Post-quantum identity authentication method and system under multi-server architecture

Abstract

The invention relates to a post-quantum identity authentication method and system under a multi-server architecture, and the method specifically comprises the steps: transmitting a server identity identifier to a registration center through a secure channel, generating a server authentication secret key by the registration center according to the server identity identifier, and transmitting the server authentication secret key to a server; the user inserts an intelligent card, generates a temporary password and a temporary identity according to the user identity label and the biological characteristics, and sends the temporary password and the temporary identity to the registration center, and the registration center generates verification information when the user logs in by using the temporary password and the temporary identity and by means of the random number; when a user accesses the server, verification information is regenerated according to the identity label and the biological characteristics, if the regenerated verification information is consistent with the verification information generated during registration, the user obtains a temporary message by using central binomial distribution, the server calculates the authentication information and the shared key by using the temporary message, and the user calculates the authentication information again. And if the authentication information is consistent, calculating a shared key, otherwise, terminating the session.

Description

Technical Field

[0001] The present invention belongs to the field of information security, and specifically relates to a post-quantum identity authentication method and system under a multi-server architecture. Background Art

[0002] Authentication protocols are closely intertwined with our daily lives, from the initial single-factor authentication (using only passwords), to the later two-factor authentication (using passwords plus smart cards), and now to multi-factor authentication (using passwords, smart cards, and biometrics). In applications requiring high security, communicating parties must negotiate a common session key during authentication to ensure the confidentiality and integrity of subsequent communications and enable secure communication within open networks. Key agreement plays the first line of defense in communication security and is a crucial component of cryptographic information protection. Research on secure authentication and key agreement will provide irreplaceable theoretical foundations and technical means for information security. Passwords are currently the primary authentication method on the internet due to their ease of memorization, deployment, and management. However, password-based single-factor authentication protocols have fundamental flaws: they are often vulnerable to offline dictionary guessing attacks, making them suitable for low-computing devices. However, they are also very insecure. Single-factor authentication protocols require servers to store password tables, and a leak of these tables can lead to large-scale data breaches. Two-factor authentication protocols are based on passwords and smart cards. Users set their own passwords, and smart cards use digital certificates. However, this authentication method has the following issues: users are prone to forgetting their passwords, and if the password security factor is low, it can be easily hacked; and physical devices such as smart cards are easily lost. With the development of biometric technologies such as fingerprints and irises, their collection and utilization are becoming increasingly convenient, offering high security and practicality, and applications supporting biometric recognition are growing. Compared to traditional single- and double-factor protocols, biometrics are difficult to forge and are more convenient to use. Multi-factor authentication protocols that combine passwords, smart cards, and biometrics offer even greater security, and research on multi-factor authentication protocols is growing.

[0003] Most current password authentication protocols utilize a single-server framework. This single-server authentication model is vulnerable to internal privilege attacks and offline dictionary attacks. If a single server is compromised, all password data can be compromised, allowing adversaries to launch impersonation attacks using the compromised password information. Furthermore, with the development of quantum computers and quantum algorithms, password-authenticated key exchange schemes based on traditionally difficult problems such as discrete logarithms and large integer factorization face significant security threats. Existing password authentication schemes based on single-server architectures have experienced frequent security incidents, leading to increased attention for multi-server and dual-server password authentication schemes. However, the security of two-server password authentication schemes has been questioned, and their scalability is limited, making them suitable only for resource-constrained applications. Furthermore, they suffer from numerous unresolved security issues, making them inadequate for practical needs. Single- and dual-server protocols no longer meet user needs, leading to the use of multiple servers collaborating to provide user convenience. Multi-server authentication schemes are gradually replacing traditional single-server authentication schemes and becoming the mainstream. However, how to better protect against server compromise attacks and quantum computing attacks while mitigating the security risks associated with the weak security of the password as a single factor remains a pressing challenge in multi-server authentication. Summary of the Invention

[0004] To address the problem of low security and susceptibility to leakage attacks and quantum attacks in identity authentication, in a first aspect, the present invention provides a post-quantum identity authentication method under a multi-server architecture, the method comprising:

[0005] The server sends the server identity to the registration center through a secure channel. The registration center generates a server authentication key based on the server identity and sends it to the server.

[0006] The user inserts the smart card and generates a temporary password and temporary identity based on the user's identity and biometrics, and sends the temporary password and temporary identity to the registration center. The registration center uses the temporary password, temporary identity and random numbers to generate verification information for the user to log in.

[0007] When a user accesses the server, verification information is regenerated based on the identity identifier and biometrics. If the regenerated verification information is consistent with the verification information generated during registration, the user uses the central binomial distribution to obtain a temporary message. The server uses the temporary message to calculate the authentication information and shared key. The user recalculates the authentication information. If the authentication information is consistent, the shared key is calculated. Otherwise, the session is terminated.

[0008] Preferably, the registration center generates a server authentication key according to the server identity identifier, specifically:

[0009] The registration center randomly selects a random number, concatenates the random number and the server identity, and then obtains the server authentication key through a hash function.

[0010] Preferably, the temporary password and temporary identity are generated according to the user identification and biometrics, specifically:

[0011] Get user identity ID i , and obtain the biometric Bio through the biometric extractor i , the user's biometric key Du and auxiliary information DI are calculated using the generating function in the biometric extractor, and the biometric key is input into the physical unclonable function to obtain the response value D i , using the response value D i Get a temporary password TPW i and temporary identity TID i .

[0012] Preferably, the use of the response value D i Get a temporary password TPW i and temporary identity TID i , specifically:

[0013] Using H0(Du||PW i ||D i ||n1) Calculate TPW i ;

[0014] Using H0(ID i ||D i ||n1) calculates TID i ;

[0015] Among them, H0() represents hash operation, || represents cascade operation, n1 represents random number, PW i Indicates the user password.

[0016] Preferably, the registration center uses a temporary password, a temporary identity and a random number to generate verification information for user login, specifically:

[0017] Get random number n1;

[0018] Using H0(AD i ||n1) calculate KD i , among which, AD i =H0(TID i ||n1);

[0019] Using H0(AP i ||n1) calculate KP i , among which, APi =H0(TPW i ||n1);

[0020] Using H0(KDP i ||n1) Get verification information V i , among which, KDP i =KP i ⊕KD i ;

[0021] Among them, H0() represents function operation, || represents cascade operation, Represents the exclusive OR operation.

[0022] Preferably, the regeneration of verification information based on the identity identifier and biometric features is specifically as follows:

[0023] Get user identity ID' i , and obtain the biometric Bio′ through the biometric extractor i , the biometric key Du′ and auxiliary information DI′ of the user are calculated using the generating function of the biometric extractor, and the biometric key is input into the physical unclonable function to obtain the response value D′ i .

[0024] According to H0(Du′||PW i ||D′ i ||n1) calculate TPW′ i , and according to H0(ID′ i ||D′ i ||n1) calculate TID′ i .

[0025] Using H0(AD′ i ||n1) calculate KD′ i , where AD′ i =H0(TID′ i ||n1);

[0026] Using H0(AP′ i ||n1) calculate KP′ i , where AP′ i =H0(TPW′ i ||n1);

[0027] Using H0(KDP′ i ||n1) Get verification information V′ i ,in,

[0028] Preferably, the user obtains the temporary message using central binomial distribution, specifically:

[0029] Sampling from the central binomial distribution yields s U 、e U , through As U +e U Calculate b U , get K through H1(Du||Du′), using Get X U , will (X U ,n2) as the temporary message M0; where A is a parameter, H1() represents a function operation, and n2 is a random number.

[0030] Preferably, the server calculates the authentication information and the shared key using the temporary message, specifically:

[0031] The server uses central binomial distribution sampling to obtain s Sk 、e Sk , and generate a random number n k2 、n k3 , calculate b Sk =A T s Sk +e Sk , According to w k Get the coordination value c k .

[0032] The server calculates the authentication information Auth=H1(KD i ||n2||n k2 ||c k ||X U ||b Sk ||KP i ), and calculate the shared key SK=H2(TDP i ||n2||n k3 ||c k ||X U ||b sk ).

[0033] Among them, H1() and H2() represent function operations.

[0034] Preferably, the user recalculates the authentication information, specifically:

[0035] Calculate the authentication information Auth′=H1(KD′ i ||n2||n k2 ||c′ k ||X U ||b sk ||KP′ i ), where c′k The coordination value calculated for the user.

[0036] In a second aspect, a post-quantum identity authentication system under a multi-server architecture is provided, characterized in that the system includes:

[0037] The server registration module sends the server identity to the registration center through a secure channel. The registration center generates a server authentication key based on the server identity and sends it to the server.

[0038] In the user registration module, the user inserts a smart card and generates a temporary password and temporary identity based on the user's identity identifier and biometrics, and sends the temporary password and temporary identity to the registration center. The registration center uses the temporary password, temporary identity and random numbers to generate verification information for the user to log in.

[0039] Authentication and key agreement module: When a user accesses the server, verification information is regenerated based on the identity identifier and biometric features. If the regenerated verification information is consistent with the verification information generated during registration, the user uses the central binomial distribution to obtain a temporary message. The server uses the temporary message to calculate the authentication information and shared key. The server sends the information including the authentication information to the user, and the user recalculates the authentication information. If the authentication information is consistent, the shared key is calculated. Otherwise, the session is terminated.

[0040] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method described in the first aspect when executed by a processor.

[0041] In order to ensure the security of multi-server authentication, the present invention utilizes biometric PUF functions and fuzzy extractors to extract biometric features, uses MLWE, a mathematically difficult problem in the KYBER algorithm in the post-quantum standard, to design the private key in the authentication process, and realizes the function of resisting quantum computing attacks. It combines the central binomial distribution sampling technology for sampling, and realizes the ability to resist server leakage attacks and quantum computing attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flow chart of Example 1;

[0043] Figure 2 Schematic diagram of the server registration process;

[0044] Figure 3 This is the overall flow chart;

[0045] Figure 4 This is a structural diagram of Example 2. DETAILED DESCRIPTION

[0046] In the embodiments of the present invention, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner to facilitate understanding.

[0047] It will be understood that the “embodiment” mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, the various embodiments throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It will be understood that in the various embodiments of the present application, the size of the sequence number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0048] In the present invention, unless otherwise specified, the same or similar parts between the various embodiments can refer to each other. In the various embodiments of the present invention, and the various implementation methods / implementation methods / implementation methods in each embodiment, if there is no special explanation and logical conflict, the terms and / or descriptions between different embodiments and the various implementation methods / implementation methods / implementation methods in each embodiment are consistent and can be referenced to each other. The technical features in different embodiments and the various implementation methods / implementation methods / implementation methods in each embodiment can be combined to form new embodiments, implementation methods, implementation methods, or implementation methods according to their inherent logical relationships. The implementation methods of the present application described below do not constitute a limitation on the scope of protection of the present application.

[0049] In the present invention, the symbols involved are as follows:

[0050] Table 1 Symbols

[0051]

[0052] Wherein, H0(·), H1(·), H2(·) represent three functions, preferably hash functions, {0,1} * →{0,1} l Indicates converting a binary string of arbitrary length to a binary string of fixed length l.

[0053] Example 1, as Figure 1 As shown, the post-quantum identity authentication method under the multi-server architecture includes:

[0054] S1, the server sends the server identity to the registration center through a secure channel. The registration center generates a server authentication key based on the server identity and sends it to the server.

[0055] In a multi-server architecture, the server needs to register with the registration center first. During registration, the server will uniquely identify its own server identity, such as the server name, IP address, unique device ID, or other pre-set identifiers. Through the encrypted communication link established between the server and the registration center, the server will send its own identity information through this secure channel to the central agency responsible for managing and authenticating each entity in the system - the registration center.

[0056] In one embodiment, the registration center randomly selects a random number, concatenates the random number and the server identity, and then obtains the server authentication key through a hash function. Specifically, Figure 2 As shown, when the server S registers with the registration center RC, it provides the identity identifier SID i The RC registration center selects a random number n0 and calculates KS i =H0(SID i ||n0), RC will KS i Send to server S. After the server receives the message, the server stores these values KS i , where H0 represents a function operation, and H1, H2, etc. hereinafter all represent function operations, preferably, the function operation is a hash operation. All information in the above process is transmitted through a secure channel.

[0057] S2, the user inserts the smart card and generates a temporary password and temporary identity based on the user's identity and biometrics, and sends the temporary password and temporary identity to the registration center. The registration center uses the temporary password, temporary identity and random numbers to generate verification information for the user to log in.

[0058] To obtain the user of the server service, first, insert a smart card on the local host or computer. The smart card is a physical security device with storage and computing capabilities, which is used to store the user's identity information, keys or other sensitive data. After inserting the smart card, the identity information stored in the smart card is read, and the user's biometric features such as fingerprints, face, etc. are collected, and then a temporary password and temporary identity credentials are generated based on the information. In one embodiment, the identity information is input by the user. The generated temporary password and temporary identity information are sent to the registration center responsible for user registration and authentication management through the network. After receiving the temporary password and temporary identity, the registration center performs a preliminary verification, and combines the random number generated by itself to generate the verification information that the user needs to provide when logging in officially through encryption or hash algorithm.

[0059] In an optional embodiment, the temporary password and temporary identity are generated based on the user identification and biometrics, specifically:

[0060] Get user identity ID i , and obtain the biometric Bio through the biometric extractor i , the user's biometric key Du and auxiliary information DI are calculated using the generating function in the biometric extractor, and the biometric key is input into the physical unclonable function to obtain the response value D i , using the response value D i Get a temporary password TPW i and temporary identity TID i .

[0061] The use of the response value D i Get a temporary password TPW i and temporary identity TID i , specifically:

[0062] Using H0(Du||PW i ||D i ||n1) Calculate TPW i ;

[0063] Using H0(ID i ||D i ||n1) calculates TID i ;

[0064] Among them, H0() represents hash operation, || represents cascade operation, n1 represents random number, PW i Indicates the user password.

[0065] Specifically, insert the smart card, and the smart card user selects the identity identifier ID i , and obtain the biometric Bio with the help of the biometric extractor i , and then use the extractor's generating function to calculate (Du, DI) = FE.GEN (Bio i ), get the user's biometric key Du and auxiliary information DI. Among them, Du can only be obtained by Bio i Generate; Auxiliary information DI generated by biometric information is stored in the smart card. Then, the uniqueness of the user's biometrics and the physical uniqueness of the device PUF are combined, and Du is used as the parameter information of the device PUF to obtain the response value D i , that is, D i =PUF(Du). Calculate TPW i =H0(Du||PW i ||D i||n1) and temporary identity TID i =H0(ID i ||D i ||n1), TPW is transmitted through a secure channel i and TID i Sent to the registration center RC. FE.GEN() is an encryption function, and PUF() is a function built into the device PUF. In one embodiment, the temporary password and temporary identity are generated by the user, while in another embodiment, they are generated by the registration center.

[0066] The user registration process is:

[0067] Input: ID i ,Bio i , PW i

[0068] calculate:

[0069] (Du,DI)=FE.GEN(Bio i )

[0070] D i =PUF(Du)

[0071] TID i =H0(ID i ||D i ||n1)

[0072] TPW i =H0(Du||PW i ||D i ||n1)

[0073] m0=(TID i ,TPW i )

[0074] After receiving the temporary password and temporary identity, the registration center further generates verification information for the user to log in. In one embodiment, the registration center uses the temporary password, temporary identity and a random number to generate the verification information for the user to log in, specifically:

[0075] Get random number n1;

[0076] Using H0(AD i ||n1) calculate KD i , among which, AD i =H0(TID i ||n1);

[0077] Using H0(AP i ||n1) calculate KP i, among which, AP i =H0(TPW i ||n1);

[0078] Using H0(KDP i ||n1) Get verification information V i ,in,

[0079] Among them, H0() represents function operation, || represents cascade operation, Represents the exclusive OR operation.

[0080] Specifically, after the registration center receives the registration information, the smart card or the registration center generates a new random number n1 and calculates the private key AD i =H0(TID i ||n1), KD i =H0(AD i ||n1), AP i =H0(TPW i ||n1), KP i =H0(AP i ||n1), And the verification information V required for login i =H0(KDP i ||n1), save V i In one embodiment, the verification information V i Sent to the user or server.

[0081] After the user inserts the smart card, the registration center generates: random number n1

[0082] calculate:

[0083] AD i =H0(TID i ||n1)

[0084] KD i =H0(AD i ||n1)

[0085] AP i =H0(TPW i ||n1)

[0086] KP i =H0(AP i ||n1)

[0087]

[0088] V i =H0(KDP i ||n1)

[0089] Save: V i .

[0090] S3: When the user accesses the server, the verification information is regenerated based on the identity identifier and biometrics. If the regenerated verification information is consistent with the verification information generated during registration, the user uses the central binomial distribution to obtain a temporary message. The server uses the temporary message to calculate the authentication information and shared key. The user recalculates the authentication information. If the authentication information is consistent, the shared key is calculated. Otherwise, the session is terminated.

[0091] When a user accesses the server, verification information is regenerated based on the identity identifier and biometrics. The server will ask the user to provide his or her identity identifier and collect the user's biometrics, such as fingerprints, facial recognition, etc. Then, the server or user uses the same method as in the registration phase to regenerate data for verifying the user's identity based on this information. If the newly generated verification information on the server matches the verification information created and stored on the server by the user during registration, it indicates that the user's identity has been initially verified. At this time, the user end will use a probability method such as central binomial distribution to generate a temporary, random message data. In one embodiment, the server or user regenerates verification information based on the identity identifier and biometrics, and the verification is performed by the server or by the user. The user represents a user terminal, such as a host, computer, mobile device, etc., through which the user accesses the server.

[0092] After receiving the temporary message sent by the user, the server will use this temporary message, combined with certain secret information previously associated with the user, to calculate an authentication information used to further verify the user's identity. At the same time, it will calculate a shared key that only the user and the server can know. The shared key is used to encrypt subsequent communications. After sending the temporary message, the user end will also use the same temporary message and the secret information shared with the server to recalculate an authentication information using the same algorithm. If the authentication information recalculated by the user end matches the authentication information sent by the server, this indicates that both parties hold the same secret information and the communication process has not been tampered with. At this time, the user end will also calculate the shared key previously calculated by the server, and the two parties will begin secure communication. If the two authentication information are inconsistent, it means that the identity authentication has failed or there is an abnormality in the communication. The server will immediately disconnect from the user and terminate the current session.

[0093] In an optional embodiment, the regeneration of verification information based on the identity identifier and biometric features is specifically as follows:

[0094] Get user identity ID' i , and obtain the biometric Bio′ through the biometric extractor i, the biometric key Du′ and auxiliary information DI′ of the user are calculated using the generating function of the biometric extractor, and the biometric key is input into the physical unclonable function to obtain the response value D′ i .

[0095] According to H0(Du′||PW i ||D′ i ||n1) calculate TPW′ i , and according to H0(ID′ i ||D′ i ||n1) calculate TID′ i ;

[0096] Using H0(AD′ i ||n1) calculate KD′ i , where AD′ i =H0(TID′ i ||n1);

[0097] Using H0(AP′ i ||n1) calculate KP′ i , where AP′ i =H0(TPW′ i ||n1);

[0098] Using H0(KDP′ i ||n1) Get verification information V′ i ,in,

[0099] Specifically, when a user accesses the server S, he inserts the smart card SC i , and enter or obtain your own identity ID from the smart card i , Biometric Information i In the smart terminal, the calculated auxiliary information DI is used as the input of the fuzzy extractor rep function, and the biometric key Du′ is calculated. Du′ is used as the information parameter to obtain the response information D′ i , calculate the temporary identity feature TID′ i =H0(ID i ||D i ||n1) and temporary password information TPW′ i =H0(Du||PW i ||D i ||n1), calculate the temporary private key AD′ i =H0(TID′ i ||n1), KD′ i =H0(AD′ i ||n1), AP′i =H0(TPW′ i ||n1), KP′ i =H0(AP′ i ||n1), and V′ i =H0(KDP′ i ||n1). To successfully log in, you must verify that the key generated during registration is equal. If verification fails, the session is terminated. Otherwise, mutual authentication and key negotiation continue.

[0100] Login process:

[0101] Du′=FE.rep(Bio i ,DI′)

[0102] D i ′=PUF(Du)

[0103] TPW′ i =H0(Du||PW i ||D i ||n1)

[0104] TID′ i =H0(ID i ||D i ||n1)

[0105] AD′ i =H0(TID′ i ||n1)

[0106] KD′ i =H0(AD′ i ||n1)

[0107] AP′ i =H0(TPW′ i ||n1)

[0108] KP′ i =H0(AP′ i ||n1)

[0109]

[0110] V′ i =H0(KDP′ i ||n1)

[0111] If V′ i =V i , the user successfully logged in.

[0112] In an optional embodiment, the user obtains the temporary message using central binomial distribution, specifically:

[0113] Sampling from the central binomial distribution yields s U 、e U , through As U +e U Calculate b U , get K through H1(Du||Du′), using Get X U , will (X U ,n2) as the temporary message M0; where A is a parameter, H1() represents a function operation, and n2 is a random number.

[0114] Specifically, user U is sampled from the central binomial distribution and is Calculate b U =As U +e U , Send information M0=(X U ,n2) to the server.

[0115] In an optional embodiment, the server calculates the authentication information and the shared key using the temporary message, specifically:

[0116] The server uses central binomial distribution sampling to obtain s Sk 、e Sk , and generate a random number n k2 、n k3 , calculate b Sk =A T s Sk +e Sk , According to w k Get the coordination value c k .

[0117] The server calculates the authentication information Auth=H1(KD i ||n2||n k2 ||c k ||X U ||b Sk ||KP i ), and calculate the shared key SK=H2(TDP i ||n2||n k3 ||c k ||X U ||b sk ).

[0118] Among them, H1() and H2() represent function operations.

[0119] Specifically, after receiving the information M0, the server S samples the central binomial distribution and obtains Generate random number n at the same time k2 、n k3 Calculate b Sk =A T s Sk +e Sk , And use the doubling, cross rounding and modulo rounding functions to calculate the doubled value Signal value Modulo integer value (What is the function of modulo rounding? This parameter is not used later) and the coordinated value c is obtained k =rec(2w k ,σ k )(Should be 2w k Or w k ), then the server calculates the authentication information Auth = H1(KD′) between the server and the user i ||n2||n k2 ||c k ||X U ||b sk ||KP′ i ), and calculate the shared key SK=H2(TDP′ between the user and the client. i ||n2||n k3 ||c k ||X U ||b sk ). Among them, dbl() represents the doubling operation.

[0120] Among them, the Peikert error coordination mechanism is a technology used to solve the error coordination problem in fault-tolerant learning. It is mainly used in key exchange protocols such as NewHope and Kyber algorithms to ensure that both communicating parties can extract a consistent key from a noisy shared value. The Peikert error coordination mechanism is defined as: if q is an integer greater than 2, then Define three intervals: (here it is still What are the functions of I0 and I1? These two parameters are not used later).

[0121] Cross-round function<·> q,2 : Specifically:

[0122] Modulo integer function: Specifically:

[0123] Coordination function rec: Specifically: (I σ What is it).

[0124] In an optional embodiment, the user recalculates the authentication information, specifically:

[0125] Calculate the authentication information Auth′=H1(KD′ i ||n2||n k2 ||c′ k ||X U ||b sk ||KP′ i ), where c′ k The coordination value calculated for the user.

[0126] Specifically, user U i After receiving the information M1, the error protocol mechanism is used to calculate And use the signal value to get the coordination value c k ′=rec(2w k ′,σ k ) and calculate the authentication information Auth′=H1(KD′ i ||n2||n k2 ||c′ k ||X U ||b sk ||KP′ i ) to determine whether Auth' and Auth are equal. If they are not equal, terminate the session. Otherwise, continue to calculate SK = H2(TDP' i ||n2||n k3 ||c′ k ||X U ||b sk ).

[0127] Authentication and key negotiation process:

[0128] user:

[0129]

[0130] b U =As U +e U

[0131]

[0132] M0=(X U ,n2)

[0133] server:

[0134]

[0135] n k2 、n k3 →0,1 n

[0136] b Sk =A T s Sk +e Sk

[0137]

[0138] Auth=H1(KD′ i ||n2||n k2 ||c k ||X U ||b sk ||KP′ i )

[0139] SK=H2(TDP′ i ||n2||n k3 ||c k ||X U ||b sk )

[0140] user:

[0141]

[0142] c k ′=rec(2w k ′,σ k )

[0143] Auth′=H1(KD′ i ||n2||n k2 ||c′ k ||X U ||b sk ||KP′ i )

[0144] Auth′=Auth

[0145] SK=H2(TDP′ i ||n2||n k3 ||c′ k ||X U ||b sk )

[0146] In yet another embodiment, Figure 3 The overall process is shown as Figure 3As shown in the figure, when a new server wishes to join the system, it sends its unique identity to the registration center via a secure, encrypted channel. After receiving the server's registration request and identity, the registration center uses this information to calculate a secret key for subsequent authentication of the server's identity. To register, a user first inserts their smart card into a card reader to obtain their identity identifier and biometric features, such as fingerprints and irises. This information is combined to generate a temporary identity identifier (TIDU) associated with the registration. The user's smart terminal device features a physical unclonable function (PUF) to generate a unique hardware fingerprint. Combined with a fuzzy extractor and hash function, the user's identity identifier and biometric features are encrypted to generate the final registration encrypted information. The PUF enhances system security by preventing easy key duplication. The fuzzy extractor ensures consistent key or credential generation, even with slightly different biometric features collected each time. The hash function generates a data digest, ensuring data integrity and irreversibility.

[0147] When the registration center receives the encrypted registration information sent by the user, it generates information for subsequent login verification. Then, the registration center sends the verification information needed by the user when logging in to the user. After the user receives the login verification information sent by the registration center, he saves the login verification information and other information.

[0148] When a user wishes to log in to the system, they insert their smart card again. After the user successfully logs in, the system uses a central binomial distribution sampling algorithm to extract the user's private key SU and some related noise information e from certain data. Central binomial distribution sampling is used to generate random numbers with specific statistical properties. The user uses their password PW and the encrypted information of the biometric BIOU collected for this login, combined with an instance of a lattice-based cryptographic problem (Module Learning With Errors, MLWE), to construct a temporary public key information bt. The user sends a login request containing the temporary public key bt and other information to the target server. Upon receiving this information, the server uses pre-stored parameters related to the user to perform calculations and generate relevant information for authenticating the user's identity.

[0149] After receiving the user's login request, the server calculates authentication information to verify the user's identity. In one embodiment, the server verifies its legitimacy, for example, using a key previously negotiated with the registration center. If all verifications are successful, the server further calculates a session key, which is used for subsequent secure communications between the user and the server.

[0150] After receiving the authentication information from the server, the user verifies the server's correctness based on the parameters they previously sent and the biometric data they collected. If the verification succeeds, it indicates that both the user and the server have passed each other's preliminary authentication. The user then calculates the same session key as the server.

[0151] Example 2, as Figure 4 As shown, a post-quantum identity authentication system under a multi-server architecture is provided, characterized in that the system includes:

[0152] The server registration module sends the server identity to the registration center through a secure channel. The registration center generates a server authentication key based on the server identity and sends it to the server.

[0153] In the user registration module, the user inserts a smart card and generates a temporary password and temporary identity based on the user's identity identifier and biometrics, and sends the temporary password and temporary identity to the registration center. The registration center uses the temporary password, temporary identity and random numbers to generate verification information for the user to log in.

[0154] Authentication and key agreement module: When a user accesses the server, verification information is regenerated based on the identity identifier and biometric features. If the regenerated verification information is consistent with the verification information generated during registration, the user uses the central binomial distribution to obtain a temporary message. The server uses the temporary message to calculate the authentication information and shared key. The server sends the information including the authentication information to the user, and the user recalculates the authentication information. If the authentication information is consistent, the shared key is calculated. Otherwise, the session is terminated.

[0155] Preferably, the registration center generates a server authentication key according to the server identity identifier, specifically:

[0156] The registration center randomly selects a random number, concatenates the random number and the server identity, and then obtains the server authentication key through a hash function.

[0157] Preferably, the temporary password and temporary identity are generated according to the user identification and biometrics, specifically:

[0158] Get user identity ID i , and obtain the biometric Bio through the biometric extractor i , the user's biometric key Du and auxiliary information DI are calculated using the generating function in the biometric extractor, and the biometric key is input into the physical unclonable function to obtain the response value D i , using the response value D i Get a temporary password TPW i and temporary identity TIDi .

[0159] Preferably, the use of the response value D i Get a temporary password TPW i and temporary identity TID i , specifically:

[0160] Using H0(Du||PW i ||D i ||n1) Calculate TPW i ;

[0161] Using H0(ID i ||D i ||n1) calculates TID i ;

[0162] Among them, H0() represents hash operation, || represents cascade operation, n1 represents random number, PW i Indicates the user password.

[0163] Preferably, the registration center uses a temporary password, a temporary identity and a random number to generate verification information for user login, specifically:

[0164] Get random number n1;

[0165] Using H0(AD i ||n1) calculate KD i , among which, AD i =H0(TID i ||n1);

[0166] Using H0(AP i ||n1) calculate KP i , among which, AP i =H0(TPW i ||n1);

[0167] Using H0(KDP i ||n1) Get verification information V i ,in,

[0168] Among them, H0() represents function operation, || represents cascade operation, Represents the exclusive OR operation.

[0169] Preferably, the regeneration of verification information based on the identity identifier and biometric features is specifically as follows:

[0170] Get user identity ID' i , and obtain the biometric Bio′ through the biometric extractori , the biometric key Du′ and auxiliary information DI′ of the user are calculated using the generating function of the biometric extractor, and the biometric key is input into the physical unclonable function to obtain the response value D′ i .

[0171] According to H0(Du′||PW i ||D′ i ||n1) calculate TPW′ i , and according to H0(ID′ i ||D′ i ||n1) calculate TID′ i ;

[0172] Using H0(AD′ i ||n1) calculate KD′ i , where AD′ i =H0(TID′ i ||n1);

[0173] Using H0(AP′ i ||n1) calculate KP′ i , where AP′ i =H0(TPW′ i ||n1);

[0174] Using H0(KDP′ i ||n1) Get verification information V′ i ,in,

[0175] Preferably, the user obtains the temporary message using central binomial distribution, specifically:

[0176] Sampling from the central binomial distribution yields s U 、e U , through As U +e U Calculate b U , get K through H1(Du||Du′), using Get X U , will (X U ,n2) as the temporary message M0; where A is a parameter, H1() represents a function operation, and n2 is a random number.

[0177] Preferably, the server calculates the authentication information and the shared key using the temporary message, specifically:

[0178] The server uses central binomial distribution sampling to obtain s Sk 、e Sk , and generate a random number nk2 、n k3 , calculate b Sk =A T s Sk +e Sk , The doubled value is calculated using random doubling, cross rounding and modulo rounding functions respectively Signal value Coordination Value

[0179] The server calculates the authentication information Auth=H1(KD i ||n2||n k2 ||c k ||X U ||b Sk ||KP i ), and calculate the shared key SK=H2(TDP i ||n2||n k3 ||c k ||X U ||b sk ).

[0180] Among them, H1() and H2() represent function operations.

[0181] Preferably, the user recalculates the authentication information, specifically:

[0182] Calculate the authentication information Auth′=H1(KD′ i ||n2||n k2 ||c′ k ||X U ||b sk ||KP′ i ), where c′ k The coordination value calculated for the user.

[0183] The above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0184] The steps of the methods or algorithms described in the embodiments of the present application can be directly embedded in hardware, software units executed by a processor, or a combination of the two. The software units can be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or other storage media in any form known in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from the storage medium and write information to the storage medium. Alternatively, the storage medium can also be integrated into the processor. The processor and storage medium can be arranged in an ASIC.

[0185] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0186] Although the present application has been described with reference to specific features and embodiments thereof, it is apparent that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely illustrative of the present application as defined by the appended claims and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, the present application is intended to include such modifications and variations if they fall within the scope of the claims of the present application and their equivalents.

Claims

1. A post-quantum identity authentication method under a multi-server architecture, characterized in that: The method comprises: The server sends the server identity to the registration center through a secure channel. The registration center generates a server authentication key based on the server identity and sends it to the server. The user inserts the smart card, and a temporary password and temporary identity are generated based on the user's identity identifier and biometrics. The temporary password and temporary identity are sent to the registration center, which uses the temporary password, temporary identity, and a random number to generate verification information for the user's login. When a user accesses the server, verification information is regenerated based on the identity identifier and biometrics. If the regenerated verification information is consistent with the verification information generated during registration, the user uses the central binomial distribution to obtain a temporary message. The server uses the temporary message to calculate the authentication information and shared key. The user recalculates the authentication information. If the authentication information is consistent, the shared key is calculated. Otherwise, the session is terminated.

2. The method according to claim 1, wherein The registration center generates a server authentication key based on the server identity identifier, specifically: The registration center randomly selects a random number, concatenates the random number and the server identity, and then obtains the server authentication key through a hash function.

3. The method according to claim 1, wherein The temporary password and temporary identity are generated based on the user's identity identifier and biometric characteristics, specifically: Get user identity ID i , and obtain the biometric Bio through the biometric extractor i , the user's biometric key Du and auxiliary information DI are calculated using the generating function in the biometric extractor, and the biometric key is input into the physical unclonable function to obtain the response value D i , using the response value D i Get a temporary password TPW i and temporary identity TID i .

4. The method according to claim 3, wherein The use of the response value D i Get a temporary password TPW i and temporary identity TID i , specifically: Using H0(Du||PW i ||D i ||n1) Calculate TPW i ; Using H0(ID i ||D i ||n1) calculates TID i ; Among them, H0() represents hash operation, || represents cascade operation, n1 represents random number, PW i Indicates the user password.

5. The method according to claim 3, wherein The registration center uses a temporary password, temporary identity and random numbers to generate verification information for user login, specifically: Get random number n1; Using H0(AD i ||n1) calculate KD i , among which, AD i =H0(TID i ||n1); Using H0(AP i ||n1) calculate KP i , among which, AP i =H0(TPW i ||n1); Using H0(KDP i ||n1) Get verification information V i , among which, KDP i =KP i ⊕KD i ; Among them, H0() represents function operation, || represents cascade operation, and ⊕ represents exclusive OR operation.

6. The method according to claim 4, wherein The verification information is regenerated based on the identity identifier and biometric features, specifically: Get user identity ID i ′ , and obtain the biometric Bio through the biometric extractor i ′ , the user's biometric key Du is calculated using the biometric extractor's generating function ′ and auxiliary information DI ′ , input the biometric key into the physical unclonable function to obtain the response value D i ′ ; According to H0(Du ′ ||PW i ||D i ′ ||n1) Calculate TPW i ′ , and according to H0(ID i ′ ||D i ′ ||n1) calculates TID i ′ ; Using H0(AD i ′ ||n1) calculate KD i ′ , among which, AD i ′ =H0(TID i ′ ||n1); Using H0(AP i ′ ||n1) calculate KP i ′ , among which, AP i ′ =H0(TPW i ′ ||n1); Using H0(KDP i ′ ||n1) Get verification information V i ′ ,in, 7. The method according to claim 6, wherein The user obtains temporary information using central binomial distribution, specifically: Sampling from the central binomial distribution yields s U 、e U , through As U +e U Calculate b U , through H1(Du||Du ′ ) to get K, using Get X U , will (X U ,n2) as the temporary message M0; where A is a parameter, H1() represents a function operation, and n2 is a random number.

8. The method according to claim 7, wherein The server uses the temporary message to calculate the authentication information and shared key, specifically: The server uses central binomial distribution sampling to obtain s Sk 、e Sk , and generate a random number n k2 、n k3 , calculate b Sk =A T s Sk +e Sk , According to w k Get the coordination value c k ; The server calculates the authentication information Auth=H1(KD i ||n2||n k2 ||c k ||X U ||b Sk ||KP i ), and calculate the shared key SK=H2(TDP i ||n2||n k3 ||c k ||X U ||b sk ); Among them, H1() and H2() represent function operations.

9. The method according to claim 8, wherein The user recalculates the authentication information, specifically: Calculate the authentication information Auth ′ =H1(KD i ′ ||n2||n k2 ||c ′ k ||X U ||b sk ||KP i ′ ), where c ′ k The coordination value calculated for the user.

10. A post-quantum identity authentication system under a multi-server architecture, characterized in that: The system comprises: The server registration module sends the server identity to the registration center through a secure channel. The registration center generates a server authentication key based on the server identity and sends it to the server; User registration module: The user inserts a smart card and generates a temporary password and temporary identity based on the user's identity identifier and biometrics. The temporary password and temporary identity are sent to the registration center, which uses the temporary password, temporary identity and random numbers to generate verification information for the user to log in; Authentication and key agreement module: When a user accesses the server, verification information is regenerated based on the identity identifier and biometric features. If the regenerated verification information is consistent with the verification information generated during registration, the user uses the central binomial distribution to obtain a temporary message. The server uses the temporary message to calculate the authentication information and shared key. The server sends the information including the authentication information to the user, and the user recalculates the authentication information. If the authentication information is consistent, the shared key is calculated. Otherwise, the session is terminated.

Images