Authentication method and system under multi-server architecture

Abstract

This application discloses an authentication method and system under a multi-server architecture. When a user registers with a registration server, the registration server generates a temporary identity identifier (TID) for the user. U When the user needs the service provided by the application server, enter the TID on the client. U The authentication user identity information γ0 can be calculated, and the client sends the set M0 containing γ0 to the application server. The application server generates relevant authentication information and sends the authentication information and M0 to the registration server. The registration server completes the identity authentication of the user and the application server. The authentication of the user and the application server is completed on the registration server. Each application server does not need to store any information about the user, which reduces the resource burden of the application server. In addition, the user only needs to register with the registration server to obtain a temporary identity to complete the authentication and key exchange. There is no need to register with each application server in the multi-server architecture, which saves time and cost.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and more specifically, to an authentication method and system under a multi-server architecture. Background Art

[0002] With the development of Internet services and e-commerce technologies, ensuring secure authentication between servers and users is of great significance. Authentication and key exchange schemes between Internet users need to be able to achieve the dual security goals of real identity recognition and session key negotiation.

[0003] Current authentication and key exchange schemes are often designed for a single server. When a user needs to request a service, he or she must first register with the server requesting the service by entering his or her identity and password, and then provide the server with the identity and password entered during registration. This allows the user to authenticate his or her identity and obtain the server's service. However, due to the rapid development of the Internet, there are a large number of servers in the current Internet environment. When users need to communicate with these servers, they must first register with these servers by entering their identity and password. In this way, each server needs to store the identity and password entered by each user during registration in order to complete authentication and key exchange, which can cause a huge resource burden. Summary of the Invention

[0004] In view of this, the present application provides an authentication method and system under a multi-server architecture, which is used to solve the existing authentication method under a multi-server architecture. Each server needs to store the identity identification and password information entered by each user when registering in order to complete the authentication, which will cause a huge resource burden.

[0005] In order to achieve the above objectives, the following solutions are proposed:

[0006] An authentication method in a multi-server architecture, applied to a client, includes:

[0007] Get the temporary identity TID entered by the user U and the application server identity ID corresponding to the application server for which the user requested service S , the TID U The identifier generated by the registration server for the user when the user registers with the registration server;

[0008] Use the preset sampling algorithm to sample from the distribution on the polynomial ring in the MLWE problem to obtain the private key s0 and noise e0;

[0009] Calculate the public key b0 based on s0 and e0 using the MLWE problem;

[0010] Based on the TID U , calculating the authentication user identity information γ0 using b0 and a preset first parameter set;

[0011] Send the set M0 to the application server so that the application server generates relevant authentication information and sends the authentication information and M0 to the registration server, and the registration server authenticates the identity of the user and the application server. The M0 includes the TID U 、The ID S , the b0 and the γ0;

[0012] receiving a set M1 sent by the application server, wherein M1 includes an encrypted set Mes1, wherein Mes1 is an encrypted set contained in a set obtained by decrypting an encrypted set sent by the application server after the registration server authenticates the identity of the user and the identity of the application server;

[0013] Decrypt the Mes1 using a preset decryption algorithm to obtain set N0.

[0014] Based on the N0, it is confirmed whether the identity authentication of the application server is passed. If the N0 includes information indicating that the identity authentication of the application server is passed, it is confirmed that the identity authentication of the application server is passed.

[0015] An authentication method in a multi-server architecture, applied to an application server, includes:

[0016] Receive the set M0 sent by the client, which includes the user temporary identity TID U , Application server identity ID S , public key b0 and authentication user identity information γ0, the TID U The identifier generated by the registration server for the user when the user registers with the registration server;

[0017] When the ID S When identifying itself, the preset sampling algorithm is used to sample from the distribution of the polynomial ring in the MLWE problem to obtain the private key s1 and the noise e1. T , the s1 and the e1 use the MLWE problem to calculate the public key w, the P T The pre-stored public key calculated by the registration server using the MLWE problem when registering with the registration server;

[0018] The preset error coordination mechanism is used to coordinate the w to obtain the intermediate secret k S1 and signal value c1;

[0019] Based on the P T , the k S1 and a preset second parameter set to calculate the authentication application server identity information Auth0;

[0020] Encrypt the set N1 using a preset encryption algorithm to obtain an encrypted set Mes0, where N1 includes Auth0 and c1;

[0021] Send set M2 to the registration server, where M2 includes M0, Mes0 and P S , the P S The public key generated in advance using the MLWE problem;

[0022] When receiving the encrypted set Mes2 sent by the registration server, decrypting Mes2 using a preset decryption algorithm to obtain a set N2, wherein N2 includes the encrypted set Mes1;

[0023] Determining whether N2 further includes information indicating that the user identity authentication has been passed;

[0024] If so, it indicates that the user's identity authentication is successful, and a set M1 is sent to the client, where M1 includes Mes1.

[0025] An authentication method in a multi-server architecture, applied to a registration server, includes:

[0026] Receive the set M2 sent by the application server, which includes the set M0, the encrypted set Mes0 and the public key P S , the M0 includes the user temporary identity TID U , Application server identity ID S , public key b0 and authentication user identity information γ0, the TID U An identifier generated for the user when the user registers;

[0027] Decrypt the Mes0 using a preset decryption algorithm to obtain a set N1, wherein N1 includes the authentication application server identity information Auth0 and the signal value c1;

[0028] Based on the P S and private keys T The public key w′ is calculated using the MLWE problem, and the w′ and c1 are coordinated using the preset error coordination mechanism to obtain the intermediate secret k T1 , the s T A private key is sampled in advance from a distribution on the polynomial ring in the MLWE problem using a preset sampling algorithm;

[0029] Based on the public key PT , the k T1 and the preset second parameter set to calculate the authentication application server identity information Auth0′, the P T The public key generated in advance by using the MLWE problem when registering with the application server;

[0030] If the Auth0′ is equal to the Auth0, based on the TID U , said b0 and a preset first parameter set generate authentication user identity information γ0′;

[0031] If γ0′ is equal to γ0, the set N0 is encrypted using a preset encryption algorithm to obtain an encrypted set Mes1, where N0 includes information indicating that the application server identity authentication has passed;

[0032] Encrypting the set N2 using a preset encryption algorithm to obtain an encrypted set Mes2, wherein N2 includes the information indicating that the user identity authentication is passed and Mes1;

[0033] Send the Mes2 to the application server.

[0034] An authentication system under a multi-server architecture includes: a client, an application server and a registration server, wherein the client, the application server and the registration server respectively implement relevant steps in the authentication method under the multi-server architecture.

[0035] From the above technical solutions, it can be seen that the authentication and key exchange method under the multi-server architecture provided by the embodiment of the present application only requires the user to register with the registration server to obtain the temporary identity identifier TID generated by the registration server for the user. U When users need services provided by the application server, they only need to enter the TID on the client. U The authentication user identity information γ0 can be calculated, and the client sends the set M0 containing γ0 to the application server. The application server generates relevant authentication information and sends the authentication information and M0 to the registration server. The registration server completes the identity authentication of the user and the application server. The authentication of the user and the application server is completed on the registration server. Each application server does not need to store any information about the user, which reduces the resource burden of the application server. In addition, the user only needs to register with the registration server to obtain a temporary identity to complete the authentication and key exchange. There is no need to register with each application server in the multi-server architecture, which saves time and cost.

[0036] Furthermore, since the private and public keys used by the client, application server, and registration server are all obtained based on the MLWE problem, current quantum algorithms cannot recover the private keys used by the client, application server, and registration server through their public keys, making the authentication and key exchange process under the multi-server architecture resistant to quantum computer attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0038] Figure 1 This is a flow chart of an authentication method under a multi-server architecture disclosed in an embodiment of the present application;

[0039] Figure 2 This is a flow chart of another authentication method under a multi-server architecture disclosed in an embodiment of the present application;

[0040] Figure 3 This is a flow chart of another authentication method under a multi-server architecture disclosed in an embodiment of the present application;

[0041] Figure 4 This is a schematic diagram of a specific authentication process under a multi-server architecture disclosed in an embodiment of the present application;

[0042] Figure 5 This is a schematic diagram of the structure of an authentication device under a multi-server architecture disclosed in an embodiment of the present application;

[0043] Figure 6 This is a schematic diagram of the structure of another authentication device under a multi-server architecture disclosed in an embodiment of the present application;

[0044] Figure 7 This is a schematic diagram of the structure of another authentication device under a multi-server architecture disclosed in an embodiment of the present application;

[0045] Figure 8 This is a hardware structure block diagram of an authentication device under a multi-server architecture disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0047] In order to facilitate the description of the authentication method under the multi-server architecture provided by this application, some symbols involved in this article and the definition of the MLWE problem are first introduced.

[0048] In the formula H(m||n), H() is a hash function, and "H(m||n)" means performing a hash operation on m and n. For m←M, if M is a function, "m←M" means assigning the output value of function M to m. If M is a polynomial ring or a distribution on a polynomial ring, then "m←M" means sampling from M to obtain m. M T represents the transpose of M.

[0049] Definition of the MLWE problem: Polynomial Ring Z q [x] is a polynomial with modulus q, and f(x) is an irreducible polynomial x n +1, n is the dimension of the vector, x is the variable of the polynomial, and the polynomial matrix is ​​randomly selected Key noise for Gaussian distribution on , calculate the public key The decision-making MLWE difficulty problem can be viewed as distinguishing between the following two distributions:

[0050] Distribution (A, B), where a random polynomial matrix is ​​selected

[0051] Distribution (A, B), where a random polynomial matrix is ​​selected sampling B=As+e;

[0052] The search MLWE problem is to find s from a given distribution (A, B).

[0053] This application embodiment provides an authentication solution under a multi-server architecture. Figure 1 The method of the multi-server architecture of this application is described from the perspective of the client. Figure 1 As shown, the method may include:

[0054] Step S100: Obtain the temporary identity TID input by the user Uand the application server identity ID corresponding to the application server for which the user requested service S .

[0055] Wherein, the TID U The identifier generated by the registration server for the user when the user registers with the registration server.

[0056] Specifically, the application server is a server that provides services to users in a multi-server architecture. The registration server is a preset trusted server that provides registration and authentication functions for users and multiple application servers in a multi-server architecture. When a user registers with the registration server, the registration server generates a temporary identity identifier (TID) for the user. U When users need services provided by the application server, they only need to enter the TID on the client. U , this embodiment of the application will obtain the TID input by the user U , and obtain the application server identity ID corresponding to the application server that the user requested service S .

[0057] Step S110 : Use a preset sampling algorithm to sample from the distribution on the polynomial ring in the MLWE problem to obtain the private key s0 and the noise e0.

[0058] Specifically, the embodiment of the present application takes into account that the adversary cannot recover the private key and noise sampled from the distribution on the polynomial ring in the MLWE problem. Therefore, a preset sampling algorithm is used to sample from the distribution on the polynomial ring in the MLWE problem to obtain the private key s0 and the noise e0, so as to calculate the public key based on the obtained private key s0 and the noise e0.

[0059] Step S120: Calculate a public key b0 based on s0 and e0 using the MLWE problem.

[0060] Specifically, the public key b0 can be calculated based on the private key s0 and noise e0 generated above by using the calculation method in the MLWE problem. The purpose of introducing noise e0 when calculating the public key is to improve security. Noise plays a key role in the difficulty of the MLWE problem under the quantum computing model. The adversary cannot recover the private key s0 from the public key b0.

[0061] Step S130: Based on the TID U , the b0 and the preset first parameter set are used to calculate the authenticated user identity information γ0.

[0062] Specifically, the embodiment of the present application found that if the registration server is to complete the authentication of the user identity, it is necessary to calculate the information of the authenticated user identity so that the registration server can also calculate the information used to authenticate the user identity based on the relevant information and compare it with the information of the authenticated user identity calculated by the client. If they are equal, it means that the user identity authentication is passed. Therefore, the embodiment of the present application is based on the temporary identity identifier TID entered by the user. U , use the public key b0 calculated by MLWE problem and the preset first parameter set to calculate the authentication user identity information γ0, based on the temporary identity identifier TID U Generating the authentication user identity information γ0 can improve the integrity of the authentication user identity information γ0. Since the public key b0 is generated using the MLWE problem, the authentication user identity information γ0 is generated based on the public key b0 so as to be able to resist the attack of quantum computers. In addition, the authentication user identity information γ0 is also generated based on a preset first parameter set. The first parameter set may include parameters known only to the user and the registration server, so that the registration server can authenticate the identity of the user. The first parameter set may also include other parameters, thereby improving the security and integrity of the generated authentication user identity information γ0.

[0063] Step S140: Send the set M0 to the application server so that the application server generates relevant authentication information and sends the authentication information and M0 to the registration server, and the registration server authenticates the identities of the user and the application server.

[0064] Wherein, the M0 includes the TID U 、The ID S , the b0 and the γ0.

[0065] Specifically, it will include a temporary identity TID U , Application server identity ID S , public key b0 and authentication user identity information γ0 is sent to the application server, and the application server forwards the set M0 to the registration server, which authenticates the user's identity based on the above information contained in the set M0.

[0066] Step S150: Receive the set M1 sent by the application server.

[0067] The M1 includes an encrypted set Mes1, which is an encrypted set contained in a set obtained by decrypting the encrypted set sent by the registration server after the application server authenticates the identity of the user and the identity of the application server.

[0068] Specifically, after the registration server authenticates the identity of the user and the identity of the application server, it will send the encrypted set to the application server. The application server decrypts the encrypted set to obtain the encrypted set Mes1. When the application server decrypts the encrypted set and obtains information indicating that the user identity authentication is successful, it sends the set M1 including the encrypted set Mes1 to the client.

[0069] Step S160: Decrypt the Mes1 using a preset decryption algorithm to obtain a set N0.

[0070] Step S170: confirm whether the identity authentication of the application server is passed based on the N0.

[0071] If N0 includes information indicating that the identity authentication of the application server has been passed, it is confirmed that the identity authentication of the application server has been passed.

[0072] Specifically, the encrypted set Mes1 is the set obtained after encryption by the registration server using a preset encryption algorithm, so it is necessary to use a preset decryption algorithm to decrypt the Mes1 to obtain the set N0, wherein the decryption algorithm corresponds to the encryption algorithm used by the registration server. When the N0 includes information representing that the identity authentication of the application server is passed, it indicates that the identity authentication of the application server is passed.

[0073] In the embodiment of the present application, the user only needs to register with the registration server to obtain the temporary identity identifier TID generated by the registration server for the user. U When users need services provided by the application server, they only need to enter the TID on the client. U The authentication user identity information γ0 can be calculated, and the client sends the set M0 containing γ0 to the application server. The application server generates relevant authentication information and sends the authentication information and M0 to the registration server. The registration server completes the identity authentication of the user and the application server. The authentication of the user and the application server is completed on the registration server. The user only needs to register with the registration server to obtain a temporary identity to complete the authentication and key exchange. There is no need to register with each application server in the multi-server architecture, which saves time and cost.

[0074] Furthermore, since the private key and public key used by the client are both obtained based on the MLWE problem, the current quantum algorithm cannot recover the private key used by the client through the public key used by the client, making the authentication and key exchange process under the multi-server architecture resistant to quantum computer attacks.

[0075] Optionally, after confirming that the identity authentication of the application server has passed, the shared key sk with the application server can be calculated. U, so that the shared key sk can be used later U Communicates with the application server.

[0076] This application embodiment provides an authentication solution under a multi-server architecture. Figure 2 The method of the multi-server architecture of this application is described from the perspective of the application server. Figure 2 As shown, the method may include:

[0077] Step S200: Receive the set M0 sent by the client.

[0078] Among them, the M0 includes the user temporary identity TID U , Application server identity ID S , public key b0 and authentication user identity information γ0, the TID U The identifier generated by the registration server for the user when the user registers with the registration server.

[0079] Step S210: When the ID S When identifying itself, the preset sampling algorithm is used to sample from the distribution of the polynomial ring in the MLWE problem to obtain the private key s1 and the noise e1. T , the s1 and the e1 use the MLWE problem to calculate the public key w.

[0080] Among them, the P T It is a pre-stored public key calculated by the registration server using the MLWE problem when registering with the registration server.

[0081] Specifically, when the application server identity ID contained in the received set M0 S When identifying itself, it means that it is necessary to provide services to users. The premise of providing services to users is that the user identity authentication and the application server identity authentication are passed. In order to register the server to authenticate the identity of the application server, it is necessary to generate information for authenticating the identity of the application server. The relevant private key and noise can be obtained first, so that the information for authenticating the identity of the application server can be calculated based on the obtained private key and noise. Considering that the adversary cannot recover the private key and noise sampled from the distribution on the polynomial ring in the MLWE problem, the preset sampling algorithm is used to sample from the distribution on the polynomial ring in the MLWE problem respectively to obtain the private key s1 and the noise e1, and based on the public key P T , private key s1 and noise e1 use the MLWE problem to calculate the public key w, which can be used to calculate the intermediate secret and signal value.

[0082] Step S220: Use the preset error coordination mechanism to coordinate the w to obtain the intermediate secret kS1 And signal value c1.

[0083] Specifically, the error coordination mechanism is used to coordinate the w to obtain the intermediate secret k S1 and signal value c1, based on the intermediate secret k S1 Calculate the information used to authenticate the identity of the application server, so that the registration server can also use the error coordination mechanism to recover the information related to the intermediate secret k S1 A consistent intermediate secret ensures normal communication between the two.

[0084] Step S230: Based on the P T , the k S1 and a preset second parameter set to calculate the authentication application server identity information Auth0.

[0085] Specifically, since the intermediate secret k S1 In order to use the preset error coordination mechanism to coordinate the public key w generated by the MLWE problem to obtain the intermediate secret, the adversary cannot recover the intermediate secret k. S1 Consistent intermediate secret, so it can be based on k S1 Generate authentication application server identity information Auth0, because P T The public key is pre-stored and calculated by the registration server using the MLWE problem when registering with the registration server. Only the application server and the registration server know it, so it can be based on P T Generate authentication application server identity information Auth0. In addition, Auth0 is also generated based on a preset second parameter set. The second parameter set may include some other parameters, thereby improving the security and integrity of the generated Auth0.

[0086] Step S240: Encrypt the set N1 using a preset encryption algorithm to obtain an encrypted set Mes0.

[0087] Wherein, the N1 includes the Auth0 and the c1.

[0088] Specifically, set N1 includes the authentication application server identity information Auth0 and the signal value c1 so that the registration server can authenticate the identity of the application server through the authentication application server identity information Auth0 and the signal value c1. The preset encryption algorithm is used to encrypt the set N1 in order to further improve the security of the authentication process. Only the registration server knows the decryption algorithm corresponding to the encryption algorithm, that is, only the registration server can use the decryption algorithm to decrypt the encrypted set Mes0 to obtain the set N1.

[0089] Step S250: Send the set M2 to the registration server.

[0090] Wherein, the M2 includes the M0, the Mes0 and the P S , the P S The public key is generated in advance using the MLWE problem.

[0091] Specifically, the sending includes the set M0, the encrypted set Mes0 and the public key P S The set M2 is given to the registration server in order for the registration server to authenticate the user identity through the set M0, and the public key P S This allows the registration server to recover the intermediate secret k S1 The consistent intermediate secret is then used to authenticate the identity of the application server through the encrypted set Mes0.

[0092] Step S260: When the encrypted set Mes2 sent by the registration server is received, the preset decryption algorithm is used to decrypt the Mes2 to obtain the set N2.

[0093] Wherein, the N2 includes the encrypted set Mes1.

[0094] Specifically, the encrypted set Mes2 received from the registration server is a set encrypted by the registration server using a preset encryption algorithm, so the encrypted set Mes2 needs to be decrypted using a preset decryption algorithm, where the decryption algorithm corresponds to the encryption algorithm used by the registration server.

[0095] Step S270: Determine whether N2 also includes information indicating that the user identity authentication is successful.

[0096] If so, it indicates that the user's identity authentication is successful, and the following step S280 is executed.

[0097] Step S280: Send the set M1 to the client.

[0098] Wherein, the M1 includes the Mes1.

[0099] Specifically, when the set N2 also includes information indicating that the user identity authentication is passed, it indicates that the user identity authentication is passed. At this time, the set M1 including the encrypted set Mes1 can be sent to the client so that the client can determine whether the application server identity authentication is passed.

[0100] Optionally, after sending the set M1 to the client in step S280, the shared key sk with the client can be calculated. S1 , so that the shared key sk can be used later S1 Communicate with the client.

[0101] In the embodiment of the present application, the user only needs to register with the registration server to obtain the temporary identity identifier TID generated by the registration server for the user. U When a user needs a service from an application server, the client will include the user's temporary identity TID U , Application server identity ID S , public key b0 and the set M0 of the authenticated user identity information γ0 are sent to the application server. The application server will generate relevant authentication information and send the authentication information and M0 to the registration server. The registration server will complete the identity authentication of the user and the application server. The authentication of the user and the application server is completed on the registration server. Each application server does not need to store any information about the user, which reduces the resource burden of the application server.

[0102] Furthermore, since the private key and public key used by the application server are both obtained based on the MLWE problem, current quantum algorithms cannot recover the private key used by the application server through the public key used by the application server, making the authentication and key exchange process under the multi-server architecture resistant to quantum computer attacks.

[0103] This application embodiment provides an authentication solution under a multi-server architecture. Figure 3 The method under the multi-server architecture of this application is described from the perspective of the registration server. Figure 3 As shown, the method may include:

[0104] Step S300: Receive the set M2 sent by the application server.

[0105] Wherein, the M2 includes the set M0, the encrypted set Mes0 and the public key P S , the M0 includes the user temporary identity TID U , Application server identity ID S , public key b0 and authentication user identity information γ0, the TID U The identifier generated for the user when the user registered.

[0106] Step S310: Decrypt the Mes0 using a preset decryption algorithm to obtain a set N1.

[0107] Wherein, the N1 includes the authentication application server identity information Auth0 and the signal value c1.

[0108] Specifically, the encrypted set Mes0 is a set obtained by encrypting the set using a preset encryption algorithm by the application server, so a preset decryption algorithm needs to be used to decrypt Mes0, wherein the decryption algorithm corresponds to the encryption algorithm used by the application server.

[0109] Step S320: Based on the P S and private keys T The public key w′ is calculated using the MLWE problem, and the w′ and c1 are coordinated using the preset error coordination mechanism to obtain the intermediate secret k T1 .

[0110] Among them, the s T The private key is sampled in advance from the distribution on the polynomial ring in the MLWE problem using a preset sampling algorithm.

[0111] Specifically, if you want to authenticate the identity of the application server, you need to calculate the authentication application server identity information Auth0′, and authenticate the identity of the application server by comparing Auth0′ with Auth0. Since Auth0 is based on the intermediate secret k S1 Generated, so first we need to calculate the intermediate secret k T1 , can be based on the received P S And the private key s generated by itself T To calculate the public key w′, and then use the preset error coordination mechanism to coordinate w′ and the signal value c1, the intermediate secret k T1 , due to the participation of the error coordination mechanism, the intermediate secret k calculated by the registration server can be T1 With k S1 The same, wherein the error coordination mechanism here is consistent with the error coordination mechanism used by the application server.

[0112] Step S330: Based on the public key P T , the k T1 and a preset second parameter set to calculate the authentication application server identity information Auth0′.

[0113] Among them, the P T The public key is generated in advance using the MLWE problem when registering with the application server.

[0114] Specifically, since the authentication application server identity information Auth0 is the public key P calculated by the registration server using the MLWE problem when the application server registers with the registration server based on the pre-stored T , intermediate secret k S1 and the preset second parameter set, so it is necessary to use the public key P generated by the MLWE problem in advance when registering with the application server T , intermediate secret k T1And the preset second parameter set is used to calculate the authentication application server identity information Auth0′, where the information in the second parameter set used to calculate Auth0′ corresponds to the second parameter set used by the application server to calculate Auth0.

[0115] Step S340: If the Auth0′ is equal to the Auth0, based on the TID U , the b0 and the preset first parameter set generate the authentication user identity information γ0′.

[0116] Specifically, if the calculated Auth0′ is equal to the Auth0 calculated by the application server, it means that the application server identity authentication is successful. At this time, the user identity information γ0 needs to be authenticated to authenticate the user. Since the authentication user identity information γ0 is a temporary identity identifier TID input by the client based on the user U , calculated using the public key b0 calculated by the MLWE problem and the preset first parameter set, so based on the received temporary identity TID U , public key b0 and the preset first parameter set generate the authentication user identity information γ0′, where the information in the first parameter set used to calculate γ0′ corresponds to the first parameter set used by the application server to calculate γ0.

[0117] Step S350: If the γ0′ is equal to the γ0, the set N0 is encrypted using a preset encryption algorithm to obtain an encrypted set Mes1.

[0118] Wherein, the N0 includes information indicating that the application server identity authentication has been passed.

[0119] Specifically, after the user and application server identity authentication are passed, information representing that the application server identity authentication is passed can be set. In order to improve security, the set N0 containing the information representing that the application server identity authentication is passed is encrypted using a preset encryption algorithm to obtain the encrypted set Mes1. Only legitimate clients know the decryption algorithm corresponding to the encryption algorithm, that is, only legitimate clients can decrypt the encrypted set Mes1 to obtain the set N0.

[0120] Step S360: Use a preset encryption algorithm to encrypt the set N2 to obtain an encrypted set Mes2.

[0121] The N2 includes information indicating that the user identity authentication is passed and the Mes1.

[0122] Step S370: Send the Mes2 to the application server.

[0123] Specifically, in addition to setting the information representing that the application server identity authentication has passed, it is also necessary to set the information representing that the user identity authentication has passed. In order to improve security, the set N2 including the information representing that the user identity authentication has passed and Mes1 is encrypted using the above-mentioned encryption algorithm to obtain the encrypted set Mes2. Only the legitimate application server knows the decryption algorithm corresponding to the encryption algorithm, that is, only the legitimate application server can decrypt the encrypted set Mes2 to obtain the set N2.

[0124] In the embodiment of the present application, the user only needs to register with the registration server to obtain the temporary identity identifier TID generated by the registration server for the user. U When a user needs a service from an application server, the client will include the user's temporary identity TID U , Application server identity ID S , public key b0 and authentication user identity information γ0 is sent to the application server. The application server generates relevant authentication information and sends the authentication information and M0 to the registration server. The registration server completes the identity authentication of the user and the application server. The authentication of the user and the application server is completed on the registration server. Each application server does not need to store any information about the user, which reduces the resource burden of the application server. In addition, the user only needs to register with the registration server to obtain a temporary identity to complete the authentication and key exchange. There is no need to register with each application server under the multi-server architecture, which saves time and cost.

[0125] Furthermore, since the private key and public key used by the registration server are both obtained based on the MLWE problem, the current quantum algorithm cannot recover the private key used by the registration server through the public key used by the registration server, making the authentication and key exchange process under the multi-server architecture resistant to quantum computer attacks.

[0126] Optionally, the embodiments of the present application found that the encryption algorithm and decryption algorithm used by the client, application server and registration server in the above embodiments can be a symmetric encryption algorithm and a symmetric decryption algorithm, and the symmetric encryption algorithm and the key used by the symmetric encryption algorithm can be a shared key calculated between the client, application server and registration server.

[0127] Based on this, the above step S230 is based on the P T , the k S1 Before calculating the authentication application server identity information Auth0 using the preset second parameter set, the following steps may also be included:

[0128] Calculate the shared key sk with the registration server S0 .

[0129] The process of encrypting the set N1 using the preset encryption algorithm to obtain the encrypted set Mes0 may include:

[0130] Based on the sk S0 The set N1 is encrypted using a symmetric encryption algorithm to obtain the encrypted set Mes0.

[0131] Specifically, calculate the shared key sk with the registration server S0 , and based on sk S0 Use symmetric encryption algorithm to encrypt the set N1, so that only the shared key calculated by the legitimate registration server and the application server can be used with sk S0 Only when they are equal can the encrypted set Mes0 be decrypted based on the calculated shared key to obtain the set N1, making the authentication process more secure.

[0132] Before the above step S310 uses a preset decryption algorithm to decrypt the Mes0 to obtain the set N1, the following steps may also be included:

[0133] Calculate the shared key sk with the application server T0 .

[0134] The process of decrypting Mes0 using a preset decryption algorithm to obtain the set N1 in step S310 may include:

[0135] Based on the sk T0 The Mes0 is decrypted using a symmetric decryption algorithm to obtain a set N1.

[0136] Specifically, since the encrypted set Mes0 is calculated based on the shared key calculated by the registration server and the application server using a symmetric encryption algorithm, the shared key sk with the registration server is first calculated. T0 , and based on sk T0 Use the symmetric decryption algorithm to decrypt Mes0.

[0137] Before the above step S350 encrypts the set N0 using a preset encryption algorithm to obtain the encrypted set Mes1, the following steps may also be included:

[0138] Calculate the shared key sk with the client T1 .

[0139] The process of encrypting the set N0 using a preset encryption algorithm in step S350 to obtain the encrypted set Mes1 may include:

[0140] Based on the sk T1 The set N0 is encrypted using a symmetric encryption algorithm to obtain the encrypted set Mes1.

[0141] The process of encrypting the set N2 using a preset encryption algorithm in step S360 to obtain the encrypted set Mes2 may include:

[0142] Based on the sk T0 The set N2 is encrypted using a symmetric encryption algorithm to obtain the encrypted set Mes2.

[0143] Specifically, calculate the shared key sk with the client T1 , and based on sk T1 The set N0 is encrypted using a symmetric encryption algorithm, so that only the shared key calculated by the legitimate client and the registration server is used with sk T1 Only when they are equal can the encrypted set Mes1 be decrypted based on the calculated shared key to obtain the set N0, and the shared key sk with the application server be calculated. T0 , and based on sk T0 The set N2 is encrypted using a symmetric encryption algorithm, so that only the shared key calculated by the legitimate application server and the registration server is used with sk T0 Only when they are equal can the encrypted set Mes2 be decrypted based on the calculated shared key to obtain the set N2, making the authentication process more secure.

[0144] The above step S130 is based on the TID U After the authentication user identity information γ0 is generated by using b0 and the preset first parameter set, the method may further include:

[0145] Calculate the shared key sk with the registration server U0 .

[0146] The process of decrypting Mes1 using a preset decryption algorithm to obtain the set N0 in step S160 may include:

[0147] Based on the sk U0 The Mes1 is decrypted using a symmetric decryption algorithm to obtain a set N0.

[0148] Specifically, since the encrypted set Mes1 is encrypted by the registration server based on the shared key calculated with the client using a symmetric encryption algorithm, the shared key sk with the registration server is first calculated. U0 , and based on the calculated sk U0 Use the symmetric decryption algorithm to decrypt Mes1.

[0149] The process of decrypting Mes2 using a preset decryption algorithm to obtain the set N2 in step S260 may include:

[0150] Based on the sk S0 Decrypt the Mes2 using the symmetric decryption algorithm to obtain the set N2.

[0151] Specifically, since the encrypted set Mes2 is encrypted by the registration server based on the shared key calculated with the application server using a symmetric encryption algorithm, the shared key sk calculated with the registration server is S0 Use the symmetric decryption algorithm to decrypt Mes2.

[0152] In an embodiment of the present application, the client, application server and registration server use a symmetric encryption algorithm to encrypt the set sent between the three based on the shared key calculated between the three, and use a symmetric decryption algorithm to decrypt the received set. The shared key calculated between the client, application server and registration server can only be calculated by the three legal parties, so the use of symmetric encryption algorithm and symmetric decryption algorithm based on these shared keys makes the authentication process more secure.

[0153] In some embodiments of the present application, the process of user registration with the registration server is introduced. When the user wants to register with the registration server, he first enters the identity ID in the interface provided by the client. i and password PW0, the client will respond to the user's operation, generate a random number n0, and calculate the password PW1 = H0 (ID i ||n0||PW0), and sends a registration request (ID i ,PW1), when the registration server receives the registration request (ID i ,PW1), generate a random number n and calculate the temporary identity TID for the user U =H0(ID TA ||n||PW1) and save the TID U and PW1, TID U Sent to the client.

[0154] In the embodiment of the present application, since the password PW0 entered by the user during registration is not sent directly by the client to the registration server, but PW1 is sent to the registration server, the user's privacy is protected and the adversary is prevented from obtaining the user's password PW0 and calculating the password PW1 and the temporary identity identifier TID. U A random number is introduced to improve security and save TID U And PW1 can facilitate the subsequent authentication of the user's identity.

[0155] In the embodiment of the present application, the process of registering the application server with the registration server is introduced. When the application server registers with the registration server, it sends its own identity ID S To the registration server, the registration server can use a preset sampling algorithm to sample the private key s obtained from the distribution on the polynomial ring in the MLWE problem. T and noise e T Generate the public key P using the MLWE problem T , store ID S With P T The mapping relationship, and P T Sent to the application server.

[0156] Based on the above embodiment, the first parameter set in step S130 may include ID S 、ID U , PW0, n0 and n1, ID U and PW0 are the identification and password entered by the user when registering, and n0 is the ID entered by the user U and the random number generated after PW0, n1 is the random number generated in advance.

[0157] Based on this, the above step S130 is based on the TID U The process of generating the authentication user identity information γ0 using b0 and a preset first parameter set may include:

[0158] Calculation password PW1=H0(ID U ||n0||PW0).

[0159] Calculate γ0=H1(TID U ||ID S ||b0||n1||PW1).

[0160] Specifically, since the registration request sent by the client to the registration server contains the password based on the identification and password entered by the user during registration and the password generated by the random number generated for the user, and the registration server will save the password, it is necessary to first calculate the password, that is, calculate PW1, and calculate γ0 based on PW1. Only a legitimate client can calculate the PW1 that is consistent with the PW1 saved by the registration server. Including n1 in the first parameter set can prevent replay attacks, including ID S The calculated γ0 can be protected to a certain extent in terms of integrity. By calculating γ0 through a hash function, security is improved based on the characteristics of the hash function.

[0161] The above calculation and the shared key sk of the registration server U0 The process may include:

[0162] Calculate sk U0 =H2(TID U ||ID S ||b0||n1||PW1);

[0163] Specifically, sk is calculated based on PW1 U0 , only the legitimate client can calculate the PW1 that is consistent with the PW1 saved by the registration server, that is, only the shared key calculated by the legitimate client is consistent with the shared key calculated by the registration server, which improves security. sk is calculated based on n1 U0 Can prevent replay attacks based on ID S Calculate sk U0 The calculated sk U0 Play a certain integrity protection, calculate sk through the hash function U0 , based on the characteristics of hash functions, security is improved.

[0164] The above calculation and the shared key sk of the registration server S0 Before, you can also include:

[0165] The sampling algorithm is used to sample from the distribution on the polynomial ring to obtain the private key s2, noise e2 and noise e3.

[0166] Based on s2 and e2, the public key b1 is calculated using the MLWE problem, and based on P T , the s2 and the e3 use the MLWE problem to calculate the public key v.

[0167] The error coordination mechanism is used to coordinate the v to obtain the intermediate secret k S0 And signal value c0.

[0168] Generate a random number n2.

[0169] The above calculation and the shared key sk of the registration server S0 The process may include:

[0170] Calculate sk S0 =H1(ID S ||ID TA ||b0||p T ||c0||n2||k S0 ), the ID TA is the identity identifier of the registrable server.

[0171] Specifically, based on ID S 、ID TA ,b0,p T and c0 to calculate skS0 It can protect the integrity and calculate sk based on n2 S0 Replay attacks can be prevented because k S0 It is obtained by coordinating the public key v calculated using the MLWE problem using the error coordination mechanism, so based on k S0 Calculate sk S0 It can resist the attack of quantum computers. Only the legitimate registration server can calculate the number of k S0 The consistent middle secret.

[0172] The second parameter set in step S230 may include ID S 、ID TA 、p s and n3, n3 is a pre-generated random number;

[0173] The above is based on the P T , the k S1 The process of calculating the authentication application server identity information Auth0 using the preset second parameter set may include:

[0174] Calculate Auth0 = H1(ID S ||ID TA ||p s ||p T ||n3||k S1 ).

[0175] Specifically, including n3 in the second parameter set can prevent replay attacks, including ID S 、ID TA 、p s The calculated Auth0 can be protected to a certain extent in terms of integrity. By calculating Auth0 through a hash function, security is improved based on the characteristics of the hash function.

[0176] In order to enable the registration server to calculate the shared key with the application server, the set M2 sent in step S250 should also include n2, b1 and c0.

[0177] Since the set M2 sent in the above step S250 should also include n2, b1 and c0, the M2 received in the above step S300 also includes n2, b1 and c0.

[0178] The above calculation and the shared key sk of the application server T0 Before, you can also include:

[0179] Based on b1 and s T Calculate the public key v′ and use the preset error coordination mechanism to coordinate the v′ and c0 to obtain the intermediate secret kT0 .

[0180] Specifically, since the shared key sk calculated by the application server and the registration server S0 is based on the intermediate secret k S0 Calculated, so first we need to calculate the intermediate secret k S0 The consistent intermediate secret can be based on the received b1 and the private key s generated by itself T To calculate the public key v′, and then use the preset error coordination mechanism to coordinate v′ and the received signal value c0, the intermediate secret k T0 , due to the participation of the error coordination mechanism, the calculated intermediate secret k T0 With k S0 The same, wherein the error coordination mechanism here is consistent with the error coordination mechanism used by the application server.

[0181] The above calculation and the shared key sk of the application server T0 The process may include:

[0182] Calculate sk T0 =H1(ID S ||ID TA ||b0||p T ||c0||n2||k T0 ), the ID TA For self-identification.

[0183] Specifically, since the shared key sk calculated by the application server and the registration server S0 In addition to the intermediate secret k S0 Calculation, also based on ID S 、ID TA ,b0,p T , c0 and n2 calculation, so calculate sk T0 Based on ID S 、ID TA ,b0,p T , c0 and n2 to calculate, calculate sk T0 The p used T The public key is generated in advance by the registration server using the MLWE problem when registering with the application server.

[0184] The second parameter set in step S330 may include ID S 、ID TA 、p s and n3, where n3 is a random number received in advance and sent by the application server.

[0185] The above step S330 is based on the public key PT , the k T1 The process of calculating the authentication application server identity information Auth0′ using the preset second parameter set may include:

[0186] Calculate Auth0′=H1(ID S ||ID TA ||p s ||p T ||n3||k T1 ).

[0187] Specifically, since the second parameter set used by the application server to calculate Auth0 includes ID S 、ID TA 、p s and n3, so calculate Auth0′=H1(ID S ||ID TA ||p s ||p T ||n3||k T1 ).

[0188] The first parameter set in step S340 may include ID S , n1 and PW1, PW1 is the password sent by the client when the user registers, and PW1 = H0 (ID U ||n0||PW0), the ID U and PW0 are the identification and password entered by the user when registering, respectively; n0 is the ID entered by the user U And the random number generated by the client after the PW0.

[0189] The above is based on the TID U The process of generating the authentication user identity information γ0′ using b0 and a preset first parameter set may include:

[0190] Calculate γ0′=H1(TID U ||ID S ||b0||n1||PW1).

[0191] Specifically, since the above step S130 is based on the TID U The process of generating the authentication user identity information γ0 by using b0 and the preset first parameter set is to calculate the password PW1=H0(ID U ||n0||PW0), γ0=H1(TID U ||ID S||b0||n1||PW1), so the first parameter set in the above step S340 includes the pre-stored password PW1 sent by the client when the user registers to authenticate the user's identity. Only when the user is legitimate will the PW1 used by the client to calculate γ0 be consistent with the PW1 used when calculating γ0′. In addition, the first parameter set in the above step S130 also includes ID S and n1, so the first parameter set in step S340 includes ID S and n1.

[0192] The above calculation and the client's shared key sk T1 The process may include:

[0193] Calculate sk T1 =H2(TID U ||ID S ||b0||n1||PW1).

[0194] Specifically, since the shared key sk calculated by the client and the registration server U0 =H2(TID U ||ID S ||b0||n1||PW1), so calculate the shared key sk with the client T1 =H2(TID U ||ID S ||b0||n1||PW1), calculate sk T1 The PW1 used is the pre-stored password sent by the client when the user registers.

[0195] The above is based on the sk T1 Before encrypting the set N0 using a symmetric encryption algorithm to obtain the encrypted set Mes1, the following may also be included:

[0196] Generate a random number n4.

[0197] The set N0 in the above step S350 also includes b1 and n4, and the set N2 in the above step S350 also includes n4.

[0198] Based on this, the set N0 in the above step S160 also includes the public key b1 and the random number n4, and the set N2 in the above step S260 also includes the random number n4.

[0199] The above calculation and the client's shared key sk S1 Before, you can also include:

[0200] Sampling from the distribution on the polynomial ring using the sampling algorithm to obtain noise e4;

[0201] Calculate a public key u based on b0, s2, and e4 using the MLWE problem;

[0202] The preset error coordination mechanism is used to coordinate the u to obtain the intermediate secret k S2 and signal value c2;

[0203] The calculation and the client shared key sk S1 ,include:

[0204] Calculate sk S1 =H2(TID U ||ID S ||b0||b1||c2||n4||k S2 ).

[0205] Specifically, based on TID U 、ID S , b0, b1 and c2 calculate sk S1 It can protect the integrity and calculate sk based on n4 S1 It can prevent replay attacks because k S2 It is obtained by coordinating the public key u calculated using the MLWE problem using the error coordination mechanism, so based on k S2 Calculate sk S1 It can resist the attack of quantum computers. Only legitimate clients can calculate the value of k S2 The consistent middle secret.

[0206] In order to enable the client to calculate the S2 The consistent intermediate secret, the set M1 in the above step S280 may also include the c2.

[0207] The above calculation and the shared key sk of the application server U Before, you can also include:

[0208] The public key u' is calculated based on b1 and s0, and the u' and c2 are coordinated using the preset error coordination mechanism to obtain the intermediate secret k U ;

[0209] The above calculation and the shared key sk of the application server U The process may include:

[0210] Calculate sk U =H2(TID U ||ID S ||b0||b1||c2||n4||k U ).

[0211] Specifically, since the shared key sk calculated by the application server and the client S1 =H2(TID U ||ID S ||b0||b1||c2||n4||k S2 ), so here we calculate the shared key sk with the application server U =H2(TID U ||ID S ||b0||b1||c2||n4||k U ).

[0212] Optionally, the sampling algorithm in the above embodiments may be a central binomial distribution sampling algorithm.

[0213] Based on this, the process of using a preset sampling algorithm to sample from the distribution on the polynomial ring in the MLWE problem to obtain the private key s0 and the noise e0 in step S110 may include:

[0214] Use the central binomial distribution sampling algorithm from Sampling is done to obtain the private key s0 and noise e0.

[0215] Among them, the is a central binomial distribution with parameter η over the polynomial ring, and k is the dimension of the polynomial matrix.

[0216] Specifically, the central binomial distribution sampling algorithm is used to select The dimensions of the private key s0 and noise e0 are both k rows and 1 column.

[0217] The process of calculating the public key b0 based on s0 and e0 using the MLWE problem in step S120 may include:

[0218] Calculate the public key b0=As0+e0, where A is a polynomial matrix sampled from the polynomial ring.

[0219] Specifically, from the MLWE problem, we can know that the polynomial matrix A can be directly sampled from the polynomial ring, and b0 can be calculated based on A, s0 and e0. The dimension of A is k rows and k columns, and the dimension of the private key s0 and the noise e0 are both k rows and 1 column, so b0=As0+e0 can be directly calculated.

[0220] The registration server obtains the private key s by sampling from the distribution on the polynomial ring in the MLWE problem using a preset sampling algorithm. T and noise e T Generate the public key P using the MLWE problem T The process may include:

[0221] Use the central binomial distribution sampling algorithm from Sampling, get the private key s T and noise T ;

[0222] Calculate P T =As T +e T .

[0223] Specifically, the central binomial distribution sampling algorithm is used to select The private key s is sampled from T and noise T The dimensions are all k rows and 1 column. According to the MLWE problem, the polynomial matrix A can be directly sampled from the polynomial ring. Based on A, s T and e T Calculate P T , the dimension of A is k rows and k columns, the private key s T and noise T The dimensions are all k rows and 1 column, so P can be directly calculated T =As T +e T .

[0224] The above step S210 uses a preset sampling algorithm to sample from the distribution of the polynomial ring in the MLWE problem to obtain the private key s1 and the noise e1. T The process of calculating the public key w by using the MLWE problem by s1 and e1 may include:

[0225] Use the central binomial distribution sampling algorithm from Sampling from β, get the private key s1, use the central binomial distribution sampling algorithm to get the private key s1 from β η Sampling, get the noise e1, calculate

[0226] Specifically, due to P T =As T +e T , P T With k rows and 1 column, use the central binomial distribution sampling algorithm from The private key s1 sampled from β is k rows and 1 column, and the central binomial distribution sampling algorithm is used to sample from β η The noise e1 sampled from the image is 1 row and 1 column, so the calculation

[0227] The process of using the sampling algorithm to sample from the distribution on the polynomial ring to obtain the private key s2, the noise e2, and the noise e3 may include:

[0228] The central binomial distribution sampling algorithm is used to sample from Sampling is done to obtain the private key s2 and noise e2, and the central binomial distribution sampling algorithm is used to sample from β η The noise e3 is obtained by sampling.

[0229] Specifically, the central binomial distribution sampling algorithm is used to select The dimensions of the private key s2 and noise e2 are both k rows and 1 column, from β η The dimension of the noise e3 obtained by sampling is 1 row and 1 column.

[0230] Based on s2 and e2, the public key b1 is calculated using the MLWE problem, and based on P T The process of calculating the public key v by using the MLWE problem by s2 and e3 may include:

[0231] Calculate b1 = A T s2+e2;

[0232] calculate

[0233] Specifically, from the MLWE problem, we can directly sample the polynomial matrix A from the polynomial ring and calculate b1 based on A, s2, and e2. The dimension of A is k rows and k columns, and the dimension of the private key s2 and the noise e2 are both k rows and 1 column, so we can directly calculate b1=As2+e2. Since P T =As T +e T , so P T The dimension of the private key s2 is k rows and 1 column, and the dimension of the noise e3 is 1 row and 1 column, so based on P T When s2 and e3 calculate the public key v, they need to calculate

[0234] The public key P generated in advance using the MLWE problem S Can be P S =A T s S +e S , s S and e S The central binomial distribution sampling algorithm can be used to The private key and noise are sampled.

[0235] The above step S330 is based on the P S and private keys T The process of calculating the public key w′ using the MLWE problem may include:

[0236]

[0237] Specifically, P S =A T s S +e S , P S The dimension is k rows and 1 column, the private key s T The dimension of is also k rows and 1 column, so the calculation

[0238] The above is based on b1 and s T The process of calculating the public key v′ may include:

[0239]

[0240] Specifically, b1 = A T s2+e2, the dimension of b1 is k rows and 1 column, the private key s T The dimension of is also k rows and 1 column, so the calculation

[0241] The process of sampling from the distribution on the polynomial ring using the sampling algorithm to obtain the noise e4 may include:

[0242] Use the central binomial distribution sampling algorithm to sample from β η The noise e4 is obtained by sampling.

[0243] The process of calculating the public key u based on b0, s2, and e4 using the MLWE problem may include:

[0244] calculate

[0245] Specifically, the central binomial distribution sampling algorithm is used to select from β η The dimension of the noise e4 sampled from the equation is 1 row and 1 column. Since the dimension of b0 is k rows and 1 column, and the dimension of the private key s2 is k rows and 1 column, the public key can be calculated.

[0246]

[0247] The process of calculating the public key u′ based on b1 and s0 may include:

[0248] calculate

[0249] Specifically, since b1=A T s2+e2, the dimension of b1 is k rows and 1 column, and the dimension of s0 is also k rows and 1 column, so we can calculate

[0250] The embodiment of the present application uses a central binomial distribution sampling algorithm for sampling. The sampling implementation process is simple and does not require the introduction of large tables and high-precision calculations. The sampling efficiency is high, and the dimension is taken into account when calculating the public key, which will not cause calculation errors.

[0251] Optionally, the above error coordination mechanism may include a Perkert error coordination mechanism. The definition of the relevant functions in the Perkert error coordination mechanism is as follows:

[0252] Cross-round function:

[0253] Modulo integer function:

[0254] Coordination function:

[0255] Random doubling function: in is a random item, The probability of being 0 is 0.5, The probability of being -1 and 1 is 0.5.

[0256] The above-mentioned preset error coordination mechanism is used to coordinate the u′ and the c2 to obtain the intermediate secret k U The process may include:

[0257] When the modulus q of the polynomial ring is even, the coordination function is used to calculate the intermediate secret k U =Rec(u′,c2).

[0258] Specifically, according to the Perkert error coordination mechanism, when q is an even number, the coordination function can be used to calculate the intermediate secret k U = Rec(u′, c2), so that the intermediate secret k U The intermediate secret k calculated by the application server S2 consistent.

[0259] When q is an odd number, the coordination function is used to calculate the intermediate secret k U =Rec(2u′,c2).

[0260] Specifically, according to the Perkert error coordination mechanism, when q is an even number, the coordination function can be used to calculate the intermediate secret k U = Rec(2u′,c2), so that the intermediate secret k U The intermediate secret k calculated by the application server S2 consistent.

[0261] The above-mentioned preset error coordination mechanism is used to coordinate the w to obtain the intermediate secret k S1 The process of determining the signal value c1 may include:

[0262] When the modulus q of the polynomial ring is an even number, the coordinated public key is calculated using the modular integer function and the cross integer function respectively. Sum signal value c1← <w> q,2 ;

[0263] Specifically, according to the Perkert error coordination mechanism, when q is an even number, the intermediate secret can be directly calculated using the modular integer function in the Perkert error coordination mechanism. Use the cross-round function to calculate the signal value c1← <w> q,2 .

[0264] When q is an odd number, the doubled public key is calculated using the random doubling function, the modulo integer function, and the cross integer function. The secret in the middle Sum signal value

[0265] Specifically, according to the Perkert error coordination mechanism, when q is an odd number, the doubled public key must first be calculated using the random doubling function. Then use the modulo integer function and cross integer function to calculate the intermediate secret Sum signal value

[0266] The above error coordination mechanism is used to coordinate the v to obtain the intermediate secret k S0 The process of determining the signal value c0 may include:

[0267] When the modulus q of the polynomial ring is an even number, the coordinated public key is calculated using the modular integer function and the cross integer function respectively. Sum signal value c0← <v> q,2 ;

[0268] Specifically, according to the Perkert error coordination mechanism, when q is an even number, the intermediate secret can be directly calculated using the modular integer function in the Perkert error coordination mechanism. Use the cross-round function to calculate the signal value c0← <v> q,2 .

[0269] When q is an odd number, the doubled public key is calculated using the random doubling function, the modulo integer function, and the cross integer function. The secret in the middle Sum signal value

[0270] Specifically, according to the Perkert error coordination mechanism, when q is an odd number, the doubled public key must first be calculated using the random doubling function. Then use the modulo integer function and cross integer function to calculate the intermediate secret Sum signal value

[0271] The above-mentioned preset error coordination mechanism is used to coordinate the u to obtain the intermediate secret k S2 The process of determining the signal value c2 may include:

[0272] When the modulus q of the polynomial ring is an even number, the coordinated public key is calculated using the modular integer function and the cross integer function respectively. Sum signal value c2← q,2 ;

[0273] Specifically, according to the Perkert error coordination mechanism, when q is an even number, the intermediate secret can be directly calculated using the modular integer function in the Perkert error coordination mechanism. Use the cross-round function to calculate the signal value c2← q,2 .

[0274] When q is an odd number, the doubled public key is calculated using the random doubling function, the modulo integer function, and the cross integer function. The secret in the middle Sum signal value

[0275] Specifically, according to the Perkert error coordination mechanism, when q is an odd number, the doubled public key must first be calculated using the random doubling function. Then use the modulo integer function and cross integer function to calculate the intermediate secret Sum signal value

[0276] The above-mentioned preset error coordination mechanism is used to coordinate the w′ and the c1 to obtain the intermediate secret k T1 The process may include:

[0277] When the modulus q of the polynomial ring is even, the coordination function is used to calculate the intermediate secret k T1 =Rec(w′,c1).

[0278] Specifically, according to the Perkert error coordination mechanism, when q is an even number, the coordination function can be used to calculate the intermediate secret k T1 = Rec(w′, c1), so that the intermediate secret k T1 The intermediate secret k calculated by the application server S1 consistent.

[0279] When q is an odd number, the coordination function is used to calculate the intermediate secret k T1 =Rec(2w′,c1).

[0280] Specifically, according to the Perkert error coordination mechanism, when q is an even number, the coordination function can be used to calculate the intermediate secret k T1 = Rec(2w′,c1), so that the intermediate secret k T1 The intermediate secret k calculated by the application server S1 consistent.

[0281] The above-mentioned preset error coordination mechanism is used to coordinate the v' and the c0 to obtain the intermediate secret k T0 The process may include:

[0282] When the modulus q of the polynomial ring is even, the coordination function is used to calculate the intermediate secret k T0 =Rec(v′,c0).

[0283] Specifically, according to the Perkert error coordination mechanism, when q is an even number, the coordination function can be used to calculate the intermediate secret k T0 = Rec(v′, c0), so that the intermediate secret k T0 The intermediate secret k calculated by the application server S0 consistent.

[0284] When q is an odd number, the coordination function is used to calculate the intermediate secret k T0 =Rec(2v′,c0).

[0285] Specifically, according to the Perkert error coordination mechanism, when q is an even number, the coordination function can be used to calculate the intermediate secret k T0 = Rec(2v′, c0), so that the intermediate secret k T0 The intermediate secret k calculated by the application server S0 consistent.

[0286] In some embodiments of the present application, the specific process of authentication under a multi-service architecture using the Perkert error coordination mechanism and the central binomial distribution sampling algorithm when the modulus q is an odd number is introduced. Figure 4 , Figure 4 The specific process of authentication is shown. The specific process is described as follows:

[0287] The client obtains the temporary identity TID entered by the user U and the application server identity ID corresponding to the application server for which the user requested the service S Afterwards, sampling Based on s0 and e0, the MLWE problem is used to calculate the public key b0=As0+e0, A is the polynomial ring The polynomial matrix obtained by upsampling is used to calculate the password PW1=H0(ID U ||n0||PW0), ID U and PW0 are the identification and password entered by the user when registering, n0 is the ID entered by the user U And the random number generated after PW0, calculate the shared key sk with the registration server U0 =H1(TID U ||ID S ||b0||n1||PW1), calculate the authentication user identity information γ0=H1(TID U ||ID S ||b0||n1||PW1), n1 is a pre-generated random number, and the sending set M0=(TID U ,ID S ,b0,γ0) to the application server.

[0288] The application server receives the set M0 sent by the client = (TID U ,ID S ,b0,γ0), when ID S When sampling for your own identity Calculate the public key P T The public key calculated by the registration server using the MLWE problem when registering with the registration server is pre-stored, and then the doubled public key is calculated using the random doubling function, cross rounding function and modular rounding function respectively. Signal value and the secret in the middle Calculate the authentication application server identity information Auth0 = H1 (ID S ||ID TA ||p s ||p T ||n3||k S1 ),sampling Calculate the public key b1 = A T s2+e2, calculate the public key Then use the random doubling function, cross rounding function and modulo rounding function to calculate the doubled public key Signal value The secret in the middle Calculate the shared key sk with the registration server S0 =H1(ID S ||ID TA ||b0||p T ||c0||n2||k S0 ), set N1=(c1,Auth0), based on sk S0 Use the symmetric encryption algorithm to encrypt the set N1 and obtain the encrypted set Mes0: Mes0 = E skS0 (N1), send set M2 = (M0, n2, p s ,Mes0,b1,c0) to the registration server.

[0289] The registration server receives the set M2 sent by the application server = (M0, n2, p s ,Mes0,b1,c0), calculate the public key Use the coordination function to calculate the intermediate secret k T0 = Rec(2v′, c0), calculate the shared key sk with the application server T0 =H1(ID S ||ID TA ||b0||p T ||c0||n2||k T0 ), based on sk T0 Use the symmetric decryption algorithm to decrypt Mes0 and obtain the set N1: N1=(c1,Auth0), calculate the public key s T The private key is sampled from the distribution of the polynomial ring in the MLWE problem using a preset sampling algorithm, and the coordination function is used to calculate the intermediate secret k T1 = Rec(2w′, c1), calculate the authentication application server identity information Auth0′ = H1(ID S ||ID TA ||p s ||p T ||n3||k T1 ), verify Auth0′? = Auth0, "? =" indicates whether it is equal, if so, it means that the application server identity authentication is passed, calculate the authentication user identity information γ0′ = H1 (TID U ||ID S ||b0||n1||PW1), verify γ0′? = γ0, if so, it means the client identity authentication is successful, calculate the shared key sk with the client T1 =H2(TID U ||ID S ||b0||n1||PW1), set N0=(Succ1,b1,n4), Succ1 is the information representing the application server identity authentication, based on sk T1 Use the symmetric encryption algorithm to encrypt the set N0 and obtain the encrypted set Mes1: Set N2 = (Succ2, Mes1, n4), Succ2 is the information representing the user identity authentication, based on sk T0 Use the symmetric encryption algorithm to encrypt the set N2 and obtain the encrypted set Mes2: Send Mes2 to the application server.

[0290] Application server based on sk S0 Use the symmetric decryption algorithm to decrypt Mes2 and obtain the set N2: N2=(Succ2,Mes1,n4), after determining that Succ2 represents the information that the user identity authentication is successful, sample (e4)←β η , calculate the public key Then use the random doubling function, cross rounding function and modulo rounding function to calculate the doubled public key Signal value and the secret in the middle Calculate the shared key sk with the client S1 =H2(TID U ||ID S ||b0||b1||c2||n4||k S2 ), send the set M1 = (c2, Mes1) to the client.

[0291] Client based on sk U0 Use the symmetric decryption algorithm to decrypt Mes1 and obtain the set N0: N0=(Succ1,b1,n4), after determining that Succ1 represents the information that the application server identity authentication has passed, calculate the public key Use the coordination function to calculate the intermediate secret k U = Rec(2u′,c2), calculate the shared key sk with the application server U =H2(TID U ||ID S ||b0||b1||c2||n4||k U ).

[0292] If the client, application server and registration server calculate and transmit relevant information honestly, then sk U =sk S1 , now give sk U =sk S1 Proof of correctness:

[0293] k U =Rec(2u′,c2)

[0294]

[0295]

[0296]

[0297]

[0298] Taking k=2 as an example, assuming

[0299]

[0300]

[0301] Since the polynomial ring is commutative, s 10 a 00 s 00 =s 00 a 00 s 10 , from which we can get therefore And ordered but From the central binomial distribution sampling algorithm and the Peikert error coordination function, k U =k s2 , then: sk U =sk S1 .

[0302] The following describes the authentication device under the multi-service architecture provided in the embodiment of the present application. The authentication device under the multi-service architecture described below and the authentication method under the multi-service architecture described above can be referenced to each other.

[0303] First, combine Figure 5 , introduces the authentication device under the multi-service architecture applied to the client, such as Figure 5 As shown, the authentication device under the multi-service architecture may include:

[0304] The identification acquisition unit 10 is used to obtain the temporary identity TID input by the user U and the application server identity ID corresponding to the application server for which the user requested service S , the TID U The identifier generated by the registration server for the user when the user registers with the registration server;

[0305] A first sampling unit 11 is configured to use a preset sampling algorithm to sample from the distribution on the polynomial ring in the MLWE problem to obtain a private key s0 and noise e0;

[0306] A first public key calculation unit 12 is configured to calculate a public key b0 based on s0 and e0 using the MLWE problem;

[0307] The first authentication user identity information calculation unit 13 calculates the user identity information based on the TID U , calculating the authentication user identity information γ0 using b0 and a preset first parameter set;

[0308] The first set sending unit 14 is used to send the set M0 to the application server so that the application server generates relevant authentication information and sends the authentication information and the M0 to the registration server, and the registration server authenticates the identity of the user and the application server. The M0 includes the TID U 、The ID S , the b0 and the γ0;

[0309] A first set receiving unit 15 is configured to receive a set M1 sent by the application server, where M1 includes an encrypted set Mes1, where Mes1 is an encrypted set contained in a set obtained by decrypting an encrypted set sent by the application server after the registration server authenticates the identity of the user and the identity of the application server;

[0310] The first decryption unit 16 is used to decrypt the Mes1 using a preset decryption algorithm to obtain a set N0.

[0311] The first authentication judgment unit 17 is configured to confirm whether the identity authentication of the application server is passed based on the N0, wherein if the N0 includes information indicating that the identity authentication of the application server is passed, then the identity authentication of the application server is confirmed to be passed.

[0312] The authentication device under the multi-server architecture may further include:

[0313] The first shared key calculation unit is used to calculate the shared key sk with the registration server U0 .

[0314] The process of the first decryption unit decrypting Mes1 using a preset decryption algorithm to obtain the set N0 may include:

[0315] Based on the sk U0 The Mes1 is decrypted using a symmetric decryption algorithm to obtain a set N0.

[0316] The authentication device under the multi-server architecture may further include:

[0317] The second shared key calculation unit is used to calculate the shared key sk with the application server U .

[0318] The first parameter set may include the ID S 、ID U , PW0, n0 and n1, the ID U and PW0 are the identification and password entered by the user when registering, respectively; n0 is the ID entered by the user U and the random number generated after the PW0, and the n1 is a random number generated in advance.

[0319] Based on this, the first authentication user identity information calculation unit calculates the user identity information based on the TID U The process of calculating the authentication user identity information γ0 using b0 and a preset first parameter set may include:

[0320] Calculation password PW1=H0(ID U ||n0||PW0);

[0321] Calculate γ0=H1(TID U ||ID S ||b0||n1||PW1).

[0322] The first shared key calculation unit calculates a shared key sk with the registration server U0 The process may include:

[0323] Calculate sk U0 =H2(TID U ||ID S ||b0||n1||PW1).

[0324] The N0 also includes an intermediate secret b1 and a random number n4, and the M1 also includes a signal value c2.

[0325] Based on this, the authentication device under the multi-server architecture may further include:

[0326] The first coordination unit is used to calculate the public key u' based on b1 and s0, and coordinate u' and c2 using a preset error coordination mechanism to obtain an intermediate secret k U .

[0327] The second shared key calculation unit calculates a shared key sk with the application server U The process may include:

[0328] Calculate sk U =H2(TID U ||ID S ||b0||b1||c2||n4||k U ).

[0329] First, combine Figure 6 , introduces the authentication device under the multi-service architecture applied to the application server, such as Figure 6 As shown, the authentication device under the multi-service architecture may include:

[0330] The second set receiving unit 20 is configured to receive a set M0 sent by the client, wherein M0 includes a user temporary identity TID U , Application server identity ID S , public key b0 and authentication user identity information γ0, the TID U The identifier generated by the registration server for the user when the user registers with the registration server;

[0331] Sampling and public key calculation unit 21, used when the ID S When identifying itself, the preset sampling algorithm is used to sample from the distribution of the polynomial ring in the MLWE problem to obtain the private key s1 and the noise e1. T , the s1 and the e1 use the MLWE problem to calculate the public key w, the P T The pre-stored public key calculated by the registration server using the MLWE problem when registering with the registration server;

[0332] The second coordination unit 22 is used to coordinate the w using a preset error coordination mechanism to obtain the intermediate secret k S1 and signal value c1;

[0333] The first authentication application server identity information calculation unit 23 is used to calculate the identity information of the authentication application server based on the P T , the k S1 and a preset second parameter set to calculate the authentication application server identity information Auth0;

[0334] A first encryption unit 24 is configured to encrypt the set N1 using a preset encryption algorithm to obtain an encrypted set Mes0, wherein the set N1 includes the Auth0 and the c1;

[0335] The second set sending unit 25 is used to send a set M2 to the registration server, where M2 includes M0, Mes0 and P S , the P S The public key generated in advance using the MLWE problem;

[0336] A second decryption unit 26 is configured to, upon receiving the encrypted set Mes2 sent by the registration server, decrypt the Mes2 using a preset decryption algorithm to obtain a set N2, wherein N2 includes the encrypted set Mes1;

[0337] A second authentication judgment unit 27 is used to judge whether N2 also includes information indicating that the user identity authentication is passed;

[0338] If yes, it indicates that the user's identity authentication is successful, and the following steps of the third set sending unit 28 are executed;

[0339] The third set sending unit 28 is configured to send a set M1 to the client, where M1 includes Mes1.

[0340] The authentication device under the multi-server architecture may further include:

[0341] The third shared key calculation unit is used to calculate the shared key sk with the registration server S0 .

[0342] The process of the first encryption unit encrypting the set N1 using a preset encryption algorithm to obtain the encrypted set Mes0 may include:

[0343] Based on the sk S0 The set N1 is encrypted using a symmetric encryption algorithm to obtain the encrypted set Mes0.

[0344] The second decryption unit decrypts Mes2 using a preset decryption algorithm to obtain the set N2, which may include:

[0345] Based on the sk S0 Decrypt the Mes2 using the symmetric decryption algorithm to obtain the set N2.

[0346] The authentication device under the multi-server architecture may further include:

[0347] The fourth shared key calculation unit is used to calculate the shared key sk with the client S1 .

[0348] The authentication device under the multi-server architecture may further include:

[0349] A second sampling unit is configured to use the sampling algorithm to sample from the distribution on the polynomial ring to obtain a private key s2, noise e2, and noise e3;

[0350] The second public key calculation unit is used to calculate the public key b1 based on the MLWE problem based on the s2 and the e2, and the public key b1 based on the P T , the s2 and the e3 use the MLWE problem to calculate the public key v.

[0351] The third coordination unit is used to coordinate the v using the error coordination mechanism to obtain the intermediate secret k S0 And signal value c0.

[0352] The authentication device under the multi-server architecture may further include:

[0353] The first random number generating unit is used to generate a random number n2.

[0354] The third shared key calculation unit calculates a shared key sk with the registration server S0 The process may include:

[0355] Calculate sk S0 =H1(ID S ||ID TA ||b0||p T ||c0||n2||k S0 ), the ID TA is the identity identifier of the registrable server.

[0356] The second parameter set may include the ID S 、The ID TA 、The p s and n3, wherein n3 is a pre-generated random number.

[0357] Based on this, the first authentication application server identity information calculation unit calculates the identity information of the authentication application server based on the P T , the k S1 The process of calculating the authentication application server identity information Auth0 using the preset second parameter set may include:

[0358] Calculate Auth0 = H1(ID S ||ID TA ||p s ||p T ||n3||k S1 ).

[0359] The M2 also includes the n2, the b1, and the c0, and the N2 also includes a random number n4.

[0360] Based on this, the authentication device under the multi-server architecture may further include:

[0361] A third sampling unit is configured to calculate a public key u based on b0, s2, and e4 by using the MLWE problem.

[0362] The fourth coordination unit is used to coordinate the u using a preset error coordination mechanism to obtain the intermediate secret k S2 And signal value c2.

[0363] The fourth shared key calculation unit calculates a shared key sk with the client S1 The process may include:

[0364] Calculate sk S1 =H2(TID U ||ID S ||b0||b1||c2||n4||k S2 ).

[0365] The M1 also includes the c2.

[0366] First, combine Figure 7 , introduces the authentication device under the multi-service architecture applied to the registration server, such as Figure 7 As shown, the authentication device under the multi-service architecture may include:

[0367] The third set receiving unit 30 is used to receive the set M2 sent by the application server, where M2 includes the set M0, the encrypted set Mes0 and the public key P S , the M0 includes the user temporary identity TID U , Application server identity ID S , public key b0 and authentication user identity information γ0, the TID U An identifier generated for the user when the user registers;

[0368] A third decryption unit 31 is configured to decrypt the Mes0 using a preset decryption algorithm to obtain a set N1, wherein N1 includes the authentication application server identity information Auth0 and a signal value c1;

[0369] Public key calculation and coordination unit 32, for S and private keys T The public key w′ is calculated using the MLWE problem, and the w′ and c1 are coordinated using the preset error coordination mechanism to obtain the intermediate secret k T1 , the s T A private key is sampled in advance from a distribution on the polynomial ring in the MLWE problem using a preset sampling algorithm;

[0370] The second authentication application server identity information calculation unit 33 is used to calculate the identity information of the second authentication application server based on the public key P T , the k T1 and the preset second parameter set to calculate the authentication application server identity information Auth0′, the P T The public key generated in advance by using the MLWE problem when registering with the application server;

[0371] If the Auth0′ is equal to the Auth0, the following steps of the second authentication user identity information calculation unit 34 are executed;

[0372] The second authentication user identity information calculation unit 34 is used to calculate the user identity information based on the TID U , said b0 and a preset first parameter set generate authentication user identity information γ0′;

[0373] If the γ0′ is equal to the γ0, the following steps of the second encryption unit 35 are executed;

[0374] A second encryption unit 35 is configured to encrypt the set N0 using a preset encryption algorithm to obtain an encrypted set Mes1, wherein the set N0 includes information indicating that the identity authentication of the application server has been passed;

[0375] A third encryption unit 36 ​​is configured to encrypt the set N2 using a preset encryption algorithm to obtain an encrypted set Mes2, wherein N2 includes the information indicating that the user identity authentication is passed and Mes1;

[0376] The fourth set sending unit 37 is configured to send the Mes2 to the application server.

[0377] The authentication device under the multi-server architecture may further include:

[0378] The fifth shared key calculation unit is used to calculate the shared key sk with the application server T0 .

[0379] The process of the third decryption unit decrypting Mes0 using a preset decryption algorithm to obtain the set N1 may include:

[0380] Based on the sk T0 The Mes0 is decrypted using a symmetric decryption algorithm to obtain a set N1.

[0381] The authentication device under the multi-server architecture may further include:

[0382] The fifth shared key calculation unit is used to calculate the shared key sk with the client T1 .

[0383] The second encryption unit encrypts the set N0 using a preset encryption algorithm to obtain the encrypted set Mes1, which may include:

[0384] Based on the sk T1 The set N0 is encrypted using a symmetric encryption algorithm to obtain the encrypted set Mes1.

[0385] The process of the third encryption unit encrypting the set N2 using a preset encryption algorithm to obtain the encrypted set Mes2 may include:

[0386] Based on the sk T0 The set N2 is encrypted using a symmetric encryption algorithm to obtain the encrypted set Mes2.

[0387] The M2 may further include a random number n2, an intermediate secret b1, and a signal value c0.

[0388] Based on this, the authentication device under the multi-server architecture may further include:

[0389] The fifth coordination unit is configured to coordinate based on the b1 and the s T Calculate the public key v′ and use the preset error coordination mechanism to coordinate the v′ and c0 to obtain the intermediate secret k T0 .

[0390] The fifth shared key calculation calculates the shared key sk with the application server T0 The process may include:

[0391] Calculate sk T0 =H1(ID S ||ID TA ||b0||p T ||c0||n2||k T0 ), the ID TA For self-identification.

[0392] The second parameter set includes the ID S 、The ID TA 、The p s and n3, wherein n3 is a random number received in advance and sent by the application server.

[0393] Based on this, the second authentication application server identity information calculation unit calculates the identity information of the server based on the public key P T , the k T1 The process of calculating the authentication application server identity information Auth0′ using the preset second parameter set may include:

[0394] Calculate Auth0′=H1(ID S ||ID TA ||p s ||p T ||n3||k T1 ).

[0395] The first parameter set may include the ID S , n1 and PW1, wherein PW1 is the pre-stored password sent by the client when the user registers, and PW1=H0(ID U ||n0||PW0), the ID U and PW0 are the identification and password entered by the user when registering, respectively; n0 is the ID entered by the user U and the random number generated by the client after the PW0, and the n1 is the random number sent by the client received in advance.

[0396] Based on this, the second authentication user identity information calculation unit calculates the user identity information based on the TID U , b0 and a preset first parameter set generate authentication user identity information γ0′, including:

[0397] Calculate γ0′=H1(TID U ||ID S ||b0||n1||PW1).

[0398] The fifth shared key calculation and the shared key sk of the client T1 The process may include:

[0399] Calculate sk T1 =H2(TID U ||ID S ||b0||n1||PW1).

[0400] Based on the sk T1 The set N0 is encrypted using a symmetric encryption algorithm to obtain the encrypted set Mes1, which also includes:

[0401] The second random number generating unit is used to generate a random number n4.

[0402] The N0 may further include the b1 and the n4, and the N2 may further include the n4.

[0403] The authentication device under the multi-server architecture provided in the embodiment of the present application can be applied to the authentication device under the multi-server architecture. The authentication device under the multi-server architecture can be a client, an application server, or a registration server. Figure 8 The hardware structure diagram of the authentication device under the multi-server architecture is shown. Figure 8 ,The hardware structure of the authentication device under the multi-server architecture may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4;

[0404] In the embodiment of the present application, the number of the processor 1, the communication interface 2, the memory 3, and the communication bus 4 is at least one, and the processor 1, the communication interface 2, and the memory 3 communicate with each other through the communication bus 4;

[0405] The processor 1 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention;

[0406] The memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory;

[0407] Among them, the memory stores a program, and the processor can call the program stored in the memory, and the program is used to: implement each processing flow in the authentication scheme of the aforementioned client under the multi-server architecture, or, implement each processing flow in the authentication scheme of the aforementioned application server under the multi-server architecture, or, implement each processing flow in the authentication scheme of the aforementioned registration server under the multi-server architecture.

[0408] An embodiment of the present application also provides a storage medium, which can store a program suitable for execution by a processor, wherein the program is used to: implement each processing flow in the authentication scheme of the aforementioned client under a multi-server architecture, or, implement each processing flow in the authentication scheme of the aforementioned application server under a multi-server architecture, or, implement each processing flow in the authentication scheme of the aforementioned registration server under a multi-server architecture.

[0409] An embodiment of the present application also discloses an authentication system under a multi-server architecture, wherein the authentication system under the multi-server architecture includes a client, an application server, and a registration server. The specific implementation logic of the client, application server, and registration server can refer to the relevant introduction of the authentication method part under the aforementioned multi-server architecture, which will not be repeated here.

[0410] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprise," "include," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a set of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0411] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0412] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein. < / v> < / v> < / w> < / w>

Claims

1. An authentication method under a multi-server architecture, characterized in that: Applied to the client, the methods include: Get the temporary identity TID entered by the user U and the application server identity ID corresponding to the application server for which the user requested service S , the TID U The identifier generated by the registration server for the user when the user registers with the registration server; Use the preset sampling algorithm to sample from the distribution on the polynomial ring in the MLWE problem to obtain the private key s0 and noise e0; Calculate the public key b0 based on s0 and e0 using the MLWE problem; Based on the TID U , calculating the authentication user identity information γ0 using b0 and a preset first parameter set; Send the set M0 to the application server so that the application server generates relevant authentication information and sends the authentication information and M0 to the registration server, and the registration server authenticates the identity of the user and the application server. The M0 includes the TID U 、The ID S , the b0 and the γ0; receiving a set M1 sent by the application server, wherein M1 includes an encrypted set Mes1, wherein Mes1 is an encrypted set contained in a set obtained by decrypting an encrypted set sent by the application server after the registration server authenticates the identity of the user and the identity of the application server; Decrypt the Mes1 using a preset decryption algorithm to obtain a set N0; Based on the N0, it is confirmed whether the identity authentication of the application server is passed. If the N0 includes information indicating that the identity authentication of the application server is passed, it is confirmed that the identity authentication of the application server is passed.

2. The method according to claim 1, characterized in that Based on the TID U After the b0 and the preset first parameter set generate the authentication user identity information γ0, the method further includes: Calculate the shared key sk with the registration server U0 ; The preset decryption algorithm is used to decrypt the Mes1 to obtain a set N0, including: Based on the sk U0 Decrypt the Mes1 using a symmetric decryption algorithm to obtain a set N0; After confirming that the identity authentication of the application server is passed, the method further includes: Calculate the shared key sk with the application server U .

3. The method according to claim 2, characterized in that The first parameter set includes the ID S 、ID U , PW0, n0 and n1, the ID U and PW0 are the identification and password entered by the user when registering, respectively; n0 is the ID entered by the user U and the random number generated after the PW0, and the n1 is a random number generated in advance; Based on the TID U , b0 and a preset first parameter set generate authentication user identity information γ0, including: Calculation password PW1=H0(ID U ||n0||PW0), H0() is the preset hash function; Calculate γ0=H1(TID U ||ID S ||b0||n1||PW1), H1() is the preset hash function; Calculate the shared key sk with the registration server U0 ,include: Calculate sk U0 =H2(TID U ||ID S |||b0||n1||PW1), H2() is the preset hash function; Said N0 also includes an intermediate secret b1 and a random number n4, and said M1 also includes a signal value c2; The calculation and the application server shared key sk U Previously, it also included: The public key u' is calculated based on b1 and s0, and the u' and c2 are coordinated using the preset error coordination mechanism to obtain the intermediate secret k U ; The calculation and the application server shared key sk U ,include: Calculate sk U =H2(TID U ||ID S ||b0||b1||c2||n4||k U ).

4. An authentication method under a multi-server architecture, characterized in that: Applied to the application server, the method includes: Receive the set M0 sent by the client, which includes the user temporary identity TID U , Application server identity ID S , public key b0 and authentication user identity information γ0, the TID U The identifier generated by the registration server for the user when the user registers with the registration server; When the ID S When identifying itself, the preset sampling algorithm is used to sample from the distribution of the polynomial ring in the MLWE problem to obtain the private key s1 and the noise e1. T , the s1 and the e1 use the MLWE problem to calculate the public key w, the P T The pre-stored public key calculated by the registration server using the MLWE problem when registering with the registration server; The preset error coordination mechanism is used to coordinate the w to obtain the intermediate secret k S1 and signal value c1; Based on the P T , the k S1 and a preset second parameter set to calculate the authentication application server identity information Auth0; Encrypt the set N1 using a preset encryption algorithm to obtain an encrypted set Mes0, where N1 includes Auth0 and c1; Send set M2 to the registration server, where M2 includes M0, Mes0 and P S , the P S The public key generated in advance using the MLWE problem; When receiving the encrypted set Mes2 sent by the registration server, decrypting Mes2 using a preset decryption algorithm to obtain a set N2, wherein N2 includes the encrypted set Mes1; Determining whether N2 further includes information indicating that the user identity authentication has been passed; If so, it indicates that the user's identity authentication is passed, and a set M1 is sent to the client, where M1 includes Mes1.

5. The method according to claim 4, characterized in that Based on the P T , the k S1 Before calculating the authentication application server identity information Auth0 using the preset second parameter set, the method further includes: Calculate the shared key sk with the registration server S0 ; The set N1 is encrypted using a preset encryption algorithm to obtain an encrypted set Mes0, including: Based on the sk S0 Use the symmetric encryption algorithm to encrypt the set N1 to obtain the encrypted set Mes0; The preset decryption algorithm is used to decrypt the Mes2 to obtain a set N2, including: Based on the sk S0 Decrypt the Mes2 using a symmetric decryption algorithm to obtain a set N2; After sending the set M1 to the client, the method further includes: Calculate the shared key sk with the client S1 .

6. The method according to claim 5, characterized in that The calculation and the registration server shared key sk S0 Previously, it also included: Use the sampling algorithm to sample from the distribution on the polynomial ring to obtain the private key s2, noise e2 and noise e3; Based on s2 and e2, the public key b1 is calculated using the MLWE problem, and based on P T , the s2 and the e3 use the MLWE problem to calculate the public key v; The error coordination mechanism is used to coordinate the v to obtain the intermediate secret k S0 and signal value c0; Generate a random number n2; The calculation and the registration server shared key sk S0 ,include: Calculate sk S0 =H1(ID S ||ID TA ||b0||p T ||c0||n2||k S0 ), the ID TA is the identity identifier of the registration server, H1() is a preset hash function; The second parameter set includes the ID S 、The ID TA 、The p s and n3, wherein n3 is a pre-generated random number; Based on the P T , the k S1 and the preset second parameter set to calculate the authentication application server identity information Auth0, including: Calculate Auth0 = H1(ID S ||ID TA ||p s ||p T ||n3||k S1 ); The M2 also includes the n2, the b1, and the c0, and the N2 also includes a random number n4; The calculation and the client shared key sk S1 Previously, it also included: Sampling from the distribution on the polynomial ring using the sampling algorithm to obtain noise e4; Calculate a public key u based on b0, s2, and e4 using the MLWE problem; The preset error coordination mechanism is used to coordinate the u to obtain the intermediate secret k S2 and signal value c2; The calculation and the client shared key sk S1 ,include: Calculate sk S1 =H2(TID U ||ID S ||b0||b1||c2||n4||k S2 ), H2() is the preset hash function; The M1 also includes the c2.

7. An authentication method under a multi-server architecture, characterized in that: Applied to the registration server, the methods include: Receive the set M2 sent by the application server, which includes the set M0, the encrypted set Mes0 and the public key P S , the M0 includes the user temporary identity TID U , Application server identity ID S , public key b0 and authentication user identity information γ0, the TID U The identifier generated for the user when the user registers with the registration server through the client; Decrypt the Mes0 using a preset decryption algorithm to obtain a set N1, wherein N1 includes the authentication application server identity information Auth0 and the signal value c1; Based on the P S and private keys T The public key w' is calculated using the MLWE problem, and the w' and c1 are coordinated using the preset error coordination mechanism to obtain the intermediate secret k T1 , the s T A private key is sampled in advance from a distribution on the polynomial ring in the MLWE problem using a preset sampling algorithm; Based on the public key P T , the k T1 and the preset second parameter set to calculate the authentication application server identity information Auth0', the P T The public key generated in advance by using the MLWE problem when registering with the application server; If the Auth0' is equal to the Auth0, based on the TID U , said b0 and a preset first parameter set generate authentication user identity information γ0'; If γ0' is equal to γ0, the set N0 is encrypted using a preset encryption algorithm to obtain an encrypted set Mes1, where N0 includes information indicating that the application server identity authentication has been passed; Encrypting the set N2 using a preset encryption algorithm to obtain an encrypted set Mes2, wherein N2 includes the information indicating that the user identity authentication is passed and Mes1; Send the Mes2 to the application server.

8. The method according to claim 7, characterized in that Before decrypting Mes0 using a preset decryption algorithm to obtain the set N1, the method further includes: Calculate the shared key sk with the application server T0 ; The preset decryption algorithm is used to decrypt the Mes0 to obtain a set N1, including: Based on the sk T0 Decrypt the Mes0 using a symmetric decryption algorithm to obtain a set N1; The method of encrypting the set N0 by using a preset encryption algorithm to obtain the encrypted set Mes1 further includes: Calculate the shared key sk with the client T1 ; The set N0 is encrypted using a preset encryption algorithm to obtain an encrypted set Mes1, including: Based on the sk T1 Use the symmetric encryption algorithm to encrypt the set N0 to obtain the encrypted set Mes1; The set N2 is encrypted using a preset encryption algorithm to obtain an encrypted set Mes2, including: Based on the sk T0 The set N2 is encrypted using a symmetric encryption algorithm to obtain the encrypted set Mes2.

9. The method according to claim 8, characterized in that The M2 also includes a random number n2, an intermediate secret b1 and a signal value c0; The calculation and the application server shared key sk T0 Previously, it also included: Based on b1 and s T Calculate the public key v' and use the preset error coordination mechanism to coordinate the v' and c0 to obtain the intermediate secret k T0 ; The calculation and the application server shared key sk T0 ,include: Calculate sk T0 =H1(ID S ||ID TA ||b0||p T ||c0||n2||k T0 ), the ID TA is its own identification, H1() is the preset hash function; The second parameter set includes the ID S 、The ID TA 、The p s and n3, wherein n3 is a random number received in advance and sent by the application server; The public key P T , the k T1 and a preset second parameter set to calculate the authentication application server identity information Auth0', including: Calculate Auth0'=H1(ID S ||ID TA ||p s ||p T ||n3||k T1 ); The first parameter set includes the ID S , n1 and PW1, wherein PW1 is the pre-stored password sent by the client when the user registers, and PW1=H0(ID U ||n0||PW0), the ID U and PW0 are the identification and password entered by the user when registering, respectively; n0 is the ID entered by the user U and the random number generated by the client after the PW0, the n1 is the random number sent by the client received in advance, and H0() is a preset hash function; Based on the TID U , b0 and a preset first parameter set generate authentication user identity information γ0', including: Calculate γ0'=H1(TID U ||ID S ||b0||n1||PW1); Calculate the shared key sk with the client T1 ,include: Calculate sk T1 =H2(TID U ||ID S ||b0||n1||PW1), H2() is the preset hash function; Based on the sk T1 The set N0 is encrypted using a symmetric encryption algorithm to obtain the encrypted set Mes1, which also includes: Generate a random number n4; The N0 also includes the b1 and the n4, and the N2 also includes the n4.

10. An authentication system under a multi-server architecture, characterized in that: include: A client, an application server and a registration server, wherein the client is used to implement the various steps of the authentication method under a multi-server architecture of any one of claims 1-3, the application server is used to implement the various steps of the authentication method under a multi-server architecture of any one of claims 4-6, and the registration server is used to implement the various steps of the authentication method under a multi-server architecture of any one of claims 7-9.

Images