Authentication processing method and device

Abstract

The present application provides an authentication processing method and device. The method includes: sending an authentication request message to a second device so that the second device generates registration information according to preset parameters; receiving the registration information sent by the second device; obtaining the current timestamp, and using the preset hash function in the registration information to perform hash operation processing on the first hash encryption item, the self-identification and the timestamp in the registration information to obtain attribute information; calculating the anonymous identification according to the self-identification and the registration information; sending the timestamp, the characteristic value in the registration information, the anonymous identification and the attribute information to the second device, so that the second device calculates the attribute verification information according to the timestamp, the characteristic value in the registration information, the anonymous identification, the attribute information, the preset parameters and the preset hash function when the timestamp meets the preset conditions, and if the attribute verification value is equal to the attribute information, the first device is authenticated. The method of the present application reduces the time cost.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an authentication processing method and device. Background Art

[0002] As the degree of social informatization gradually increases, enterprises and individuals have realized online transactions through the Internet on a large scale. In this case, it is very important to ensure the security of online transactions. Banks and other trading institutions need to be authenticated by a third-party trusted institution before conducting transactions, which ensures the reliability of the transaction object. Online transaction security is not only reflected in the transaction process, but also in the authentication process between the transaction party and the trusted institution before the transaction.

[0003] Currently, identity authentication during the authentication process can be accomplished using elliptic curve cryptography or bilinear pairing encryption techniques.

[0004] However, encryption using elliptic curve cryptography or bilinear pairings is time-consuming and expensive. Summary of the invention

[0005] The present application provides an authentication processing method and device to solve the problem of high time cost when using elliptic curve encryption or bilinear pairing encryption.

[0006] In a first aspect, the present application provides an authentication processing method, comprising:

[0007] Send an authentication request message to a second device so that the second device generates registration information according to preset parameters, wherein the second device is a device corresponding to a trusted organization; receive the registration information sent by the second device; obtain the current timestamp, and use the hash function preset in the registration information to perform hash operation on the first hash encryption item, the self-identity and the timestamp in the registration information to obtain attribute information; calculate an anonymous identifier based on the self-identity and the registration information; send the timestamp, the characteristic value in the registration information, the anonymous identifier and the attribute information to the second device, so that the second device, when the timestamp meets the preset conditions, calculates the attribute verification information based on the timestamp, the characteristic value in the registration information, the anonymous identifier, the attribute information, the preset parameters and the preset hash function, and if the attribute verification value is equal to the attribute information, authenticate the first device.

[0008] In one possible implementation, a hash function preset in the registration information is used to perform a hash operation on the first hash encryption item, the self-identification and the timestamp in the registration information to obtain attribute information, including: connecting the first hash encryption item, the self-identification and the timestamp in the registration information and substituting them into the preset hash function to obtain the attribute information.

[0009] In a possible implementation, the anonymous identifier is calculated based on the self-identifier and the registration information, including: obtaining an exclusive OR value of the self-identifier and the first hash encryption item in the registration information to obtain the anonymous identifier.

[0010] In one possible implementation, after the timestamp, the characteristic value in the registration information, the anonymous identifier, and the attribute information are sent to the second device, it also includes: if the symmetric key in the registration information has expired, re-authentication; if the symmetric key in the registration information has not expired, encrypting the information using the symmetric key to obtain the encrypted information, and sending the encrypted information to the target first device, wherein the target first device is the device that completes the authentication.

[0011] In one possible implementation, after the timestamp, the characteristic value in the registration information, the anonymous identifier and the attribute information are sent to the second device, it also includes: receiving encrypted information and decrypting the encrypted information using the symmetric key in the registration information; if the decryption fails, re-authenticating to obtain a new symmetric key, and using the new symmetric key to decrypt to obtain the decrypted information.

[0012] In a second aspect, the present application provides an authentication processing method, comprising:

[0013] Receive authentication request information sent by a first device, wherein the first device is a device corresponding to a transaction institution; generate corresponding registration information according to preset parameters, and send the registration information to the first device so that the first device obtains a current timestamp, and uses a hash function preset in the registration information to perform hash operation processing on a first hash encryption item, its own identification and timestamp in the registration information to obtain attribute information, and calculate an anonymous identification according to its own identification and the registration information; receive the timestamp sent by the first device, the anonymous identification of the characteristic value in the registration information, and the attribute information; if the timestamp meets the preset conditions, calculate the attribute verification information according to the timestamp, the characteristic value in the registration information, the anonymous identification, the attribute information, the preset parameters and the preset hash function; if the attribute verification information is equal to the attribute information, authenticate the first device.

[0014] In one possible implementation, attribute verification information is obtained based on a timestamp, an anonymous identifier of a characteristic value in registration information, attribute information, preset parameters, and a preset hash function, including: connecting the symmetric key in the registration information, the characteristic value in the registration information, and the system private key in the preset parameters and substituting them into a preset hash function to obtain a second hash encryption item; using the anonymous identifier and the second hash encryption item to perform an XOR operation to obtain identity authentication information; connecting the second hash encryption item, the identity authentication information, and the timestamp, and substituting them into a preset hash function to obtain the attribute verification information.

[0015] In a possible implementation, the corresponding registration information is generated according to the preset parameters, including: the multiplication group in the preset parameters Two data are randomly selected from the , one of the two data is determined as the characteristic value in the registration information, and the other is determined as the symmetric key; the finite field in the preset parameter Select a random number as the system private key; connect the system private key, the characteristic value in the registration information, and the symmetric key and substitute them into the preset hash function to obtain the first hash encryption item; substitute the preset hash function, the symmetric key, the characteristic value in the registration information, the finite field in the preset parameters The first hash encryption item and the prime number q in the preset parameters are determined as registration information.

[0016] In a possible implementation, before receiving the authentication request information sent by the first device, the method further includes: selecting a prime number p and a prime number q, where p≥4q; determining a multiplication group using the prime number p; Finite field determined by prime number q In finite fields Select a random number as the system private key; set the prime number q, the finite field Multiplication Group The system private key and the preset hash function are determined as preset parameters.

[0017] In a third aspect, the present application provides an authentication processing device, including:

[0018] The first sending module is used to send authentication request information to the second device so that the second device generates registration information according to preset parameters, wherein the second device is a device corresponding to a trusted organization; the first receiving module is used to receive the registration information sent by the second device; the first obtaining module is used to obtain the current timestamp, and use the hash function preset in the registration information to perform hash operation on the first hash encryption item, the self-identification and the timestamp in the registration information to obtain attribute information; the second obtaining module is used to calculate the anonymous identification according to the self-identification and the registration information; the second sending module is used to send the timestamp, the characteristic value in the registration information, the anonymous identification and the attribute information to the second device, so that the second device can obtain the attribute verification information according to the timestamp, the characteristic value anonymous identification in the registration information, the attribute information, the preset parameters and the preset hash function when the timestamp meets the preset conditions, and if the attribute verification value is equal to the attribute information, the first device is authenticated.

[0019] The authentication processing method and device provided in the present application obtain attribute information by performing hash operation on part of the data in the received registration information and the obtained timestamp using a hash function, and then calculate the anonymous identifier from its own identifier and the registration information. Finally, the timestamp, attribute information, anonymous identifier and part of the value in the registration information are sent to the second device to complete the authentication. The data processing process uses a hash function to perform hash operation, which ensures anonymous authentication of the identity, avoids information forgery, and achieves the effect of saving time costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0021] Figure 1 A schematic diagram of an application scenario of the authentication processing method provided in an embodiment of the present application;

[0022] Figure 2 Schematic diagram of the authentication process provided in this application embodiment Figure 1 ;

[0023] Figure 3 Schematic diagram of the authentication process provided in this application embodiment Figure 2 ;

[0024] Figure 4 A schematic diagram of the interactive process of the authentication processing method provided in the embodiment of the present application;

[0025] Figure 5 A schematic diagram of an authentication processing device provided in an embodiment of the present application Figure 1 ;

[0026] Figure 6 A schematic diagram of an authentication processing device provided in an embodiment of the present application Figure 2 ;

[0027] Figure 7 A schematic diagram of an authentication processing device provided in an embodiment of the present application Figure 3 ;

[0028] Figure 8 A schematic diagram of an authentication processing device provided in an embodiment of the present application Figure 4 ;

[0029] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0030] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0031] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0032] With the rapid development of communication technology, people's daily life is gradually becoming more information-based. Most commodity transactions are already conducted through the Internet. The process of online transactions is completed through data transmission, which requires the transmission of data to be encrypted. At the same time, in order to ensure the reliability of the identities of both parties to the transaction, double identities must be authenticated before the transaction is carried out, and the identity authentication process also needs to be processed accordingly.

[0033] Currently, the authentication process can be completed by using elliptic curve encryption or bilinear pairing encryption technology, but the use of elliptic curve encryption or bilinear pairing encryption technology has high time cost due to complex calculations.

[0034] In response to the above-mentioned high time cost problem, the present application provides the following technical ideas: the registration information of the second device is received by the first device, the attribute information is calculated using a hash function, and then the anonymous identifier is obtained by XOR. When generating the anonymous identifier, the hash function is used to ensure the encryption of the information, and the anonymous identifier, the first hash encryption item in the registration information and the attribute information are sent to the second device. The second device reversely deduces the attribute verification information from the registration information, the anonymous identifier, the first hash encryption item in the registration information, and some preset parameters. If the attribute verification information and the attribute information are equal, it means that it is the information sent by the first device. If they are not equal, it means that it is not the information sent by the first device, thereby completing the authentication of the first device. The entire authentication process does not require elliptic curve encryption or bilinear pairing encryption, and only uses hash functions, which avoids complex calculation operations and reduces time costs.

[0035] Figure 1 Schematic diagram of application scenarios of the authentication processing method provided in the embodiment of the present application. Figure 1 , this scenario includes: a first device 101 and a second device 102.

[0036] The first device 101 may be a front-end terminal of a transaction institution, that is, an intermediate device used on site, or a server. A transaction institution may be a bank, a stock exchange, etc. Front-end terminals commonly used in banks may be ATM (Automated Teller Machine) and POS (Point of Sales).

[0037] The second device 102 may be a server or a server or a cluster of multiple servers with stronger processing power and higher security. If possible, a computer or laptop with stronger computing power may be used as a substitute. The second device 102 may be a device corresponding to a trusted institution. The trusted institution may be a third-party certificate issuing authority, which is completely trusted and cannot be hacked by default.

[0038] The connection between the first device 101 and the second device 102 can be through a wired connection or a wireless network connection, wherein the network used for the wireless network connection can include various types of wired and wireless networks, such as but not limited to: the Internet, local area network, Wireless Fidelity (Wireless Fidelity, WIFI), Wireless Local Area Networks (Wireless Local Area Networks, WLAN), cellular communication network (General Packet Radio Service Technology (General Packet Radio Service, GPRS), Code Division Multiple Access (Code Division Multiple Access, CDMA), 2G / 3G / 4G / 5G cellular network), satellite communication network, etc.

[0039] In the specific implementation process, the first device 101 is used to send request information, receive registration information sent by the second device 102, obtain a timestamp, and encrypt part of the information in the registration information according to a hash function to obtain attribute information, and then calculate anonymous information from the attribute information and part of the data in the registration information, and send the registration information, anonymous information, timestamp, and part of the data in the registration information to the second device for verification during registration. When communicating with other first devices, the registration information, anonymous information, timestamp, and part of the data in the registration information can also be sent to the second device for identity verification, so as to perform encrypted communication with a device with a legitimate identity in an encrypted manner.

[0040] The second device 102 is used to generate registration information according to preset parameters, receive the registration information, anonymous information, timestamp and part of the data in the registration information sent by the first device 101, and use the received data and preset parameters to calculate the attribute verification information, and compare the attribute verification information with the attribute information. If they are the same, the first device is authenticated, otherwise the authentication fails due to illegal identity.

[0041] It is understandable that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the authentication processing method. In other feasible implementations of the present application, the above architecture may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown may be implemented in hardware, software, or a combination of software and hardware.

[0042] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0043] Figure 2 Schematic diagram of the authentication process provided in this application embodiment Figure 1 The execution subject of the embodiment of the present application may be Figure 1 The first device 101 in the embodiment may also be a computer and / or a mobile phone, etc., and this embodiment of the present application does not impose any particular limitation on this. Figure 2 As shown, the method includes:

[0044] S201: Sending authentication request information to a second device, so that the second device generates registration information according to preset parameters, wherein the second device is a device corresponding to a trusted institution.

[0045] In this step, the authentication request information may include an authentication request and may also include a message with information such as the identity, code, name, address, and self-identification of the first device's corresponding organization. The sending method may include a default security method.

[0046] Among them, the default secure method can be face-to-face communication, a pre-arranged dedicated line, or sending in other default non-eavesdropping and non-hackable methods.

[0047] S202: Receive registration information sent by the second device.

[0048] In this step, the registration information may also be received in a default secure manner, which is as described in step S201 above and will not be described in detail here. After receiving the registration information, the registration information may be stored in a secure location of the first device.

[0049] S203: Obtain the current timestamp, and use the hash function preset in the registration information to perform hash operation on the first hash encryption item, the self-identification and the timestamp in the registration information to obtain attribute information.

[0050] In this step, the current timestamp may be obtained by using a preset program or script, etc. The first hash encryption item, the self-identification and the timestamp in the registration information are hashed as a whole.

[0051] S204: Calculate an anonymous identifier based on the self-identifier and registration information.

[0052] In this step, the self-identification may be possessed by the first device itself and may be obtained without being acquired.

[0053] In a possible implementation, the anonymous identifier is calculated based on the self-identifier and the registration information, specifically including:

[0054] Calculate the XOR value of the self-identity and the first hash encryption item in the registration information to obtain an anonymous identification.

[0055] Specifically, the XOR value of the self-identity and the first hash encryption item in the registration information is calculated to obtain the anonymous identity, which can be calculated using the following formula:

[0056]

[0057] Among them, AIDb i Represents anonymous identification, IDb i Represents self-identification, Rb i represents the first hashed encrypted term, Is the XOR symbol.

[0058] In this step, the number of digits of the self-identification and the first hash encryption item in the registration information can be equal. They are both strings of 0 or 1. This application does not limit the number of digits of the self-identification and the first hash encryption item. When calculating XOR, the same is 0 and the different is 1. This application does not limit the method of calculating XOR. It can be to directly calculate the XOR of each bit in the data, or to use the first bit of the first data and the last bit of the second data to calculate the XOR, and the second bit of the first data and the second to last bit of the second data to calculate the XOR, until the XOR calculation of all digits is completed.

[0059] For example, the self-identity may be 100101, the first hash encryption item may be 010001, and the anonymous identification obtained by XOR may be 110100. The self-identity may be 1110101, the first hash encryption item may be 0111010, and the anonymous identification obtained by XOR may be 1001111.

[0060] S205: Send the timestamp, the characteristic value in the registration information, the anonymous identifier and the attribute information to the second device, so that when the timestamp meets the preset conditions, the second device calculates the attribute verification information according to the timestamp, the characteristic value in the registration information, the anonymous identifier, the attribute information, the preset parameters and the preset hash function; if the attribute verification value is equal to the attribute information, the first device is authenticated.

[0061] In this step, the data can be sent via the network or other forms such as text messages, and this application does not impose any special restrictions on this. If the attribute verification value is equal to the attribute information, the first device is a legal device and the authentication is successful, otherwise the authentication fails.

[0062] From the description of the above embodiments, it can be seen that in the embodiments of the present application, attribute information is obtained by encrypting part of the data in the received registration information and the obtained timestamp using a hash function, and then an anonymous identifier is calculated from its own identifier and the registration information. Finally, the timestamp, attribute information, anonymous identifier and part of the value in the registration information are sent to the second device to complete the authentication, and the data processing process is encrypted using a hash function, which ensures anonymous authentication of the identity, avoids information forgery, and achieves the effect of saving time costs.

[0063] In a possible implementation, after the step S205 sends the timestamp, the feature value in the registration information, the anonymous identifier, and the attribute information to the second device, it also includes receiving a message indicating successful authentication.

[0064] In a possible implementation, in the above step S203, a hash function preset in the registration information is used to perform a hash operation on the first hash encryption item, the self-identification and the timestamp in the registration information to obtain the attribute information, specifically including:

[0065] The first hash encryption item, the self-identification and the timestamp in the registration information are connected and substituted into the preset hash function to obtain the attribute information.

[0066] Specifically, the first hash encryption item, the self-identification, and the timestamp in the registration information are connected and substituted into a preset hash function to obtain the attribute information, which can be obtained using the following formula:

[0067] ATbi =H(Rb i ||IDb i ||Tb i )

[0068] Among them, ATb i Indicates attribute information, H indicates the preset hash function, IDb i Represents self-identification, Rb i Represents the first hash encryption term, Tb i Represents a timestamp, and || is a connection symbol, which means connecting the previous and next strings.

[0069] Specifically, the connection may be end-to-end connection, that is, connecting the string of multiple 0s or 1s of the first hash encryption item with the beginning of the string of self-identification, and connecting the last digit of the string of self-identification with the first digit of the timestamp.

[0070] From the description of the above embodiments, it can be seen that in the embodiments of the present application, attribute information is obtained by connecting the first hash encryption item, the self-identification and the timestamp and encrypting them using a hash function, which facilitates the subsequent verification of the first device during registration.

[0071] In a possible implementation, after the above step S205, after sending the timestamp, the feature value in the registration information, the anonymous identifier, and the attribute information to the second device, the method further includes:

[0072] S206: If the symmetric key in the registration information has expired, re-authentication is performed.

[0073] In this step, the symmetric key has a validity period, and the validity period of the symmetric key can be verified by comparing the validity period with the current time. Re-authentication can be re-performing the above steps S203 to S205, or re-performing the above steps S201 to S205.

[0074] Specifically, the validity period can be 1 month, 3 months, half a year or one year, etc., and this application does not impose any restrictions on this.

[0075] S207: If the symmetric key in the registration information has not expired, the symmetric key is used to encrypt the information to obtain the encrypted information, and the encrypted information is sent to the target first device, where the target first device is the device that completes the authentication.

[0076] In this step, the information is encrypted using a symmetric key, which may be performed by encrypting the information using an algorithm corresponding to the symmetric key.

[0077] From the description of the above embodiments, it can be seen that in the embodiments of the present application, by verifying the validity period of the symmetric key, it can be ensured that the encrypted information can be decrypted after being received by the target first device, thereby completing the sending of the encrypted information.

[0078] In a possible implementation manner, after sending the timestamp, the feature value in the registration information, the anonymous identifier, and the attribute information to the second device, the method further includes:

[0079] S208: Receive the encrypted information, and use the symmetric key in the registration information to decrypt the encrypted information.

[0080] In this step, the encrypted information is decrypted using the symmetric key in the registration information, and the encrypted information may be decrypted using an algorithm corresponding to the symmetric key.

[0081] S209: If the decryption fails, a new symmetric key is obtained by re-authentication, and the new symmetric key is used for decryption to obtain the decrypted information.

[0082] In this step, the decryption failure may be that the decrypted information is garbled or cannot be decrypted. The process of re-authentication is the same as the above step S206, which will not be repeated here.

[0083] From the description of the above embodiments, it can be seen that in the embodiments of the present application, valid unencrypted information can be obtained by decrypting encrypted information using a symmetric key, and re-authentication can avoid the situation where the symmetric key is different due to the update of the validity period of the symmetric key of the sender of the encrypted data.

[0084] Figure 3 Schematic diagram of the authentication process provided in this application embodiment Figure 2 The execution subject of the embodiment of the present application may be Figure 1 The second device 102 in the embodiment may also be a computer and / or a mobile phone, etc., and this embodiment of the present application does not impose any special restrictions on this. Figure 3 As shown, the method includes:

[0085] S301: Receive authentication request information sent by a first device, where the first device is a device corresponding to a transaction institution.

[0086] In this step, the authentication request information may be received by adopting the same default security method as the above step S201.

[0087] S302: Generate corresponding registration information according to preset parameters, and send the registration information to the first device so that the first device obtains the current timestamp, and uses the hash function preset in the registration information to perform hash operation on the first hash encryption item, its own identification and timestamp in the registration information to obtain attribute information, and calculate the anonymous identification based on its own identification and the registration information.

[0088] In this step, sending the registration information to the first device may be sending the registration information in a secure manner as in S201.

[0089] S303: Receive the timestamp, the anonymous identifier of the characteristic value in the registration information, and the attribute information sent by the first device.

[0090] In this step, the method of receiving the above data may be the same as the method of sending the data in the above step S205.

[0091] S304: If the timestamp meets the preset conditions, the attribute verification information is obtained according to the timestamp, the characteristic value in the registration information, the anonymous identifier, the attribute information, the preset parameters and the preset hash function calculation.

[0092] In this step, the preset condition may be that the difference between the time corresponding to the timestamp and the time when the timestamp is received is less than or equal to a preset value, that is, whether the difference between the time when the first device sends the message and the time when the second device receives the message is less than or equal to the maximum allowable time delay. If the time difference is greater than the maximum time delay, the message is discarded.

[0093] In a possible implementation, step S304 calculates attribute verification information based on the timestamp, the anonymous identifier of the characteristic value in the registration information, the attribute information, the preset parameters, and the preset hash function, specifically including:

[0094] S3041: Connect the symmetric key in the registration information, the characteristic value in the registration information, and the system private key in the preset parameters and substitute them into a preset hash function to obtain a second hash encryption item.

[0095] In this step, the second hash encryption item may be obtained using the following formula:

[0096] Rb′ i =H(s||μb i ||x i )

[0097] Among them, Rb′ i is the second hash encryption item, H is the preset hash function, s is the system private key, μb i is the characteristic value in the registration information, x i is a symmetric key, and || is a connection symbol, which means connecting the previous and next strings.

[0098] S3042: XOR the anonymous identifier with the second hash encryption item to obtain identity authentication information.

[0099] In this step, the authentication information can be obtained using the following formula:

[0100]

[0101] Among them, IDb′ i AIDb is the identity verification information. i For anonymous identification, Rbi′ i represents the second hash encryption term, Is the XOR symbol.

[0102] S3043: After connecting the second hash encryption item, the identity verification information and the timestamp, substitute them into the preset hash function to obtain the attribute verification information.

[0103] In this step, the attribute verification information can be obtained using the following formula:

[0104] ATb i ′=H(Rb i ′||IDb i ′||Tb i )

[0105] Among them, ATb i ′ is the attribute verification information, H is the preset hash function, Rb i ′ is the second hash encryption item, IDb i ′ is the identity verification information, Tb i is a timestamp, and || is a connection symbol, which means connecting the previous and next strings.

[0106] S305: If the attribute verification information is equal to the attribute information, the first device is authenticated.

[0107] In this step, the attribute verification information is equal to the attribute information, and the attribute verification information and the attribute information may be completely identical.

[0108] Specifically, the attribute verification information is completely identical to the attribute information, and may be a string consisting of 0s and 1s that is completely identical.

[0109] From the description of the above embodiments, it can be seen that in the embodiments of the present application, by sending the registration information to the first device and receiving the value returned by the first device, the hash function can be used to reversely push back the attribute verification information, and by comparing whether the attribute verification information is equal to the attribute information, it can be determined whether the first device is forged, thereby completing the authentication process. Since a timestamp is used, the timeliness of the information is guaranteed, and replay attacks can be effectively resisted. Moreover, since only hash functions and XOR calculations are used in the embodiments of the present application, the time cost is reduced.

[0110] In a possible implementation, after the first device is authenticated in the above step S305, the method further includes: sending a message indicating successful authentication to the first device, so that the first device can communicate or transfer files with other devices.

[0111] The message of successful authentication can be sent in encrypted form.

[0112] In a possible implementation, in the above step S302, generating corresponding registration information according to preset parameters includes:

[0113] S3021: Multiplication group in preset parameters Two data are randomly selected, one of the two data is determined as the characteristic value in the registration information, and the other is determined as the symmetric key.

[0114] In this step, the characteristic value in the registration information is μb in the above formula i The symmetric key is x in the above formula i These two data, namely μb i With x i Can be relatively prime, if multiple μb are selected i Then these multiple μb i They can also be relatively prime. Where i∈(1, 2, 3, ..., n), n is the total number of elements in the multiplicative group.

[0115] S3022: Finite field in preset parameters Select a random number as the system private key.

[0116] In this step, the system private key is s in the above formula.

[0117] S3023: Connect the system private key, the characteristic value in the registration information, and the symmetric key and substitute them into a preset hash function to obtain a first hash encryption item.

[0118] In this step, the first hash encryption term is Rb in the above formula i .

[0119] S3024: The preset hash function, the symmetric key, the characteristic value in the registration information, and the finite field in the preset parameters are combined. The first hash encryption item and the prime number q in the preset parameters are determined as registration information.

[0120] In this step, the registration information may be in a table or any other form, and this application does not impose any limitation on this.

[0121] It can be seen from the description of the above embodiment that the embodiment of the present application provides a method for obtaining registration information, which facilitates the subsequent generation of other parameters.

[0122] In a possible implementation, before the step S301 of receiving the authentication request information sent by the first device, the method further includes:

[0123] S101: Select a prime number p and a prime number q, where p≥4q.

[0124] In this step, the prime number p and the prime number q can be randomly selected as long as p≥4q is satisfied.

[0125] S102: Determine the multiplication group using prime number p

[0126] In this step, the multiplication group may include using the mutually prime congruence class of prime numbers p and p as the multiplication group.

[0127] S103: Determine the finite field with prime number q

[0128] In this step, the finite field It can be a finite field with q as its characteristic number

[0129] S104: In finite fields Select a random number as the system private key.

[0130] In this step, the system private key is represented by s in the above formula.

[0131] S105: Prime number q, finite field Multiplication Group The system private key and the preset hash function are determined as preset parameters.

[0132] In this step, the present application does not limit the specific format of the preset parameters.

[0133] It can be seen from the description of the above embodiment that the embodiment of the present application obtains all preset parameters by selecting two prime numbers.

[0134] Figure 4 Schematic diagram of the interaction process of the authentication processing method provided in the embodiment of the present application. This embodiment describes the interaction process between the first device and the second device, such as Figure 4 As shown, the method includes:

[0135] S401: The first device sends authentication request information to the second device.

[0136] S402: The second device generates registration information according to preset parameters.

[0137] S403: The second device sends registration information to the first device.

[0138] S404: The first device obtains the current timestamp, and uses the hash function preset in the registration information to perform a hash operation on the first hash encryption item, its own identification, and the timestamp in the registration information to obtain attribute information.

[0139] S405: The first device calculates an anonymous identifier according to its own identifier and registration information.

[0140] S406: The first device sends the timestamp, the feature value in the registration information, the anonymous identifier, and the attribute information to the second device.

[0141] S407: If the timestamp meets the preset conditions, the second device calculates the attribute verification information according to the timestamp, the characteristic value in the registration information, the anonymous identifier, the attribute information, the preset parameters and the preset hash function.

[0142] S408: If the attribute verification information is equal to the attribute information, the second device authenticates the first device.

[0143] Figure 5 A schematic diagram of an authentication processing device provided in an embodiment of the present application Figure 1 .like Figure 5 As shown, the authentication processing device 500 includes: a first sending module 501 , a first receiving module 502 , a first obtaining module 503 , a second obtaining module 504 and a second sending module 505 .

[0144] The first sending module 501 is used to send authentication request information to the second device, so that the second device generates registration information according to preset parameters, wherein the second device is a device corresponding to a trusted institution.

[0145] The first receiving module 502 is configured to receive registration information sent by the second device.

[0146] The first obtaining module 503 is used to obtain the current timestamp, and use the hash function preset in the registration information to perform hash operation on the first hash encryption item, the self-identification and the timestamp in the registration information to obtain the attribute information.

[0147] The second obtaining module 504 is used to calculate and obtain an anonymous identifier according to the self-identification and the registration information.

[0148] The second sending module 505 is used to send the timestamp, the characteristic value in the registration information, the anonymous identifier and the attribute information to the second device, so that when the timestamp meets the preset conditions, the second device obtains the attribute verification information according to the timestamp, the characteristic value in the registration information, the anonymous identifier, the attribute information, the preset parameters and the preset hash function calculation; if the attribute verification value is equal to the attribute information, the first device is authenticated.

[0149] In a possible implementation, the first calculation module 503 is specifically used to: connect the first hash encryption item, the self-identification and the timestamp in the registration information and substitute them into a preset hash function to obtain the attribute information.

[0150] In a possible implementation, the second calculation module 504 is specifically used to obtain an XOR value of the self-identity and the first hash encryption item in the registration information to obtain an anonymous identification.

[0151] Figure 6 A schematic diagram of an authentication processing device provided in an embodiment of the present application Figure 2 .like Figure 5 As shown, the authentication processing device 500 further includes: a first authentication module 506 and a third sending module 507 .

[0152] The first authentication module 506 is used to re-authenticate if the symmetric key in the registration information has expired.

[0153] The third sending module 507 is used to encrypt the information using the symmetric key if the symmetric key in the registration information has not expired, obtain the encrypted information, and send the encrypted information to the target first device, where the target first device is the device that completes the authentication.

[0154] Continue to refer Figure 6 .like Figure 6 As shown, the authentication processing device 500 further includes: a first decryption module 508 and a second decryption module 509 .

[0155] A first decryption module 508, for receiving the encrypted information and decrypting the encrypted information using the symmetric key in the registration information;

[0156] The second decryption module 509 is used to obtain a new symmetric key by re-authentication if the decryption fails, and use the new symmetric key to decrypt to obtain the decrypted information.

[0157] Figure 7 A schematic diagram of an authentication processing device provided in an embodiment of the present application Figure 3 .like Figure 7 As shown, the authentication processing device 700 includes: a second receiving module 701 , a fourth sending module 702 , a third receiving module 703 , a third obtaining module 704 and a second authentication module 705 .

[0158] The second receiving module 701 is used to receive authentication request information sent by a first device, wherein the first device is a device corresponding to a transaction institution.

[0159] The fourth sending module 702 is used to generate corresponding registration information according to preset parameters, and send the registration information to the first device so that the first device obtains the current timestamp, and uses the hash function preset in the registration information to perform hash operation on the first hash encryption item, its own identification and timestamp in the registration information to obtain attribute information, and calculate the anonymous identification based on its own identification and the registration information.

[0160] The third receiving module 703 is used to receive the timestamp, the anonymous identifier of the characteristic value in the registration information, and the attribute information sent by the first device.

[0161] The third obtaining module 704 is used to obtain the attribute verification information according to the timestamp, the characteristic value in the registration information, the anonymous identifier, the attribute information, the preset parameters and the preset hash function calculation if the timestamp meets the preset conditions.

[0162] The second authentication module 705 is configured to authenticate the first device if the attribute verification information is equal to the attribute information.

[0163] In a possible implementation, the third acquisition module 704 is specifically used to: connect the symmetric key in the registration information, the characteristic value in the registration information, and the system private key in the preset parameters and substitute them into a preset hash function to obtain a second hash encryption item; use an anonymous identifier and the second hash encryption item to calculate an XOR to obtain identity authentication information; connect the second hash encryption item, the identity authentication information and the timestamp, and substitute them into the preset hash function to obtain attribute verification information.

[0164] In a possible implementation, the fourth sending module 702 is specifically configured to: Two data are randomly selected from the , one of which is determined as the characteristic value in the registration information, and the other is determined as the symmetric key. Select a random number as the system private key. Connect the system private key, the characteristic value in the registration information, and the symmetric key and substitute them into the preset hash function to obtain the first hash encryption item. Substitute the preset hash function, the symmetric key, the characteristic value in the registration information, the finite field in the preset parameters The first hash encryption item and the prime number q in the preset parameters are determined as registration information.

[0165] Figure 8 A schematic diagram of an authentication processing device provided in an embodiment of the present application Figure 4 .like Figure 8 As shown, the authentication processing device 700 further includes:

[0166] A prime number selection module 706 is used to select a prime number p and a prime number q, where p≥4q;

[0167] The multiplication group determination module 707 is used to determine the multiplication group with the prime number p.

[0168] The finite field determination module 708 is used to determine the finite field with the prime number q.

[0169] The private key acquisition module 709 is used to obtain the private key in a limited domain. Select a random number as the system private key.

[0170] The parameter acquisition module 710 is used to obtain the prime number q, the finite field Multiplication Group The system private key and the preset hash function are determined as preset parameters.

[0171] Fig. 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. For example, see Fig. 9 As shown, the electronic device 900 may include a processor 901 and a memory 902 communicatively connected to the processor 901 .

[0172] Memory 902 stores computer-executable instructions.

[0173] The processor 901 executes the computer-executable instructions stored in the memory 902 to implement the authentication processing method provided in any of the above embodiments.

[0174] Optionally, the memory 902 may be independent or integrated with the processor 901. When the memory 902 is a device independent of the processor 901, the electronic device may further include a bus for connecting the memory 902 and the processor 901.

[0175] The present application also provides a computer-readable storage medium, which stores computer execution instructions. When the processor executes the computer execution instructions, the technical solution of the authentication processing method in any of the above-mentioned embodiments is implemented. Its implementation principle and beneficial effects are similar to the implementation principle and beneficial effects of the authentication processing method. Please refer to the implementation principle and beneficial effects of the authentication processing method, which will not be repeated here.

[0176] The present application also provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the technical solution of the authentication processing method in any of the above-mentioned embodiments. Its implementation principle and beneficial effects are similar to the implementation principle and beneficial effects of the authentication processing method. Please refer to the implementation principle and beneficial effects of the authentication processing method, and no further details will be given here.

[0177] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0178] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.

[0179] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0180] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0181] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

[0182] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0183] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0184] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0185] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the storage medium can also exist as discrete components in an electronic device or a main control device.

[0186] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

[0187] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0188] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. An authentication processing method, characterized in that: The first device corresponding to the trading institution includes: Send authentication request information to the second device, so that the second device generates registration information according to preset parameters, wherein the second device is a device corresponding to a trusted institution, and the preset parameters are a prime number q, a finite field , multiplication group , a system private key and a preset hash function, the registration information is determined by the preset hash function, the symmetric key, the characteristic value in the registration information, the finite field in the preset parameters , the first Hash encryption item and the prime number q in the preset parameters; The first hash encryption term is expressed as: , s represents the system private key, and are mutually prime, respectively representing the characteristic value and the symmetric key in the registration information, H represents a preset hash function, and || is a connection symbol, indicating that the previous and next character strings are connected; receiving the registration information sent by the second device; Obtaining a current timestamp, and concatenating the first hash encryption item, the self-identity, and the timestamp in the registration information and substituting them into the preset hash function to obtain attribute information; The attribute information is represented as: in, represents attribute information, H represents the preset hash function, Indicates self-identification, represents the first hashed encrypted term, Represents a timestamp, and || is a connection symbol, which means connecting the previous and next strings; Calculate the XOR value of the self-identity and the first hash encryption item in the registration information to obtain an anonymous identification; The anonymous identifier is represented by: in, Represents an anonymous identifier, Indicates self-identification, represents the first hashed encrypted term, is the XOR symbol; The timestamp, the characteristic value in the registration information, the anonymous identifier and the attribute information are sent to the second device, so that the second device obtains the attribute verification information according to the timestamp, the characteristic value in the registration information, the anonymous identifier, the attribute information, the preset parameters and the preset hash function when the timestamp meets the preset conditions; if the attribute verification information is equal to the attribute information, the first device is authenticated.

2. The method according to claim 1, characterized in that After sending the timestamp, the feature value in the registration information, the anonymous identifier, and the attribute information to the second device, the method further includes: If the symmetric key in the registration information has expired, re-authentication is performed; If the symmetric key in the registration information has not expired, the symmetric key is used to encrypt the information to obtain the encrypted information, and the encrypted information is sent to the target first device, where the target first device is the device that completes the authentication.

3. The method according to claim 1 or 2, characterized in that: After sending the timestamp, the feature value in the registration information, the anonymous identifier, and the attribute information to the second device, the method further includes: Receiving the encrypted information and decrypting the encrypted information using the symmetric key in the registration information; If the decryption fails, re-authentication is performed to obtain a new symmetric key, and the new symmetric key is used to decrypt to obtain the decrypted information.

4. An authentication processing method, characterized in that: The second device corresponding to the trusted institution includes: Receiving authentication request information sent by a first device, wherein the first device is a device corresponding to the transaction institution; Generate corresponding registration information according to preset parameters, and send the registration information to the first device, so that the first device obtains the current timestamp, and uses the hash function preset in the registration information to perform hash operation on the first hash encryption item, the self-identification and the timestamp in the registration information to obtain attribute information, and calculate the anonymous identification according to the self-identification and the registration information, wherein the preset parameters are a prime number q, a finite field , multiplication group , a system private key and a preset hash function, the registration information is determined by the preset hash function, the symmetric key, the characteristic value in the registration information, the finite field in the preset parameters , a first Hash encryption item and a prime number q in the preset parameters, wherein the first Hash encryption item is expressed as: , s represents the system private key, and are mutually prime, representing the characteristic value and symmetric key in the registration information respectively, H represents the preset hash function, and || is a connection symbol, indicating that the previous and next strings are connected; Receive the timestamp, the characteristic value, the anonymous identifier, and the attribute information sent by the first device; If the timestamp meets the preset conditions, the symmetric key in the registration information, the characteristic value in the registration information and the system private key in the preset parameters are connected and substituted into the preset hash function to obtain a second hash encryption item; The second hash encryption term is expressed as: in, is the second hash encryption item, H is the preset hash function, s is the system private key, is the characteristic value in the registration information, is a symmetric key, || is a connection symbol, which means connecting the previous and next strings; The anonymous identifier is XORed with the second hash encryption item to obtain identity authentication information; The identity verification information is represented as: in, For authentication information, For anonymous identification, represents the second hash encryption term, is the XOR symbol; After connecting the second hash encryption item, the identity verification information and the timestamp, the concatenation is substituted into the preset hash function to obtain the attribute verification information; The attribute verification information is represented as: in, is the attribute verification information, H is the preset hash function, is the second hash encryption item, For authentication information, is a timestamp, and || is a connection symbol, which means connecting the previous and next strings; If the attribute verification information is equal to the attribute information, the first device is authenticated.

5. The method according to claim 4, characterized in that The generating corresponding registration information according to the preset parameters includes: The multiplicative group in the preset parameters Randomly select two data, determine one of the two data as the characteristic value in the registration information, and determine the other as the symmetric key; The finite field in the preset parameters Select a random number as the system private key; Connect the system private key, the characteristic value in the registration information, and the symmetric key and substitute them into a preset hash function to obtain a first hash encryption item; The preset hash function, the symmetric key, the characteristic value in the registration information, and the finite field in the preset parameters are combined. , the first hash encryption item and the prime number q in the preset parameters are determined as the registration information.

6. The method according to claim 5, characterized in that Before receiving the authentication request information sent by the first device, the method further includes: Select a prime number p and a prime number q, where ; Determine the multiplication group with the prime number p ; Determine the finite field with the prime number q ; In the finite field Select a random number as the system private key; The prime number q, the finite field , the multiplication group , the system private key and the preset hash function are determined as the preset parameters.

7. An authentication processing device, characterized in that: The first device corresponding to the trading institution includes: The first sending module is used to send authentication request information to the second device, so that the second device generates registration information according to preset parameters, wherein the second device is a device corresponding to a trusted institution, and the preset parameters are a prime number q, a finite field , multiplication group , a system private key and a preset hash function, the registration information is determined by the preset hash function, the symmetric key, the characteristic value in the registration information, the finite field in the preset parameters , a first Hash encryption item and a prime number q in the preset parameters, wherein the first Hash encryption item is expressed as: , s represents the system private key, and are mutually prime, representing the characteristic value and symmetric key in the registration information respectively, H represents the preset hash function, and || is a connection symbol, indicating that the previous and next strings are connected; A first receiving module, configured to receive the registration information sent by the second device; A first obtaining module is used to obtain a current timestamp, and connect the first hash encryption item in the registration information, the self-identification and the timestamp and substitute them into the preset hash function to obtain attribute information; The attribute information is represented as: in, represents attribute information, H represents the preset hash function, Indicates self-identification, represents the first hashed encrypted term, Indicates a timestamp, || is a connection symbol, which means connecting the previous and next strings. A second obtaining module is used to obtain an XOR value of the self-identity and the first hash encryption item in the registration information to obtain an anonymous identification; The anonymous identifier is represented by: in, Represents an anonymous identifier, Indicates self-identification, represents the first hashed encrypted term, is an exclusive OR symbol; a second sending module is used to send the timestamp, the characteristic value in the registration information, the anonymous identifier and the attribute information to the second device, so that the second device can obtain the attribute verification information according to the timestamp, the characteristic value in the registration information, the anonymous identifier, the attribute information, the preset parameters and the preset hash function when the timestamp meets the preset conditions, and if the attribute verification information is equal to the attribute information, the first device is authenticated.

Images