Anonymous Internet of Things identity authentication method and device based on anti-quantum computing password

Abstract

The invention provides an anonymous Internet of Things identity authentication method and device based on an anti-quantum computing password. A key generation device sends a public key to a message sending end and a message receiving end, and sends a private key to an authentication server; the authentication server generates a blind parameter based on the private key, and sends the blind parameter to the message sending end; the message sending end performs blind operation based on the blind parameter, the public key and the to-be-transmitted message to obtain a blind message, and sends the blind message to the authentication server; the authentication server performs post-quantum signature on the blind message based on the private key to obtain a to-be-solved blind signature, and sends the to-be-solved blind signature to the message sending end; the message sending end carries out blind resolution operation on the to-be-resolved blind signature to obtain a target signature; the message sending end sends the to-be-transmitted message and the target signature to a message receiving end; and the message receiving end performs post-quantum verification on the target signature based on the public key, and if verification succeeds, processing is performed based on the to-be-transmitted message. Through the scheme of the invention, the user data security can be improved.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things security technology, and in particular to an anonymous Internet of Things identity authentication method and device based on quantum computing-resistant cryptography. Background Art

[0002] With the rapid development of Internet of Things technology, more and more devices are connected to the Internet. These devices are called Internet of Things devices. Internet of Things devices can include smart home devices, industrial control equipment, medical equipment, etc. While providing convenience, Internet of Things devices also bring privacy leakage risks and security risks.

[0003] IoT devices need to collect and process large amounts of private data (also known as sensitive data). This private data may include user location information, health data, and lifestyle habits. If this private data is improperly accessed or leaked, it will pose a serious threat to user privacy.

[0004] For example, when an IoT device sends user data (such as private data) to a server, it needs to sign the data to ensure its integrity. The signature and data are then sent to the server together. The server verifies the signature. If verification passes, the user data has not been tampered with. If verification fails, the user data has been tampered with and is discarded.

[0005] When signing user data, the IoT device needs to send the user data to the signing device. The signing device then signs the user data to obtain the signature data and returns the signature data to the IoT device. However, during this signing process, the IoT device needs to send the user data to the signing device, which results in the user data being exposed to the signing device, leading to the leakage of private data. Summary of the Invention

[0006] The present application provides an anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography, which is applied to an Internet of Things system. The Internet of Things system includes a key generation device, a message sending end, a message receiving end, and an authentication server. The method includes: The key generation device generates a public key and a private key based on the acquired security parameters, sends the public key to the message sending end and the message receiving end, and sends the private key to the authentication server; The authentication server generates a blinding parameter based on the private key, and sends the blinding parameter to the message sending end; the message sending end performs a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message, and sends the blinded message to the authentication server; The authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded, and sends the signature to be unblinded to the message sending end; the message sending end performs an unblinding operation on the signature to be unblinded to obtain a target signature of the message to be transmitted; The message sending end sends the message to be transmitted and the target signature to the message receiving end; The message receiving end performs post-quantum verification on the target signature based on the public key. If the verification is successful, the message is processed based on the message to be transmitted. If the verification fails, the message to be transmitted is discarded.

[0007] This application provides an anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography, which is applied to a message sending end in an Internet of Things system. The method includes: Sending a signature request to an authentication server, so that the authentication server generates blinding parameters based on the private key; Receiving a blinding parameter sent by the authentication server, performing a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message, and sending the blinded message to the authentication server, so that the authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded; Receive the signature to be unblinded sent by the authentication server, perform an unblinding operation on the signature to be unblinded to obtain the target signature of the message to be transmitted, and send the message to be transmitted and the target signature to a message receiving end, so that the message receiving end performs post-quantum verification on the target signature based on the public key.

[0008] This application provides an anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography, which is applied to an authentication server in an Internet of Things system. The method includes: After receiving the signature request sent by the message sender, generating a blinding parameter based on the obtained private key, and sending the blinding parameter to the message sender, so that the message sender performs a blinding operation based on the blinding parameter, the public key and the message to be transmitted to obtain a blinded message; Receive the blinded message sent by the message sending end, perform a post-quantum signature on the blinded message based on a private key to obtain a signature to be unblinded, and send the signature to be unblinded to the message sending end, so that the message sending end performs an unblinding operation on the signature to be unblinded to obtain a target signature of the message to be transmitted.

[0009] The present application provides an anonymous IoT identity authentication device based on quantum computing-resistant cryptography, which is applied to a message sending end in an IoT system. The device includes: A sending module, configured to send a signature request to an authentication server, so that the authentication server generates a blinding parameter based on a private key; a receiving module, configured to receive the blinding parameter sent by the authentication server; a processing module, configured to perform a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message; and a sending module, configured to send the blinded message to the authentication server, so that the authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded; The receiving module is configured to receive the signature to be unblinded sent by the authentication server; The processing module is used to perform an unblinding operation on the signature to be unblinded to obtain the target signature of the message to be transmitted; the sending module is used to send the message to be transmitted and the target signature to a message receiving end, so that the message receiving end performs post-quantum verification on the target signature based on a public key.

[0010] The present application provides an anonymous IoT identity authentication device based on quantum computing-resistant cryptography, which is applied to an authentication server in an IoT system. The device includes: A receiving module, configured to receive a signature request sent by a message sender; A generation module, used to generate blinding parameters based on the obtained private key; A sending module, configured to send the blinding parameter to the message sending end, so that the message sending end performs a blinding operation based on the blinding parameter, the public key and the message to be transmitted to obtain a blinded message; The receiving module is used to receive the blinded message sent by the message sending end; A signature module, configured to perform a post-quantum signature on the blinded message based on a private key to obtain a signature to be unblinded; The sending module is configured to send the signature to be unblinded to the message sending end, so that the message sending end performs an unblinding operation on the signature to be unblinded to obtain a target signature of the message to be transmitted.

[0011] The present application provides an electronic device, comprising: a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography as described in the above example of the present application.

[0012] The present application provides a message sending end, comprising: a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography of the above example of the present application.

[0013] The present application provides an authentication server, comprising: a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the anonymous Internet of Things identity authentication method based on quantum-resistant cryptography of the above example of the present application.

[0014] The present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography as described in the above example of the present application.

[0015] The present application provides a machine-readable storage medium, which stores machine-executable instructions that can be executed by a processor; wherein the processor is used to execute the machine-executable instructions, and when the machine-executable instructions are executed, the anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography of the above example of the present application is implemented.

[0016] As can be seen from the above technical solution, in the embodiments of the present application, the message sender performs a blinding operation based on the blinding parameters, the public key, and the message to be transmitted to obtain a blinded message. This message is then sent to the authentication server, rather than the message to be transmitted itself (i.e., user data). This avoids sending user data to the authentication server, preventing the exposure of user data to the authentication server and the leakage of private data, thereby improving data security. The authentication server performs a post-quantum signature on the blinded message using the private key, and the message receiver performs post-quantum verification of the target signature using the public key. This utilizes a post-quantum cryptographic algorithm to implement signing and verification, improving the security of user data and making the signature resistant to quantum attacks. Combining post-quantum cryptographic algorithms with blind signature algorithms, the introduction of post-quantum cryptographic algorithms can achieve quantum resistance in signatures, meaning that signatures are resistant to quantum attacks and offer higher security. By introducing a blind signature algorithm, the message to be transmitted can be blinded, preventing the exposure of user private data to the authentication server (i.e., the signing device), protecting the privacy of user data and achieving higher security and privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1A This is a flowchart of an anonymous IoT identity authentication method based on quantum computing-resistant cryptography; Figure 1B This is a flowchart of an anonymous IoT identity authentication method based on quantum computing-resistant cryptography; Figure 1C This is a flowchart of an anonymous IoT identity authentication method based on quantum computing-resistant cryptography; Figure 2AThis is a schematic structural diagram of an Internet of Things system in one embodiment of the present application; Figure 2B This is a schematic diagram of the implementation process of signature verification in one embodiment of the present application; Figure 3 This is a flowchart of an anonymous IoT identity authentication method based on quantum computing-resistant cryptography; Figure 4 This is a schematic diagram of generating a signature through negotiation in one embodiment of the present application; Figure 5A This is a schematic diagram of the structure of an anonymous IoT identity authentication device based on quantum computing-resistant cryptography; Figure 5B This is a schematic diagram of the structure of an anonymous IoT identity authentication device based on quantum computing-resistant cryptography; Figure 6 It is a hardware structure diagram of an electronic device in one embodiment of the present application. DETAILED DESCRIPTION

[0018] In the embodiment of the present application, an anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography is proposed. The method can be applied to an Internet of Things system, which may include a key generation device, a message sending end, a message receiving end, and an authentication server. Figure 1A FIG. 1 is a flow chart of an anonymous IoT identity authentication method based on quantum computing-resistant cryptography. The method may include: Step 101: The key generation device generates a public key and a private key based on the acquired security parameters, sends the public key to the message sender and the message receiver, and sends the private key to the authentication server.

[0019] Step 102: The authentication server generates a blinding parameter based on the private key and sends the blinding parameter to the message sender; the message sender performs a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message, and the message sender sends the blinded message to the authentication server.

[0020] Step 103: The authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded, and sends the signature to be unblinded to the message sender; after obtaining the signature to be unblinded, the message sender performs an unblinding operation on the signature to be unblinded to obtain the target signature of the message to be transmitted.

[0021] Step 104: The message sending end sends the message to be transmitted and the target signature to the message receiving end.

[0022] Step 105: The message receiving end performs post-quantum verification on the target signature based on the public key. If the verification succeeds, the message is processed based on the message to be transmitted. If the verification fails, the message to be transmitted is discarded.

[0023] Exemplarily, the public key may include, but is not limited to, matrix generation parameters and a high-order bit vector, and the private key may include, but is not limited to, matrix generation parameters, private key generation parameters, a first key vector, a second key vector, and a low-order bit vector. The key generation device generates the public key and the private key based on the acquired security parameters, and may include, but is not limited to: performing a hash operation based on the security parameters to obtain the matrix generation parameters, the key vector generation parameters, and the private key generation parameters; performing matrix expansion based on the matrix generation parameters to obtain an expanded matrix, and performing uniform sampling based on the key vector generation parameters to obtain the first key vector and the second key vector; generating a high-order bit vector and a low-order bit vector based on the first key vector, the second key vector, and the expanded matrix; generating the public key based on the matrix generation parameters and the high-order bit vector, and generating the private key based on the matrix generation parameters, the private key generation parameters, the first key vector, the second key vector, and the low-order bit vector.

[0024] Exemplarily, the private key may include but is not limited to matrix generation parameters and private key generation parameters. The authentication server generates blinding parameters based on the private key, which may include but is not limited to: performing matrix expansion based on the matrix generation parameters to obtain an expanded matrix; generating a random number, and performing vector generation based on the random number to obtain a masking vector; generating a blinding vector based on the expanded matrix and the masking vector; generating a blinding parameter based on the private key generation parameters and the blinding vector, and the blinding parameter may include the private key generation parameters and the blinding vector.

[0025] Exemplarily, the public key may include but is not limited to a matrix generation parameter and a high-order bit vector, and the blinding parameter may include a private key generation parameter and a blinding vector. The message sender performs a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message, which may include but is not limited to: performing a matrix expansion based on the matrix generation parameter to obtain an extended matrix; performing a hash operation based on the matrix generation parameter, the high-order bit vector, and the message to be transmitted to obtain an initial summary; performing a hash operation based on the initial summary and the private key generation parameter to obtain a first blinding factor, and generating a second blinding factor based on the initial summary; in addition, polynomial parameters may be generated based on the extended matrix, the first blinding factor, the blinding vector in the blinding parameter, the high-order bit vector, and the second blinding factor; performing a hash operation based on the high-order bits of the polynomial parameter and the initial summary to obtain initial blinding information; generating target blinding information based on the initial blinding information and the second blinding factor; and obtaining a blinded message, where the blinded message includes target blinding information and polynomial parameters.

[0026] Exemplarily, the private key may include but is not limited to a first key vector, a second key vector, and a low-order bit vector. The blinded message may include target blinding information and polynomial parameters. The authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded, which may include but is not limited to: generating a first intermediate vector based on the obtained masking vector, the first key vector, and the target blinding information; generating a second intermediate vector based on the polynomial parameters, the second key vector, and the target blinding information; generating a third intermediate vector based on the target blinding information and the low-order bit vector; generating a hint parameter based on the second intermediate vector and the third intermediate vector; and obtaining the signature to be unblinded, the signature to be unblinded including the hint parameter and the first intermediate vector.

[0027] Illustratively, before generating the prompt parameter based on the second intermediate vector and the third intermediate vector, it may be further determined whether a preset condition is satisfied. If so, it may be determined that the signature of the blinded message is invalid, and the message sender may be prompted to regenerate the blinded message. If not, it may be determined that the signature of the blinded message is valid, and an operation of generating the prompt parameter based on the second intermediate vector and the third intermediate vector is performed. For example, if at least one of the following expressions holds true, the precondition is satisfied: ; ; ;in, represents the first intermediate vector, Indicates infinite order, represents the coefficient range of the masking vector, Indicates the constant that has been obtained, A vector representing the low-order bits of the second intermediate vector, represents the floor range of the masking vector, represents the third intermediate vector.

[0028] Exemplarily, the signature to be unblinded may include a prompt parameter and a first intermediate vector. The message sending end performs an unblinding operation on the signature to be unblinded to obtain a target signature of the message to be transmitted, which may include but is not limited to: performing an unblinding operation on the first intermediate vector based on the obtained first blinding factor to obtain a target vector; if the target vector meets the configured security conditions, the target signature can be obtained; wherein, the target signature may include but is not limited to the target vector, the prompt parameter and the obtained initial blinding information.

[0029] Exemplarily, the public key may include but is not limited to matrix generation parameters and high-order bit vectors, the target signature may include a target vector, prompt parameters and initial blinding information, and the message receiving end performs post-quantum verification on the target signature based on the public key, which may include but is not limited to: performing matrix expansion based on the matrix generation parameters to obtain an extended matrix; performing a hash operation based on the matrix generation parameters, the high-order bit vector and the message to be transmitted to obtain an initial summary; determining the high-order bits of the polynomial parameters based on the target vector, the prompt parameters, the initial blinding information, the extended matrix and the high-order bit vector; performing a hash operation based on the high-order bits of the polynomial parameters and the initial summary to obtain verification blinding information; judging whether the verification conditions are met, the verification conditions including verifying that the blinding information is the same as the initial blinding information; if so, determining that the verification is successful, otherwise, determining that the verification has failed.

[0030] In the embodiment of the present application, an anonymous IoT identity authentication method based on quantum computing-resistant cryptography is proposed. This method can be applied to the message sending end in the IoT system. Figure 1B FIG. 1 is a flow chart of an anonymous IoT identity authentication method based on quantum computing-resistant cryptography. The method may include: Step 111: Send a signature request to the authentication server, so that the authentication server generates blinding parameters based on the private key. That is, after receiving the signature request, the authentication server generates blinding parameters based on the private key.

[0031] Step 112: Receive the blinding parameters sent by the authentication server, perform a blinding operation based on the blinding parameters, the public key, and the message to be transmitted to obtain a blinded message, and send the blinded message to the authentication server, so that the authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded.

[0032] Step 113: Receive the unblinded signature sent by the authentication server, perform an unblinding operation on the unblinded signature to obtain the target signature of the message to be transmitted, and send the message to be transmitted and the target signature to the message receiving end, so that the message receiving end performs post-quantum verification on the target signature based on the public key.

[0033] Exemplarily, the public key includes a matrix generation parameter and a high-order bit vector, the blinding parameter includes a private key generation parameter and a blinding vector, and the blinding operation based on the blinding parameter, the public key and the message to be transmitted to obtain the blinded message includes: performing matrix expansion based on the matrix generation parameter to obtain an extended matrix; performing a hash operation based on the matrix generation parameter, the high-order bit vector and the message to be transmitted to obtain an initial summary; performing a hash operation based on the initial summary and the private key generation parameter to obtain a first blinding factor, and generating a second blinding factor based on the initial summary; generating polynomial parameters based on the extended matrix, the first blinding factor, the blinding vector in the blinding parameter, the high-order bit vector and the second blinding factor; performing a hash operation based on the high-order bits of the polynomial parameter and the initial summary to obtain initial blinded information; generating target blinded information based on the initial blinding information and the second blinding factor; obtaining a blinded message, the blinded message including the target blinding information and the polynomial parameter.

[0034] Exemplarily, the signature to be unblinded includes a prompt parameter and a first intermediate vector, and an unblinding operation is performed on the signature to be unblinded to obtain a target signature of the message to be transmitted, including: performing an unblinding operation on the first intermediate vector based on the obtained first blinding factor to obtain a target vector; if the target vector meets the configured security conditions, obtaining the target signature, the target signature includes the target vector, the prompt parameter and the obtained initial blinding information.

[0035] In the embodiment of the present application, an anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography is proposed. This method can be applied to the authentication server in the Internet of Things system. Figure 1C FIG. 1 is a flow chart of an anonymous IoT identity authentication method based on quantum computing-resistant cryptography. The method may include: Step 121: After receiving the signature request sent by the message sender, generate a blinding parameter based on the acquired private key, and send the blinding parameter to the message sender, so that the message sender performs a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message.

[0036] Step 122: Receive the blinded message sent by the message sender, perform a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded, and send the signature to be unblinded to the message sender, so that the message sender performs an unblinding operation on the signature to be unblinded to obtain the target signature of the message to be transmitted.

[0037] Exemplarily, the private key may include but is not limited to matrix generation parameters and private key generation parameters. Generating blinding parameters based on the obtained private key may include but is not limited to: performing matrix expansion based on the matrix generation parameters to obtain an expanded matrix; generating a random number, and performing vector generation based on the random number to obtain a masking vector; generating a blinding vector based on the expanded matrix and the masking vector; generating a blinding parameter based on the private key generation parameters and the blinding vector, and the blinding parameter may include the private key generation parameters and the blinding vector.

[0038] Exemplarily, the private key may include a first key vector, a second key vector, and a low-order bit vector, the blinded message may include target blinding information and polynomial parameters, and post-quantum signing of the blinded message based on the private key to obtain the signature to be unblinded may include but is not limited to: generating a first intermediate vector based on the obtained masking vector, the first key vector, and the target blinding information; generating a second intermediate vector based on the polynomial parameters, the second key vector, and the target blinding information; generating a third intermediate vector based on the target blinding information and the low-order bit vector; generating a hint parameter based on the second intermediate vector and the third intermediate vector; and obtaining the signature to be unblinded, which may include the hint parameter and the first intermediate vector.

[0039] Illustratively, before generating the prompt parameter based on the second intermediate vector and the third intermediate vector, it may be further determined whether a preset condition is satisfied. If so, it may be determined that the signature of the blinded message is invalid, and the message sender may be prompted to regenerate the blinded message. If not, it may be determined that the signature of the blinded message is valid, and an operation of generating the prompt parameter based on the second intermediate vector and the third intermediate vector is performed. For example, if at least one of the following expressions holds true, the precondition is satisfied: ; ; ;in, represents the first intermediate vector, Indicates infinite order, represents the coefficient range of the masking vector, Indicates the constant that has been obtained, A vector representing the low-order bits of the second intermediate vector, represents the floor range of the masking vector, represents the third intermediate vector.

[0040] As can be seen from the above technical solution, in the embodiments of the present application, the message sender performs a blinding operation based on the blinding parameters, the public key, and the message to be transmitted to obtain a blinded message. This message is then sent to the authentication server, rather than the message to be transmitted itself (i.e., user data). This avoids sending user data to the authentication server, preventing the exposure of user data to the authentication server and the leakage of private data, thereby improving data security. The authentication server performs a post-quantum signature on the blinded message using the private key, and the message receiver performs post-quantum verification of the target signature using the public key. This utilizes a post-quantum cryptographic algorithm to implement signing and verification, improving the security of user data and making the signature resistant to quantum attacks. Combining post-quantum cryptographic algorithms with blind signature algorithms, the introduction of post-quantum cryptographic algorithms can achieve quantum resistance in signatures, meaning that signatures are resistant to quantum attacks and offer higher security. By introducing a blind signature algorithm, the message to be transmitted can be blinded, preventing the exposure of user private data to the authentication server (i.e., the signing device), protecting the privacy of user data and achieving higher security and privacy.

[0041] The above technical solutions of the embodiments of the present application are described below in conjunction with specific application scenarios.

[0042] When an IoT device sends user data (such as private data) to a server, it must send the user data to a signing device. The signing device then signs the user data, generating signature data and returning the signature data to the IoT device. The IoT device then sends the signature data along with the user data to the server. The server verifies the signature data. If verification passes, the user data has not been tampered with. If verification fails, the user data has been tampered with and is discarded.

[0043] However, during this signing process, user data must be exposed to the signing party's device, resulting in the leakage of private data. Furthermore, the signature data is generated using cryptographic algorithms such as RSA. With the rapid development of quantum computing technology, signature data generated by RSA cryptographic algorithms can be quickly cracked. Therefore, it is impossible to protect the privacy of user data, and the signature data cannot be protected against quantum attacks.

[0044] In IoT scenarios, user data privacy protection is essential. For example, in smart home environments, users want to enjoy a convenient lifestyle while maintaining a high degree of privacy for their habits and preferences, ensuring that their private information is not at risk of being leaked. In the connected vehicle (IoV) scenario, efficient communication between vehicles requires not only data authenticity and integrity but also the privacy of each vehicle owner, ensuring that their private information is not at risk of being leaked. In healthcare and finance, user data is highly sensitive, placing an even greater demand for privacy protection, ensuring that private information is not at risk of being leaked. In summary, preventing the leakage of private information in these sensitive areas is crucial, and user data privacy protection is essential.

[0045] In response to these findings, the present invention proposes an anonymous IoT identity authentication method based on quantum-resistant cryptography. This method combines post-quantum cryptography with a blind signature algorithm. By introducing a post-quantum cryptography algorithm, the signature achieves quantum resistance, meaning that the signature is secure against quantum attacks. The blind signature algorithm blinds the message to be transmitted, preventing the user's private data from being exposed to the authentication server.

[0046] See also Figure 2A Figure 2 shows a schematic diagram of the structure of an IoT system, which can also be called an anonymous IoT identity authentication system based on quantum-resistant cryptography. The IoT system can include a key generation device, a message sender, a message receiver, and an authentication server. The key generation device, also known as a key generation center, is responsible for key generation and distribution. The message sender can be an IoT device, such as a smart home device, industrial control equipment, or medical equipment. It can also be other types of user devices, such as a personal computer, smartphone, or laptop. There is no restriction on the type of message sender; it can be any device that needs to send messages. The message sender is responsible for blinding messages and unblinding signatures. The message receiver can be a server device (i.e., a server), and the message receiver is any device that needs to receive messages. The message receiver is responsible for signature verification (identity authentication or data integrity verification). The authentication server, also known as an authentication center, is a signing device and is responsible for signature generation and issuance.

[0047] Based on the functions of the key generation device, message sender, message receiver and authentication server, see Figure 2B The following is a flow chart of the implementation of signature verification. First, the key generation device generates the key according to the security parameters Generate a public key and private key , the public key Send the private key to the message sender and the message receiver. Send it to the authentication server to achieve key distribution function. Then, the message sender uses the public key and blinding parameters Treating transmission messages m (i.e. message to be signed m ) to perform blind processing and obtain the blind message , that is, Blind ( m , ) represents blind processing, and we get , and the blinded message Sent to the authentication server to negotiate for a blind signature , blind signature Is the signature to be unblinded , which will be recorded as the signature to be unblinded later.

[0048] Then, the authentication server uses the private key Blind message Sign to get the unblinded signature , that is, PQCSign ( , ) indicates signature processing, and gets , the signature to be unblinded Sent to the message sender.

[0049] Then, the message sender treats the unblinded signature Perform unblinding to obtain the target signature , and sign the target and messages to be transmitted m The message receiving end uses the public key Sign the target Verification is performed to achieve identity authentication or message integrity verification for the message sender.

[0050] In the above application scenario, an anonymous IoT identity authentication method based on quantum computing-resistant cryptography is proposed in the embodiment of the present application. Figure 3 FIG. 1 is a flow chart of the anonymous IoT identity authentication method based on quantum computing-resistant cryptography, which may include the following steps: Step 301: The key generation device obtains security parameters and generates a public key and a private key based on the security parameters. There is no restriction on the generation method of the public key and the private key, and the public key and the private key can be generated using a key generation algorithm.

[0051] For example, the key generation algorithm The input can be a security parameter , key generation algorithm The output can be a public key and private key , for this key generation algorithm No restrictions, based on this, when the security parameters After substitution, you can get the public key and private key .

[0052] For example, for step 301, the following steps can be used to generate a public key: and private key : Step S11: Obtain security parameters For example, security parameters can be determined based on security requirements. The greater the security requirement, the greater the security parameter The more bits there are, the smaller the security requirement is, and the security parameter The fewer the number of digits. Based on security parameters The number of digits can be used to generate a random number of this number (such as using a sampling algorithm to generate a random number of this number), and this random number is used as a security parameter Taking 256 bits as an example, a 256-bit security parameter can be generated. , the security parameters Recorded as .

[0053] Step S12: Based on security parameters Perform hash operation to obtain parameter set , parameter set Matrix generation parameters can be included , key vector generation parameters and private key generation parameters .

[0054] For example, the input to the hash algorithm is the security parameter , the output of the hash algorithm is the parameter set , in the security parameters After substituting into the hash algorithm, based on the security parameters Perform hash operation to obtain parameter set The hash algorithm can be SHAKE256 algorithm or other types of algorithms, and there is no restriction on this. Taking SHAKE256 algorithm as an example, the security parameter As input, the parameter set is generated by the SHAKE256 algorithm , Represents the SHAKE256 algorithm, Represents the matrix generation parameters It is a 256-bit value (composed of 0s and 1s, and the security parameter The number of bits is the same), key vector generation parameters and private key generation parameters It is also a 256-bit value.

[0055] Step S13: Generate parameters based on the matrix Perform matrix expansion to obtain the expanded matrix A.

[0056] For example, the input of the matrix expansion algorithm is the matrix generation parameters , the output of the matrix expansion algorithm is the expanded matrix A, so when the matrix generation parameters After substituting into the matrix expansion algorithm, the parameters can be generated based on the matrix Perform matrix expansion to obtain the expanded matrix A. For example, the matrix generation parameters As input, the matrix expansion algorithm is used to generate the expanded matrix A , Represents the matrix expansion algorithm. The input of the matrix expansion algorithm is , the output of the matrix expansion algorithm is A. It can represent the dimension of the expanded matrix A, It can represent the value range of the expanded matrix A.

[0057] Step S14: Generate parameters based on the key vector Uniform sampling is performed to obtain the first key vector and the second key vector. The first key vector can be recorded as , the second key vector can be recorded as .

[0058] For example, the key vector generates parameters As input, the key vector can be generated by uniform sampling , Indicates that parameters are generated based on the key vector Perform uniform sampling, represents the first key vector, represents the second key vector, Represents the dimension of the key vector , and the dimension of the expanded matrix A correspond, Represents the dimension of the key vector , and the dimension of the expanded matrix A correspond.

[0059] Step S15: Based on the first key vector , the second key vector And the expanded matrix A generates a high-order bit vector and a low-order bit vector, and the high-order bit vector is recorded as , the low-order bit vector is recorded as .

[0060] For example, the first key vector , the second key vector And the expanded matrix A generates the vector t to be decomposed. For example, the following formula can be used to generate the vector t to be decomposed: .

[0061] After obtaining the vector t to be decomposed, the high-order bits of the vector t to be decomposed can be extracted to obtain the high-order bit vector , and extract the low-order bits of the vector t to be decomposed to obtain the low-order bit vector For example, taking the vector t to be decomposed as input, the bit decomposition algorithm can be used to extract the high-order bits and low-order bits of the vector t to be decomposed, and the high-order bit vector and the low-order bit vector For example, the bit decomposition algorithm is used to extract the high and low bits of the vector t to be decomposed. . It represents the bit decomposition algorithm. The vector to be decomposed t and the parameter d are the input of the bit decomposition algorithm. It means that the low d bits of the vector to be decomposed t are decomposed to obtain the high bit vector and the low-order bit vector The value of the parameter d may be pre-configured or obtained using an algorithm, and there is no restriction on this.

[0062] Step S16: Generate a public key based on the matrix generation parameters and the high-order bit vector, and generate a private key based on the matrix generation parameters, the private key generation parameters, the first key vector, the second key vector, and the low-order bit vector.

[0063] For example, the public key Matrix generation parameters can be included and high bit vector , private key Matrix generation parameters can be included , private key generation parameters , the first key vector , the second key vector and the low-order bit vector On this basis, , .

[0064] At this point, step 301 is completed and the key generation device can obtain the public key and private key .

[0065] Step 302: The key generation device sends the public key to the message sender, the key generation device sends the public key to the message receiver, and the key generation device sends the private key to the authentication server.

[0066] Step 303: The message sending end sends a signature request to the authentication server. For example, when there is a message to be transmitted that needs to be signed, the message sending end sends a signature request to the authentication server.

[0067] Step 304: When receiving the signature request, the authentication server generates blinding parameters based on the private key.

[0068] For example, the blinding parameter is The relevant parameters can be based on the private key Generate blinded parameters. There is no restriction on the generation process. For example, the following steps can be used to generate blinded parameters: Step S21: Generate parameters based on the matrix Perform matrix expansion to obtain the expanded matrix A.

[0069] For example, the private key Matrix generation parameters can be included , the matrix generation parameters As input, the matrix expansion algorithm is used to generate the expanded matrix A , see step S13.

[0070] Step S22: Generate a random number, and generate a vector based on the random number to obtain a masking vector.

[0071] For example, we can determine the number of digits of a random number and generate a random number of that digit (e.g., using a random sampling algorithm to generate a random number of that digit), and record this random number as a parameter , taking 384 bits as an example, a 384-bit random number can be generated, which is recorded as , that is, a value composed of 0 and 1.

[0072] For example, the input of a vector generation algorithm (such as a vector generation function) is a random number , the output of the vector generation algorithm is the masking vector , so when the random number After substituting into the vector generation algorithm, we can Perform vector generation to obtain the masking vector For example, the random number As input, a vector generation algorithm can be used to generate a masking vector , Represents a vector generation algorithm, the input of which is a random number , the output of the vector generation algorithm is the masking vector .

[0073] Step S23: Based on the expanded matrix A and the masking vector Generate blinded vector .

[0074] For example, we can use the expanded matrix A and the masking vector The product value of determines the blinding vector , for example, the blinding vector can be determined using the following formula : .

[0075] Step S24: Generate parameters based on the private key and the blinding vector Generate blinding parameters , the blinding parameter Can include private key generation parameters and the blinding vector For example, the private key Can include private key generation parameters , so, after obtaining the blinded vector Afterwards, the authentication server can generate the private key parameters and the blinding vector Combine to obtain the blinding parameters , that is, the blinding parameter .

[0076] At this point, step 304 is completed and the authentication server can obtain the blinding parameters .

[0077] Step 305: The authentication server sends the blinding parameters to the message sender.

[0078] Step 306: After receiving the blinding parameters, the message sender performs a blinding operation based on the blinding parameters, the public key, and the message to be transmitted (the message to be transmitted is the message to be signed) to obtain a blinded message.

[0079] Exemplarily, the input of the blinding algorithm can be the blinding parameter , public key and messages to be transmitted , the output of the blinding algorithm can be the blinded message , there is no restriction on this blinding algorithm. Based on this, when the blinding parameter , public key and messages to be transmitted After substituting into the blinding algorithm, we can get the blinded message .

[0080] For example, a blinded message can be generated by a blinding algorithm , It can be expressed as a blinding algorithm, represents the input of the blinding algorithm, Represents the output of the blinding algorithm.

[0081] For example, for step 306, the following steps may be used to generate a blinded message: : Step S31: Generate parameters based on the matrix Perform matrix expansion to obtain the expanded matrix A.

[0082] For example, the public key Matrix generation parameters can be included , the matrix generation parameters As input, the matrix expansion algorithm is used to generate the expanded matrix A , see step S13.

[0083] Step S32: Generate parameters based on the matrix , high bit vector and messages to be transmitted Perform hash operation to get initial summary , that is, the information obtained after hash operation is used as the initial summary .

[0084] For example, the input of the hash algorithm can be the matrix generation parameter , high bit vector and messages to be transmitted , matrix generation parameters and high bit vector Can be determined by public key It is known that both are known parameters and the message is to be transmitted It is the content that the message sender needs to send to the message receiver, and the message to be transmitted As is known, the output of the hash algorithm is the initial digest Based on this, the matrix generation parameters , high bit vector and messages to be transmitted After substituting into the hash algorithm, the parameters can be generated based on the matrix , high bit vector and messages to be transmitted Perform hash operation to obtain the initial summary .

[0085] For example, the hash algorithm can be a collision-resistant hash algorithm (such as a collision-resistant hash function) or other types of algorithms, and there is no restriction on this. Taking the collision-resistant hash algorithm as an example, the matrix generation parameters , high bit vector and messages to be transmitted As input, a collision-resistant hash algorithm can be used to generate the initial digest , represents a collision-resistant hash algorithm, represents the input of the collision-resistant hash algorithm, Represents the output of the collision-resistant hash algorithm, that is, the matrix generation parameters , high bit vector and messages to be transmitted As input to the collision-resistant hash algorithm, the initial digest as output.

[0086] Step S33: Perform a hash operation based on the initial digest and the private key generation parameter to obtain a first blinding factor.

[0087] For example, the input to the hash algorithm can be the initial digest and private key generation parameters , private key generation parameters By blinding parameter It is known that the parameters can be known, and the output of the hash algorithm can be an intermediate parameter Based on this, the initial summary and private key generation parameters After substituting into the hash algorithm, it can be based on the initial summary and private key generation parameters Perform hash operation to obtain intermediate parameters .

[0088] For example, the hash algorithm can be a collision-resistant hash algorithm or other types of algorithms, and there is no restriction on this. Taking the collision-resistant hash algorithm as an example, the initial digest and private key generation parameters As input, a collision-resistant hash algorithm can be used to generate intermediate parameters , represents a collision-resistant hash algorithm, represents the input of the collision-resistant hash algorithm, Represents the output of a collision-resistant hash algorithm.

[0089] Exemplarily, the input of the vector generation algorithm (such as the vector generation function) is the intermediate parameter , the output of the vector generation algorithm is the first blinding factor , so, when the intermediate parameter After substituting into the vector generation algorithm, we can Generate vector to get the first blinding factor For example, the intermediate parameter As input, the first blinding factor can be generated using a vector generation algorithm .

[0090] Step S34: Based on the initial summary Generate the second blinding factor .

[0091] For example, the initial summary Perform hash operation to obtain the initial summary The hash operation result is then sampled to obtain the second blinding factor For example, the input of the sampling algorithm can be the hash operation result, and the output of the sampling algorithm can be the second blinding factor Based on this, after substituting the hash operation result into the sampling algorithm, the second blinding factor can be obtained .

[0092] For example, the initial summary As input, a hash algorithm and a sampling algorithm can be used to generate the second blinding factor , Indicates the initial summary , so the above formula is also equivalent to , Can represent the initial summary Perform a hash operation (H operation) to obtain a hash operation result. Can represent the result of hash operation Take samples, Represents the sampling algorithm.

[0093] Step S35: Based on the expanded matrix A and the first blinding factor , blinding parameters The blinding vector in , public key The high-order bit vector in and the second blinding factor Generator polynomial parameters .

[0094] For example, we can use the blinding parameter Obtain the blinded vector , from the public key Get the high-order bit vector , after obtaining the expanded matrix A and the first blinding factor and the second blinding factor Afterwards, the polynomial can be constructed by the polynomial generation algorithm , and then get the polynomial parameters .

[0095] In the above polynomial, the expanded matrix A, the first blinding factor , blinded vector , high bit vector and the second blinding factor are all known values. In addition, referring to step S15, parameter d is the input of the bit decomposition algorithm, which means decomposition is performed from the lower d bits of the vector t to be decomposed. It can be a pre-configured value or obtained by using a certain algorithm. Therefore, parameter d is also a known value. In this way, when these values are substituted into the polynomial After that, we can get the polynomial parameters .

[0096] Step S36: Based on polynomial parameters Get the high-order bits of the polynomial parameters , based on the high-order bits of the polynomial parameters and initial summary Perform hash operation to obtain initial blinded information .

[0097] For example, when obtaining the polynomial parameters Afterwards, the polynomial parameters can be extracted High bit of For example, if we change the polynomial parameters As input, the polynomial parameters can be extracted using the high-order bit decomposition algorithm High bit of , that is, the high-order bit vector For example, the high-order bit decomposition algorithm is used to extract the polynomial parameters High bit of , Indicates the high-order bit decomposition algorithm, polynomial parameters and parameters Is the input of the high-order bit decomposition algorithm, indicating the For polynomial parameters Decompose the high-order bits to obtain the polynomial parameters High bit of About parameters , Represents the range of rounding down of the masking vector. The content of the masking vector can be referred to step S22. Set to a constant, such as based on the security level setting The constant value of There is no restriction on the value of .

[0098] For example, the input of the hash algorithm can be the high-order bits of the polynomial parameter and initial summary , the output of the hash algorithm can be the initial blinded information Based on this, the high-order bits of the polynomial parameters are and initial summary After substituting into the hash algorithm, it can be based on the high-order bits of the polynomial parameters and initial summary Perform a hash operation (such as a hash operation after connecting the two) to obtain the initial blinded information .

[0099] For example, the high-order bits of the polynomial parameters can be and initial summary After connection, it is used as input and the hash algorithm is used to generate the initial blinded information , represents the hash algorithm, Indicates that the high-order bits of the polynomial parameters are and initial summary After concatenation, they are used as input to the hash algorithm.

[0100] Step S37: Based on the initial blinding information and the second blinding factor Generate target blinding information , for example, based on the initial blinding information and the second blinding factor The sum of the values determines the target blinding information .

[0101] For example, the target blinding information can be determined using the following formula: : .

[0102] Step S38: Save the first blinding factor and initial blinding information , the first blinding factor and initial blinding information The unblinding operation is used in the subsequent process. For the unblinding operation, please refer to the subsequent embodiments.

[0103] Step S39: Obtain blinded message , the blinded message Can include target blinding information and polynomial parameters , for example, the blinded message Obviously, the blinded message Already treated as a transmission message Perform blinding operation, the blind message The user's private data will not be exposed.

[0104] At this point, step 306 is completed and the message sender can obtain the blinded message .

[0105] Step 307: The message sender sends the blinded message to the authentication server. Sent to the authentication server, which performs the signing operation.

[0106] Step 308: The authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded.

[0107] For example, the input of the post-quantum signature algorithm can be a private key and blinded messages , the output of the post-quantum signature algorithm can be the signature to be unblinded , there is no restriction on the post-quantum signature algorithm. Based on this, when the private key and blinded messages After substituting the post-quantum signature algorithm, it can be based on the private key Blind message Perform post-quantum signature to obtain the signature to be unblinded For example, a post-quantum signature algorithm can be used to generate a signature to be unblinded. = , can represent the post-quantum signature algorithm, can represent the input of the post-quantum signature algorithm, It can represent the output of the post-quantum signature algorithm.

[0108] For example, for step 308, the following steps can be used to generate the signature to be unblinded: : Step S41: Generate a first intermediate vector based on the masking vector, the first key vector and target blinding information.

[0109] For example, referring to step S22, the masking vector , see step 307, blinding message Can include target blinding information In addition, the private key May include a first key vector On this basis, the first intermediate vector can be calculated using the following formula : .

[0110] Step S42: Generate a second intermediate vector based on the polynomial parameters, the second key vector and the target blinding information. For example, referring to step 307, the blinding message Polynomial parameters can be included and target blinding information In addition, the private key A second key vector may be included On this basis, the second intermediate vector can be calculated using the following formula: ,Right now as the second intermediate vector.

[0111] Step S43: Generate a third intermediate vector based on the target blinding information and the low-order bit vector. Can include target blinding information , private key Can include low order bit vector , the third intermediate vector can be calculated using the following formula: ,Right now as the third intermediate vector.

[0112] Step S44: Determine whether the preset conditions are met. If so, the signature of the blinded message is determined to be invalid, prompting the message sender to regenerate the blinded message. The process then returns to step 306, where the message sender re-blinds the message based on the blinding parameters, the public key, and the message to be transmitted to obtain the blinded message, and repeats the above steps.

[0113] If not, it is determined that the signature of the blinded message is valid, and step S45 can be executed.

[0114] In a possible implementation, if at least one of the following expressions holds true, it is determined that the preset condition is met; if all of the following expressions do not hold true, it is determined that the preset condition is not met.

[0115] ; ; ; In the above expression, can represent the first intermediate vector, represents an infinite order, that is, represents the infinite order of the first intermediate vector. Can represent the masking vector The coefficient range of the masking vector Refer to step S22 for the content of Set to a constant, such as based on the security level setting The constant value of There is no restriction on the value of . Can represent obtained constants, for example, , Represents the key vector generation parameter, which is a known parameter. For key range, you can Set to a constant, such as based on the security level setting The constant value of There is no restriction on the value of . On this basis, and Get The value of Set to a constant, There is no restriction on the value of .

[0116] The second intermediate vector can be represented by ). For example, after obtaining the second intermediate vector, the high-order bits of the second intermediate vector can be extracted to obtain the high-order bit vector The low-order bits of the second intermediate vector are used to obtain the low-order bit vector For example, taking the second intermediate vector as input, the bit decomposition algorithm can be used to extract the high-order bits and low-order bits of the second intermediate vector to obtain the high-order bit vector and the low-order bit vector For example, the bit decomposition algorithm is used to extract the high and low bits of the second intermediate vector . represents the bit decomposition algorithm, (i.e., the second intermediate vector) and parameters is the input of the bit decomposition algorithm, which represents the Perform bit decomposition on the second intermediate vector to obtain the low-order bit vector of the second intermediate vector About parameters , Represents the range of the mask vector rounded down, which can be Set to a constant.

[0117] represents the third intermediate vector, represents the infinite order of the third intermediate vector.

[0118] Step S45: Generate prompt parameters based on the second intermediate vector and the third intermediate vector.

[0119] For example, The input of the algorithm (hint generation algorithm) can be the second intermediate vector ( ) and the third intermediate vector ( ), The output of the algorithm can be a hint parameter Based on this, when substituting the second intermediate vector and the third intermediate vector into After the algorithm, the prompt parameter can be generated based on the second intermediate vector and the third intermediate vector .about The content of the algorithm is not limited in this embodiment, as long as The input and output of the algorithm only need to satisfy the above relationship.

[0120] For example, you can use the following expression to generate prompt parameters : , represents the third intermediate vector, represents the second intermediate vector, express algorithm( function). Obviously, the negative value of the third intermediate vector (i.e. ), the sum of the second intermediate vector and the third intermediate vector (i.e. ),parameter As three inputs, substitute algorithm, thereby obtaining the prompt parameters .

[0121] Step S46: Based on prompt parameters and the first intermediate vector Get the signature to be unblinded , to be unblinded signature Can include prompt parameters and the first intermediate vector , that is, the blind signature to be unblinded .

[0122] At this point, step 308 is completed and the authentication server can obtain the signature to be unblinded .

[0123] Step 309: The authentication server sends the signature to be unblinded to the message sender.

[0124] Step 310: The message sending end performs an unblinding operation on the signature to be unblinded to obtain a target signature.

[0125] Exemplarily, the input of the unblinding algorithm can be the first blinding factor , initial blinding information and the unblinded signature , the output of the unblinding algorithm can be the target signature (i.e., messages to be transmitted The real signature ), there is no restriction on this unblinding algorithm. Based on this, when the first blinding factor , initial blinding information and the unblinded signature After substituting into the unblinding algorithm, we can and initial blinding information Treating unblinded signatures Perform unblinding operation to obtain target signature For example, through the unblinding algorithm Blind message The unblinded signature Perform unblinding operation to obtain the message to be transmitted Target signature , It can be expressed as the unblinding algorithm, It can represent the input of the unblinding algorithm.

[0126] For example, for step 310, the target signature can be generated by the following steps: : Step S51: Based on the first blinding factor For the first intermediate vector Perform unblinding operation to obtain target vector For example, referring to step S38, the first blinding factor has been saved , and waiting for the unblinded signature A first intermediate vector may be included , therefore, can be based on the first blinding factor For the first intermediate vector To perform the unblinding operation, for example, the target vector can be determined using the following formula : .

[0127] Step S52: Determine target vector Whether the configured security conditions are met.

[0128] If not, the blinded message is regenerated, that is, returning to step 306, the message sending end performs a blinding operation based on the blinding parameters, the public key and the message to be transmitted to obtain a blinded message, and repeats the above steps.

[0129] If so, it means that the security requirement is met, the target signature is allowed to be output, and step S53 is executed.

[0130] In a possible implementation, if the following expression holds true, it can be determined that the security condition is satisfied. If the following expression does not hold true, it can be determined that the security condition is not satisfied.

[0131] ; In the above expression, represents the target vector, represents the infinite order of the target vector.

[0132] Step S53: Obtain target signature , the target signature Can include target vector , prompt parameters and initial blinding information For example, the prompt parameter From the signature to be unblinded Obtained in step S38, the initial blinding information has been saved , so the target signature can be obtained ,Right now .

[0133] At this point, step 310 is completed and the message sender can obtain the target signature .

[0134] Step 311: The message sending end sends the message to be transmitted and the target signature to the message receiving end.

[0135] Step 312: The message receiving end performs post-quantum verification on the target signature based on the public key. If the verification succeeds, the message is processed based on the message to be transmitted. If the verification fails, the message to be transmitted is discarded.

[0136] For example, the input of the post-quantum verification algorithm can be a public key and target signature The output of the post-quantum verification algorithm can be a verification result, which is used to indicate verification success or verification failure. There is no restriction on this post-quantum verification algorithm. Based on this, when the public key and target signature After substituting the post-quantum verification algorithm, it can be based on the public key Sign the target Perform post-quantum verification to obtain verification results.

[0137] For example, based on public key , through the post-quantum verification algorithm in post-quantum cryptography Sign the target To verify, can represent post-quantum verification algorithms, can represent the input of the post-quantum verification algorithm, Indicates the message to be transmitted. If the verification is successful, it can indicate that the user identity is valid or the message to be transmitted Complete, can be based on the message to be transmitted If the verification fails, it means that the user identity is invalid or the message is to be transmitted. Incomplete, the message to be transmitted can be discarded .

[0138] For example, for step 312, the following steps can be used to sign the target: Conducting post-quantum verification: Step S61: Generate parameters based on the matrix Perform matrix expansion to obtain the expanded matrix A.

[0139] For example, the public key Matrix generation parameters can be included , the matrix generation parameters As input, the matrix expansion algorithm is used to generate the expanded matrix A , see step S13.

[0140] Step S62: Generate parameters based on the matrix , high bit vector and messages to be transmitted Perform hash operation to get initial summary , that is, the information obtained after hash operation is used as the initial summary .

[0141] For example, the public key Matrix generation parameters can be included and high bit vector , the matrix generation parameters , high bit vector and messages to be transmitted As input, a collision-resistant hash algorithm can be used to generate the initial digest The process can be referred to step S32 and will not be described in detail here.

[0142] Step S63: Based on the target vector , prompt parameters , initial blinding information , expanded matrix A and high-order bit vector , determine the polynomial parameters The corresponding high-order bit .

[0143] For example, the target vector , prompt parameters and initial blinding information Can be signed from target Get, high bit vector From the public key Therefore, the above parameters are all known parameters.

[0144] For example, the high bit recovery algorithm can be used Algorithm (i.e., prompt restoration algorithm), other algorithms can also be used without restriction. algorithm as an example. The input to the algorithm can be a target vector , prompt parameters , initial blinding information , expanded matrix A and high-order bit vector , The output of the algorithm can be a polynomial parameter The corresponding high-order bit Based on this, when the target vector , prompt parameters , initial blinding information , expanded matrix A and high-order bit vector Substitution After the algorithm, it can be based on the target vector , prompt parameters , initial blinding information , expanded matrix A and high-order bit vector Get polynomial parameters The corresponding high-order bit .about The content of the algorithm is not limited in this embodiment, as long as the input and output satisfy the above relationship.

[0145] For example, the following expression can be used to generate polynomial parameters The corresponding high-order bit : For example, parameter d is the input of the bit decomposition algorithm, which means decomposition starts from the lower d bits of the vector t to be decomposed. Parameter d is a known value. Indicates the range of the mask vector rounded down. The parameter Set as a constant, that is, parameter is a known value.

[0146] From the above, we can see that 、A、 、 、 , d and These are known values. After the algorithm, the polynomial parameters can be obtained The corresponding high-order bit , so that the target signature can be used and public key , the polynomial parameters are calculated by high-bit recovery algorithm The corresponding high-order bit , polynomial parameters Also called a vector , that is, the polynomial parameter is a vector.

[0147] Step S64: Based on the high-order bits of the polynomial parameters and initial summary Perform hash operation to obtain verification blind information , verify the blinding information For initial blinding information to verify.

[0148] For example, the input of the hash algorithm can be the high-order bits of the polynomial parameter and initial summary , the output of the hash algorithm can be used to verify the blinded information Based on this, the high-order bits of the polynomial parameters are and initial summary After substituting into the hash algorithm, it can be based on the high-order bits of the polynomial parameters and initial summary Perform hash operation (such as hash operation after connecting the two) to obtain verification blind information .

[0149] For example, the high-order bits of the polynomial parameters can be and initial summary After connection, it is used as input and the hash algorithm is used to generate verification blind information ; represents the hash algorithm, Indicates that the high-order bits of the polynomial parameters are and initial summary After concatenation, it is used as input to the hash algorithm.

[0150] Step S65: Determine whether the verification condition is met. If so, the verification is successful, and the message to be transmitted can be If not, the verification is determined to have failed and the message to be transmitted can be discarded. .

[0151] In one possible implementation, the verification condition may include the following expression: , that is, verify the blinded information With initial blinding information If they are the same, it means that the verification condition is met, the verification is successful, and the blinding information is verified. With initial blinding information If they are different, it means that the verification condition is not met and the verification is determined to have failed.

[0152] In one possible implementation, the verification condition may include the following expression: ， ，q That is, when the above three expressions are satisfied at the same time, it means that the verification condition is satisfied and the verification is determined to be successful. When any of the above three expressions is not satisfied, it means that the verification condition is not satisfied and the verification is determined to be failed.

[0153] For example, represents the target vector, the target vector Can be signed from target Get represents the infinite order of the target vector. and Can be a configured constant. q Indicates prompt parameters The number of 1s in the prompt parameter Can be signed from target Obtained from. Indicates prompt parameters The maximum number of 1s in the Indicates the specified parameters. Can be a constant, and can be configured according to the security level The value of .

[0154] At this point, step 312 is completed, and the message receiving end completes the post-quantum verification of the target signature.

[0155] In one possible implementation, see Figure 4 FIG2 is a schematic diagram showing the negotiation between the message sender and the authentication server to generate a signature. The following describes the processing procedures of the message sender and the authentication server.

[0156] The message sender sends a signature request to the authentication server. The authentication server responds and sends the blinded parameters The message sender sends a blinded message to the authentication server. If the preset conditions are met (YES), the authentication server requires the user to reconstruct the blind signature. If the preset conditions are not met (NO), the authentication server sends the blind signature to the message sender. , that is, the blind signature to be unblinded .

[0157] For the message sender, a blinded message is generated through a blinding algorithm , Represents the blinding algorithm, and the process can be referred to step 306. The generation process may involve the following operations: A , , , , , , , , .

[0158] For the message sender, through the unblinding algorithm Blind message The unblinded signature Perform the unblinding operation to obtain the message to be transmitted Target signature , If satisfied , then output the target signature If not satisfied, return to generate blinded message .

[0159] For the authentication server, a post-quantum signature algorithm is used to generate a signature to be unblinded. = , The post-quantum signature algorithm can be represented. The process can be referred to in steps 304 and 308, which involves generating blinding parameters and signatures to be unblinded. The generation process may involve the following operations: A , , , . , .

[0160] like" , or, , or, " is established, the user is required to reconstruct the blinded signature, otherwise, generate , then, the authentication server can get the blind signature , that is, the blind signature to be unblinded .

[0161] In one possible implementation, key generation, signing, and authentication functions can also be implemented using other lattice-based post-quantum signature algorithms that can be extended to blind signatures. The blinding and unblinding functions can be adapted based on the signature algorithm used. Data transmission between key generation devices, authentication servers, and other devices can utilize a post-quantum key agreement algorithm (CRYSTALS-KYBER) or a combination of public key algorithms (such as RSA and DH) to complete key agreement. Data can then be encrypted using a symmetric algorithm (such as AES) for transmission, making the entire authentication system resistant to quantum attacks.

[0162] As can be seen from the above technical solution, in the embodiment of the present application, the message sender performs a blinding operation based on the blinding parameters, the public key, and the message to be transmitted to obtain a blinded message, and sends the blinded message to the authentication server instead of sending the message to be transmitted itself (i.e., user data) to the authentication server, thereby avoiding sending user data to the authentication server and preventing user data from being leaked to the authentication server. The authentication server performs a post-quantum signature on the blinded message based on the private key, and the message receiver performs post-quantum verification on the target signature based on the public key, thereby using a post-quantum cryptographic algorithm to implement signing and verification, making the signature resistant to quantum attacks.

[0163] Combining post-quantum cryptographic algorithms (such as CRYSTALS-Dilithium) with blind signature algorithms, this technology achieves quantum-resistance for signatures, making them resistant to quantum attacks and offering enhanced security. This blind signature algorithm blinds the transmitted message, preventing user privacy from being exposed to the authentication server (i.e., the signing device), protecting user data privacy and achieving higher security and privacy. This technology can enhance security and stability in future quantum computing environments, ensuring the continuous and reliable operation of IoT systems.

[0164] Based on the same application concept as the above method, an anonymous IoT identity authentication device based on quantum computing-resistant cryptography is proposed in the embodiment of this application, which is applied to the message sending end in the IoT system. Figure 5A FIG. 1 is a schematic structural diagram of the device, which includes: The sending module 511 is used to send a signature request to the authentication server, so that the authentication server generates a blinding parameter based on the private key; the receiving module 512 is used to receive the blinding parameter sent by the authentication server; the processing module 513 is used to perform a blinding operation based on the blinding parameter, the public key and the message to be transmitted to obtain a blinded message; the sending module 511 is also used to send the blinded message to the authentication server, so that the authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded; the receiving module 512 is also used to receive the signature to be unblinded sent by the authentication server; the processing module 513 is also used to perform an unblinding operation on the signature to be unblinded to obtain a target signature of the message to be transmitted; the sending module 511 is also used to send the message to be transmitted and the target signature to a message receiving end, so that the message receiving end performs post-quantum verification on the target signature based on the public key.

[0165] Exemplarily, the public key includes a matrix generation parameter and a high-order bit vector, the blinding parameter includes a private key generation parameter and a blinding vector, and the processing module 513 performs a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message, specifically for: performing matrix expansion based on the matrix generation parameter to obtain an extended matrix; performing a hash operation based on the matrix generation parameter, the high-order bit vector, and the message to be transmitted to obtain an initial summary; performing a hash operation based on the initial summary and the private key generation parameter to obtain a first blinding factor, and generating a second blinding factor based on the initial summary; generating polynomial parameters based on the extended matrix, the first blinding factor, the blinding vector in the blinding parameter, the high-order bit vector, and the second blinding factor; performing a hash operation based on the high-order bits of the polynomial parameter and the initial summary to obtain initial blinding information; generating target blinding information based on the initial blinding information and the second blinding factor; and obtaining a blinded message, wherein the blinded message includes the target blinding information and the polynomial parameter.

[0166] The signature to be unblinded includes a prompt parameter and a first intermediate vector. When the processing module 513 performs an unblinding operation on the signature to be unblinded to obtain the target signature of the message to be transmitted, it is specifically used to: perform an unblinding operation on the first intermediate vector based on the obtained first blinding factor to obtain a target vector; if the target vector meets the configured security conditions, obtain the target signature; wherein, the target signature includes the target vector, the prompt parameter and the obtained initial blinding information.

[0167] Based on the same application concept as the above method, an anonymous IoT identity authentication device based on quantum computing-resistant cryptography is proposed in the embodiment of this application, which is applied to the authentication server in the IoT system. Figure 5B FIG. 1 is a schematic structural diagram of the device, which includes: The receiving module 521 is used to receive a signature request sent by the message sending end; the generating module 522 is used to generate a blinding parameter based on the obtained private key; the sending module 523 is used to send the blinding parameter to the message sending end, so that the message sending end performs a blinding operation based on the blinding parameter, the public key and the message to be transmitted to obtain a blinded message; the receiving module 521 is used to receive the blinded message sent by the message sending end; the signing module 524 is used to perform a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded; the sending module 523 is used to send the signature to be unblinded to the message sending end, so that the message sending end performs an unblinding operation on the signature to be unblinded to obtain the target signature of the message to be transmitted.

[0168] Exemplarily, the private key includes a matrix generation parameter and a private key generation parameter, and the generation module 522 generates blinding parameters based on the acquired private key, specifically for: performing matrix expansion based on the matrix generation parameter to obtain an expanded matrix; generating a random number, and performing vector generation based on the random number to obtain a masking vector; generating a blinding vector based on the expanded matrix and the masking vector; generating a blinding parameter, wherein the blinding parameter includes the private key generation parameter and the blinding vector.

[0169] Exemplarily, the private key includes a first key vector, a second key vector, and a low-order bit vector, and the blinded message includes target blinding information and polynomial parameters. Based on this, when the signature module 524 performs a post-quantum signature on the blinded message based on the private key to obtain the signature to be unblinded, it is specifically used to: generate a first intermediate vector based on the obtained masking vector, the first key vector, and the target blinding information; generate a second intermediate vector based on the polynomial parameters, the second key vector, and the target blinding information; generate a third intermediate vector based on the target blinding information and the low-order bit vector; generate a hint parameter based on the second intermediate vector and the third intermediate vector; and obtain the signature to be unblinded, wherein the signature to be unblinded includes the hint parameter and the first intermediate vector.

[0170] Exemplarily, the signature module 524 is further configured to determine whether a preset condition is satisfied; if so, determine that the signature of the blinded message is invalid, and prompt the message sender to regenerate the blinded message; if not, determine that the signature of the blinded message is valid, and generate a prompt parameter based on the second intermediate vector and the third intermediate vector; wherein, the preset condition is satisfied if at least one of the following expressions holds true: ; ; ; represents the first intermediate vector, Indicates infinite order, represents the coefficient range of the masking vector, Indicates the constant that has been obtained, A vector representing the low-order bits of the second intermediate vector, represents the floor range of the masking vector, represents the third intermediate vector.

[0171] Based on the same application concept as the above method, an electronic device (such as the message sending end, message receiving end, authentication server or key generation device in the above embodiment) is proposed in the embodiment of the present application. Figure 6As shown, the electronic device includes: a processor 61 and a machine-readable storage medium 62, the machine-readable storage medium 62 storing machine-executable instructions that can be executed by the processor 61; the processor 61 is used to execute the machine-executable instructions to implement the anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography disclosed in the above example of this application.

[0172] Based on the same application concept as the above method, an embodiment of the present application also provides a machine-readable storage medium, on which a number of computer instructions are stored. When the computer instructions are executed by a processor, the anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography disclosed in the above example of the present application can be implemented.

[0173] The machine-readable storage medium may be any electronic, magnetic, optical, or other physical storage device that may contain or store information, such as executable instructions, data, and the like. For example, the machine-readable storage medium may be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, a storage drive (such as a hard disk drive), a solid-state drive, any type of storage disk (such as a CD, DVD, etc.), or similar storage media, or a combination thereof.

[0174] Based on the same application concept as the above method, an embodiment of the present application further provides a computer program product, which may include a computer program. When the computer program is executed by a processor, it can implement the anonymous IoT identity authentication method based on quantum-resistant cryptography disclosed in the above example of the present application.

[0175] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a fully hardware embodiment, a fully software embodiment, or an embodiment combining software and hardware. Furthermore, the embodiments of the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0176] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. An anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography, characterized in that: Applied to an Internet of Things system, the Internet of Things system includes a key generation device, a message sending end, a message receiving end, and an authentication server, and the method includes: The key generation device generates a public key and a private key based on the acquired security parameters, sends the public key to the message sending end and the message receiving end, and sends the private key to the authentication server; The authentication server generates a blinding parameter based on the private key, and sends the blinding parameter to the message sending end; the message sending end performs a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message, and sends the blinded message to the authentication server; The authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded, and sends the signature to be unblinded to the message sending end; the message sending end performs an unblinding operation on the signature to be unblinded to obtain a target signature of the message to be transmitted; The message sending end sends the message to be transmitted and the target signature to the message receiving end; The message receiving end performs post-quantum verification on the target signature based on the public key. If the verification is successful, the message is processed based on the message to be transmitted. If the verification fails, the message to be transmitted is discarded.

2. The method according to claim 1, characterized in that The public key includes a matrix generation parameter and a high-order bit vector, and the private key includes a matrix generation parameter, a private key generation parameter, a first key vector, a second key vector and a low-order bit vector; The key generation device generates a public key and a private key based on the acquired security parameters, including: Performing a hash operation based on the security parameters to obtain a matrix generation parameter, a key vector generation parameter, and a private key generation parameter; performing matrix expansion based on the matrix generation parameter to obtain an extended matrix, and performing uniform sampling based on the key vector generation parameter to obtain a first key vector and a second key vector; generating a high-order bit vector and a low-order bit vector based on the first key vector, the second key vector, and the extended matrix; The public key is generated based on the matrix generation parameter and the high-order bit vector, and the private key is generated based on the matrix generation parameter, the private key generation parameter, the first key vector, the second key vector and the low-order bit vector.

3. The method according to claim 1, characterized in that The private key includes a matrix generation parameter and a private key generation parameter, and the authentication server generates a blinding parameter based on the private key, including: Performing matrix expansion based on the matrix generation parameters to obtain an expanded matrix; Generate a random number, and perform vector generation based on the random number to obtain a masking vector; generating a blinding vector based on the expanded matrix and the masking vector; Generate blinding parameters, where the blinding parameters include the private key generation parameter and the blinding vector.

4. The method according to claim 1, wherein The public key includes a matrix generation parameter and a high-order bit vector, the blinding parameter includes a private key generation parameter and a blinding vector, and the message sending end performs a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message, including: Performing matrix expansion based on the matrix generation parameters to obtain an expanded matrix; Performing a hash operation based on the matrix generation parameter, the high-order bit vector, and the message to be transmitted to obtain an initial digest; performing a hash operation based on the initial digest and the private key generation parameter to obtain a first blinding factor, and generating a second blinding factor based on the initial digest; generating a polynomial parameter based on the expanded matrix, the first blinding factor, the blinding vector in the blinding parameter, the high-order bit vector, and the second blinding factor; and performing a hash operation on the high-order bits of the polynomial parameter and the initial digest to obtain initial blinding information; Generating target blinding information based on the initial blinding information and the second blinding factor; A blinding message is acquired, where the blinding message includes the target blinding information and the polynomial parameters.

5. The method according to claim 1, wherein The private key includes a first key vector, a second key vector, and a low-order bit vector, and the blinded message includes target blinding information and polynomial parameters. The authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded, including: Generate a first intermediate vector based on the obtained masking vector, the first key vector, and the target blinding information; generate a second intermediate vector based on the polynomial parameter, the second key vector, and the target blinding information; and generate a third intermediate vector based on the target blinding information and the low-order bit vector; generating a prompt parameter based on the second intermediate vector and the third intermediate vector; A signature to be unblinded is obtained, where the signature to be unblinded includes the prompt parameter and the first intermediate vector.

6. The method according to claim 5, characterized in that Before generating the prompt parameter based on the second intermediate vector and the third intermediate vector, the method further includes: Determining whether a preset condition is met; if so, determining that the signature of the blinded message is invalid, and prompting the message sender to regenerate the blinded message; if not, determining that the signature of the blinded message is valid, and performing an operation of generating a prompt parameter based on the second intermediate vector and the third intermediate vector; If at least one of the following expressions holds true, the preset condition is met: ； ； ； represents the first intermediate vector, Indicates infinite order, represents the coefficient range of the masking vector, Indicates the constant that has been obtained, A vector representing the low-order bits of the second intermediate vector, represents the floor range of the masking vector, represents the third intermediate vector.

7. The method according to claim 1, characterized in that The signature to be unblinded includes a prompt parameter and a first intermediate vector, and the message sending end performs an unblinding operation on the signature to be unblinded to obtain a target signature of the message to be transmitted, including: Performing an unblinding operation on the first intermediate vector based on the obtained first blinding factor to obtain a target vector; If the target vector meets the configured security conditions, the target signature is obtained; wherein the target signature includes the target vector, the prompt parameter and the obtained initial blinding information.

8. The method according to claim 1, characterized in that The public key includes a matrix generation parameter and a high-order bit vector, the target signature includes a target vector, a prompt parameter, and initial blinding information, and the message receiving end performs post-quantum verification on the target signature based on the public key, including: Performing matrix expansion based on the matrix generation parameters to obtain an expanded matrix; performing a hash operation based on the matrix generation parameters, the high-order bit vector, and the message to be transmitted to obtain an initial digest; Determining high-order bits of a polynomial parameter based on the target vector, the prompt parameter, the initial blinding information, the expanded matrix, and the high-order bit vector; performing a hash operation on the high-order bits of the polynomial parameter and the initial digest to obtain verification blinding information; Determine whether a verification condition is met, wherein the verification condition includes that the verification blinding information is the same as the initial blinding information; if so, determine that the verification is successful; if not, determine that the verification fails.

9. An anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography, characterized in that: Applied to a message sending end in an Internet of Things system, the method includes: Sending a signature request to an authentication server, so that the authentication server generates blinding parameters based on the private key; Receiving a blinding parameter sent by the authentication server, performing a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message, and sending the blinded message to the authentication server, so that the authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded; Receive the signature to be unblinded sent by the authentication server, perform an unblinding operation on the signature to be unblinded to obtain the target signature of the message to be transmitted, and send the message to be transmitted and the target signature to a message receiving end, so that the message receiving end performs post-quantum verification on the target signature based on the public key.

10. An anonymous Internet of Things identity authentication method based on quantum computing-resistant cryptography, characterized in that: Applied to an authentication server in an Internet of Things system, the method includes: After receiving the signature request sent by the message sender, generating a blinding parameter based on the obtained private key, and sending the blinding parameter to the message sender, so that the message sender performs a blinding operation based on the blinding parameter, the public key and the message to be transmitted to obtain a blinded message; Receive the blinded message sent by the message sending end, perform a post-quantum signature on the blinded message based on a private key to obtain a signature to be unblinded, and send the signature to be unblinded to the message sending end, so that the message sending end performs an unblinding operation on the signature to be unblinded to obtain a target signature of the message to be transmitted.

11. An anonymous Internet of Things identity authentication device based on quantum computing-resistant cryptography, characterized in that: The device is applied to a message sending end in an Internet of Things system, and includes: A sending module, configured to send a signature request to an authentication server, so that the authentication server generates a blinding parameter based on a private key; a receiving module, configured to receive the blinding parameter sent by the authentication server; a processing module, configured to perform a blinding operation based on the blinding parameter, the public key, and the message to be transmitted to obtain a blinded message; and a sending module, configured to send the blinded message to the authentication server, so that the authentication server performs a post-quantum signature on the blinded message based on the private key to obtain a signature to be unblinded; The receiving module is configured to receive the signature to be unblinded sent by the authentication server; The processing module is used to perform an unblinding operation on the signature to be unblinded to obtain the target signature of the message to be transmitted; the sending module is used to send the message to be transmitted and the target signature to a message receiving end, so that the message receiving end performs post-quantum verification on the target signature based on a public key.

12. An anonymous Internet of Things identity authentication device based on quantum computing-resistant cryptography, characterized in that: An authentication server used in an Internet of Things system, the device comprising: A receiving module, configured to receive a signature request sent by a message sender; A generation module, used to generate blinding parameters based on the obtained private key; A sending module, configured to send the blinding parameter to the message sending end, so that the message sending end performs a blinding operation based on the blinding parameter, the public key and the message to be transmitted to obtain a blinded message; The receiving module is used to receive the blinded message sent by the message sending end; A signature module, configured to perform a post-quantum signature on the blinded message based on a private key to obtain a signature to be unblinded; The sending module is configured to send the signature to be unblinded to the message sending end, so that the message sending end performs an unblinding operation on the signature to be unblinded to obtain a target signature of the message to be transmitted.

13. An electronic device, characterized in that: include: a processor and a machine-readable storage medium storing machine-executable instructions capable of being executed by the processor; The processor is configured to execute machine-executable instructions to implement the method of claim 9, or the processor is configured to execute machine-executable instructions to implement the method of claim 10.

Images