A multi-target authentication method based on secret sharing

Abstract

The application discloses a multi-target authentication method based on secret sharing. The system applied by the method comprises at least one client and a server, and the client and the server are in communication connection; each client has a unique id, and an id of each client and corresponding secret fragment information mapping relationship table are stored in the server; the method comprises a predefined secret fragment allocation strategy flow and a protocol authentication flow. The application is efficient, safe and capable of multi-target authentication, and can guarantee that a receiver authenticates a sender when data is exchanged each time, and can ensure data confidentiality and authenticity; the multi-target batch authentication processing is performed by referring to the secret sharing mode, and the server overhead is reduced to guarantee communication efficiency.

Description

Technical fields:

[0001] This invention relates to the field of marine communication security, such as marine equipment authentication, and more specifically, to a multi-target authentication method based on secret sharing. Background technology:

[0002] Communication networks in the open marine environment primarily serve to ensure communication between fixed offshore platforms and shore-based systems. Since offshore platforms are far from land, only wireless and satellite communication can guarantee communication. The open channels used in wireless networks allow attackers to exploit this vulnerability to launch various security attacks, such as eavesdropping, replay attacks, and data tampering. Furthermore, marine networks are open, and external factors can cause unnecessary difficulties in the exploration and collection of marine data. Therefore, to ensure data confidentiality, the reliability and authenticity of data sources, and the correctness of data content, both encrypted data transmission and data verification are necessary. Summary of the Invention:

[0003] To address the aforementioned problems, this invention provides a multi-target authentication method based on secret sharing. The system using this method includes at least one client and one server, which are communicatively connected. Each client has a unique ID, and the server stores a mapping table of each client's ID and corresponding secret fragment information. The method includes a predefined secret fragment allocation strategy process and a protocol authentication process.

[0004] In the predefined secret fragment allocation strategy process, the number of sub-secrets, the number of fragments used to calculate the recovered secret, and the number of idle secret fragments are defined; the secret is a parameter generated by a third trusted institution.

[0005] The protocol authentication process includes initialization steps, client registration steps, authentication steps between the client and the server, and key calculation steps.

[0006] Furthermore, in the predefined secret fragment allocation strategy process, the value of the number of sub-secret fragments N is specified, and the minimum number of sub-secrets T for restoring the secret S is set. If the current number of clients in the system is D, then the number of allocated sub-secrets is defined as D, the number of fragments used to calculate the restored secret is T-1, and the number of idle sub-secrets is...

[0007] ND-T+1.

[0008] Furthermore, in the initialization step, a polynomial F(x) is constructed based on the number of clients at the time of initialization to hide the secret S and to calculate the sub-secret fragments s. i .

[0009] Furthermore, the initialization step generates sub-secret fragments s.i The generation method is as follows:

[0010] Step 2.1: Find the largest prime number P;

[0011] Step 2.2: Select a secret S, S <P;

[0012] Step 2.3: Determine the minimum number of sub-secrets T needed to recover secret S and the number of holders N of the sub-secret fragments;

[0013] Step 2.4: Randomly select T-1 numbers from a finite field from 1 to P: a1, a2, a3, a4…a T-1 , which are the coefficients of the non-constant terms of the T-1 degree polynomial F(x);

[0014] Step 2.5: Construct the polynomial F(x) = S + a1x + a2x 2 +….+a T-1 x T-1 ;

[0015] Step 2.6: The n holders are denoted as N1, N2, ... N. i …N n N i The sub-secret fragment information assigned is s i ;

[0016] Step 2.7: Destroy the polynomial F(x).

[0017] Furthermore, the client registration process includes sub-steps for generating the master public key and master private key, generating client secret credentials, and generating server secret credentials.

[0018] The calculation method for generating client credentials is as follows:

[0019] M = id||s i

[0020] sk id =H(M)

[0021] H(.) is a collision-resistant one-way hash function, sk id For client-side secret credentials;

[0022] Server secret credential generation:

[0023] sk s =IBE.KeyGen(msk,H(R))

[0024] IBE.KeyGen is a key generation formula in an identity-based encryption algorithm, where H(R) is the server-side identity identifier and msk is the master key.

[0025] Furthermore, the authentication steps between the client and the server are as follows:

[0026] Step 3.1: After collecting the data, the client broadcasts information to request authentication;

[0027] Step 3.2: The client generates signature information and ciphertext:

[0028] α1=H(M||nonce)β1=IBE.Encrypt(mpk,H(R),M)

[0029] M is the message, mpk is the master public key, nonce is the random number, β1 is the ciphertext, and α1 is the signature information;

[0030] Step 3.3: The client transmits data to the server, and the server decrypts it to obtain the plaintext M';

[0031] Step 3.4: The server calculates the signature information using the plaintext obtained in the previous step and compares it with the signature information calculated in step 3.2 to determine whether any changes have occurred during data transmission.

[0032] Step 3.5: Obtain the client ID and corresponding secret fragment through data splitting, and use the remaining sub-secrets s to initialize L We can solve for the secret S' by reverse reasoning;

[0033] Step 3.6: Compare S with S', and query the id and s in M' at this time. i Does the mapping relationship exist in the server? If S and S' are the same, and id and s exist... i The mapping relationship indicates that the client identity of the data source is legitimate; otherwise, the data source will be tested in batches.

[0034] Furthermore, in step 3.5, the secret S' is solved in reverse using the Lagrange interpolation formula.

[0035] Furthermore, the key calculation includes the following process:

[0036] Step 4.1: The server selects a random sub-secret s' from the remaining sub-secrets. i Then calculate:

[0037] g = H(sk) id ||sk s )

[0038] β2 = SKE.Encrypt(sk id ,s′ i )

[0039]

[0040] α2=H(s′ i ||(nonce+1))

[0041] Step 4.2: The server sets β2, α2 is returned to the client, and the server updates the remaining secrets using s. i Replace s' i The remaining sub-secrets and idle sub-secrets are redistributed, and the encryption key K for this data exchange is calculated:

[0042]

[0043] Step 4.3: The client uses its own ID and the secret s at this time. i Calculate sk' id =H(id||s) i ), Decryption calculation

[0044] M1 = SKE.Decrypt(sk′ id ,β2)

[0045] α′2=H(M1||(nonce+1))

[0046] Compare the values ​​of α2 and α'2 for data verification. If they are equal, the transmission is successful. Then, calculate the encryption key.

[0047]

[0048] Step 4.4: The client and server use their session keys to encrypt and transmit data.

[0049] Furthermore, this also includes the equipment expansion process;

[0050] When a new client joins, a sub-secret is randomly allocated from the available sub-secrets and assigned to the new client. The server maintains a list of data to define the sub-secret information s in the distributed clients. i The association attribute between it and its ID.

[0051] Furthermore, it also includes a device retirement process, used to remove the pairing information between the ID of a marine data acquisition device that failed to be authenticated and the corresponding sub-secret from the server.

[0052] The beneficial effects of this invention are as follows:

[0053] This invention addresses the issues of identity authentication and data security by proposing a multi-target authentication and key exchange protocol based on secret sharing for secure communication, thereby mitigating the aforementioned security problems. The invention employs an end-to-end authentication transmission mode. The data acquisition device is responsible for intelligent data collection and encrypted transmission, while the data receiving device is responsible for authentication and, after authentication, establishes a secure channel for data exchange between the two. The invention proposes using a Physically Incompressible Function (PUF) to generate the secret credentials for the data collection device. The protocol's most significant feature is its simultaneous multi-target authentication through secret decryption, saving computational resources and improving communication efficiency. Furthermore, key calculation is performed based on authentication for encrypted data transmission. Moreover, the proposed protocol exhibits asymmetric operation, requiring less computation from the acquisition device when calculating the interaction key.

[0054] This invention provides efficient, secure, and multi-target authentication, ensuring that the receiver authenticates the sender during each data exchange, thus guaranteeing the confidentiality and authenticity of the data. It adopts a secret sharing approach for multi-target batch authentication, reducing server overhead and ensuring efficient communication. Based on the DDH assumption, it enables both parties to ensure the confidentiality of data transmission by calculating the data encryption key under the premise of authentication. Attached image description:

[0055] Figure 1 This is a system model diagram for the application of this method.

[0056] Figure 2 This diagram illustrates the data interaction between the server and client during the registration process.

[0057] Figure 3 This diagram illustrates the data interaction between the server and client during authentication and key calculation. Detailed implementation method:

[0058] The following combination Figure 1-3 The specific embodiments of the present invention will be described in detail. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0059] The design concept of this invention is as follows: Building upon previous identity authentication methods, a multi-target authentication scheme based on secret sharing is proposed to alleviate the aforementioned security problems. This embodiment utilizes the characteristics of secret sharing to divide the secret into multiple sub-secrets, and then dynamically allocates the sub-secrets using a designed sub-secret allocation strategy. In this way, the identity credentials of the data acquisition device (i.e., the client) will change after the last successful authentication. This scheme is based on the principle of secret solving, providing security while ensuring transmission efficiency, and focusing most of the key calculation results on the server. In addition, this embodiment also provides device expansion and device retirement measures to facilitate future replacement, addition, or deletion of devices.

[0060] like Figure 1 As shown, in the system model applied in this invention, the two communicating parties are a marine data acquisition device and a marine data collection server. The marine data acquisition device has a unique identifier associated with it and is capable of executing the encryption algorithms mentioned herein. The marine data collection server is an information collection platform, which can be a shore-based platform or a mobile server platform at sea; the data within it is absolutely trustworthy and secure. In this embodiment, the client refers to the marine data acquisition device, and the server refers to the marine data collection server. Of course, it should be understood that this method can also be applied to non-marine communication network environments; the method is similar, and no further detailed embodiments will be described in this application.

[0061] The secret described in this embodiment is a value smaller than a large prime number P. It is a secure parameter generated by a trusted third-party organization.

[0062] The specific implementation method of this method will be described below.

[0063] This invention includes a predefined sub-secret allocation strategy process and a protocol authentication process. The protocol authentication process comprises four steps: initialization, registration, authentication, and key calculation. Preferably, it also includes a device expansion process and a device retirement process. These will be described separately below.

[0064] (I) The process of predefined sub-secret allocation strategy

[0065] The purpose of this process is to define the number of sub-secrets, the number of fragments used to calculate the recovery secret, and the number of free sub-secrets.

[0066] According to the actual requirements, the size of the number N of sub-secret fragments can be specified, and the number of secrets can be allocated according to the previous requirements. If the current number of clients is D, then the number of allocated sub-secrets is defined as D. When setting the threshold T (the threshold is the minimum number of sub-secrets required to restore the secret S), the remaining sub-secrets can be allocated as follows: The remaining sub-secrets are divided into two parts, namely the number of fragments used to calculate the restored secret and the number of idle sub-secrets. Among them, the number of sub-secrets stored in the server for calculating the restored secret S is defined as T - 1 (setting it to T - 1 can ensure that when the received client data is from a single client, the secret S can still be restored), and the remaining sub-secrets are defined as idle sub-secrets with the number of (N - D - T + 1), which are used for later client expansion and client replacement.

[0067] Through the above settings, the dynamics and randomness of the key used for data encrypted transmission can be effectively ensured.

[0068] (2) Protocol authentication process:

[0069] This process involves the specific data interaction process between the client and the server. It includes the following steps:

[0070] (1) Initialization step

[0071] Assume that the IBE (Identity-Based Encryption) in the communication protocol between the client and the server is an anonymous, secure, and indistinguishable identity encryption scheme, and the SKE (Symmetric key encryption) is a symmetric key encryption scheme that is secure against PCPA (pseudo-randomness against chosen plaintext attacks). According to the number of initialized clients, construct a polynomial F(x) to hide the secret S and calculate the sub-secret f(i).

[0072] The specific method of generating sub-secrets is as follows:

[0073] Step 2.1: Select the largest prime number P.

[0074] Step 2.2: Select a secret S.

[0075] In this embodiment, the largest prime number P should be selected first, and then a secure secret S is randomly selected, as long as S < P is satisfied.

[0076] Step 2.3: Determine the threshold value T and the number N of holders of sub-secrets.

[0077] The method for determining the threshold value T is as follows: First, determine the number of sub-secrets based on the number of initial clients. Then, set up an experiment to restore the secret S based on the number of sub-secrets. As the percentage of the threshold value increases, obtain the percentage of the threshold value that takes the least time to restore the secret S with a fixed number of sub-secrets. This is how the threshold value T is determined.

[0078] With a fixed number of bits in the secret S, compare multiple implementations: 1. With a fixed number of sub-secrets N, observe the time required to restore secret S when the threshold percentages differ. 2. With a fixed threshold, observe the relationship between the number of sub-secrets N and the time required to restore secret S, and then find an optimal number of sub-secrets N based on the initial number of clients.

[0079] Step 2.4: Randomly select T-1 numbers from a finite field from 1 to P: a1, a2, a3, a4…a T-1 , which are the coefficients of the non-constant terms of the T-1 degree polynomial F(x).

[0080] Step 2.5: Construct the polynomial F(x) = S + a1x + a2x to hide the secret S. 2 +….+a T-1 x T-1 mod(P);

[0081] S is a secret term placed as a constant term within the polynomial.

[0082] Step 2.6: The n holders are denoted as N1, N2, ... N. i …N n N i The sub-secret information assigned is f(i).

[0083] Step 2.7: Destroy the polynomial F(x).

[0084] Once T related sub-secrets are known, Lagrange interpolation can be used to recover the coefficients of F(x), and finally the secret S can be obtained. If the number of known sub-secrets is less than T, the secret S cannot be obtained.

[0085] (2) Client registration steps

[0086] like Figure 2 As shown. The registration process includes sub-steps for generating the system master public key and master private key, client secret credential generation, and server secret credential generation.

[0087] The system's master public key and master key sub-steps are generated using the `IBE.SETUP` function, a key initialization function in identity-based encryption algorithms. This function obtains `msk` and `mpk` by selecting a relevant parameter `λ`. `mpk` is the master public key used for encrypting information. `msk` is the master key.

[0088] The client secret credential generation sub-step utilizes the client ID and a randomly assigned sub-secret s from the server. i The generation process is as follows:

[0089] Whenever a new client initiates injection, it interacts with the server, and the server randomly selects a sub-secret s from the list of free sub-secrets. i The server transmits the secret to the client and maintains a sub-secret s for managing the current client. i The server will also send its own identity identifier H(R) to the client, and then use the result as the client's secret credential through the following calculation:

[0090] M = id||s i sk id =H(M)

[0091] `id` is the unique identifier for this client. `H(.)` is a collision-resistant one-way hash function, in the form `H:{0,1}`. * →{0,1} l It accepts an input string of arbitrary length and produces a fixed-length output as a "message digest (hash value)". id This serves as a secret credential for the client.

[0092] The server secret credential is generated using the system-generated master key and the server identity identifier, specifically as follows:

[0093] For a given PUF (Physically Unclonable Function, uniquely identified by its inherent physical structure, where any input challenge will produce a unique and unpredictable response), a specific input C belonging to Z (where Z represents a challenge space), called a challenge, will produce an output response R = PUF(C). This response is unique for a given PUF and therefore unclonable. Here, C represents a challenge. This approach uses a challenge / response-based authentication system. Each time authentication occurs, the server sends a different "challenge" string to the client. Upon receiving this "challenge" string, the client program responds accordingly.

[0094] The following calculation result is set as the server's secret credential:

[0095] sk s =IBE.KeyGen(msk,H(R))

[0096] Here, IBE.KeyGen is the key generation formula in the identity-based encryption algorithm. msk is the master key, generated by the system.

[0097] (III) Certification Steps

[0098] This step involves mutual authentication between the client and server when transmitting data, and includes the following sub-steps.

[0099] Step 3.1: After collecting a certain amount of data, the client broadcasts information to request identity authentication;

[0100] Step 3.2: The client generates signature information and ciphertext:

[0101] α1=H(M||nonce)β1=IBE.Encrypt(mpk,H(R),M)

[0102] M is the message, nonce is a random number, and α1 is the signature information. IBE.Encrypt() is the encryption phase formula in the identity-based encryption algorithm, which obtains the ciphertext β1 using mpk, the server's unique identifier H(R), and the message.

[0103] Step 3.3: The client transmits data to the server, and the server decrypts it to obtain the plaintext;

[0104] The client transmits data to the server in the format InfoToServer = (α1, β1, nonce). The server obtains information by receiving signals (the server can receive multiple signals simultaneously). Upon receiving a signal, the server uses its own secret credentials to decrypt the signal data.

[0105] M' = IBE.Decrypt(sk s ,β1)

[0106] IBE.Decrypt is the decryption phase in an identity-based encryption algorithm. M' represents the plaintext obtained after decryption.

[0107] Step 3.4: The server calculates the signature information using the plaintext obtained in the previous step and compares it with the signature information calculated in step 3.2 to determine whether any changes have occurred during data transmission.

[0108] The calculation formula is:

[0109] α'1=H(M'||nonce)

[0110] M' represents the plaintext obtained after decryption using the IBE.Decrypt algorithm. The values ​​of α1 and α'1 are used to verify whether the data has been altered during transmission.

[0111] Step 3.5: Obtain id and s through data splitting. i Utilize the initialization of the remaining sub-secrets s L The secret S' is then solved in reverse, using the Lagrange interpolation formula for reconstruction. The specific formula is as follows:

[0112]

[0113] In the process of generating sub-secret information, N sub-secrets (x, f(i)) are obtained by randomly selecting N unequal x values ​​and substituting them into a polynomial, where y in the formula... i Let f(i) represent the expression. Where x... i and x j Let x represent multiple randomly selected x, t represent the threshold, and p represent the selected large prime number. When x is 0, S = F(0), so we only need to substitute the T sub-secret information (x, f(i)) into the above formula to obtain S.

[0114] Step 3.6: Compare S with S', and query the id and s in M' at this time. i If the corresponding relationship exists in the relevant list maintained by the server, and S and S' are the same and a corresponding relationship exists, it means that the client identity of the data source is legitimate; otherwise, the data source is checked in batches.

[0115] Solving the secret S' is key to multi-target authentication. Once multiple information sources are received, this embodiment uses the secret S' from each source. i Furthermore, this is combined with sub-secrets in the server to achieve the minimum threshold value T for solving secret S (secret S can only be solved if there are at least T sub-secrets in the server used to calculate and restore secret S). In initialization step 2.5, N distinct x values ​​are randomly selected and substituted into the polynomial to obtain N sub-secrets (x, f(i)), of which D sub-secrets are assigned to D clients. When the server receives sub-secret information sent by a client, the server uses the client's sub-secrets and its remaining sub-secrets to form T sets of sub-secret information. Then, the solution is obtained using the Lagrange interpolation formula. Here is an example.

[0116] Example: Suppose there are w = 4 people, and at least t = 3 people are needed to recover the secret. The secret is S = 2, p = 23. Construct F(x) = 2 + 3x + 2x 2 (mod23). Substituting x1=1, x2=2, x3=3, x4=4, we get y1=7, y2=16, y3=6, y4=0. Using these 3 sets, we can recover (1,7)(3,6)(4,0).

[0117] S=F(0)=7*(0-3)*(0-4)*((1-3)*(1-4)) -1 +

[0118] 6*(0-1)*(0-4)*((3-1)(3-4)) -1 +

[0119] 0*(0-1)*(0-3)*((4-1)*(4-3)) -1 mod (23)

[0120] The calculation yields S = 2. Following this method, we can derive a polynomial with N sub-secrets, a threshold of T, and F(X) consisting of T-1 terms.

[0121] Secret sharing involves the server first collecting the client's sub-secret information, then using this sub-secret information to solve for the secret S—this process effectively authenticates the client. Each client is assigned sub-secret information during initialization and uses it to calculate identity credentials. To verify identity, the server only needs to combine certain data. In this way, secret sharing ensures that all participants see random numbers during the calculation process, yet still obtain the desired result. Secret sharing effectively improves verification efficiency and avoids server authentication latency.

[0122] When considering multi-objective verification, if the S' obtained in this solution is different from the secret S, a binary approach is used to detect the data source in batches, and the data that has been successfully verified is returned first.

[0123] The time complexity of single-target verification is O(n), where n is the problem size (n corresponds to the number of clients authenticated each time). O(b) represents performing a single operation on all problems. In this paper, Li Zhong, the time complexity of multi-target verification is... Calculation process: Assuming the list has n elements, after the first binary search, we need to continue... Search among the elements; after the first binary search, it is necessary to continue searching. The search continues among the elements. In the worst case, only one element remains, meaning the search continues... The search is performed on each element, so t is the number of searches, which can be calculated. Get 2 t =n was finally calculated to get In the best-case scenario, it passes on the first try; in the worst-case scenario... It effectively reduces the waiting time when processing multi-target authentication.

[0124] (4) Key calculation

[0125] like Figure 3 As shown, after successful authentication, key calculation is performed.

[0126] Step 4.1: The server selects a random sub-secret s' from the remaining sub-secrets. i Then calculate:

[0127] g = H(sk) id ||sk s )

[0128] β2 = SKE.Encrypt(sk id ,s′ i )

[0129]

[0130] α2=H(s′ i ||(nonce+1))

[0131] SKE.Encrypt() is a PCPA-secure symmetric key encryption phase formula;

[0132] Step 4.2: The server sets β2, α2 is returned to the client, and the server updates the remaining secrets using s. i Replace s' i The remaining sub-secrets and idle sub-secrets are redistributed, and the encryption key K for this data exchange is calculated:

[0133]

[0134] s' i This represents the replacement information, which is then encrypted and transmitted to the client for use in generating new identity credentials during the next authentication. i and s i They both belong to the category of sub-secret information.

[0135] Step 4.3: The client uses its own ID and the secret s at this time. i Calculate sk' id =H(id||s) i ), Decryption calculation

[0136] M1 = SKE.Decrypt(sk′ id ,β2)

[0137] α′2=H(M1||(nonce+1))

[0138] SKE.Decrypt() is a decryption phase formula based on PCPA-secure symmetric keys;

[0139] Compare the values ​​of α2 and α'2 for data verification. If they are equal, the transmission is successful. Then, calculate the encryption key.

[0140]

[0141] Use s' i Replace s i The parameter s used in this calculation of key K i and s' i Each calculation process is different, and the spatial combinations are large enough.

[0142] Step 4.4: After key calculation, a session key is obtained. The client and server can use this session key to encrypt and transmit data. This problem is based on the mathematically difficult problem, the DDH (Decisional Diffie-Hellman Assumption).

[0143] Preferably, this embodiment also includes a process for expanding equipment capacity and a process for decommissioning equipment.

[0144] Equipment expansion process:

[0145] According to the predefined sub-secret allocation strategy, the number of available sub-secrets is (ND-T+1). Whenever a new client joins, a sub-secret is randomly allocated from the available sub-secrets and assigned to the new client. The server maintains a data list to define the sub-secret information s in the distributed clients. i The association attribute between it and its ID.

[0146] Equipment obsolescence process:

[0147] This process is used to remove the pairing information between the ID of a marine data acquisition device that failed to be authenticated and the corresponding sub-secret from the server.

[0148] During authentication, the server decrypts and retrieves the client's data. It then compares this data with the aforementioned associated attributes. A successful match confirms the data's correctness. Finally, authentication is performed by restoring the secret S. After successful authentication, a sub-secret is allocated from the free sub-secret list and passed to the client for calculating the secret credential in the next authentication. The free sub-secret list contains s' i Replace s i The sub-secret information is the sub-secret s obtained during the initialization step of the protocol authentication process. i .

[0149] The replacement of a sub-secret does not change the secret information itself.

[0150] The sub-secret information replaces the sub-secret information s obtained during the device registration phase. iThe replacement rule for sub-secret information is that after a device successfully authenticates, the server randomly selects a sub-secret from the available sub-secrets to replace the currently authenticated device's sub-secret information. If a match fails, the ID and its associated sub-secrets will be discarded (a failed match does not mean abandoning the device, but rather abandoning the pairing relationship, because the device's random fragments will change during the next authentication, and the space for such pairing relationships is large enough for communication between devices). This is to ensure that if a device's information is leaked, it prevents adversaries from using that information to wirelessly inject useless data.

Claims

1. A multi-target authentication method based on secret sharing, characterized by, The method is applied to wireless communication in an open marine environment, and a system to which the method is applied comprises at least one client and a server, which are communicatively connected; each client has a unique id, and the server stores an id of each client and a corresponding secret fragment information mapping relationship table; the method comprises a predefined secret fragment allocation strategy process and a protocol authentication process; In the predefined secret fragment allocation strategy process, a sub-secret share, a number of fragments used to calculate a recovered secret, and a number of idle secret fragments are defined; the secret is a parameter generated by a third trusted authority; The protocol authentication process comprises an initialization step, a client registration step, a step of authentication between the client and the server, and a key calculation step; In the predefined secret fragment allocation strategy process, a value of the number of sub-secret fragments N is specified, a minimum number of sub-secrets T for recovering the secret S is set, if the number of current clients in the system is D, the number of allocated sub-secrets is defined as D, the number of fragments used to calculate the recovered secret is T-1, and the number of idle sub-secrets is N-D-T+1; Generating sub-secret fragments s in the initialization step i The generating method is: Step 2.1: take the maximum prime number P; Step 2.2: select a secret S, S < P; Step 2.3: determine the minimum number of sub-secrets T for recovering the secret S and the number of sub-secret fragment holders N; Step 2.4: Randomly take T-1 numbers in the finite field of 1 to P: a1, a2, a3, a4... aT-1, as the coefficients of the non-constant term of the T-1 degree polynomial F(x). T-1 , as the coefficients of the non-constant term of the T-1 degree polynomial F(x). Step 2.5: Constructing the polynomial F(x) = S + a1x + a2x 2 +….+a T-1 x T-1 ; Step 2.6: n holders are denoted as N1, N2, … Nn i … n , Nn i The sub-secret fragment information allocated to each of the n holders is s i ; Step 2.7: destroy the polynomial F(x); The client registration step comprises a master public key and master key generation sub-step, a client secret credential generation sub-step, and a server secret credential generation sub-step: The calculation method for generating the client credential is: M = id || s i sk id = H(M) H(.) is an anti-collision one-way hash function, sk id is a client secret credential; The server secret credential is generated as follows: sk s = IBE.KeyGen(msk, H(R)) IBE.KeyGen is a key generation stage formula in an identity-based encryption algorithm, H(R) is an identity identifier on the server side, and msk is a master key; The step of authentication between the client and the server is as follows: Step 3.1: the client broadcasts information after collecting data, requesting identity authentication; Step 3.2: the client generates signature information and ciphertext: α1=H(M||nonce) β1=IBE.Encrypt(mpk,H(R),M) M is a message, mpk is a master public key, nonce is a random number, β1 is ciphertext, α1 is signature information, and IBE.Encrypt() is an encryption stage formula in an identity-based encryption algorithm; Step 3.3: the client transmits data to the server, and the server decrypts to obtain plaintext M'; Step 3.4: the server calculates signature information using the plaintext obtained in the previous step, and compares the signature information with the signature information calculated in step 3.2 to determine whether the data transmission process has changed; Step 3.5: Get the client id and the corresponding secret shard by data splitting, use the initialization remaining sub-secret s to solve the secret S' L ' Step 3.6: Compare S with S′, and query the id and s in M′ at this time. i Does the mapping relationship exist in the server? If S and S′ are the same, and there exists an id and s i The mapping relationship indicates that the client identity of the data source is legitimate; otherwise, the data source will be tested in batches.

2. The multi-target authentication method based on secret sharing of claim 1, wherein, In the initialization step, a polynomial F(x) is constructed for hiding the secret S according to the number of clients at the time of initialization and a sub-secret fragment s is calculated i .

3. The multi-target authentication method based on secret sharing as claimed in claim 1, wherein, In step 3.5, the secret S' is solved by using the Lagrange interpolation formula.

4. The multi-target authentication method based on secret sharing of claim 1, wherein, The key calculation comprises the following process: Step 4.1: The server picks a random sub-secret s' among the remaining sub-secrets i and then computes: g = H(sk id ||sk s ) β2 = SKE.Encrypt(sk id , s' i ) a2= H(s' + nonce) i || (nonce + 1)) SKE.Encrypt() is an encryption stage formula of a symmetric key based on PCPA security; Step 4.2: The server returns β2, α2to the client, and updates the remaining secret with s i s' = s i , reassigns the remaining sub-secrets and free sub-secrets, and computes the encryption key K for this data interaction: Step 4.3: Client uses its own id and the secret s at this time i Compute sk' id = H(id || s i ), decrypt computation M1 = SKE.Decrypt(sk', M0, β1, β2) id , β2) α′2=H(M1||(nonce+1)) SKE.Decrypt() is a decryption stage formula of a symmetric key based on PCPA security; The data of α2 and α′2 are compared, and if the data is equal, it indicates that the transmission is correct, and the encryption key is calculated as follows: Step 4.4: Client and server session keys encrypt the data for transmission.

5. The multi-target authentication method based on secret sharing as claimed in claim 1, wherein, Further comprising a device expansion process; When a new client is added, a sub-secret is randomly divided from the idle sub-secret to the new client, and the server will maintain a data list to define the sub-secret information s in the distributed client i The association attribute between the id and the sub-secret 6. The multi-target authentication method based on secret sharing as claimed in claim 1, wherein, Further comprising a device elimination process for removing the pairing information of the id of the marine data acquisition device that fails to authenticate successfully and the sub-secret corresponding to the device from the server.

Images