes an encrypted random number and encrypted signaling data.

It should be noted that the aforementioned encrypted random number is a random number generated by the terminal and encrypted using a quantum-resistant public key. The aforementioned encrypted signaling data is encrypted signaling data determined by the terminal based on the session key and the signaling data. The session key is determined based on the first shared key and the random number (using XOR, concatenation, alternating merging, and misalignment rearrangement). The first shared key is determined based on the server's public key and the terminal's public key.

S404: Decrypt the encrypted random number using the quantum-resistant private key to determine the random number.

It should be noted that the aforementioned quantum-resistant cryptography, also known as post-quantum cryptography, is a new generation of cryptographic algorithms capable of resisting quantum computing attacks on existing cryptographic algorithms. It ensures the security of cryptographic algorithms in a quantum environment. PQC primarily focuses on asymmetric cryptographic algorithms, which can run on classical computers but cannot be cracked by quantum computers. The aforementioned private key can be the secret half of the key pair and can be used to encrypt information.

Specifically, the quantum-resistant encryption algorithm is deployed on the server side, and the quantum-resistant public key is made public. The quantum-resistant private key is kept on the server side. The key pair obtained through this algorithm is guaranteed to be unique worldwide. When using this key pair, if a piece of data is encrypted with one key, it must be decrypted with the other key. That is, if data is encrypted with the public key, it must be decrypted with the private key, and vice versa. Otherwise, decryption will fail.

For example, use the server's Kyber private key to decrypt encrypted random numbers to obtain random numbers.

S406, determine the session key based on the first shared key and the random number, wherein the first shared key is determined based on the server public key and the terminal public key.

For example, the server constructs a first shared key based on the client's public key using a key negotiation algorithm, and then performs an XOR operation on the first shared key and a random number to generate a session key.

S408, decrypts encrypted signaling data based on the session key.

For example, the server uses the session key to decrypt the plaintext signaling data and then uses the session key for subsequent secure data communication.

This application processes the key generated by the traditional key negotiation algorithm with the key encapsulated with quantum-resistant algorithms, which can resist quantum computing attacks and ensure information security.

In one embodiment of this disclosure, as shown in FIG5, the signaling message in the information verification method provided in this embodiment further includes: terminal login information and hash message authentication code, wherein the hash message authentication code is generated based on the session key. Before decrypting the encrypted signaling data based on the session key, this disclosure can verify the user's login information securely through the following steps:

S502, verify the hash message authentication code based on the session key;

S504 If the verification is successful, the encrypted signaling data is decrypted according to the session key.

In one example of this disclosure, the server looks up the terminal public key based on the user account.

Figure 6 shows a schematic flowchart of an information verification method between a terminal and a server according to an embodiment of this disclosure. As shown in Figure 6, the information verification method between a terminal and a server provided in this embodiment of the disclosure includes the following steps:

S601: Install the application client on the terminal and complete the initialization, and configure the server (management platform) public key and Kyber public key (or transmit public key information over the network);

S602, the terminal generates a terminal public key, calculates a shared key K1 (equivalent to the first shared key mentioned above) through a key negotiation algorithm, uses K1 to encrypt the user account password information, and uploads the encrypted account password and client public key to the server to complete device registration;

S603, the server stores the terminal's public key, calculates the shared key K1 based on the terminal's public key and the server's public key, decrypts the account information, and stores it;

S604, the terminal generates a random number K2, encrypts it using the server's Kyber public key, calculates the session key K = K1 ⊕ K2, encrypts the signaling data using K, and sends a signaling message. The signaling message contains the user account, the signaling ciphertext, the K2 ciphertext, and the authentication information (Hmac) generated using K.

S605: The server finds the terminal public key based on the user account, constructs a shared key K1 through a key negotiation algorithm, decrypts the random number K2 using the platform's Kyber private key, calculates the session key K = K1 ⊕ K2, and uses K to verify the message verification code.

S606: If the verification is successful, use K to decrypt the plaintext signaling data and proceed with subsequent secure data communication based on K; if the verification fails, terminate the session.

Among them, S601-S603 are for device registration, and S604-S606 are for signaling communication.

It should be noted that in the original key negotiation, if the server's public key is distributed in a pre-defined form, the key K1 generated by the key negotiation algorithm remains unchanged each time, posing a risk of replay attacks. With the addition of the PQC algorithm, a random number K2 is generated for each signaling communication, ensuring the randomness of the session key K (K1⊕K2) for each session. The symbol "⊕" represents the XOR operation, with the following rules: 0⊕0 = 00 XOR, 00⊕1 = 10 XOR, 11⊕0 = 11 XOR, 11⊕1 = 01 XOR. A result of 0 indicates that the two logical variables are different, and only then will the output be 1.

The traditional cryptographic algorithms used for user login and registration are vulnerable to cracking by quantum computers, which can rapidly solve the underlying mathematical problems upon which they rely. This severely threatens the security of the algorithms themselves, thereby affecting the security of the login and registration process.

This disclosure addresses the security challenges posed by quantum computing to traditional key exchange algorithms by combining a quantum-resistant key encapsulation algorithm (using CRYSTALS-Kyber as an example) with a traditional key negotiation algorithm to improve the quantum-resistant security of information exchange during registration and login between communicating parties.

This disclosure focuses on the registration and login process from the terminal to the platform. The login process uses a traditional key negotiation (DH) algorithm. Based on the original registration and login process, a PQC algorithm is added to enhance quantum security. The terminal is configured with the platform's PQC public key, which is used to encrypt a random number K2.

It should be noted that this disclosure uses the Kyber algorithm as an example, and the specific PQC key negotiation algorithm to be used can be selected according to the system requirements.

Based on the same inventive concept, this disclosure also provides an information verification device for a terminal, as described in the following embodiments. Since the principle by which this device embodiment solves the problem is similar to that of the above-described method embodiments, the implementation of this device embodiment can refer to the implementation of the above-described method embodiments, and repeated details will not be elaborated further.

Figure 7 shows a schematic diagram of an information verification device applied to a terminal in an embodiment of the present disclosure. As shown in Figure 7, the device includes: an encrypted random number determination module 71, a session key first determination module 72, an encrypted signaling data determination module 73, a signaling message sending module 74, a first shared key determination module 75, a login information encryption module 76, and a registration module 77.

Among them, the encrypted random number determination module 71 is used to generate a random number and encrypt it according to the quantum-resistant public key to determine the encrypted random number;

The session key first determination module 72 is used to determine the session key based on the first shared key and the random number, wherein the first shared key is determined based on the server public key and the terminal public key;

The encrypted signaling data determination module 73 is used to determine the encrypted signaling data based on the session key and the signaling data;

The signaling message sending module 74 is used to send signaling messages to the server so that the server can verify the signaling messages. The signaling messages include the encrypted signaling data and the encrypted random number.

In one example of this disclosure, the aforementioned information verification device applied to the terminal further includes a first shared key determination module 75, used to determine a first shared key based on the server public key and the terminal public key.

In one example of this disclosure, the aforementioned information verification device applied to the terminal further includes a login information encryption module 76, used to encrypt the user's login information according to the first shared key, and to determine the user's encrypted login information.

In one example of this disclosure, the aforementioned information verification device applied to the terminal further includes a registration module 77, used to send the user's encrypted login information and the terminal's public key to the server for user registration.

It should be noted that the aforementioned encrypted random number determination module 71, session key first determination module 72, encrypted signaling data determination module 73, and signaling message sending module 74 correspond to S202 to S208 in the method embodiment. The examples and application scenarios implemented by these modules and their corresponding steps are the same, but they are not limited to the content disclosed in the above method embodiment. It should also be noted that these modules, as part of the apparatus, can be executed in a computer system such as a set of computer-executable instructions.

Figure 8 shows a schematic diagram of an information verification device applied to a server in an embodiment of the present disclosure. As shown in Figure 8, the device includes: a signaling message acquisition module 81, a random number determination module 82, a session key second determination module 83, a signaling data decryption module 84, and a hash message authentication code verification module 85.

The signaling message acquisition module 81 is used to acquire the signaling message sent by the terminal, wherein the signaling message includes an encrypted random number and encrypted signaling data;

The random number determination module 82 is used to decrypt the encrypted random number based on the quantum-resistant private key and determine the random number.

The second session key determination module 83 is used to determine the session key based on the first shared key and a random number, wherein the first shared key is determined based on the server public key and the terminal public key;

The signaling data decryption module 84 is used to decrypt encrypted signaling data based on the session key.

In one example of this disclosure, the aforementioned information verification device applied to the server further includes a hash message authentication code verification module 85, used to verify the hash message authentication code based on the session key.

It should be noted that the signaling message acquisition module 81, random number determination module 82, session key second determination module 83, and signaling data decryption module 84 mentioned above correspond to S402 to S408 in the method embodiment. The examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above method embodiment. It should be noted that the above modules, as part of the apparatus, can be executed in a computer system such as a set of computer-executable instructions.

Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

The electronic device 900 according to this embodiment of the present disclosure will now be described with reference to FIG9. The electronic device 900 shown in FIG9 is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present disclosure.

As shown in Figure 9, the electronic device 900 is presented in the form of a general-purpose computing device. The components of the electronic device 900 may include, but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

The storage unit stores program code that can be executed by the processing unit 910, causing the processing unit 910 to perform the steps described in the "Exemplary Methods" section above according to various exemplary embodiments of this disclosure.

For example, the processing unit 910 can perform the following steps in the above method embodiment:

Generate a random number and encrypt it using a quantum-resistant public key to determine the encrypted random number;

The session key is determined based on the first shared key and the random number, wherein the first shared key is determined based on the server public key and the terminal public key;

Based on the session key and signaling data, the encrypted signaling data is determined;

The signaling message is sent to the server so that the server can verify the signaling message. The signaling message includes encrypted signaling data and encrypted random number.

For example, the processing unit 910 can perform the following steps in the above method embodiment:

The first shared key is determined based on the server's public key and the terminal's public key;

The user's login information is encrypted using the first shared key to determine the user's encrypted login information;

The user's encrypted login information and terminal public key are sent to the server for user registration.

For example, the processing unit 910 can perform the following steps in the above method embodiment:

Acquire the signaling message sent by the terminal, wherein the signaling message includes an encrypted random number and encrypted signaling data;

The encrypted random number is decrypted using a quantum-resistant private key to determine the random number;

The session key is determined based on the first shared key and the random number, wherein the first shared key is determined based on the server public key and the terminal public key;

Decrypt the encrypted signaling data based on the session key.

For example, the processing unit 910 can perform the following steps in the above method embodiment:

Verify the hash message authentication code using the session key;

If the verification is successful, the encrypted signaling data is decrypted based on the session key. The signaling message also includes: terminal login information and hash message authentication code, whereby the hash message authentication code is generated based on the session key.

Storage unit 920 may include readable media in the form of volatile storage units, such as random access memory (RAM) 9201 and/or cache memory 9202, and may further include read-only memory (ROM) 9203.

Storage unit 920 may also include a program/utility 9204 having a set (at least one) program module 9205, such program module 9205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

Bus 930 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

Electronic device 900 can also communicate with one or more external devices 940 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 900, and/or with any device that enables electronic device 900 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input/output (I/O) interface 950. Furthermore, electronic device 900 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and/or public networks, such as the Internet) via network adapter 960. As shown, network adapter 960 communicates with other modules of electronic device 900 via bus 930. It should be understood that, although not shown in the figures, other hardware and/or software modules can be used in conjunction with electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

In particular, according to embodiments of this disclosure, the process described above with reference to the flowchart can be implemented as a computer program product, which includes a computer program that, when executed by a processor, implements the above-described information verification method.

In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the methods described above is stored thereon. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code, which, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java and C++, and conventional procedural programming languages such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and/or a step may be broken down into multiple steps.

From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims (10)

An information verification method, characterized in that it is applied to a terminal and includes: Generate a random number and encrypt it using a quantum-resistant public key to determine the encrypted random number; The session key is determined based on the first shared key and the random number, wherein the first shared key is determined based on the server public key and the terminal public key; Based on the session key and signaling data, the encrypted signaling data is determined; The signaling message is sent to the server so that the server can verify the signaling message, wherein the signaling message includes the encrypted signaling data and the encrypted random number. The information verification method according to claim 1, characterized in that, before generating a random number and encrypting it according to a quantum-resistant public key to determine the encrypted random number, the method further includes: The first shared key is determined based on the server public key and the terminal public key; The user's login information is encrypted using the first shared key to determine the user's encrypted login information; The user's encrypted login information and the terminal's public key are sent to the server for user registration. According to the information verification method of claim 1, the signaling message further includes: the terminal login information and the hash message authentication code, wherein the hash message authentication code is generated based on the session key. An information verification method, characterized in that it is applied to a server and includes: Acquire signaling messages sent by the terminal, wherein the signaling messages include encrypted random numbers and encrypted signaling data; The encrypted random number is decrypted using the quantum-resistant private key to determine the random number; The session key is determined based on the first shared key and the random number, wherein the first shared key is determined based on the server public key and the terminal public key; The encrypted signaling data is decrypted using the session key. According to the information verification method of claim 4, the signaling message further includes: the terminal login information and the hash message authentication code, wherein the hash message authentication code is generated based on the session key; Before decrypting the encrypted signaling data according to the session key, the method further includes: Verify the hash message authentication code using the session key; If the verification is successful, the encrypted signaling data is decrypted using the session key. An information verification device, characterized in that it is applied to a terminal and includes: The encrypted random number determination module is used to generate a random number and encrypt it using a quantum-resistant public key to determine the encrypted random number. The first session key determination module is used to determine the session key based on the first shared key and the random number, wherein the first shared key is determined based on the server public key and the terminal public key; An encrypted signaling data determination module is used to determine encrypted signaling data based on the session key and the signaling data; The signaling message sending module is used to send signaling messages to the server so that the server can verify the signaling messages, wherein the signaling messages include the encrypted signaling data and the encrypted random number. An information verification device, characterized in that it is applied to a server and includes: The signaling message acquisition module is used to acquire the signaling message sent by the terminal, wherein the signaling message includes an encrypted random number and encrypted signaling data; The random number determination module is used to decrypt the encrypted random number based on the quantum-resistant private key to determine the random number; The second session key determination module is used to determine the session key based on the first shared key and the random number, wherein the first shared key is determined based on the server public key and the terminal public key; The signaling data decryption module is used to decrypt the encrypted signaling data according to the session key. An information verification system, characterized in that it comprises: The terminal generates a random number and encrypts it using a quantum-resistant public key to determine the encrypted random number; The terminal determines a session key based on a first shared key and the random number, wherein the first shared key is determined based on the server's public key and the terminal's public key; The terminal determines the encrypted signaling data based on the session key and signaling data; The terminal sends a signaling message to the server, wherein the signaling message includes the encrypted signaling data and the encrypted random number; The server obtains the signaling message sent by the terminal; The server decrypts the encrypted random number using the quantum-resistant private key to determine the random number; The server determines the session key based on the first shared key and the random number; The server decrypts the encrypted signaling data based on the session key. An electronic device, characterized in that it comprises: Processor; and Memory for storing the executable instructions of the processor; The processor is configured to execute the information verification method according to any one of claims 1 to 7 by executing the executable instructions. A computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the information verification method according to any one of claims 1 to 7.