Attack detection method and device for collaborative cryptographic calculation based on variation factor

Abstract

The present disclosure provides an attack detection method and device for collaborative cryptographic calculation based on a change factor, which can be applied to the cryptographic field. The attack detection method includes: in response to completion of digital signature calculation, message decryption or key exchange, determining the original sub-private key D1′ and the first change factor W1; sending the first change factor W1 to the second communication party; receiving the second change factor W2 from the second communication party; using the first change factor W1 and the second change factor W2 to change the original sub-private key D1′ to obtain the current sub-private key D1; determining a partial public key P1 based on the current sub-private key D1; and in response to failure of digital signature calculation, message decryption or key exchange, sending the partial public key P1 to the second communication party so that the second communication party uses the partial public key P1 for pairing processing, and performing attack detection based on the obtained pairing result.

Description

Technical Field

[0001] The present disclosure relates to the field of cryptography, and more specifically, to an attack detection method and device for collaborative cryptographic calculation based on a variation factor, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] Digital signature, encryption, decryption and key exchange technologies based on public key cryptography have been widely used in electronic businesses in various fields. The private key can be split into multiple sub-private keys and stored in independent devices of multiple parties. In each round of digital signature operation, decryption or key exchange operation, multiple parties can collaborate, that is, multiple sub-private keys can participate in the calculation together.

[0003] In a (t, m) threshold digital signature or decryption or key exchange scheme, the private key can be split into m sub-private keys, each of which is held by m members. Any t of the m members can collaborate to complete the digital signature or decryption or key exchange operation, but less than t members cannot complete it. The sub-private keys can be generated by each party participating in the collaborative computing, or they can be generated by the key generator and sent to each party separately.

[0004] For example, in a two-party collaborative computing scheme, also known as a (2,2) threshold scheme, the private key is stored in the form of two sub-private keys on both sides of the communication. Each digital signature, decryption, or key exchange operation requires the cooperation of both parties to complete the calculation. In the above process, neither party can obtain any information about the sub-private key stored by the other party, nor can they obtain any information about the private key as a whole.

[0005] In the process of realizing the concept disclosed in the present invention, the inventors found that there are at least the following problems in the related technology: due to resource limitations and cost constraints, it is difficult for the communicating parties (especially mobile terminal users) to use dedicated cryptographic equipment to protect sub-private keys, and they are unable to respond promptly to attacks from other parties, thereby failing to ensure the security of private keys. Summary of the invention

[0006] In view of this, the present disclosure provides an attack detection method and device for collaborative cryptographic computing based on a variation factor, an electronic device, a computer-readable storage medium, and a computer program product.

[0007] According to one aspect of the present disclosure, there is provided an attack detection method for collaborative cryptographic calculation based on a variation factor. The attack detection method for collaborative cryptographic calculation based on a variation factor is based on an elliptic curve public key cryptography algorithm and is applied to a first communication party, comprising: in response to completion of digital signature calculation, message decryption or key exchange, determining an original sub-private key D1′ and a first variation factor W1, wherein the original sub-private key D1′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange; sending the first variation factor W1 to a second communication party; receiving a second variation factor W2 from the second communication party; using the first variation factor W1 and the second variation factor W2 to perform variation processing on the original sub-private key D1′ to obtain a current sub-private key D1; determining a partial public key P1 based on the current sub-private key D1; and in response to failure of digital signature calculation, message decryption or key exchange, sending the partial public key P1 to the second communication party so that the second communication party performs pairing processing using the partial public key P1, and performs attack detection based on the obtained pairing result.

[0008] According to an embodiment of the present disclosure, the above-mentioned first change factor W1 and the above-mentioned second change factor W2 are used to change the above-mentioned original sub-private key D1′ to obtain the current sub-private key D1, which includes: calculating V1 according to the above-mentioned first change factor W1, the above-mentioned second change factor W2 and the above-mentioned original sub-private key D1′, wherein V1=(D1′*W1 -1 *W2)mod n, * represents integer multiplication, W1 -1 Represents the inverse element of W1 modulo n; and determines V1 as the above-mentioned current child private key D1.

[0009] According to an embodiment of the present disclosure, the sending of the partial public key P1 to the second communication party so that the second communication party performs pairing processing using the partial public key P1 includes: calculating T1 and P1, wherein T1=D1 -1 mod n,P1=[T1]G,D1 -1 mod n represents the inverse element of D1 mod n, [T1]G represents the T1-multiplied point operation of the base point G of the elliptic curve; and P1 is sent to the above-mentioned second communication party so that the above-mentioned second communication party can perform pairing processing.

[0010] According to an embodiment of the present disclosure, the above-mentioned first change factor W1 and the above-mentioned second change factor W2 are used to change the above-mentioned original sub-private key D1′ to obtain the current sub-private key D1, which includes: calculating U1 according to the above-mentioned first change factor W1, the above-mentioned second change factor W2 and the above-mentioned original sub-private key D1′, wherein U1=(D1′*W1*W2 -1)mod n, * represents integer multiplication, W2 -1 mod n represents the inverse element of W2 mod n; and U1 is determined as the above-mentioned current sub-private key D1.

[0011] According to an embodiment of the present disclosure, the above-mentioned first change factor W1 and the above-mentioned second change factor W2 are used to change the above-mentioned original sub-private key D1′ to obtain the current sub-private key D1, including: calculating S1 according to the above-mentioned first change factor W1, the above-mentioned second change factor W2 and the above-mentioned original sub-private key D1′, wherein S1=(D1′+W1-W2)mod n, modn represents modulo n operation, + represents integer addition operation or elliptic curve point addition operation, - represents integer subtraction operation or elliptic curve point subtraction operation; and determining S1 as the above-mentioned current sub-private key D1.

[0012] According to an embodiment of the present disclosure, the sending of the partial public key P1 to the second communication party so that the second communication party can use the partial public key P1 for pairing processing includes: calculating P1, wherein P1=[D1]G, [D1]G represents the D1 times point operation of the base point G of the elliptic curve; and sending P1 to the second communication party so that the second communication party can perform pairing processing.

[0013] According to another aspect of the present disclosure, a method for detecting attacks on collaborative cryptographic calculations based on a variation factor is provided. The method for detecting attacks on collaborative cryptographic calculations based on a variation factor is based on an elliptic curve public key cryptography algorithm and is applied to a second communication party, comprising: in response to completion of digital signature calculation or message decryption or key exchange, determining an original sub-private key D2′ and a second variation factor W2, wherein the original sub-private key D2′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange; sending the second variation factor W2 to the first communication party; receiving a message from the first communication party; The first change factor W1 of the communication party; using the above-mentioned first change factor W1 and the above-mentioned second change factor W2, the above-mentioned original sub-private key D2′ is changed to obtain the current sub-private key D2; in response to the failure of digital signature calculation or the failure of message decryption or the failure of key exchange, receiving the partial public key P1 from the above-mentioned first communication party; according to the above-mentioned current sub-private key D2 and the above-mentioned partial public key P1, the current public key P′ is determined; the above-mentioned current public key P′ and the original public key P are paired to obtain a pairing result; and in response to the above-mentioned pairing result indicating that the pairing of the above-mentioned current public key P′ and the above-mentioned original public key P fails, it is determined that an attack behavior has been detected.

[0014] According to an embodiment of the present disclosure, the pairing process of the current public key P′ and the original public key P to obtain the pairing result includes: calculating T2 and P′, T2=D2 -1mod n,P'=[T2]P1-G,D2 -1 mod n represents the inverse element of D2 mod n, and [T1]P1 represents the T1-times point operation of the elliptic curve point P1. The current public key P' and the original public key P are paired to obtain the pairing result.

[0015] According to another aspect of the present disclosure, there is provided an attack detection device for collaborative cryptographic calculation based on a variation factor. The attack detection device for collaborative cryptographic calculation based on a variation factor is based on an elliptic curve public key cryptographic algorithm and is applied to a first communication party, comprising: a first determination module, for determining an original sub-private key D1′ and a first variation factor W1 in response to completion of digital signature calculation or message decryption or key exchange, wherein the original sub-private key D1′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange; a first sending module, for sending the first variation factor W1 to a second communication party; communication party; a first receiving module, used to receive a second change factor W2 from a second communication party; a first processing module, used to use the above-mentioned first change factor W1 and the above-mentioned second change factor W2 to perform change processing on the above-mentioned original sub-private key D1′ to obtain a current sub-private key D1; a second determination module, used to determine the partial public key P1 according to the above-mentioned current sub-private key D1; and a second sending module, used to send the above-mentioned partial public key P1 to the above-mentioned second communication party in response to a failure in digital signature calculation or a failure in message decryption or a failure in key exchange, so that the above-mentioned second communication party can use the above-mentioned partial public key P1 for pairing processing and perform attack detection according to the obtained pairing result.

[0016] According to another aspect of the present disclosure, there is provided an attack detection device for collaborative cryptographic calculation based on a variation factor. The attack detection device for collaborative cryptographic calculation based on a variation factor is based on an elliptic curve public key cryptographic algorithm and is applied to a second communication party, comprising: a third determination module, for determining an original sub-private key D2′ and a second variation factor W2 in response to completion of digital signature calculation or message decryption or key exchange, wherein the original sub-private key D2′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange; a third sending module, for sending the second variation factor W2 to a first communication party; and a second receiving module, for receiving the first variation factor W2 from the first communication party. W1; a second processing module, used to use the above-mentioned first change factor W1 and the above-mentioned second change factor W2 to change the above-mentioned original sub-private key D2′ to obtain the current sub-private key D2; a third receiving module, used to receive the partial public key P1 from the above-mentioned first communication party in response to the failure of digital signature calculation or the failure of message decryption or the failure of key exchange; a fourth determination module, used to determine the current public key P′ according to the above-mentioned current sub-private key D2 and the above-mentioned partial public key P1; the third processing module, used to pair the above-mentioned current public key P′ and the above-mentioned original public key P to obtain a pairing result; and a fifth determination module, used to respond to the above-mentioned pairing result indicating that the pairing of the above-mentioned current public key P′ and the above-mentioned original public key P fails, and determine that an attack behavior has been detected.

[0017] According to an embodiment of the present disclosure, in the process of the two communicating parties collaborating to perform digital signature calculation or message decryption, when the digital signature calculation of the previous round is completed or the message decryption is completed, the sub-private keys of the two communicating parties can be changed by the change factor to obtain the current sub-private key. The digital signature operation or message decryption operation of this round is performed using the obtained current sub-private key. In the case of failure of the digital signature calculation or message decryption of the previous round, pairing processing can be performed, and attack detection can be performed based on the obtained pairing results. Through the above-mentioned technical means, the technical problem of the inability to respond to attacks from other parties in a timely manner in the related art is at least partially overcome, thereby ensuring the security of the private key. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0019] Figure 1 A flowchart of an attack detection method for collaborative cryptographic calculation based on a variation factor according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 2A flowchart of an attack detection method for collaborative cryptographic calculation based on a variation factor according to another embodiment of the present disclosure is schematically shown;

[0021] Figure 3 An example schematic diagram of an attack detection process of collaborative cryptographic calculation based on a variation factor according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 4 An example schematic diagram of an attack detection process of collaborative cryptographic calculation based on a variation factor according to another embodiment of the present disclosure is schematically shown;

[0023] Figure 5 An example schematic diagram of an attack detection process of collaborative cryptographic calculation based on a variation factor according to another embodiment of the present disclosure is schematically shown;

[0024] Figure 6 An example schematic diagram of an attack detection process of collaborative cryptographic calculation based on a variation factor according to another embodiment of the present disclosure is schematically shown;

[0025] Figure 7 A block diagram of an attack detection device for collaborative cryptographic calculation based on a variation factor according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 8 A block diagram schematically shows an attack detection device for collaborative cryptographic calculation based on a variation factor according to another embodiment of the present disclosure; and

[0027] Fig. 9 A block diagram of an electronic device suitable for implementing an attack detection method for collaborative cryptographic calculation based on a variation factor according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0028] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0029] In the technical solution disclosed in the present invention, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and do not violate public order and good morals.

[0030] In the technical solution of the present disclosure, the user's authorization or consent is obtained before obtaining or collecting the user's personal information.

[0031] In order to at least partially solve the technical problems existing in the related art, the present disclosure provides an attack detection method and device for collaborative cryptographic calculation based on a change factor. The attack detection method includes: in response to the completion of digital signature calculation or message decryption or key exchange, determining the original sub-private key D1′ and the first change factor W1, wherein the original sub-private key D1′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange; sending the first change factor W1 to the second communication party; receiving the second change factor W2 from the second communication party; using the first change factor W1 and the second change factor W2, changing the original sub-private key D1′ to obtain the current sub-private key D1; determining a partial public key P1 based on the current sub-private key D1; and in response to the failure of digital signature calculation or message decryption, sending the partial public key P1 to the second communication party so that the second communication party uses the partial public key P1 for pairing processing, and performing attack detection based on the obtained pairing result.

[0032] Figure 1 The flowchart of the attack detection method of collaborative cryptographic calculation based on variation factors according to an embodiment of the present disclosure is schematically shown.

[0033] like Figure 1 As shown, the attack detection method for collaborative cryptographic calculation based on variation factors includes operations S110 to S160.

[0034] In operation S110, in response to completion of digital signature calculation or message decryption or key exchange, the original sub-private key D1′ and the first change factor W1 are determined, wherein the original sub-private key D1′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange.

[0035] In operation S120, the first variation factor W1 is sent to the second communication party.

[0036] In operation S130, a second variation factor W2 is received from a second communication party.

[0037] In operation S140, the original sub-private key D1' is changed using the first change factor W1 and the second change factor W2 to obtain the current sub-private key D1.

[0038] In operation S150, a partial public key P1 is determined according to the current child private key D1.

[0039] In operation S160, in response to a failure in digital signature calculation, message decryption, or key exchange, a partial public key P1 is sent to a second communication party so that the second communication party performs pairing processing using the partial public key P1 and performs attack detection based on the obtained pairing result.

[0040] According to an embodiment of the present disclosure, the first communication party and the second communication party may share elliptic curve parameters E(Fq), G and n of an elliptic curve public key cryptographic algorithm (SM2 algorithm), where the elliptic curve E is an elliptic curve defined on a finite field Fq, and G represents a base point of order n on the elliptic curve E. The specific values ​​of each parameter may be set by those skilled in the art according to the SM2 algorithm based on actual needs.

[0041] According to an embodiment of the present disclosure, the change process can be performed when one of the following conditions is met: the calculation of the digital signature of the previous round is completed, the decryption of the message of the previous round is completed, or when the timing of the first preset period ends. The specific value of the first preset period can be set by those skilled in the art according to actual needs. For example, the first preset period can be set to 24 hours, that is, the sub-private key change operation is performed once every 24 hours.

[0042] According to an embodiment of the present disclosure, the pairing process can be performed when one of the following conditions is met: the previous round of digital signature calculation fails, the previous round of message decryption fails, or when the second preset period of time ends. The specific value of the second preset period of time can be set by those skilled in the art according to actual needs. For example, the second preset period of time can be set to 48 hours, that is, the sub-private key pairing detection operation is performed once every 24 hours.

[0043] According to an embodiment of the present disclosure, in the process of the two communicating parties collaborating to perform digital signature calculation or message decryption, when the digital signature calculation of the previous round is completed or the message decryption is completed, the sub-private keys of the two communicating parties can be changed by the change factor to obtain the current sub-private key. The digital signature operation or message decryption operation of this round is performed using the obtained current sub-private key. In the case of failure of the digital signature calculation or message decryption of the previous round, pairing processing can be performed, and attack detection can be performed based on the obtained pairing results. Through the above-mentioned technical means, the technical problem of the inability to respond to attacks from other parties in a timely manner in the related art is at least partially overcome, thereby ensuring the security of the private key.

[0044] Figure 2 The flowchart of the attack detection method of collaborative cryptographic calculation based on variation factors according to another embodiment of the present disclosure is schematically shown.

[0045] like Figure 2 As shown, the attack detection method for collaborative cryptographic calculation based on variation factors includes operations S210 to S280.

[0046] In operation S210, in response to completion of digital signature calculation or message decryption or key exchange, the original sub-private key D2′ and the second change factor W2 are determined, wherein the original sub-private key D2′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange.

[0047] In operation S220, the second variation factor W2 is sent to the first communication party.

[0048] In operation S230, a first variation factor W1 is received from a first communication party.

[0049] In operation S240, the original sub-private key D2' is changed using the first change factor W1 and the second change factor W2 to obtain the current sub-private key D2.

[0050] In operation S250, in response to a digital signature calculation failure or a message decryption failure or a key exchange failure, a partial public key P1 is received from the first communication party.

[0051] In operation S260, a current public key P' is determined based on the current child private key D2 and the partial public key P1.

[0052] In operation S270, a pairing process is performed on the current public key P' and the original public key P to obtain a pairing result.

[0053] In operation S280, in response to the pairing result indicating that the current public key P' and the original public key P fail to pair, it is determined that an attack behavior is detected.

[0054] Reference below Figure 3 to Figure 6 , combined with specific embodiments Figure 1 and Figure 2 The method shown is further explained.

[0055] Figure 3 An example schematic diagram of an attack detection process for collaborative cryptographic computing based on a variation factor according to an embodiment of the present disclosure is schematically shown.

[0056] like Figure 3 As shown, in operation S301, in response to completion of digital signature calculation or message decryption or key exchange, the first communication party may determine the original sub-private key D1′ and the first variation factor W1.

[0057] In operation S302, the first communication party may send the first variation factor W1 to the second communication party.

[0058] In operation S303, in response to completion of the digital signature calculation or completion of the message decryption, the second communication party may determine the original sub-private key D2' and the second variation factor W2.

[0059] In operation S304, the second communication party may send the second variation factor W2 to the first communication party.

[0060] In operation S305 , the first communication party may receive a second variation factor W2 from the second communication party.

[0061] In operation S306 , the second communication party may receive the first variation factor W1 from the first communication party.

[0062] In operation S307, the first communication party may use the first change factor W1 and the second change factor W2 to change the original sub-private key D1' to obtain the current sub-private key D1.

[0063] In operation S308, the second communication party may use the first change factor W1 and the second change factor W2 to change the original sub-private key D2' to obtain the current sub-private key D2.

[0064] In operation S309 , the first communication party may determine the partial public key P1 according to the current sub-private key D1 .

[0065] In operation S310, in response to a failure in digital signature calculation or message decryption or key exchange, the first communication party may send a partial public key P1 to the second communication party so that the second communication party may perform pairing processing using the partial public key P1 and perform attack detection based on the obtained pairing result.

[0066] In operation S311 , the second communication party may receive a partial public key P1 from the first communication party.

[0067] In operation S312, the second communication party may determine the current public key P′ according to the current sub-private key D2 and the partial public key P1.

[0068] In operation S313, the second communication party may perform pairing processing on the current public key P′ and the original public key P to obtain a pairing result.

[0069] In operation S314, in response to the pairing result indicating that the current public key P′ and the original public key P fail to pair, the second communication party may determine that an attack behavior is detected.

[0070] According to an embodiment of the present disclosure, after an attacker steals a sub-private key, if both parties of a collaborative computing process perform a sub-private key change operation, the sub-private keys of both parties of the collaborative computing process will be changed, making it impossible for the attacker to use the sub-private key to collaborate with the other party to complete a digital signature or decryption operation.

[0071] According to an embodiment of the present disclosure, if after an attacker steals a sub-private key, the two parties to the collaborative computing do not perform a sub-private key change operation, the attacker will collaborate with the other party to perform a digital signature or decryption operation, and can only collaborate with the other party to complete a small number of digital signatures or decryption operations, because the subsequent collaborative digital signature or decryption operations participated by the party whose sub-private key was stolen will fail. The two parties to the collaborative computing will perform a sub-private key pairing detection operation, and if it is detected that the sub-private keys of both parties are not paired, it can be determined that an attack has been detected.

[0072] According to the embodiments of the present disclosure, through the above technical means, even if an attacker steals the sub-private key of one party, he cannot impersonate the party for a long time to communicate with the other party to perform digital signature or message decryption. The changed current sub-private key is determined by the original sub-private key and the change factor, so sending the change factor between the first communication party and the second communication party will not disclose the changed current sub-private key and the original sub-private key. In the above process, neither of the communicating parties can obtain any information about the sub-private key stored by the other party, nor can they obtain any information about the private key as a whole, thereby ensuring the security of the private key.

[0073] Figure 4 An example schematic diagram of an attack detection process for collaborative cryptographic computing based on a variation factor according to another embodiment of the present disclosure is schematically shown.

[0074] According to an embodiment of the present disclosure, in this case, the private key d, the original sub-private key D1′ of the first communication party, and the original sub-private key D2′ of the second communication party satisfy (d+1) -1 =(D1′*D2′)mod n.

[0075] According to an embodiment of the present disclosure, operation S140 may include the following operations.

[0076] According to the first change factor W1, the second change factor W2 and the original child private key D1′, V1 is calculated, V1=(D1′*W1 -1 *W2)mod n, * represents integer multiplication, W1 -1 Denotes the inverse of W1 modulo n. Determine V1 as the current child private key D1.

[0077] According to an embodiment of the present disclosure, operation S160 may include the following operations.

[0078] Calculate T1 and P1, T1 = D1 -1 mod n,P1=[T1]G,D1 -1 mod n represents the inverse element of D1 modulo n, [T1]G represents the T1-fold point operation of the base point G of the elliptic curve; and

[0079] P1 is sent to the second communication party so that the second communication party can perform pairing processing.

[0080] According to an embodiment of the present disclosure, operation S240 may include the following operations.

[0081] According to the first change factor W1, the second change factor W2 and the original child private key D2′, V2 is calculated, V2=(D2′*W1*W2 -1 )mod n, * represents integer multiplication, W2 -1 mod n represents the inverse of W2 mod n. V2 is determined as the current sub-private key D2;

[0082] According to an embodiment of the present disclosure, operation S270 may include the following operations.

[0083] Calculate T2 and P', T2 = D2 -1 mod n,P'=[T2]P1-G,D2 -1 mod n represents the inverse element of D2 mod n, and [T1]P1 represents the T1-time point operation of the elliptic curve point P1. P' and the public key P are paired to obtain a pairing result.

[0084] like Figure 4 As shown, in operation S401, in response to completion of digital signature calculation or message decryption or key exchange, the first communication party may determine the original sub-private key D1′ and the first variation factor W1.

[0085] In operation S402, the first communication party may send the first variation factor W1 to the second communication party.

[0086] In operation S403, in response to completion of digital signature calculation or message decryption or key exchange, the second communication party may determine the original sub-private key D2' and the second variation factor W2.

[0087] In operation S404, the second communication party may send the second change factor W2 to the first communication party.

[0088] In operation S405 , the first communication party may receive a second variation factor W2 from the second communication party.

[0089] In operation S406 , the second communication party may receive the first variation factor W1 from the first communication party.

[0090] In operation S407, the first communication party may calculate V1=(D1′*W1 -1 *W2)mod n, determine V1 as the current child private key D1.

[0091] In operation S408, the second communication party may calculate V2=(D2′*W1*W2-1 )mod n, and determine V2 as the current child private key D2.

[0092] In operation S409, the first communication party may calculate T1=D1 -1 mod n, P1=[T1]G.

[0093] In operation S410, in response to a digital signature calculation failure or a message decryption failure or a key exchange failure, the first communication party may send a partial public key P1 to the second communication party.

[0094] In operation S411, the second communication party may accept the partial public key P1 from the first communication party.

[0095] In operation S412, the second communication party may calculate T2=D2 -1 mod n, P′=[T2]P1-G.

[0096] In operation S413, the second communication party may perform pairing processing on P′ and the public key P to obtain a pairing result.

[0097] According to the embodiment of the present disclosure, the above process can keep the private key of the SM2 elliptic curve public key cryptography algorithm unchanged as a whole, that is, the changed current sub-private keys D1 and D2 still satisfy (d+1) -1 =(D1*D2)mod n.

[0098] Figure 5 An example schematic diagram of an attack detection process for collaborative cryptographic computing based on a variation factor according to another embodiment of the present disclosure is schematically shown.

[0099] According to an embodiment of the present disclosure, in this case, the private key d, the original child private key D1′ of the first communication party, and the original child private key D2′ of the second communication party satisfy d=(D1′*D2′) mod n.

[0100] According to an embodiment of the present disclosure, operation S140 may include the following operations.

[0101] According to the first change factor W1, the second change factor W2 and the original child private key D1′, calculate U1, U1=(D1′*W1*W2 -1 )mod n, * represents integer multiplication, W2 -1 Denotes the inverse of W2 modulo n. Determine U1 as the current child private key D1.

[0102] According to an embodiment of the present disclosure, operation S160 may include the following operations.

[0103] Calculate P1, P1 = [D1] G, [D1] G represents the D1 multiplication of the base point G of the elliptic curve. Send P1 to the second communication party so that the second communication party can perform pairing processing.

[0104] According to an embodiment of the present disclosure, operation S240 may include the following operations.

[0105] According to the first change factor W1, the second change factor W2 and the original child private key D2′, calculate U2, U2=(D2′*W1 -1 *W2)mod n, * represents integer multiplication, W1 -1 Denotes the inverse of W1 modulo n. Determine U2 as the current child private key D2.

[0106] According to an embodiment of the present disclosure, operation S270 may include the following operations.

[0107] Calculate P', P' = [D2] P1, [D2] P1 represents the D2-times point operation of the elliptic curve point P1. Pair P' and the public key P to obtain a pairing result.

[0108] like Figure 5 As shown, in operation S501, in response to completion of digital signature calculation or message decryption or key exchange, the first communication party may determine the original sub-private key D1′ and the first variation factor W1.

[0109] In operation S502, the first communication party may send the first variation factor W1 to the second communication party.

[0110] In operation S503, in response to completion of digital signature calculation or message decryption or key exchange, the second communication party may determine the original sub-private key D2' and the second variation factor W2.

[0111] In operation S504, the second communication party may send the second change factor W2 to the first communication party.

[0112] In operation S505 , the first communication party may receive a second variation factor W2 from the second communication party.

[0113] In operation S506 , the second communication party may receive the first variation factor W1 from the first communication party.

[0114] In operation S507, the first communication party may calculate U1=(D1′*W1*W2 -1 )mod n determines U1 as the current child private key D1.

[0115] In operation S508, the second communication party may calculate U2=(D2′*W1 -1*W2)mod n, determine U2 as the current child private key D2.

[0116] In operation S509, the first communicating party may calculate P1=[D1]G.

[0117] In operation S510, in response to a digital signature calculation failure or a message decryption failure or a key exchange failure, the first communication party may send a partial public key P1 to the second communication party.

[0118] In operation S511, the second communication party may accept the partial public key P1 from the first communication party.

[0119] In operation S512, the second communicating party may calculate P′=[D2]P1.

[0120] In operation S513, the second communication party may perform pairing processing on P′ and the public key P to obtain a pairing result.

[0121] According to an embodiment of the present disclosure, the above process can keep the private key of the SM2 elliptic curve public key cryptography algorithm unchanged as a whole, that is, the changed current sub-private keys D1 and D2 still satisfy d=(D1*D2)mod n.

[0122] Figure 6 An example schematic diagram of an attack detection process for collaborative cryptographic computing based on a variation factor according to another embodiment of the present disclosure is schematically shown.

[0123] According to an embodiment of the present disclosure, in this case, the private key d, the original sub-private key D1′ of the first communication party, and the original sub-private key D2′ of the second communication party satisfy (d+1) -1 =(D1′+D2′)mod n.

[0124] According to an embodiment of the present disclosure, operation S140 may include the following operations.

[0125] According to the first change factor W1, the second change factor W2 and the original child private key D1′, S1 is calculated, S1=(D1′+W1-W2)mod n, mod n represents modulo n operation, + represents integer addition operation or elliptic curve point addition operation, - represents integer subtraction operation or elliptic curve point subtraction operation. S1 is determined as the current child private key D1.

[0126] According to an embodiment of the present disclosure, operation S160 may include the following operations.

[0127] Calculate P1, P1 = [D1] G, [D1] G represents the D1 multiplication of the base point G of the elliptic curve. Send P1 to the second communication party so that the second communication party can perform pairing processing.

[0128] According to an embodiment of the present disclosure, operation S240 may include the following operations.

[0129] According to the first change factor W1, the second change factor W2 and the original child private key D2′, S2 is calculated, S2 = (D2′-W1+W2) mod n, mod n represents modulo n operation, + represents integer addition operation or elliptic curve point addition operation, - represents integer subtraction operation or elliptic curve point subtraction operation. S2 is determined as the current child private key D2;

[0130] According to an embodiment of the present disclosure, operation S270 may include the following operations.

[0131] Calculate P', P' = [D2]G + P1, [D2]G represents the D2-times point operation of the base point G of the elliptic curve. P' and the public key P are paired to obtain a pairing result.

[0132] like Figure 6 As shown, in operation S601, in response to completion of digital signature calculation or message decryption or key exchange, the first communication party may determine the original sub-private key D1′ and the first variation factor W1.

[0133] In operation S602, the first communication party may send the first variation factor W1 to the second communication party.

[0134] In operation S603, in response to completion of digital signature calculation or message decryption or key exchange, the second communication party may determine the original sub-private key D2' and the second variation factor W2.

[0135] In operation S604, the second communication party may send the second change factor W2 to the first communication party.

[0136] In operation S605 , the first communication party may receive a second variation factor W2 from the second communication party.

[0137] In operation S606 , the second communication party may receive the first variation factor W1 from the first communication party.

[0138] In operation S607, the first communication party may calculate S1=(D1′+W1−W2) mod n and determine S1 as the current child private key D1.

[0139] In operation S608, the second communication party may calculate S2=(D2′-W1+W2) mod n and determine U2 as the current child private key D2.

[0140] In operation S609, the first communicating party may calculate P1=[D1]G.

[0141] In operation S610, in response to a digital signature calculation failure or a message decryption failure or a key exchange failure, the first communication party may send a partial public key P1 to the second communication party.

[0142] In operation S611, the second communication party may accept the partial public key P1 from the first communication party.

[0143] In operation S612, the second communicating party may calculate P′=[D2]G+P1.

[0144] In operation S613, the second communication party may perform pairing processing on P′ and the public key P to obtain a pairing result.

[0145] According to the embodiment of the present disclosure, the above process can keep the private key of the SM2 elliptic curve public key cryptography algorithm unchanged as a whole, that is, the changed current sub-private keys D1 and D2 still satisfy (d+1) -1 =(D1+D2)mod n.

[0146] Figure 7 A block diagram of an attack detection device for collaborative cryptographic calculation based on a variation factor according to an embodiment of the present disclosure is schematically shown.

[0147] like Figure 7 As shown, the attack detection device 700 for collaborative cryptographic calculation based on variation factors includes a first determination module 710 , a first sending module 720 , a first receiving module 730 , a first processing module 740 , a second determination module 750 and a second sending module 760 .

[0148] The first determination module 710 is used to determine the original sub-private key D1′ and the first change factor W1 in response to completion of digital signature calculation or message decryption or key exchange, wherein the original sub-private key D1′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange.

[0149] The first sending module 720 is configured to send the first change factor W1 to the second communication party.

[0150] The first receiving module 730 is configured to receive a second variation factor W2 from a second communication party.

[0151] The first processing module 740 is used to perform a change process on the original sub-private key D1′ by using the first change factor W1 and the second change factor W2 to obtain the current sub-private key D1.

[0152] The second determination module 750 is used to determine the partial public key P1 according to the current sub-private key D1.

[0153] The second sending module 760 is used to send the partial public key P1 to the second communication party in response to the failure of digital signature calculation, message decryption failure or key exchange failure, so that the second communication party can use the partial public key P1 for pairing processing and perform attack detection according to the obtained pairing result.

[0154] According to an embodiment of the present disclosure, the first processing module 740 includes a first calculating unit and a first determining unit.

[0155] The first calculation unit is used to calculate V1 according to the first change factor W1, the second change factor W2 and the original sub-private key D1′, where V1=(D1′*W1 -1 *W2)mod n, * represents integer multiplication, W1 -1 represents the inverse element of W1 modulo n.

[0156] The first determining unit is used to determine V1 as the current sub-private key D1.

[0157] According to an embodiment of the present disclosure, the second sending module 760 includes a second calculating unit and a first sending unit.

[0158] The second calculation unit is used to calculate T1 and P1, where T1 = D1 -1 mod n,P1=[T1]G,D1 -1 mod n represents the inverse element of D1 modulo n, and [T1]G represents the T1-multiplied point operation of the base point G of the elliptic curve.

[0159] The first sending unit is used to send P1 to the second communication party so that the second communication party can perform pairing processing.

[0160] According to an embodiment of the present disclosure, the first processing module 740 includes a third calculating unit and a second determining unit.

[0161] The third calculation unit is used to calculate U1 according to the first change factor W1, the second change factor W2 and the original sub-private key D1′, wherein U1=(D1′*W1*W2 -1 ,) mod n* represents integer multiplication, W2 -1 mod n represents the inverse element of W2 modulo n.

[0162] The second determining unit is used to determine U1 as the current sub-private key D1.

[0163] According to an embodiment of the present disclosure, the second sending module 760 includes a fourth calculating unit and a second sending unit.

[0164] The fourth calculation unit is used to calculate P1, wherein P1=[D1]G, and [D1]G represents the D1-multiplied point operation of the base point G of the elliptic curve.

[0165] The second sending unit is used to send P1 to the second communication party so that the second communication party can perform pairing processing.

[0166] According to an embodiment of the present disclosure, the first processing module 740 includes a fifth calculating unit and a third determining unit.

[0167] The fifth computing unit is used to calculate S1 according to the first change factor W1, the second change factor W2 and the original sub-private key D1′, wherein S1=(D1′+W1-W2)mod n, mod n represents modulo n operation, + represents integer addition operation or elliptic curve point addition operation, and - represents integer subtraction operation or elliptic curve point subtraction operation.

[0168] The third determining unit is used to determine S1 as the current sub-private key D1.

[0169] According to an embodiment of the present disclosure, the second sending module 760 includes a sixth calculating unit and a second sending unit.

[0170] The sixth calculation unit is used to calculate P1, wherein P1=[D1]G, and [D1]G represents the D1-multiplied point operation of the base point G of the elliptic curve.

[0171] The second sending unit is used to send P1 to the second communication party so that the second communication party can perform pairing processing.

[0172] Figure 8 A block diagram of an attack detection device for collaborative cryptographic computation based on a variation factor according to another embodiment of the present disclosure is schematically shown.

[0173] like Figure 8 As shown, the attack detection device 800 for collaborative cryptographic calculation based on variation factor includes a third determination module 810, a third sending module 820, a second receiving module 830, a second processing module 840, a third receiving module 850, a fourth determination module 860, a third processing module 870 and a fifth determination module 880.

[0174] The third determination module 810 is used to determine the original sub-private key D2′ and the second change factor W2 in response to completion of digital signature calculation or message decryption or key exchange, wherein the original sub-private key D2′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange.

[0175] The third sending module 820 is configured to send the second change factor W2 to the first communication party.

[0176] The second receiving module 830 is configured to receive a first variation factor W1 from a first communication party.

[0177] The second processing module 840 is used to perform a change process on the original sub-private key D2′ by using the first change factor W1 and the second change factor W2 to obtain the current sub-private key D2.

[0178] The third receiving module 850 is configured to receive a partial public key P1 from the first communication party in response to a failure in digital signature calculation, a failure in message decryption, or a failure in key exchange.

[0179] A fourth determination module 860 is used to determine a current public key P′ according to the current sub-private key D2 and the partial public key P1;

[0180] The third processing module 870 is used to perform pairing processing on the current public key P' and the original public key P to obtain a pairing result.

[0181] The fifth determination module 880 is configured to determine that an attack behavior is detected in response to the pairing result indicating that the pairing of the current public key P′ and the original public key P fails.

[0182] According to an embodiment of the present disclosure, the second processing module 840 includes a seventh calculating unit and a fourth determining unit.

[0183] The seventh calculation unit is used to calculate V2 according to the first change factor W1, the second change factor W2 and the original child private key D2′, wherein V2=(D2′*W1*W2 -1 )mod n, * represents integer multiplication, W2 -1 mod n represents the inverse element of W2 modulo n.

[0184] The fourth determining unit is used to determine V2 as the current sub-private key D2.

[0185] According to an embodiment of the present disclosure, the third processing module 870 is used to perform pairing processing on the current public key P′ and the original public key P to obtain a pairing result, including an eighth calculation unit and a first pairing processing unit.

[0186] The eighth calculation unit is used to calculate T2 and P', where T2 = D2 -1 mod n,P′=[T2]P1-G,D2 -1 modn represents the inverse element of D2 modulo n, and [T1]P1 represents the T1-fold point operation of the elliptic curve point P1.

[0187] The first pairing processing unit is used to perform pairing processing on P′ and the public key P to obtain a pairing result.

[0188] According to an embodiment of the present disclosure, the second processing module 840 includes a ninth calculating unit and a fifth determining unit.

[0189] The ninth calculation unit is used to calculate U2 according to the first change factor W1, the second change factor W2 and the original child private key D2′, wherein U2=(D2′*W1 -1 *W2)mod n, * represents integer multiplication, W1 -1 represents the inverse element of W1 modulo n.

[0190] The fifth determining unit is used to determine U2 as the current sub-private key D2.

[0191] According to an embodiment of the present disclosure, the third processing module 870 includes a tenth calculation unit and a second pairing processing unit.

[0192] The tenth calculation unit is used to calculate P′, where P′=[D2]P1, and [D2]P1 represents the D2-times point operation of the elliptic curve point P1.

[0193] The second pairing processing unit is used to perform pairing processing on P′ and the public key P to obtain a pairing result.

[0194] According to an embodiment of the present disclosure, the second processing module 840 includes an eleventh calculating unit and a sixth determining unit.

[0195] The eleventh calculation unit is used to calculate S2 according to the first change factor W1, the second change factor W2 and the original sub-private key D2′, wherein S2=(D2′-W1+W2)mod n, mod n represents modulo n operation, + represents integer addition operation or elliptic curve point addition operation, and - represents integer subtraction operation or elliptic curve point subtraction operation.

[0196] The sixth determining unit is used to determine S2 as the current sub-private key D2.

[0197] According to an embodiment of the present disclosure, the third processing module 870 includes a twelfth calculation unit and a third pairing processing unit.

[0198] a twelfth calculation unit, configured to calculate P′, wherein P′=[D2]G+P1, and [D2]G represents a D2-times point operation of a base point G of an elliptic curve; and

[0199] The third pairing processing unit is used to perform pairing processing on P′ and the public key P to obtain a pairing result.

[0200] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0201] For example, any multiple of the first determination module 710, the first sending module 720, the first receiving module 730, the first processing module 740, the second determination module 750, the second sending module 760, the third determination module 810, the third sending module 820, the second receiving module 830, the second processing module 840, the third receiving module 850, the fourth determination module 860, the third processing module 870, and the fifth determination module 880 can be combined in one module / unit / subunit for implementation, or any one of the modules / units / subunits can be split into multiple modules / units / subunits. Alternatively, at least part of the functions of one or more of these modules / units / subunits can be combined with at least part of the functions of other modules / units / subunits and implemented in one module / unit / subunit. According to an embodiment of the present disclosure, at least one of the first determination module 710, the first sending module 720, the first receiving module 730, the first processing module 740, the second determination module 750, the second sending module 760, the third determination module 810, the third sending module 820, the second receiving module 830, the second processing module 840, the third receiving module 850, the fourth determination module 860, the third processing module 870 and the fifth determination module 880 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or may be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or may be implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the first determination module 710, the first sending module 720, the first receiving module 730, the first processing module 740, the second determination module 750, the second sending module 760, the third determination module 810, the third sending module 820, the second receiving module 830, the second processing module 840, the third receiving module 850, the fourth determination module 860, the third processing module 870 and the fifth determination module 880 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is executed.

[0202] It should be noted that the attack detection device part in the embodiment of the present disclosure corresponds to the attack detection method part in the embodiment of the present disclosure. The description of the attack detection device part specifically refers to the attack detection method part, which will not be repeated here.

[0203] Fig. 9 A block diagram of an electronic device suitable for implementing an attack detection method for collaborative cryptographic calculation based on a variation factor according to an embodiment of the present disclosure is schematically shown. Fig. 9The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0204] like Fig. 9 As shown, the computer electronic device 800 according to the embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 902 or the program loaded from the storage part 909 to the random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present disclosure.

[0205] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0206] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0207] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0208] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0209] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0210] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 902 and / or the RAM 903 described above and / or one or more memories other than the ROM 902 and the RAM 903 .

[0211] An embodiment of the present disclosure also includes a computer program product, which includes a computer program, which contains program code for executing the method provided by the embodiment of the present disclosure. When the computer program product is run on an electronic device, the program code is used to enable the electronic device to implement the attack detection method for collaborative cryptographic calculation based on variation factors provided by the embodiment of the present disclosure.

[0212] When the computer program is executed by the processor 901, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0213] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0214] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0215] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions. It can be understood by those skilled in the art that the features recorded in the various embodiments and / or claims of the present disclosure can be combined and / or combined in a variety of ways, even if such a combination or combination is not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0216] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A collaborative cryptographic attack detection method based on a variation factor, the collaborative attack detection method based on a variation factor based on an elliptic curve public key cryptographic algorithm, applied to a first communication party, comprising: In response to completion of digital signature calculation or message decryption or key exchange, determining an original sub-private key D1′ and a first change factor W1, wherein the original sub-private key D1′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange; Sending the first change factor W1 to the second communication party; receiving a second variation factor W2 from a second communication party; Using the first change factor W1 and the second change factor W2, the original sub-private key D1′ is changed to obtain the current sub-private key D1; Determine a partial public key P1 according to the current sub-private key D1; and In response to a failure in digital signature calculation, a failure in message decryption, or a failure in key exchange, sending the partial public key P1 to the second communication party so that the second communication party performs pairing processing using the partial public key P1 and performs attack detection according to the obtained pairing result; Among them, the second communication party uses the partial public key P1 for pairing processing, and performs attack detection based on the obtained pairing result, including: determining the current public key P′ according to the current sub-private key D2 and the partial public key P1; pairing the current public key P′ with the original public key P to obtain a pairing result; and, in response to the pairing result indicating that the pairing of the current public key P′ and the original public key P fails, determining that an attack behavior has been detected.

2. The method according to claim 1, wherein: The using of the first change factor W1 and the second change factor W2 to change the original sub-private key D1′ to obtain the current sub-private key D1 includes: According to the first change factor W1, the second change factor W2 and the original sub-private key D1′, V1 is calculated, where V1=(D1′*W1 -1 *W2)mod n, * represents integer multiplication, W1 -1 represents the inverse element of W1 modulo n; and V1 is determined as the current child private key D1.

3. The method according to claim 1, wherein: The using of the first change factor W1 and the second change factor W2 to change the original sub-private key D1′ to obtain the current sub-private key D1 includes: According to the first change factor W1, the second change factor W2 and the original sub-private key D1′, U1 is calculated, where U1=(D1′*W1*W2 -1 )mod n* represents integer multiplication, W2 -1 mod n represents the inverse element of W2 modulo n; and Determine U1 as the current child private key D1.

4. The method according to claim 1, wherein: The using of the first change factor W1 and the second change factor W2 to change the original sub-private key D1′ to obtain the current sub-private key D1 includes: Calculate S1 according to the first change factor W1, the second change factor W2 and the original sub-private key D1′, where S1=(D1′+W1-W2)mod n, mod n represents a modulo n operation, + represents an integer addition operation or an elliptic curve point addition operation, and - represents an integer subtraction operation or an elliptic curve point subtraction operation; and S1 is determined as the current child private key D1.

5. The method according to claim 2, wherein: The sending the partial public key P1 to the second communication party so that the second communication party uses the partial public key P1 for pairing processing includes: Calculate T1 and P1, where T1 = D1 -1 mod n,P1=[T1]G,D1 -1 mod n represents the inverse element of D1 modulo n, [T1]G represents the T1-fold point operation of the base point G of the elliptic curve; and P1 is sent to the second communication party so that the second communication party can perform pairing processing.

6. The method according to claim 3 or 4, wherein: The sending the partial public key P1 to the second communication party so that the second communication party performs pairing processing using the partial public key P1 includes: Calculate P1, where P1=[D1]G, [D1]G represents the D1-multiplication of the base point G of the elliptic curve; and P1 is sent to the second communication party so that the second communication party can perform pairing processing.

7. A collaborative cryptographic attack detection method based on a variation factor, the collaborative attack detection method based on a variation factor being based on an elliptic curve public key cryptographic algorithm and applied to a second communication party, comprising: In response to completion of digital signature calculation or message decryption or key exchange, determining an original sub-private key D2′ and a second variation factor W2, wherein the original sub-private key D2′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange; Sending the second change factor W2 to the first communication party; receiving a first variation factor W1 from a first communication party; Using the first change factor W1 and the second change factor W2, the original sub-private key D2′ is changed to obtain the current sub-private key D2; In response to a failure in digital signature calculation or a failure in message decryption or a failure in key exchange, receiving a partial public key P1 from the first communication party; Determine the current public key P′ according to the current sub-private key D2 and the partial public key P1; Pairing the current public key P' and the original public key P to obtain a pairing result; and In response to the pairing result indicating that the pairing of the current public key P′ and the original public key P fails, it is determined that an attack behavior is detected.

8. The method according to claim 7, wherein: The pairing process of the current public key P′ and the original public key P to obtain the pairing result includes: Calculate T2 and P', T2 = D2 -1 mod n,P'=[T2]P1-G,D2 -1 mod n represents the inverse element of D2 mod n, and [T1]P1 represents the T1-multiplied point operation of the elliptic curve point P1; the current public key P' and the original public key P are paired to obtain the pairing result.

9. A collaborative attack detection device based on a variation factor, the collaborative attack detection device based on a variation factor is based on an elliptic curve public key cryptography algorithm, applied to a first communication party, comprising: A first determination module, configured to determine an original sub-private key D1′ and a first variation factor W1 in response to completion of digital signature calculation or message decryption or key exchange, wherein the original sub-private key D1′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange; A first sending module, used for sending the first change factor W1 to a second communication party; a first receiving module, used for receiving a second change factor W2 from the second communication party; A first processing module, configured to perform a change process on the original sub-private key D1′ by using the first change factor W1 and the second change factor W2 to obtain a current sub-private key D1; A second determination module is configured to determine a partial public key P1 according to the current sub-private key D1; and A second sending module is used to send the partial public key P1 to the second communication party in response to a failure in digital signature calculation, a failure in message decryption, or a failure in key exchange, so that the second communication party uses the partial public key P1 for pairing processing and performs attack detection according to the obtained pairing result; Among them, the second communication party uses the partial public key P1 for pairing processing, and performs attack detection based on the obtained pairing result, including: determining the current public key P′ according to the current sub-private key D2 and the partial public key P1; pairing the current public key P′ with the original public key P to obtain a pairing result; and, in response to the pairing result indicating that the pairing of the current public key P′ and the original public key P fails, determining that an attack behavior has been detected.

10. A collaborative attack detection device based on a variation factor, the collaborative attack detection device based on a variation factor is based on an elliptic curve public key cryptography algorithm and is applied to a second communication party, comprising: A third determination module, configured to determine an original sub-private key D2′ and a second variation factor W2 in response to completion of digital signature calculation or message decryption or key exchange, wherein the original sub-private key D2′ is used to perform at least one of the following operations: collaborative digital signature calculation, collaborative message decryption or collaborative key exchange; A third sending module, configured to send the second change factor W2 to the first communication party; A second receiving module, configured to receive a first variation factor W1 from a first communication party; A second processing module, configured to use the first change factor W1 and the second change factor W2 to perform a change process on the original sub-private key D2′ to obtain a current sub-private key D2; A third receiving module, configured to receive a partial public key P1 from the first communication party in response to a failure in digital signature calculation or a failure in message decryption or a failure in key exchange; A fourth determination module, configured to determine a current public key P′ according to the current sub-private key D2 and the partial public key P1; A third processing module is used to perform pairing processing on the current public key P′ and the original public key P to obtain a pairing result; and The fifth determination module is configured to determine that an attack behavior is detected in response to the pairing result indicating that the pairing of the current public key P′ and the original public key P fails.

Images