Identity binding authentication key negotiation method based on user password enhancement

Abstract

The invention discloses an identity binding authentication key negotiation method based on user password enhancement, and belongs to an information security technology. According to the method, aiming at the problems that an existing identity binding password authentication key exchange protocol cannot resist brute force attack after compromise and communication rounds are many, a high-entropy key is introduced to be bound with a user password and a device identity, and an enhanced long-term identity certificate is constructed. The protocol comprises three stages of system initialization, equipment registration and single-round authentication key exchange. In the registration stage, the device generates an authentication file containing a long-term private key and public parameters based on a password, a high-entropy key and identity information. In a key exchange stage, both parties only need to exchange single-round messages, identity authentication and a key exchange process are fused in a mode of encrypting a temporary public key by using own identity public keys, a receiver can independently decrypt and verify the identity of the opposite party, and then a shared session key is calculated in combination with own private keys and public parameters of the opposite party; the communication security is ensured, and the protocol efficiency and the anti-attack capability are improved.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to an identity binding authentication key negotiation technology based on user password enhancement. Background Technology

[0002] The rapid development of the Internet of Things (IoT) has driven the proliferation of unmanned scenarios (i.e., scenarios with minimal human intervention). In typical unmanned scenarios such as drone swarms, smart home systems, and autonomous vehicles, devices often form groups and need to cooperate to complete complex tasks. The information transmitted between devices often involves sensitive or private information. Therefore, ensuring communication security in unmanned scenarios is crucial. To achieve this goal, two issues need to be addressed: mutual authentication between devices and the establishment of shared session keys.

[0003] The Password-based Authenticated Key Exchange (PAKE) protocol is a class of cryptographic primitives that meet the above requirements. Using the PAKE protocol, two parties can establish a high-entropy session key based on the same low-entropy user password. The PAKE protocol framework requires all parties to provide plaintext user passwords. Therefore, in unmanned scenarios lacking user input, this setting requires devices to store plaintext user passwords. Once an adversary compromises a device, it can quickly steal the user password, thus enabling it to impersonate any uncompromised device using the same user password. We call such an attack a Key Compromise Impersonation Attack (KCI).

[0004] Recently, a new scheme called iPAKE (Identity-bindingPAKE) has emerged to combat KCI attacks. iPAKE integrates the Identity-based Key Agreement (IB-KA) protocol with PAKE. The IB-KA protocol allows participants to negotiate a shared key based on key information derived from identity information. In iPAKE, participants derive a password file from their identity information and their own password, and use this password file to complete mutual authentication and key negotiation. In unmanned scenarios, because the password file is bound to the device identity, an adversary who captures an uncontrolled device cannot directly obtain the password, and therefore cannot generate password files for other devices. Thus, the adversary cannot impersonate an uncaptured device.

[0005] Compared to previous solutions, iPAKE is more effective at defending against KCI attacks, but the following issues still exist: In terms of security, iPAKE cannot resist compromised brute-force attacks. After capturing the device and extracting the user password file, due to the low entropy of the user password, an adversary can recover the user password through brute-force dictionary attacks, thereby breaking iPAKE's KCI resistance.

[0006] In terms of efficiency, iPAKE requires at least two rounds of communication to complete the authentication key negotiation, which makes it unsuitable for the resource-constrained characteristics of common unmanned environments. For example, the sensor nodes and edge controllers deployed in large numbers in the Industrial Internet of Things are often limited by low-power processors, limited storage space, and stringent energy consumption requirements. Summary of the Invention

[0007] The technical problem to be solved by this invention is to provide an authentication key negotiation scheme that effectively resists KCI attacks and compromised brute-force attacks in device environments with limited computing and communication resources, addressing the issue that existing user password authentication key exchange protocols cannot resist compromised brute-force attacks.

[0008] The technical solution adopted by this invention to solve the above-mentioned technical problems is a method for identity binding authentication key negotiation based on user password enhancement, which binds a high-entropy key with the user password and device identity, including the following steps: System initialization steps are used to determine the common parameters of the cryptographic system; The device registration step is used to enable the device to generate and store an authentication file containing the device identity identifier, a long-term private key, and several public parameters corresponding to the long-term private key based on the user password, high-entropy key, session group identifier, and its own identity identifier. The generation of the long-term private key integrates the user password, high-entropy key, and its own identity identifier. The single-round authentication key exchange step enables two devices to complete mutual authentication and negotiate a shared session key by exchanging a single round of messages; wherein, the operations performed by each device include: a) Generate and send a message: Based on its own stored authentication file and the current session identifier, generate a message containing an encrypted temporary public key and send it to the other device; b) Receive, process and generate session key: After receiving a receive message containing an encrypted temporary public key from the other party's device, based on its own long-term private key, the other party's public credentials and the current session identifier, decrypts the other party's temporary public key, and calculates the shared session key by combining the public information exchanged between the two parties.

[0009] The iPAKE protocol relies on low-entropy user passwords. In a model without a trusted third party, if either party sends password-related information that can be independently verified by the other party in advance, an attacker can gain the ability to perform offline dictionary attacks or cross-session replay attacks. Therefore, security requires that password-related proofs must be valid only within a specific session context, and that this context must be unpredictable to the attacker beforehand.

[0010] To meet the three objectives of resisting offline dictionary attacks, mutual authentication, and man-in-the-middle attacks, both parties must introduce new session randomness and generate authentication information that is valid only for the current session. Since neither party can securely generate verifiable password proofs without obtaining the other party's session randomness, the protocol requires at least two rounds of interaction to jointly establish the session context and complete mutual authentication.

[0011] Based on the above analysis of the existing iPAKE, the applicant introduces a high-entropy key to create a sufficiently strong, long-term identity credential resistant to offline attacks. This strong credential allows the device to pre-compute the identity certificate and embed it into the key exchange message, enabling the other party to independently complete authentication and key calculation upon receiving a single message, without further interaction, thus achieving single-round authentication key negotiation. Efficiency improvements and security enhancements complement each other in this design.

[0012] The beneficial effects of this invention are that by introducing a high-entropy key to enhance the user password, the method can effectively resist KCI attacks and compromised brute-force attacks; at the same time, the entire protocol only requires a single round of communication to complete mutual authentication and key negotiation, making it suitable for device environments with limited computing and communication resources. Detailed Implementation

[0013] I. Initialization Phase: Determine the system common parameter set based on security parameters. ,in It is a prime number. It is the modulus excluding 0. Integer field It is a collision-resistant hash function. It is a secure symmetric encryption / decryption algorithm. for A generator of a domain.

[0014] II. Preparation Phase: The device owner selects the user password. and high-entropy keys and using user password and high-entropy keys Generate user password file for device User password It is a secret string chosen by the device owner that is easy to remember but has a low entropy value. High-entropy key. A sufficiently long and highly random secret value (such as a 256-bit random number) generated by the user. It is the core of resistance to brute-force attacks and provides the cryptographic strength foundation for the entire credential system.

[0015] III. Registration Stage: 1. The device is in the domain Select random number As a long-term random private key seed.

[0016] 2. The device will assign the session group identifier. User password and high-entropy keys The deterministic secret value generated by mixing the three is the master private key. Among them, the session group identifier It is a group-level long-term identifier used to distinguish different device groups or application scenarios. Because High entropy It is itself high-entropy.

[0017] 3. Device calculations are based on a long-term random private key seed. long-term public key Outsiders cannot from Reverse deduction ; The calculation is based on the master private key identity public key This is a public credential for identity binding.

[0018] 4. The device identifies itself. With its long-term public key In specific groups The hash value bound together with the device serves as a unique credential to ensure the device's identity, i.e., the device's identity factor. .

[0019] 5. The device will use a long-term random private key seed to represent randomness. The master private key that represents the secret of identity and identity factors Combined into a single value As a long-term private key In the final stage of key negotiation, This is combined with the other party's public key information to generate a shared secret.

[0020] 6. Device storage certification documents .

[0021] IV. Authentication Key Exchange Phase: equipment via session group identifier Retrieve your own user password file and ; where subscript and Let each device number represent a serial number. Let the serial number of either device in the session be 1. The serial number of the other party's device is , subscript Subscript used to represent oneself / one's own device in a conversation. This refers to the other party's device.

[0022] equipment Randomly select a number for this session Use this as a temporary private key to calculate the temporary public key. .

[0023] equipment Using one's own identity public key and the session identifier Calculate hash value As a temporary symmetric key for this session, Then use encryption algorithms and temporary symmetric keys Encrypt the temporary public key to obtain the encrypted temporary public key. ; The introduction of this feature is used to distinguish different sessions and bind protocol messages to specific session contexts, thereby ensuring message freshness and preventing cross-session replay attacks.

[0024] equipment To the equipment Send containing the session identifier Self-identification identifier The long-term public key of the device itself and encrypted temporary public key Composition of sending messages .

[0025] equipment Receive from the other party's device The message is parsed to obtain the received message. Including the session identifier The other party's device identification identifier The long-term operation of the other party's equipment The temporary public key for encryption of the other party's device .

[0026] equipment Using the identity identifier of the other device obtained through parsing and long-term public keys Using the other party's public key and the session identifier Obtain the session key used to decrypt the other party's messages. , Using session group identifiers Identifier of the other party's device and long-term public keys The identity factor of the other device is obtained through a hash algorithm. .

[0027] equipment Using the session key of the decrypted message from the other party and the identity factor of the other party's device Valid candidate values ​​of the encrypted temporary public key of the other party's device obtained through decryption. .

[0028] equipment Using your own temporary private key Valid candidate values ​​of the temporary public key of the other device Calculate the shared value of the temporary key exchange Then use your own temporary private key Your own long-term private key Your own identity public key Identity factors of the other party's device The long-term public key of the other party's device Valid candidate values ​​for the encrypted temporary public key of the other device The shared value for identity key exchange is calculated. .

[0029] equipment Using the above shared values ​​and communication copies Calculate session key ,in . copy of correspondence In this session, the device Send message and receiving messages A complete record of all plaintext messages. Hash into the final key This ensures that even if an attacker tampers with any part of the communication, the keys calculated by both parties will be different, thus detecting the attack.

Claims

1. A method for identity binding authentication key negotiation based on user password enhancement, characterized in that, Includes the following steps: System initialization steps are used to determine the common parameters of the cryptographic system; The device registration step is used to enable the device to generate and store an authentication file containing the device identity identifier, a long-term private key, and several public parameters corresponding to the long-term private key based on the user password, high-entropy key, session group identifier, and its own identity identifier. The generation of the long-term private key integrates the user password, high-entropy key, and its own identity identifier. The single-round authentication key exchange step enables two devices to complete mutual authentication and negotiate a shared session key by exchanging a single round of messages; wherein, the operations performed by each device include: a) Generate and send a message: Based on its own stored authentication file and the current session identifier, generate a message containing an encrypted temporary public key and send it to the other device; b) Receive, process and generate session key: After receiving a receive message containing an encrypted temporary public key from the other party's device, based on its own identity public key, long-term private key, the other party's public credentials and the current session identifier, decrypts the other party's temporary public key, and calculates the shared session key by combining the public information exchanged by both parties.

2. The method as described in claim 1, characterized in that, During the initialization phase, the system's common parameter set is determined based on security parameters. ,in It is a prime number. It is the modulus excluding 0. Integer field It is a collision-resistant hash function. It is a secure symmetric encryption / decryption algorithm. for A generator of a domain.

3. The method as described in claim 1, characterized in that, The device registration process includes: the device registering based on its user password. High-entropy keys Session group identifier and identity identifiers Perform the following calculations: Device in integer field Select random number As a long-term random private key seed; Calculate the master private key ; Calculate the long-term public key and identity public key ; Calculate identity factors Long-term public key Identity public key With identity factors All of these are public parameters corresponding to the long-term private key; Calculate the long-term private key. ; Store authentication files .

4. The method as described in claim 3, characterized in that, The high-entropy key is a cryptographically secure random number, with an entropy value sufficient to prevent an attacker from obtaining the authentication file and retrieving the identity public key through offline brute-force search. The user password was recovered in the middle. .

5. The method as described in claim 4, characterized in that, In the single-round authentication key exchange step, the two devices and The following single-round interaction completes mutual authentication and negotiates the shared session key, where the subscript... The subscript used to represent one's own device in a conversation. Indicating the other party's device: a. Each device Generate a temporary private key for the current session and the corresponding temporary public key Based on one's own identity public key and the session identifier Calculate the temporary symmetric key for this session ;use encryption Obtain the encrypted temporary public key Send a message containing the session identifier to the other device. The device's own identifier The long-term public key of the device itself and encrypted temporary public key Composition of sending messages ; b. Equipment Receive from the other party's device The message was parsed to obtain the session identifier. The other party's device identification identifier The long-term operation of the other party's equipment The temporary public key for encryption of the other party's device Receive message Then, perform the following operations: i. Based on one's own public identity key and the session identifier Calculate the session key to decrypt the other party's message , ; ii. Valid candidate values ​​for the encrypted temporary public key of the other party's device, obtained through decryption and reconstruction. ; iii. Calculate the identity factor of the other device. ; iv. Temporary private key based on the device itself Identity public key and long-term private key Valid candidate values ​​for the encrypted temporary public key of the other party's device. Long-term public key and identity factors Calculate the shared value of the temporary key exchange. Shared values ​​exchanged with identity keys ; v. based on , And includes sending messages and receiving messages copy of correspondence Calculate the session key Used for this session.

6. The method according to claim 1, characterized in that, Decryption to obtain the candidate value of the temporary public key of the other party's device Following this, a verification step is also included: Verification Is it an integer field? If the element in the form is valid, the verification passes and the next step continues; otherwise, the verification fails and the session is terminated.

7. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6.

Images