A two-way identity authentication method, device, equipment and storage medium

Abstract

The embodiment of the present invention discloses a two-way identity authentication method, device, equipment and storage medium. The method includes: receiving a sender identification, a sender random number and a sender signature value; generating a sender identification public key according to pre-acquired public parameters and the sender identification, and verifying the sender random number and the sender signature value using the sender identification public key; if the verification result is successful, generating a receiver timestamp signature value according to the pre-acquired receiver private key, and sending the receiver timestamp signature value and the receiver identification corresponding to the receiver communication entity to the sender communication entity. The technical solution of the embodiment of the present invention improves the efficiency of identity authentication of both parties of the communication entity, reduces the management cost of the verification process for the verification information, and at the same time, when performing two-way verification, the combination of identification number, time and random number is used to improve the security of identity authentication of both parties of the communication entity.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communication security technology, and in particular to a two-way identity authentication method, apparatus, device and storage medium. Background Art

[0002] With the continuous development of the Internet and the continuous enrichment of its applications, information systems such as office applications, secure access, email, and video conferencing based on cloud computing infrastructure have also become popular. However, with the continuous renovation of attack methods, hackers use brute force cracking, automated proxies, and other methods to impersonate users, steal user identity information, steal user privacy data, and spy on social engineering information security issues that are becoming increasingly prominent. Verifying the authenticity of the identity of access users has become an important means of ensuring information security.

[0003] In typical e-government network applications, authentication between devices and between users and devices is very common. However, in the existing access process, when authenticating users or devices, username and password authentication is usually used, which poses certain security risks. When authenticating the two through digital certificate authentication technology, it is necessary to authenticate through a digital certificate issued by a trusted certificate authentication center, but the management of the certificate is cumbersome and expensive, and it is difficult to implement in technology. When most service providers use self-generated certificates for authentication to avoid cumbersome issues, it is difficult to prevent the security risk of man-in-the-middle attacks. If hackers use self-generated certificates to establish a pseudo-trust channel between two communication entities that need to communicate, they can unimpededly spy on and steal the communication data of both parties. This reduces the efficiency and security of identity authentication of both parties, fails to ensure the security and ease of identity authentication of both parties during the access process, and reduces the completeness of the two-way identity authentication of the communication entities. Summary of the invention

[0004] The present invention provides a two-way identity authentication method, device, equipment and storage medium to verify the identities of both parties of a communication entity before they need to communicate, thereby improving the verification efficiency and security of the identity authentication of both parties of the communication entity, reducing the difficulty of managing verification information during the verification process, reducing the memory required for identity authentication in the communication entity, and reducing the cost of two-way identity authentication.

[0005] In a first aspect, an embodiment of the present invention provides a two-way identity authentication method, which is applied to a receiving communication entity, including:

[0006] Receive sender ID, sender random number and sender signature value;

[0007] Generate a sender identification public key based on the pre-acquired public parameters and the sender identification, and use the sender identification public key to verify the sender random number and the sender signature value;

[0008] If the verification result is successful, a receiver timestamp signature value is generated according to the receiver private key obtained in advance, and the receiver timestamp signature value and the receiver identification corresponding to the receiver communication entity are sent to the sender communication entity.

[0009] Further, the sender identification public key is used to verify the sender random number and the sender signature value, including:

[0010] Decrypt the sender's signature value using the sender's identification public key to determine the decrypted value;

[0011] If the decrypted value is the same as the sender's random number, the verification result is determined to be successful;

[0012] Otherwise, the verification result is determined to be failed.

[0013] Furthermore, generating a recipient's timestamp signature value according to the recipient's private key obtained in advance includes:

[0014] Obtain the receiver's timestamp from the public clock;

[0015] Combine the receiver's timestamp with the sender's random number to generate a timestamp random number;

[0016] The timestamp random number signature is encrypted using the recipient's private key obtained in advance to generate the recipient's timestamp signature value.

[0017] Furthermore, after the verification result is determined to be a failure, the method further includes:

[0018] Cancel the communication between the receiving communication entity and the sending communication entity.

[0019] Furthermore, before receiving the sender identifier, the sender random number and the sender signature value, it also includes:

[0020] According to the receiver identifier corresponding to the receiver communication entity, the key management platform obtains the receiver private key and public parameters corresponding to the receiver communication entity.

[0021] In a second aspect, an embodiment of the present invention further provides a two-way identity authentication method, which is applied to a sending communication entity, comprising:

[0022] When secure communication is required, a sender random number is generated, and the sender random number is encrypted by the sender's private key obtained in advance to generate a sender signature value;

[0023] Sending the sender random number, the sender signature value, and the sender identifier corresponding to the sender communication entity to the receiver communication entity;

[0024] Generate a receiver identification public key based on the received receiver identification and pre-acquired public parameters, and verify the received receiver timestamp signature value using the receiver identification public key and the sender random number;

[0025] The communication between the sending communication entity and the receiving communication entity is established according to the verification result.

[0026] Furthermore, the received recipient's timestamp signature value is verified using the recipient's identification public key and the sender's random number, including:

[0027] Decrypt the recipient's timestamp signature value using the recipient's identification public key to determine the recipient's timestamp and decryption random value;

[0028] Get the sender timestamp from the public clock;

[0029] The receiver's timestamp and decrypted random number are verified based on the sender's timestamp and the sender's random number.

[0030] Further, the receiving party's timestamp and the decrypted random value are verified according to the sending party's timestamp and the sending party's random number, including:

[0031] Determine the time difference between the sender's timestamp and the receiver's timestamp;

[0032] If the time difference is less than the preset time threshold, and the decrypted random number is the same as the sender's random number, the verification result is determined to be successful;

[0033] Otherwise, the verification result is determined to be a failure.

[0034] Further, establishing communication between the sender communication entity and the receiver communication entity according to the verification result includes:

[0035] If the verification result is successful, the communication between the sender communication entity and the receiver communication entity is established;

[0036] If the verification result is failure, the communication between the receiving communication entity and the sending communication entity is cancelled.

[0037] Furthermore, before performing secure communication, the following steps are also included:

[0038] According to the sender identifier corresponding to the sender communication entity, the key management platform obtains the sender private key and public parameters corresponding to the sender communication entity.

[0039] In a third aspect, an embodiment of the present invention further provides a two-way identity authentication device, which is applied to a receiving communication entity, and the two-way identity authentication device includes:

[0040] A parameter receiving module, used to receive a sender identifier, a sender random number, and a sender signature value;

[0041] The signature value verification module is used to generate a sender identification public key according to the pre-acquired public parameters and the sender identification, and use the sender identification public key to verify the sender random number and the sender signature value;

[0042] The first parameter sending module is used to generate a receiver timestamp signature value according to a pre-acquired receiver private key if the verification result is successful, and send the receiver timestamp signature value and a receiver identifier corresponding to the receiver communication entity to the sender communication entity.

[0043] In a fourth aspect, an embodiment of the present invention further provides a two-way identity authentication device, which is applied to a sending communication entity, and the two-way identity authentication device includes:

[0044] The signature value generation module is used to generate a sender random number when secure communication is required, and to encrypt the sender random number with the sender's private key obtained in advance to generate a sender signature value;

[0045] A second parameter sending module, used to send a sender random number, a sender signature value, and a sender identifier corresponding to the sender communication entity to a receiver communication entity;

[0046] A parameter verification module, used to generate a receiver identification public key according to the received receiver identification and the pre-acquired public parameters, and verify the received receiver timestamp signature value using the receiver identification public key and the sender random number;

[0047] The communication establishment module is used to establish communication between the sending party communication entity and the receiving party communication entity according to the verification result.

[0048] In a fifth aspect, an embodiment of the present invention further provides a two-way identity authentication device, including:

[0049] a storage device and one or more processors;

[0050] A storage device for storing one or more programs;

[0051] When one or more programs are executed by one or more processors, the one or more processors implement the two-way identity authentication method of the first aspect mentioned above when the two-way identity authentication device is a receiving communication entity, and implement the two-way identity authentication method of the second aspect mentioned above when the two-way identity authentication device is a sending communication entity.

[0052] In a sixth aspect, an embodiment of the present invention further provides a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to execute the two-way identity authentication method of the first aspect or the second aspect.

[0053] A two-way identity authentication method, apparatus, device and storage medium provided by an embodiment of the present invention are directed to a receiving communication entity, by receiving a sender identifier, a sender random number and a sender signature value; generating a sender identifier public key according to pre-acquired public parameters and the sender identifier, and using the sender identifier public key to verify the sender random number and the sender signature value; if the verification result is successful, generating a receiver timestamp signature value according to a pre-acquired receiver private key, and sending the receiver timestamp signature value and the receiver identifier corresponding to the receiving communication entity to the sending communication entity. By adopting the above technical solution, when secure communication is required, the receiving communication entity verifies that the sending communication entity is the communication entity that needs to be connected for communication by the receiving random number, the sending signature value and the sending identification of the receiving communication entity, and then generates the receiving timestamp signature value according to the pre-acquired receiving private key and the time when the receiving communication entity sends information to the sending communication entity, and sends the receiving timestamp signature value and the receiving identification corresponding to the receiving communication entity to the sending communication entity, so that the sending communication entity can authenticate the receiving communication entity according to the receiving timestamp signature value and the receiving identification containing the timestamp information. The problem that if the traditional two-way identity authentication relies on password authentication technology, the security is low, and if it relies on certificate authentication technology, it needs to rely on a third-party certificate authentication center, and the management is complicated and costly is solved. Since both parties do not need to obtain digital certificates through a third-party certificate authentication center when performing identity authentication, and do not need to store certificate information locally, the efficiency of identity authentication of both parties of the communication entity is improved, and the management cost of the verification process for verification information is reduced. At the same time, when performing two-way authentication, the security of identity authentication of both parties of the communication entity is improved by combining identification number, time and random number. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0055] Figure 1 is a flow chart of a two-way identity authentication method in Embodiment 1 of the present invention;

[0056] Figure 2 is a flow chart of a two-way identity authentication method in Embodiment 2 of the present invention;

[0057] Figure 3 is a flow chart of a two-way identity authentication method in Embodiment 3 of the present invention;

[0058] Figure 4 is a flow chart of a two-way identity authentication method in Embodiment 4 of the present invention;

[0059] Figure 5 It is a flow chart of verifying a receiving party's timestamp and a decrypted random value according to a sending party's timestamp and a sending party's random number in a fourth embodiment of the present invention;

[0060] Figure 6 It is a schematic diagram of the structure of a two-way identity authentication device in Embodiment 5 of the present invention;

[0061] Figure 7 It is a structural schematic diagram of a two-way identity authentication device in Embodiment 6 of the present invention;

[0062] Figure 8 It is a structural diagram of a two-way identity authentication device in Embodiment 7 of the present invention;

[0063] Fig. 9 This is an example diagram of a two-way identity authentication topology in Embodiment 7 of the present invention. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical scheme and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below in conjunction with the accompanying drawings. It should be clear that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are only examples of devices and methods consistent with some aspects of the present invention as detailed in the attached claims.

[0066] In the description of the present invention, it should be understood that the terms "first", "second", "third", etc. are only used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to the specific circumstances. In addition, in the description of the present invention, unless otherwise specified, "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0067] Embodiment 1

[0068] Figure 1 A flowchart of a two-way identity authentication method provided in the first embodiment of the present invention. This embodiment is applicable to the situation where the receiving communication entity authenticates the sending communication entity and sends its own authentication information to the sending communication entity for its authentication. The method can be executed by a two-way identity authentication device, which can be implemented by software and / or hardware. The two-way identity authentication device can be configured on a two-way identity authentication device, which can be a computer device, which can be composed of two or more physical entities or one physical entity. Generally speaking, the computer device can be a notebook, a desktop computer, a smart tablet, etc.

[0069] like Figure 1 As shown, a two-way identity authentication method provided in the first embodiment is applied to a receiving communication entity and specifically includes the following steps:

[0070] S101. Receive a sender identifier, a sender random number, and a sender signature value.

[0071] In this embodiment, the receiving communication entity can be specifically understood as the communication entity that serves as the communication receiver among the two communication entities that need to conduct secure communication. Optionally, the communication entity can be a computer device that can realize interactive communication, such as a mobile communication device, a notebook, a desktop computer, and a smart tablet. The embodiment of the present invention does not limit the specific type of the communication entity. The sender identification can be specifically understood as the device code corresponding to the communication entity that serves as the communication initiator in secure communication. It should be clear that for all communication entities under the same government network, each communication entity has its own unique device code, and the device code can be used to clarify information such as the location and type of the communication entity. The sender random number can be specifically understood as the random value generated in the communication entity that serves as the communication initiator. The sender signature value can be specifically understood as the parameter value obtained after encrypting the sender random number through the signature technology.

[0072] Specifically, when secure communication is required between two communication entities, the receiving communication entity as the communication receiver receives the sender identification, the sender random number and the sender signature value sent by the sending communication entity.

[0073] S102: Generate a sender identification public key according to the pre-acquired public parameters and the sender identification, and use the sender identification public key to verify the sender random number and the sender signature value.

[0074] In this embodiment, the public parameter can be specifically understood as the parameter value obtained by the communication entity in advance from the key management platform (Key Generation Center, KGC) to identify the cryptographic algorithm. It should be clear that for multiple communication entities under the management of the same KGC, the public parameters obtained from the KGC are the same. The sender identification public key can be specifically understood as the non-secret half corresponding to the private key of the sender communication entity, which is used to decrypt the information encrypted by the sender's private key.

[0075] Generally, for government systems, communication entities belonging to the same region are managed by the same KGC, and the public parameters they obtain are the same. Communication entities in the region can directly perform two-way identity authentication based on the public parameters obtained once, while other communication entities outside the region cannot perform two-way identity authentication due to different public parameters, unless the corresponding public parameters are exchanged before authentication. For example, assuming that each communication entity in Shenzhen and Zhuhai is managed by two KGCs respectively, each communication entity in Shenzhen can perform two-way identity authentication based on the corresponding KGC public parameters, while it is difficult for communication entities in Shenzhen and Zhuhai to directly perform two-way identity authentication based on the public parameters obtained by each.

[0076] Specifically, based on the identification key algorithm that complies with the national cryptographic specifications, combined with the public parameters pre-acquired by the key management platform and the received sender identification, a sender identification public key corresponding to the sender private key corresponding to the sender communication entity is generated, and then the sender identification public key is used to decrypt the received sender signature value, and the decrypted sender signature value is compared and verified with the sender random number to obtain the corresponding verification result. Exemplarily, the identification key algorithm in the embodiment of the present invention can be an SM9 identification key algorithm that complies with the national standard "GM / T 0044-2016SM9 identification cryptographic algorithm", and the embodiment of the present invention does not limit the identification key method specifically adopted by the communication entity.

[0077] In the embodiment of the present invention, since the key is the device code of the communication entity, there is no need to apply for a trusted electronic certification certificate (CA) from a third-party certificate authentication center, which avoids the problem that the CA certificate is inconvenient to manage in terms of storage consumption and performance, and the low efficiency when performing identity authentication for massive communication entities. At the same time, it avoids the problem of low security when the two communication entities in the prior art do not generate a trusted CA certificate through a trusted third-party certificate authentication center, but generate a non-trusted certificate for verification through self-generation. The efficiency of key management is improved, the complexity of identity authentication of the two communicating parties is reduced, the occupation of network resources is saved, and multiple interactions with third parties are avoided, thereby improving security.

[0078] S103: If the verification result is successful, a receiver timestamp signature value is generated according to the receiver private key obtained in advance, and the receiver timestamp signature value and the receiver identifier corresponding to the receiver communication entity are sent to the sender communication entity.

[0079] In this embodiment, the recipient's private key can be specifically understood as the secret half of the key pair used with the public key algorithm in the recipient's communication entity, which can be used to encrypt the parameters in the recipient's communication entity. The encrypted parameters can only be decrypted by the recipient's private key or the corresponding public key. The recipient's timestamp signature value can be specifically understood as the parameter value obtained by encrypting the string containing both the timestamp information and the random number information by the recipient's private key using the signature technology. The recipient's identification can be specifically understood as the device code corresponding to the communication entity used as the communication recipient in secure communication.

[0080] Specifically, if the verification is successful, it can be determined that the sending communication entity is a communication entity that is located in the same area as the receiving communication entity and can communicate securely. At this time, the receiving communication entity needs to obtain a timestamp corresponding to the current time, and combine the timestamp with the obtained sender random number. The combination is then signed and encrypted by the pre-acquired receiver private key to obtain the corresponding receiver timestamp signature value, and the obtained receiver timestamp signature value and the receiver identifier corresponding to the receiver communication entity are sent to the sending communication entity, so that the sending communication entity can verify the identity of the receiver communication entity based on the receiver timestamp signature value and the receiver identifier.

[0081] The embodiment of the present invention receives a sender identification, a sender random number, and a sender signature value; generates a sender identification public key according to a pre-acquired public parameter and a sender identification, and verifies the sender random number and the sender signature value using the sender identification public key; if the verification result is successful, generates a receiver timestamp signature value according to a pre-acquired receiver private key, and sends the receiver timestamp signature value and the receiver identification corresponding to the receiver communication entity to the sender communication entity. By adopting the above technical solution, when secure communication is required, the receiver communication entity verifies that the sender communication entity is the communication entity that needs to be connected for communication by the received sender random number, sender signature value, and sender identification of the sender communication entity, and then generates a receiver timestamp signature value according to the pre-acquired receiver private key and the time when the receiver communication entity sends information to the sender communication entity, and sends the receiver timestamp signature value and the receiver identification corresponding to the receiver communication entity to the sender communication entity, so that the sender communication entity can authenticate the receiver communication entity according to the receiver timestamp signature value and the receiver identification containing the timestamp information. It solves the problem that if the traditional two-way identity authentication relies on password authentication technology, the security is low, and if it relies on certificate authentication technology, it needs to rely on a third-party certificate authentication center, which is complicated and costly to manage. Since both parties do not need to obtain digital certificates from a third-party certificate authentication center when performing identity authentication, nor do they need to store certificate information locally, the efficiency of identity authentication of both communicating entities is improved, and the management cost of authentication information during the authentication process is reduced. At the same time, when performing two-way authentication, the combination of identification number, time and random number is used to improve the security of identity authentication of both communicating entities.

[0082] Embodiment 2

[0083] Figure 2 A flowchart of a two-way identity authentication method is provided for the second embodiment of the present invention. The technical scheme of the embodiment of the present invention is further optimized on the basis of the above-mentioned optional technical schemes. The sender's signature value is decrypted by the generated sender identification public key, and the decrypted signature value is verified to be the same as the sender's random number. If the verification is successful, the receiver's timestamp is obtained by the public clock, and the receiver's timestamp is combined with the sender's random number and encrypted by the receiver's private key, thereby generating a receiver's timestamp signature value for sending to the sender's communication entity, and adding time information to the encrypted information used for identity authentication, thereby improving the accuracy of two-way identity authentication. Identity authentication is only performed by the two parties who need to communicate, reducing the amount of data transmission in the verification process, improving the efficiency of identity authentication of both communication entities, reducing the management cost of verification information during the verification process, and ensuring the security of identity authentication.

[0084] like Figure 2As shown, a two-way identity authentication method provided by Embodiment 2 of the present invention specifically includes the following steps:

[0085] S201. According to the receiver identifier corresponding to the receiver communication entity, the key management platform obtains the receiver private key and public parameters corresponding to the receiver communication entity.

[0086] In this embodiment, the key management platform can be specifically understood as a management key infrastructure used to manage the keys of each communication entity in its area. Each communication entity managed by it should be backed up in it, and when the communication entity has a key requirement, the corresponding private key and public parameter generated can be obtained from it.

[0087] Specifically, when the receiving communication entity needs to obtain its own corresponding receiving private key and public parameters, it sends its own corresponding receiving identifier to the key management platform. The key management platform detects whether the receiving identifier exists in the platform. If so, it generates the corresponding receiving private key based on the receiving identifier, and sends the receiving private key and the public parameters corresponding to the key management platform to the corresponding receiving communication entity.

[0088] S202: Receive a sender ID, a sender random number, and a sender signature value.

[0089] S203: Generate a sender identification public key according to the public parameters and the sender identification, decrypt the sender signature value by using the sender identification public key, and determine the decrypted value.

[0090] Specifically, the receiving communication entity sends an identification public key application information containing the sender's identification to the key management platform, so that the key management platform can generate a sender identification public key based on an identification key algorithm that complies with national cryptographic specifications and combines public parameters with the sender's identification and feeds it back to the receiving communication entity. The receiving communication entity decrypts the sender's signature value encrypted by the sender's private key through the sender's identification public key, and determines the value obtained after decryption as the decrypted value.

[0091] S204, determine whether the decrypted value is the same as the sender's random number, if so, execute step S205; if not, execute step S206.

[0092] Specifically, character comparison is used to determine whether the decrypted value is the same as the sender's random number. If they are the same, it can be considered that the sender's communication entity is indeed located in the same area as the receiver's communication entity, and is a communication entity managed by the same key management platform. A secure communication relationship can be established between the two, and the identity authentication of the sender's communication entity is passed. At this time, step S205 is executed; if they are different, it can be considered that the sender's communication entity may not be located in the same area as the receiver's communication entity, the two cannot establish a secure communication relationship, and the identity authentication of the sender's communication entity fails. At this time, step S206 is executed.

[0093] S205. Determine the verification result as successful, and execute step S208.

[0094] S206: Determine the verification result as failure, and execute step S207.

[0095] S207: Cancel the communication between the receiving communication entity and the sending communication entity.

[0096] Specifically, since the receiving communication entity confirms that the sending communication entity is not a communication entity with which secure communication can be established, the receiving communication entity can directly cancel the communication between the two.

[0097] Furthermore, after canceling the communication between the two communication entities, the receiving communication entity may issue an alarm so that the technical personnel can troubleshoot the abnormality, reduce the risk of man-in-the-middle attacks, and avoid necessary communication requests from different-region communication entities being ignored.

[0098] S208: Obtain the receiver's timestamp from the public clock.

[0099] In this embodiment, the common clock can be specifically understood to be a common clock for communication entities that need to use a clock in the same area, which can be used as a standard to unify the relative time between the communication entities.

[0100] Specifically, after determining that the verification result is successful, the receiving communication entity can be considered to have completed the identity authentication of the sending communication entity that will communicate with it, and the corresponding identity authentication information needs to be generated for the sending communication entity to verify its identity. Since the verification time of the two should theoretically be relatively small, the current time can be obtained from the public clock and used to construct the receiving party's timestamp to take the time factor into account in the identity authentication and improve the accuracy of the identity authentication.

[0101] S209: Combine the receiving party's timestamp with the sending party's random number to generate a timestamp random number.

[0102] Specifically, the field corresponding to the receiver's timestamp is combined with the field corresponding to the sender's random number. Exemplarily, the field corresponding to the sender's random number can be added to the field corresponding to the receiver's timestamp, and the combined field is determined as the timestamp random number.

[0103] S210. Encrypt the timestamp random number signature using the recipient's private key to generate a recipient's timestamp signature value.

[0104] Specifically, the timestamp random number is signed and encrypted as a whole using the recipient's private key in conjunction with the signature technology, and the encrypted timestamp random number is determined as the recipient's timestamp signature value.

[0105] S211. Send the receiver's timestamp signature value and the receiver's identifier corresponding to the receiver's communication entity to the sender's communication entity.

[0106] The technical solution of this embodiment completes the decryption of the sender signature value through the sender identification and the sender identification public key generated by the public parameters, and compares it with the sender random number to clarify the sender's identity, without the participation of a third party, reducing the amount of data transmission during verification, and improving the efficiency of identity authentication of both communication entities. After the verification is successful, the receiving party's timestamp is obtained by the public clock, and the receiving party's timestamp is combined with the sender's random number and encrypted by the receiving party's private key to generate a receiving party timestamp signature value for sending to the sending communication entity. The time information is added to the encrypted information used for identity authentication, so that the sending communication entity can authenticate the receiving communication entity based on the time and the receiving party identification at the same time, thereby improving the accuracy of two-way identity authentication, further ensuring the security of identity authentication, and reducing the management cost of verification information during the verification process.

[0107] Embodiment 3

[0108] Figure 3 A flowchart of a two-way identity authentication method is provided for the third embodiment of the present invention. The technical solution of the embodiment of the present invention is further optimized on the basis of the above-mentioned optional technical solutions. This embodiment is applicable to the situation where the sender communication entity authenticates the receiver communication entity. The method can be executed by a two-way identity authentication device, which can be implemented by software and / or hardware. The two-way identity authentication device can be configured on a two-way identity authentication device. The two-way identity authentication device can be a computer device, which can be composed of two or more physical entities or one physical entity. Generally speaking, the computer device can be a notebook, a desktop computer, a smart tablet, etc.

[0109] like Figure 3 As shown, a two-way identity authentication method provided in this embodiment 3 is applied to a sending communication entity and specifically includes the following steps:

[0110] S301. When secure communication is required, generate a sender random number, and encrypt the sender random number with the sender private key signature acquired in advance to generate a sender signature value.

[0111] In this embodiment, the sender communication entity can be specifically understood as the communication entity that is the communication initiator of the two communication entities that need to communicate securely. The sender random number can be specifically understood as a random value randomly generated by the sender communication entity to assist encryption for identity authentication. The sender private key can be specifically understood as the secret half of the key pair used with the public key algorithm in the sender communication entity, which can be used to encrypt the parameters that need to be sent in the sender communication entity, and the encrypted parameters can only be decrypted by the sender private key or its corresponding public key.

[0112] Specifically, when secure communication is required, the sending communication entity first identifies the receiving communication entity with which communication is required, and generates a sender random number by itself. The sender random number is signed and encrypted using the sender private key obtained in advance from the key management platform, and the encrypted sender random number is determined as the sender signature value.

[0113] S302: Send the sender random number, the sender signature value, and the sender identifier corresponding to the sender communication entity to the receiver communication entity.

[0114] Specifically, since the receiving communication entity does not have a pre-acquired sender random number, the identity authentication of the sender communication entity cannot be achieved only through the sender signature value and the sender identifier. Therefore, the sender communication entity needs to send the sender random number, the sender signature value and the sender identifier corresponding to the sender communication entity to the receiving communication entity for identity authentication.

[0115] S303: Generate a receiver identification public key according to the received receiver identification and pre-acquired public parameters, and verify the received receiver timestamp signature value using the receiver identification public key and the sender random number.

[0116] In this embodiment, the recipient identification public key can be specifically understood as the non-secret half corresponding to the recipient communication entity private key, which is used to decrypt the information encrypted by the recipient private key.

[0117] Specifically, based on the identification key algorithm that complies with the national cryptographic standards, combined with the public parameters pre-acquired by the key management platform and the received recipient identification, a recipient identification public key corresponding to the recipient private key corresponding to the recipient communication entity is generated, and then the recipient identification public key is used to decrypt the received recipient timestamp signature value, and the decrypted recipient timestamp signature value is compared and verified with the sender's random number and the corresponding time when the sender communication entity receives the recipient timestamp signature value to obtain the corresponding verification result.

[0118] S304: Establish communication between the sending communication entity and the receiving communication entity according to the verification result.

[0119] Specifically, since when the sending communication entity can receive the receiving identification and the receiving timestamp signature value sent by the receiving communication entity, it can be considered that the receiving communication entity has completed the identity authentication of the sending communication entity. Therefore, when the sending communication entity determines that the verification result is successful, it can be determined that the two parties are two communication entities that can communicate securely. At this time, the sending communication entity can establish communication between the sending communication entity and the receiving communication entity. Otherwise, it can be considered that secure communication cannot be carried out between the two, and the establishment of communication between the sending communication entity and the receiving communication entity is cancelled.

[0120] The embodiment of the present invention generates a sender random number when secure communication is required, and generates a sender signature value by encrypting the sender random number with a sender private key signature acquired in advance; sends the sender random number, the sender signature value and a sender identifier corresponding to the sender communication entity to a receiver communication entity; generates a receiver identifier public key according to the received receiver identifier and a pre-acquired public parameter, and verifies the received receiver timestamp signature value using the receiver identifier public key and the sender random number; and establishes communication between the sender communication entity and the receiver communication entity according to the verification result. By adopting the above technical solution, when secure communication is required, the sender random number generated by itself is first encrypted through the sender private key obtained in advance, and then the sender random number, the sender signature value obtained after encryption, and the sender identifier corresponding to the sender communication entity are sent to the corresponding receiver communication entity that needs to communicate, so that the corresponding receiver communication entity can directly complete the identity authentication of the sender communication entity according to the received content, and then after the verification is passed, the receiver identifier and the receiver timestamp signature value sent by the receiver communication entity can be received, and the receiver identifier public key corresponding to the receiver private key is generated by the receiver identifier and the pre-acquired public parameters, and the receiver timestamp signature value is decrypted to verify the identity of the receiver communication entity based on the time information and the random number information obtained by decryption at the same time, and then secure communication is established between the two based on the verification result. It solves the problem that if the traditional two-way identity authentication relies on password authentication technology, the security is low, and if it relies on certificate authentication technology, it needs to rely on a third-party certificate authentication center, which is complicated and costly to manage. Since both parties do not need to obtain digital certificates from a third-party certificate authentication center or store certificate information locally when performing identity authentication, the efficiency of identity authentication of both communicating entities is improved and the management cost of verification information during the verification process is reduced. At the same time, when performing two-way authentication, the security of identity authentication of both communicating entities is improved by combining identification numbers, time and random numbers.

[0121] Embodiment 4

[0122] Figure 4A flowchart of a two-way identity authentication method is provided for Embodiment 4 of the present invention. The technical solution of the embodiment of the present invention is further optimized on the basis of the above-mentioned optional technical solutions. The receiver's timestamp signature value is decrypted by the generated receiver identification public key, and the receiver's timestamp and decryption random value are determined according to the decrypted receiver's timestamp signature value. The receiver's timestamp and decryption random value are verified according to the sender's timestamp and the sender's random number obtained by the public clock during decryption. Communication between the sender's communication entity and the receiver's communication entity is established according to the verification result, and time information is applied to the encrypted information for identity authentication, thereby improving the accuracy of two-way identity authentication. In addition, only the two communicating parties need to participate in the identity authentication process, thereby reducing the amount of data transmission in the verification process, improving the efficiency of identity authentication of both communicating entities, and reducing the management cost of verification information in the verification process.

[0123] like Figure 4 As shown, a two-way identity authentication method provided by Embodiment 4 of the present invention specifically includes the following steps:

[0124] S401. According to the sender identifier corresponding to the sender communication entity, the key management platform obtains the sender private key and public parameters corresponding to the sender communication entity.

[0125] Specifically, when the sending communication entity needs to obtain its own corresponding sender private key and public parameters, it sends its own corresponding sender identifier to the key management platform. The key management platform detects whether the sender identifier exists in the platform. If so, it generates the corresponding sender private key based on the sender identifier, and sends the sender private key and the corresponding public parameters of the key management platform to the corresponding sending communication entity.

[0126] S402: When secure communication is required, generate a sender random number, and encrypt the sender random number with the sender private key acquired in advance to generate a sender signature value.

[0127] S403: Send the sender random number, the sender signature value, and the sender identifier corresponding to the sender communication entity to the receiver communication entity.

[0128] S404: Generate a recipient identification public key according to the received recipient identification and public parameters.

[0129] The specific sending communication entity sends the identification public key application information containing the recipient identification to the key management platform, so that the key management platform can generate the recipient identification public key based on the identification key algorithm that complies with the national cryptographic specifications, combining the public parameters and the recipient identification, and feed it back to the sending communication entity.

[0130] S405: Decrypt the recipient's timestamp signature value using the recipient's identification public key to determine the recipient's timestamp and decrypted random value.

[0131] Specifically, the sending communication entity decrypts the receiver's timestamp signature value encrypted by the receiver's private key through the receiver's identification public key, splits the decrypted value into fields, and determines the receiver's timestamp and decryption random value.

[0132] S406: Obtain the sender timestamp from the public clock.

[0133] Specifically, since the theoretical time difference for identity authentication between the sending communication entity and the receiving communication entity should be small, after completing the decryption of the received receiving timestamp signature value, the current time can be obtained from the public clock and used to construct the sending timestamp to represent the time when the sending communication entity performs identity authentication.

[0134] S407: Verify the receiver's timestamp and the decrypted random number value according to the sender's timestamp and the sender's random number.

[0135] Specifically, determine whether this identity authentication is the same identity authentication established during the same secure communication based on the sender's timestamp and the receiver's timestamp, and determine the identity of the receiver's communication entity through the sender's random number and the decrypted random number value, and combine the two to determine the verification result.

[0136] Further, Figure 5 A flowchart of verifying a receiving party's timestamp and a decrypted random number value according to a sending party's timestamp and a sending party's random number is provided for Embodiment 4 of the present invention, such as Figure 5 As shown, the specific steps include:

[0137] S4071. Determine the time difference between the sender's timestamp and the receiver's timestamp.

[0138] Specifically, the time value corresponding to the timestamp of the sender is subtracted from the time difference corresponding to the timestamp of the receiver, and the absolute value of the difference is determined as the time difference.

[0139] S4072. Determine whether the time difference is less than a preset time threshold, and whether the decrypted random number value is the same as the sender's random number. If so, execute step S4073; if not, execute step S4074.

[0140] Specifically, if the time difference is less than the preset time threshold, it can be considered that this identity authentication is the identity authentication when the same secure communication is established. At the same time, if the decrypted random number value is the same as the sender's random number, it can be considered that the receiving communication entity is the object that needs to communicate with this secure communication, and step S4073 is executed at this time; otherwise, it can be considered that this identity authentication is not the identity authentication when the same secure communication is established, or the receiving communication entity is not the object that needs to communicate with this secure communication, and step S4074 is executed at this time.

[0141] Optionally, the preset time threshold may be 5 minutes, and may also be adaptively set according to actual needs, which is not limited in the embodiment of the present invention.

[0142] S4073. Determine that the verification result is successful.

[0143] S4074. Determine that the verification result is a failure.

[0144] S408: Determine whether the verification result is successful. If so, execute step S409; if not, execute step S410.

[0145] Specifically, if the verification result is successful, it can be considered that the sending communication entity is indeed located in the same area as the receiving communication entity, and is a communication entity managed by the same key management platform. A secure communication relationship can be established between the two, and the identity authentication of the sending communication entity is passed. At this time, step S409 is executed; if the verification result is failed, it can be considered that the sending communication entity may not be located in the same area as the receiving communication entity, the two cannot establish a secure communication relationship, and the identity authentication of the sending communication entity fails. At this time, step S410 is executed.

[0146] S409: Establish communication between the sending communication entity and the receiving communication entity.

[0147] S410. Cancel the communication between the receiving communication entity and the sending communication entity.

[0148] Specifically, since the sending communication entity confirms that the receiving communication entity is not a communication entity with which secure communication can be established, the sending communication entity can directly cancel the communication between the two.

[0149] Furthermore, after canceling the communication between the two communication entities, the sending communication entity may issue an alarm so that the technical staff can troubleshoot the abnormality, reduce the risk of man-in-the-middle attacks, and avoid necessary communication requests of the communication entities in different regions being ignored.

[0150] The technical solution of this embodiment completes the decryption of the receiver's timestamp signature value through the receiver's identification and the receiver's identification public key generated by the public parameters, and determines the receiver's timestamp and decryption random value based on the decrypted receiver's timestamp signature value, verifies the receiver's timestamp and decryption random value based on the sender's timestamp and sender's random number obtained by the public clock during decryption, establishes communication between the sender communication entity and the receiver communication entity based on the verification result, adds time information to the encrypted information used for identity authentication, so that the sender communication entity can authenticate the receiver communication entity based on the time and the receiver's identification at the same time, thereby improving the accuracy of two-way identity authentication, further ensuring the security of identity authentication, and reducing the management cost of verification information during the verification process.

[0151] Embodiment 5

[0152] Figure 6 A schematic diagram of the structure of a two-way identity authentication device provided in Embodiment 5 of the present invention is applied to a receiving communication entity. The two-way identity authentication device includes: a parameter receiving module 51, a signature value verification module 52 and a first parameter sending module 53.

[0153] Among them, the parameter receiving module 51 is used to receive the sender identification, the sender random number and the sender signature value; the signature value verification module 52 is used to generate the sender identification public key according to the pre-acquired public parameters and the sender identification, and use the sender identification public key to verify the sender random number and the sender signature value; the first parameter sending module 53 is used to generate the receiver timestamp signature value according to the pre-acquired receiver private key if the verification result is successful, and send the receiver timestamp signature value and the receiver identification corresponding to the receiver communication entity to the sender communication entity.

[0154] The technical solution of this embodiment solves the problem that if the traditional two-way identity authentication relies on password authentication technology, the security is low, and if it relies on certificate authentication technology, it needs to rely on a third-party certificate authentication center, which is complicated and costly to manage. Since both parties do not need to obtain digital certificates from a third-party certificate authentication center when performing identity authentication, nor do they need to store certificate information locally, the efficiency of identity authentication of both parties of the communication entity is improved, and the management cost of the authentication information during the authentication process is reduced. At the same time, when performing two-way authentication, the combination of identification number, time and random number is used to improve the security of identity authentication of both parties of the communication entity.

[0155] Optionally, the signature value verification module 52 includes:

[0156] The signature decryption unit is used to decrypt the sender's signature value through the sender's identification public key to determine the decrypted value.

[0157] The verification result determination unit is used to determine the verification result as success if the decrypted value is the same as the sender's random number; otherwise, determine the verification result as failure.

[0158] Optionally, the first parameter sending module 53 includes:

[0159] The timestamp acquisition unit is used to acquire the receiver's timestamp from the public clock.

[0160] The timestamp random number generating unit is used to combine the receiving party's timestamp with the sending party's random number to generate a timestamp random number.

[0161] The timestamp signature value generating unit is used to encrypt the timestamp random number signature by using the pre-acquired recipient private key to generate the recipient's timestamp signature value.

[0162] The parameter sending unit is used to send the receiving party's timestamp signature value and the receiving party's identifier corresponding to the receiving party's communication entity to the sending party's communication entity.

[0163] Optionally, the two-way authentication device also includes:

[0164] The private key acquisition module is used to obtain the receiver's private key and public parameters corresponding to the receiver's communication entity from the key management platform according to the receiver's identification corresponding to the receiver's communication entity before receiving the sender's identification, sender's random number and sender's signature value.

[0165] The communication canceling module is used to cancel the communication between the receiving communication entity and the sending communication entity after the verification result is determined to be a failure.

[0166] The two-way identity authentication device provided in the embodiment of the present invention can execute the two-way identity authentication method provided in the first embodiment of the present invention and the second embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0167] Embodiment 6

[0168] Figure 7 A structural diagram of a two-way identity authentication device provided for Embodiment 6 of the present invention is applied to a sending communication entity. The two-way identity authentication device includes: a signature value generating module 61, a second parameter sending module 62, a parameter verifying module 63 and a communication establishing module 64.

[0169] Among them, the signature value generation module 61 is used to generate a sender random number when secure communication is required, and to generate a sender signature value by encrypting the sender random number with a pre-acquired sender private key signature; the second parameter sending module 62 is used to send the sender random number, the sender signature value and the sender identifier corresponding to the sender communication entity to the receiver communication entity; the parameter verification module 63 is used to generate a receiver identifier public key based on the received receiver identifier and the pre-acquired public parameters, and to verify the received receiver timestamp signature value using the receiver identifier public key and the sender random number; the communication establishment module 64 is used to establish communication between the sender communication entity and the receiver communication entity based on the verification result.

[0170] The technical solution of this embodiment solves the problem that if the traditional two-way identity authentication relies on password authentication technology, the security is low, and if it relies on certificate authentication technology, it needs to rely on a third-party certificate authentication center, which is complicated and costly to manage. Since both parties do not need to obtain digital certificates from a third-party certificate authentication center when performing identity authentication, nor do they need to store certificate information locally, the efficiency of identity authentication of both parties of the communication entity is improved, and the management cost of the authentication information during the authentication process is reduced. At the same time, when performing two-way authentication, the combination of identification number, time and random number is used to improve the security of identity authentication of both parties of the communication entity.

[0171] Optionally, the parameter verification module 63 includes:

[0172] The parameter decryption unit is used to decrypt the recipient's timestamp signature value through the recipient's identification public key to determine the recipient's timestamp and decryption random value.

[0173] The timestamp acquisition unit is used to acquire the sender timestamp from the public clock.

[0174] The timestamp value verification unit is used to verify the receiver's timestamp and the decrypted random value according to the sender's timestamp and the sender's random number.

[0175] Optional, timestamp value verification unit, specifically used for:

[0176] Determine the time difference between the sender's timestamp and the receiver's timestamp;

[0177] If the time difference is less than the preset time threshold, and the decrypted random number is the same as the sender's random number, the verification result is determined to be successful;

[0178] Otherwise, the verification result is determined to be a failure.

[0179] Optionally, the communication establishing module 64 is specifically used for:

[0180] If the verification result is successful, the communication between the sender communication entity and the receiver communication entity is established;

[0181] If the verification result is failure, the communication between the receiving communication entity and the sending communication entity is cancelled.

[0182] Optionally, the two-way authentication device also includes:

[0183] The private key acquisition module is used to obtain the sender's private key and public parameters corresponding to the sender's communication entity from the key management platform according to the sender's identifier corresponding to the sender's communication entity before conducting secure communication.

[0184] The two-way identity authentication device provided in the embodiment of the present invention can execute the two-way identity authentication method provided in the third embodiment of the present invention and the fourth embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0185] Embodiment 7

[0186] Figure 8 The structure diagram of a two-way identity authentication device provided in Embodiment 7 of the present invention includes: a processor 70, a storage device 71, a display screen 72, an input device 73 and an output device 74. The number of processors 70 in the data processing device can be one or more. Figure 8 A processor 70 is taken as an example. The number of storage devices 71 in the data processing device can be one or more. Figure 8 A storage device 71 is taken as an example. The processor 70, storage device 71, display screen 72, input device 73 and output device 74 of the data processing device can be connected by a bus or other means. Figure 8 In the embodiment, the data processing device may be a computer, a notebook or a smart tablet.

[0187] The storage device 71, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the two-way identity authentication device described in any embodiment of the present application (for example, parameter receiving module 51, signature value verification module 52 and first parameter sending module 53, or signature value generation module 61, second parameter sending module 62, parameter verification module 63 and communication establishment module 64). The storage device 71 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the device, etc. In addition, the storage device 71 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the storage device 71 may further include a memory remotely arranged relative to the processor 70, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0188] The display screen 72 may be a display screen 72 with a touch function, which may be a capacitive screen, an electromagnetic screen, or an infrared screen. Generally speaking, the display screen 72 is used to display data according to the instructions of the processor 70, and is also used to receive a touch operation acting on the display screen 72 and send a corresponding signal to the processor 70 or other devices.

[0189] The input device 73 can be used to receive input digital or character information, and generate key signal input related to user settings and function control of the display device. It can also be a camera for acquiring images and a sound pickup device for acquiring audio data. The output device 74 can include audio devices such as speakers. It should be noted that the specific composition of the input device 73 and the output device 74 can be set according to actual conditions.

[0190] The processor 70 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the storage device 71, that is, implements the above-mentioned two-way identity authentication method.

[0191] The two-way identity authentication device provided above can be used to execute the two-way identity authentication method provided in any of the above embodiments, and has corresponding functions and beneficial effects.

[0192] For example, Fig. 9 A bidirectional authentication topology example diagram is provided in an embodiment of the present invention, such as Fig. 9As shown, before the sender communication entity as the communication initiator wishes to conduct secure communication, it applies for a private key from the KGC key management platform through its own identification, and the KGC obtains the sender private key generated according to the sender identification and the public parameters corresponding to the KGC, generates the sender signature value based on the sender random number and the sender private key generated by itself, and sends the sender random number, the sender signature value and the sender identification to the receiver communication entity. Before receiving the above information, the receiver communication entity applies for a private key from the KGC key management platform through its own identification, and the KGC obtains the receiver private key generated according to the receiver identification and the public parameters corresponding to the KGC. After receiving the sender's random number, sender's signature value and sender's identification, the receiving communication entity sends an identification public key application to KGC based on the sender's identification. KGC generates a sender's identification public key based on the received sender's identification and public parameters and sends it to the receiving communication entity, so that the receiving communication entity can decrypt the sender's signature value according to the sender's identification public key, and then verify the identity of the sender communication entity through the sender's random number and the decrypted sender's signature value. After the verification is successful, the receiving time stamp is obtained from the shared public clock, and it is combined with the sender's random number and encrypted with the receiver's private key to obtain the receiving time stamp signature value. The receiver's identification and the receiver's time stamp signature value are sent to the sending communication entity to complete the sender's communication entity's identity authentication of the receiving communication entity. After receiving the receiver's identifier and the receiver's timestamp signature value, the sender communication entity applies to the KGC for the receiver's identifier public key based on the receiver's identifier. The KGC generates the receiver's identifier public key based on the received receiver's identifier and public parameters and sends it to the sender communication entity. The sender communication entity can decrypt the receiver's timestamp signature value based on the receiver's identifier public key, and obtain the sender's timestamp from the shared public clock after decryption. The decrypted receiver's timestamp signature value is verified by the sender's timestamp and the sender's random number, and then a secure communication connection is established between the sender communication entity and the receiver communication entity based on the verification result.

[0193] Embodiment 8

[0194] Embodiment 8 of the present invention also provides a storage medium containing computer executable instructions for verification. When the computer executable instructions are executed by a computer processor, they are used to perform a two-way identity authentication method. When applied to a receiving communication entity, the method includes:

[0195] Receive sender ID, sender random number and sender signature value;

[0196] Generate a sender identification public key based on the pre-acquired public parameters and the sender identification, and use the sender identification public key to verify the sender random number and the sender signature value;

[0197] If the verification result is successful, a receiver timestamp signature value is generated according to the receiver private key obtained in advance, and the receiver timestamp signature value and the receiver identification corresponding to the receiver communication entity are sent to the sender communication entity.

[0198] When applied to a sending communication entity, the method includes:

[0199] When secure communication is required, a sender random number is generated, and the sender random number is encrypted by the sender's private key obtained in advance to generate a sender signature value;

[0200] Sending the sender random number, the sender signature value, and the sender identifier corresponding to the sender communication entity to the receiver communication entity;

[0201] Generate a receiver identification public key based on the received receiver identification and pre-acquired public parameters, and verify the received receiver timestamp signature value using the receiver identification public key and the sender random number;

[0202] The communication between the sending communication entity and the receiving communication entity is established according to the verification result.

[0203] Of course, the computer executable instructions of a storage medium containing computer executable instructions provided by an embodiment of the present invention are not limited to the method operations described above, and can also execute related operations in the two-way identity authentication method provided by any embodiment of the present invention.

[0204] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0205] It is worth noting that in the embodiment of the above-mentioned search device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0206] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A two-way identity authentication method, characterized in that: Applied to a receiving communication entity, the method comprises: Receive a sender identifier, a sender random number, and a sender signature value; wherein the sender identifier is a device code corresponding to a communication entity that is a communication initiator in secure communication, and the sender identifier is used to clarify location information and type information of the communication entity; Generate a sender identification public key according to the pre-acquired public parameters and the sender identification, and use the sender identification public key to verify the sender random number and the sender signature value; wherein the public parameters are parameter values ​​pre-acquired from the key management platform for identifying the cryptographic algorithm; for multiple communication entities managed by the same key management platform, the public parameters obtained from the key management platform are the same; If the verification result is successful, a receiver timestamp signature value is generated according to the receiver private key obtained in advance, and the receiver timestamp signature value and the receiver identifier corresponding to the receiver communication entity are sent to the sender communication entity; The step of generating a recipient's timestamp signature value based on a pre-acquired recipient's private key includes: Obtain the receiver's timestamp from the public clock; Performing field combination of the receiving party's timestamp and the sending party's random number to generate a timestamp random number; The timestamp random number signature is encrypted using the pre-acquired recipient private key to generate the recipient timestamp signature value.

2. The method according to claim 1, characterized in that The using the sender identification public key to verify the sender random number and the sender signature value includes: Decrypting the sender signature value using the sender identification public key to determine the decrypted value; If the decrypted value is the same as the sender's random number, the verification result is determined to be successful; Otherwise, the verification result is determined to be failed.

3. The method according to claim 2, characterized in that After determining the verification result as a failure, the method further includes: The communication between the receiving communication entity and the sending communication entity is cancelled.

4. The method according to claim 1, characterized in that: Before receiving the sender identification, the sender random number and the sender signature value, it also includes: According to the receiver identifier corresponding to the receiver communication entity, the key management platform obtains the receiver private key and public parameters corresponding to the receiver communication entity.

5. A two-way identity authentication method, characterized in that: Applied to a sending communication entity, the method comprises: When secure communication is required, a sender random number is generated, and the sender random number is encrypted by signing with a pre-acquired sender private key to generate a sender signature value; The sender random number, the sender signature value and the sender identifier corresponding to the sender communication entity are sent to the receiver communication entity; wherein the sender identifier is a device code corresponding to the communication entity used as the communication initiator in secure communication, and the sender identifier is used to clarify the location information and type information of the communication entity; Generate a receiver identification public key according to the received receiver identification and the pre-acquired public parameters, and verify the received receiver timestamp signature value using the receiver identification public key and the sender random number; wherein the public parameters are parameter values ​​pre-acquired from the key management platform for identifying the cryptographic algorithm; for multiple communication entities under the management of the same key management platform, the public parameters acquired from the key management platform are the same; Establishing communication between the sending communication entity and the receiving communication entity according to the verification result; The method of generating the receiving party timestamp signature value by the receiving party communication entity is as follows: Obtain the receiver's timestamp from the public clock; Performing field combination of the receiving party's timestamp and the sending party's random number to generate a timestamp random number; The timestamp random number signature is encrypted using the pre-acquired recipient private key to generate the recipient timestamp signature value.

6. The method according to claim 5, characterized in that The verifying the received recipient timestamp signature value by using the recipient identification public key and the sender random number includes: Decrypt the recipient's timestamp signature value using the recipient's identification public key to determine the recipient's timestamp and decrypted random value; Get the sender timestamp from the public clock; The receiving party timestamp and the decrypted random number value are verified according to the sending party timestamp and the sending party random number.

7. The method according to claim 6, characterized in that The verifying the receiving party timestamp and the decrypted random value according to the sending party timestamp and the sending party random number includes: Determine a time difference between the sender timestamp and the receiver timestamp; If the time difference is less than the preset time threshold, and the decrypted random number value is the same as the sender random number, then the verification result is determined to be successful; Otherwise, the verification result is determined to be a failure.

8. The method according to claim 5, characterized in that The establishing of communication between the sending party communication entity and the receiving party communication entity according to the verification result includes: If the verification result is successful, establishing communication between the sending communication entity and the receiving communication entity; If the verification result is failure, the communication between the receiving communication entity and the sending communication entity is cancelled.

9. The method according to claim 5, characterized in that Before the secure communication, the method further includes: According to the sender identifier corresponding to the sender communication entity, the key management platform obtains the sender private key and public parameters corresponding to the sender communication entity.

10. A two-way identity authentication device, characterized in that: Applied to a receiving communication entity, the device comprises: A parameter receiving module, used to receive a sender identifier, a sender random number, and a sender signature value; wherein the sender identifier is a device code corresponding to a communication entity used as a communication initiator in secure communication, and the sender identifier is used to clarify the location information and type information of the communication entity; A signature value verification module, used to generate a sender identification public key according to a pre-acquired public parameter and the sender identification, and to verify the sender random number and the sender signature value using the sender identification public key; wherein the public parameter is a parameter value obtained in advance from a key management platform to identify a cryptographic algorithm; for multiple communication entities under the management of the same key management platform, the public parameters obtained from the key management platform are the same; A first parameter sending module, configured to generate a receiver timestamp signature value according to a pre-acquired receiver private key if the verification result is successful, and send the receiver timestamp signature value and a receiver identifier corresponding to the receiver communication entity to a sender communication entity; The step of generating a recipient's timestamp signature value based on a pre-acquired recipient's private key includes: Obtain the receiver's timestamp from the public clock; Performing field combination of the receiving party's timestamp and the sending party's random number to generate a timestamp random number; The timestamp random number signature is encrypted using the pre-acquired recipient private key to generate the recipient timestamp signature value.

11. A two-way identity authentication device, characterized in that: Applied to a sending party communication entity, the device comprises: The signature value generation module is used to generate a sender random number when secure communication is required, and encrypt the sender random number with the sender's private key signature acquired in advance to generate a sender signature value; A second parameter sending module, used to send the sender random number, the sender signature value and the sender identifier corresponding to the sender communication entity to the receiver communication entity; wherein the sender identifier is a device code corresponding to the communication entity used as the communication initiator in secure communication, and the sender identifier is used to clarify the location information and type information of the communication entity; A parameter verification module, used to generate a receiver identification public key according to the received receiver identification and pre-acquired public parameters, and verify the received receiver timestamp signature value using the receiver identification public key and the sender random number; wherein the public parameters are parameter values ​​pre-acquired from the key management platform for identifying the cryptographic algorithm; for multiple communication entities under the management of the same key management platform, the public parameters acquired from the key management platform are the same; A communication establishment module, used to establish communication between the sender communication entity and the receiver communication entity according to the verification result; The method of generating the receiving party timestamp signature value by the receiving party communication entity is as follows: Obtain the receiver's timestamp from the public clock; Performing field combination of the receiving party's timestamp and the sending party's random number to generate a timestamp random number; The timestamp random number signature is encrypted using the pre-acquired recipient private key to generate the recipient timestamp signature value.

12. A two-way identity authentication device, characterized in that: The two-way identity authentication device includes: a storage device and one or more processors; The storage device is used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the two-way authentication method as described in any one of claims 1-4 when the two-way authentication device is a receiving communication entity, and implement the two-way authentication method as described in any one of claims 5-9 when the two-way authentication device is a sending communication entity.

13. A storage medium containing computer executable instructions, characterized in that: When the computer executable instructions are executed by a computer processor, they are used to perform the two-way identity authentication method according to any one of claims 1 to 4 and claims 5 to 9.

Images