Key negotiation method, device, equipment and storage medium

Abstract

The present application provides a key negotiation method, apparatus, device, and storage medium, relating to the field of communications. The method comprises: randomly selecting a first random number and a second random number; calculating negotiation information corresponding to each UE in a group other than a first UE based on the first random number and the second random number; sending the negotiation information corresponding to each UE in the group other than the first UE; receiving the negotiation information sent by each UE in the group other than the first UE; determining a candidate session key based on the received negotiation information and a key derivation function; receiving verification information sent by each UE in the group other than the first UE; decrypting the verification information based on a symmetric encryption algorithm to obtain a first parameter; and determining the candidate session key as a target session key if the first parameter satisfies a preset rule. This method is applicable to key negotiation processes and is used to address the problem of improved negotiation efficiency.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a key negotiation method, apparatus, device, and storage medium. Background Art

[0002] Key negotiation refers to the negotiation between two communicating parties of a random number as the session key for subsequent communications.

[0003] In the current key agreement scheme, two rounds of interaction are required to confirm the session key:

[0004] Round 1: The session initiator first uses the public key to encrypt the identity set of one or more session inviters, obtains the list information and broadcasts it. Each session inviter uses the private key to decrypt the list information, obtains the identity set, and checks whether it is in the identity set.

[0005] Second round: For any session inviter who decrypts and confirms that he is in the identity set, the session inviter uses the public key to encrypt the session message and identity set, and negotiates the key with the session inviters in other identity sets.

[0006] However, the efficiency of the two-round interaction protocol needs to be improved. Summary of the Invention

[0007] Based on the above technical problems, the present application provides a key negotiation method, apparatus, device and storage medium, which can complete key negotiation in one round of interaction and improve the efficiency of key negotiation.

[0008] In the first aspect, the present application provides a key negotiation method, which is applied to the first UE in a group, and the method includes: the first UE randomly selects a first random number and a second random number; the first UE calculates the negotiation information corresponding to each UE in the group except the first UE based on the first random number and the second random number; wherein the negotiation information includes Ri, Ai, Vi, σij; Ri is determined based on the first hash algorithm, the private key of the first UE, and the first random number; Ai is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the first random number; Vi is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the second random number; σij is determined based on the second hash algorithm, the ID of the first UE, the first hash algorithm, the private key of the first UE, the first random number, the third hash algorithm, and the ID of the second UE; the second UE is the UE corresponding to the negotiation information; the first hash algorithm, the second hash algorithm, the first hash algorithm, the private key of the first UE, the first random number, the third hash algorithm, and the ID of the second UE The three hash algorithms and the private key of the first UE are all selected by the authoritative center and sent to the first UE; the first UE sends the negotiation information corresponding to each UE in the group except the first UE; the first UE receives the negotiation information sent by each UE in the group except the first UE; the first UE determines the candidate session key based on the received negotiation information and the key derivation function; the key derivation function is selected by the authoritative center and sent to each UE in the group; the first UE receives the verification information sent by each UE in the group except the first UE; wherein, the verification information is determined by each UE based on the ID of the UE and the first parameter corresponding to the UE based on the symmetric encryption algorithm, and the first parameter corresponding to the UE is determined by the UE based on the received negotiation information; the symmetric encryption algorithm is selected by the authoritative center and sent to each UE in the group; the first UE decrypts the verification information based on the symmetric encryption algorithm to obtain the first parameter; if the first parameter meets the preset rules, the first UE determines the candidate session key as the target session key.

[0009] In a possible implementation, the first UE calculates negotiation information corresponding to each UE in the group except the first UE based on the first random number and the second random number, including:

[0010] The first UE calculates the negotiation information according to the following formula:

[0011]

[0012] Wherein, i represents the first UE; j represents the second UE; H represents the first hash algorithm; represents the private key of the first UE; k i represents the first random number; t i represents the second random number; k i , t i∈Z p ; H1 represents the second hash algorithm; ID i represents the ID of the first UE; H2 represents the third hash function; ID i represents the ID of the second UE; e represents a bilinear mapping, e: G×G→G T ; g represents the generator of G. The negotiation information is specifically {(R i , A i , V i ,{σ i，j} j∈[1，n]，j≠i )}i∈[1,n],i≠j.

[0013] In one possible implementation, the first UE determines a candidate session key based on the received negotiation information and the key derivation function, including:

[0014] The first UE calculates the candidate session key according to the following formula:

[0015]

[0016] Where n represents the number of user devices in the group; K1 represents the verification information encryption key; and K2 is the candidate session key.

[0017] Optionally, the verification information received by the first UE from the second UE is calculated by the second UE according to the following formula:

[0018]

[0019] Among them, C j Indicates the verification information sent by the second UE; (ID j , v j ) represents the first parameter.

[0020] Optionally, the preset rules are:

[0021] Optionally, before the first UE randomly selects the first random number and the second random number, the method further includes: the first UE sends registration information to the authoritative center; the first UE receives the ID of the first UE and the key of the first UE sent by the authoritative center; the key of the first UE is a random number s randomly selected by the authoritative center and generated based on the ID of the first UE, the second hash algorithm, the master private key and the master public key; the master public key and the master private key are used by the authoritative center to obtain security parameters In, and generate a bilinear group (p, g, G, G T ) and the bilinear map e: G×G→G T Then, it is calculated according to the following formula:

[0022] msk=s, mpk=(p,g,G,G T, H, H1, H2)

[0023] Among them, msk represents the master private key; mpk represents the master public key.

[0024] In the key negotiation method provided in the present application, the first UE can implement identity-based anonymous authentication group key negotiation through one round of interaction of negotiation information and verification information, which improves the efficiency of key negotiation compared with the existing two-round interaction protocol.

[0025] In a second aspect, the present application provides a key agreement device, which is applied to the first UE described in the first aspect above, and includes: an acquisition module, a processing module, and a sending module.

[0026] The acquisition module is used to randomly select a first random number and a second random number.

[0027] A processing module is used to calculate the negotiation information corresponding to each UE in the group except the first UE based on the first random number and the second random number; wherein the negotiation information includes Ri, Ai, Vi, σij; Ri is determined based on the first hash algorithm, the private key of the first UE, and the first random number; Ai is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the first random number; Vi is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the second random number; σij is determined based on the second hash algorithm, the ID of the first UE, the first hash algorithm, the private key of the first UE, the first random number, the third hash algorithm, and the ID of the second UE; the second UE is the UE corresponding to the negotiation information; the first hash algorithm, the second hash algorithm, the third hash algorithm, and the private key of the first UE are all selected by the authoritative center and sent to the first UE.

[0028] The sending module is configured to send negotiation information corresponding to each UE in the group except the first UE.

[0029] The acquisition module is further configured to receive negotiation information sent by each UE in the group except the first UE.

[0030] The processing module is further configured to determine a candidate session key based on the received negotiation information and a key derivation function; the key derivation function is selected by the authoritative center and sent to each UE in the group.

[0031] The acquisition module is also used to receive verification information sent by each UE in the group except the first UE; wherein the verification information is determined by each UE based on the ID of the UE and the first parameter corresponding to the UE based on the symmetric encryption algorithm, and the first parameter corresponding to the UE is determined by the UE based on the received negotiation information; the symmetric encryption algorithm is selected by the authoritative center and sent to each UE in the group.

[0032] The processing module is further configured to decrypt the verification information based on a symmetric encryption algorithm to obtain a first parameter; if the first parameter satisfies a preset rule, the candidate session key is determined as the target session key.

[0033] In a possible implementation, the processing module is specifically configured to calculate the negotiation information according to the following formula:

[0034]

[0035] Wherein, i represents the first UE; j represents the second UE; H represents the first hash algorithm; represents the private key of the first UE; k i represents the first random number; t i represents the second random number; k i , t i ∈Z p ; H1 represents the second hash algorithm; ID i represents the ID of the first UE; H2 represents the third hash function; ID i represents the ID of the second UE; e represents a bilinear mapping, e: G×G→G T ; g represents the generator of G. The negotiation information is specifically {(R i , A i , V i ,{σ i，j} j∈[1，n]，j≠i )}i∈[1,n],i≠j.

[0036] In another possible implementation, the processing module is specifically configured to calculate the candidate session key according to the following formula:

[0037]

[0038] Where n represents the number of user devices in the group; K1 represents the verification information encryption key; and K2 is the candidate session key.

[0039] In another possible implementation, the verification information of the second UE received by the acquisition module is calculated by the second UE according to the following formula:

[0040]

[0041] Among them, C j Indicates the verification information sent by the second UE; (ID j , v j ) represents the first parameter.

[0042] In another possible implementation, the preset rules are specifically:

[0043] In another possible implementation, before the acquisition module randomly selects the first random number and the second random number, the sending module is further used to send registration information to the authoritative center; the acquisition module is further used to receive the ID of the first UE and the key of the first UE sent by the authoritative center; the key of the first UE is a random number s randomly selected by the authoritative center and generated based on the ID of the first UE, the second hash algorithm, the master private key and the master public key; the master public key and the master private key are used by the authoritative center to obtain the security parameter λ and generate a bilinear group (p, g, G, G R ) and the bilinear map e: G×G→G R Then, it is calculated according to the following formula:

[0044] msk=s, mpk=(p,g,G,G r , H, H1, H2)

[0045] Among them, msk represents the master private key; mpk represents the master public key.

[0046] In a third aspect, the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the steps of the related method described in the first aspect to implement the method described in the first aspect.

[0047] In a fourth aspect, the present application provides an electronic device comprising a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the electronic device implements the method described in the first aspect above.

[0048] In a fifth aspect, the present application provides a readable storage medium, which includes: software instructions; when the software instructions are executed in an electronic device, the electronic device implements the method described in the first aspect above.

[0049] The beneficial effects of the second to fourth aspects mentioned above can be referred to those described in the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0051] Figure 1 A schematic diagram of the key agreement system provided in an embodiment of the present application;

[0052] Figure 2 A schematic diagram of the composition of an electronic device provided in an embodiment of the present application;

[0053] Figure 3 A flowchart of a key agreement method according to an embodiment of the present invention;

[0054] Figure 4 A schematic diagram of sending negotiation information provided in an embodiment of the present application;

[0055] Figure 5 A schematic diagram of receiving verification information provided in an embodiment of the present application;

[0056] Figure 6 A registration diagram provided for an embodiment of this application;

[0057] Figure 7 A schematic diagram of the composition of the key agreement device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0059] It should be noted that in the embodiments of this application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described in the embodiments of this application as "exemplarily" or "for example" should not be interpreted as being more preferred or advantageous than other embodiments or designs. Rather, the use of words such as "exemplarily" or "for example" is intended to present the relevant concepts in a concrete manner.

[0060] In order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

[0061] Key negotiation refers to the negotiation between two communicating parties of a random number as the session key for subsequent communications.

[0062] In the current key agreement scheme, two rounds of interaction are required to confirm the session key:

[0063] Round 1: The session initiator first uses the public key to encrypt the identity set of one or more session inviters, obtains the list information and broadcasts it. Each session inviter uses the private key to decrypt the list information, obtains the identity set, and checks whether it is in the identity set.

[0064] Second round: For any session inviter who decrypts and confirms that he is in the identity set, the session inviter uses the public key to encrypt the session message and identity set, and negotiates the key with the session inviters in other identity sets.

[0065] However, the efficiency of the two-round interaction protocol needs to be improved.

[0066] Based on this, an embodiment of the present application provides a key negotiation method, which can complete key negotiation in one round of interaction, thereby improving the efficiency of key negotiation.

[0067] The following is an introduction with reference to the accompanying drawings.

[0068] Figure 1 This is a schematic diagram of the key agreement system provided in the embodiment of the present application. Figure 1 As shown, the system includes a user equipment (UE) 100 and an authority center 200. The user equipment 100 may include multiple user equipments, and the multiple user equipments are user equipments of the same group. The multiple user equipments and each user equipment and the authority center 200 can be connected via a wired network or a wireless network.

[0069] The user device 100 may be a mobile phone, a tablet computer, a wearable device, an in-vehicle device, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiment of the present application does not limit the specific type of the user device 100 ( Figure 1 A mobile phone is used as an example).

[0070] The user equipment 100 may determine the session key according to the key negotiation method in the following method embodiment. The specific functions may refer to those described in the following method embodiment and will not be described in detail here.

[0071] The authority center 200 can be an electronic device with computing and processing capabilities, such as a computer or a server. The server can be a single server, or it can be a server cluster composed of multiple servers. In some implementations, the server cluster can also be a distributed cluster. Optionally, the server can also be implemented on a cloud platform. For example, the cloud platform can include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an inter-cloud, and a multi-cloud, or any combination thereof. The embodiments of the present application are not limited to this.

[0072] The authority center 200 is used to generate some relevant parameters for user devices in the group to perform key negotiation (such as a key derivation function and a private key of each user device, etc., which can be specifically described in the following method embodiment) and send them to each user device.

[0073] For example, as described above, each user device and the authoritative center 200 may be connected via a wired network or a wireless network. The wired network or the wireless network may include one or more media or devices capable of transmitting relevant parameters from the authoritative center 200 to the user device 100.

[0074] In some embodiments, the wired network or wireless network may include one or more communication media that enable the authoritative center 200 to transmit the relevant parameters directly to the user device 100 in real time. In the embodiment herein, the authoritative center 200 may modulate the relevant parameters according to a communication standard (e.g., a wireless communication protocol) and transmit the modulated relevant parameters to the user device 100. The one or more communication media may include wireless, and / or wired communication media, such as a radio frequency (RF) spectrum or one or more physical transmission lines. Optionally, the one or more communication media may form part of a packet-based network, which may be, for example, a local area network, a wide area network, or a global network (e.g., the Internet). Optionally, the one or more communication media may include routers, switches, base stations, or other devices that facilitate communication from the authoritative center 200 to the user device 100.

[0075] The key agreement method provided in the embodiments of the present application is executed by any one of the user devices 100, or a processor in any one of the user devices; or an application (APP) installed in any one of the user devices that provides a key agreement function; or a functional module in any one of the user devices that performs a key agreement function. The embodiments of the present application are not limited thereto.

[0076] Figure 2 Schematic diagram of the composition of an electronic device provided in an embodiment of the present application. The electronic device may be any one of the user devices 100 described above. Figure 2 As shown, the electronic device may include: a processor 10, a memory 20, a communication line 30, a communication interface 40, and an input and output interface 50.

[0077] The processor 10 , the memory 20 , the communication interface 40 , and the input / output interface 50 may be connected via a communication line 30 .

[0078] The processor 10 is used to execute the instructions stored in the memory 20 to implement the key negotiation method provided in the following embodiments of the present application. The processor 10 can be a central processing unit (CPU), a general-purpose processor network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller (MCU) / single chip microcomputer / single chip microcomputer, a programmable logic device (PLD) or any combination thereof. The processor 10 can also be any other device with processing functions, such as a circuit, a device or a software module, which is not limited in the embodiments of the present application. In one example, the processor 10 may include one or more CPUs, such as Figure 2 As an optional implementation, the electronic device may include multiple processors, for example, in addition to the processor 10, it may also include a processor 60 ( Figure 2 The dashed line is used as an example.

[0079] The memory 20 is used to store instructions. For example, the instruction may be a computer program. Optionally, the memory 20 may be a read-only memory (ROM) or other types of static storage devices that can store static information and / or instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and / or instructions, or an electrically erasable programmable read-only memory (EEPROM), a CD-ROM or other optical disk storage, an optical disk storage (including a compact disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, etc., and the embodiments of the present application are not limited thereto.

[0080] It should be noted that the memory 20 may exist independently of the processor 10 or may be integrated with the processor 10. The memory 20 may be located inside the electronic device or outside the electronic device, which is not limited in the embodiment of the present application.

[0081] The communication line 30 is used to transmit information between the components included in the electronic device.

[0082] Communication interface 40 is used to communicate with other devices (e.g., other user devices in user device 100 and authority center 200) or other communication networks. Such other communication networks may be Ethernet, radio access networks (RAN), wireless local area networks (WLAN), etc. Communication interface 40 may be a module, circuit, transceiver, or any other device capable of communication.

[0083] The input / output interface 50 is used to implement human-computer interaction between a user and the electronic device, such as action interaction, text interaction, or voice interaction.

[0084] For example, the input / output interface 50 may be a keyboard, a mouse, etc. Action interaction or text interaction between a user and the electronic device may be achieved through the keyboard, the mouse, etc.

[0085] It should be noted that Figure 2 The structure shown in the figure does not constitute a limitation on the electronic device, except Figure 2 In addition to the components shown, the electronic device may include more or fewer components than shown, or a combination of certain components, or a different arrangement of components.

[0086] The following describes the key negotiation method provided in the embodiment of the present application with reference to the accompanying drawings.

[0087] Figure 3 This is a flow chart of the key negotiation method provided in the embodiment of the present application. Figure 3 As shown, the method includes S101 to S108.

[0088] S101. A first UE randomly selects a first random number and a second random number.

[0089] The first UE is any one of the user equipments 100 mentioned above.

[0090] S102: The first UE calculates negotiation information corresponding to each UE in the group except the first UE based on the first random number and the second random number.

[0091] Among them, the negotiation information includes Ri, Ai, Vi, and σij; Ri is determined based on the first hash algorithm, the private key of the first UE, and the first random number; Ai is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the first random number; Vi is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the second random number; σij is determined based on the second hash algorithm, the ID of the first UE, the first hash algorithm, the private key of the first UE, the first random number, the third hash algorithm, and the ID of the second UE; the second UE is the UE corresponding to the negotiation information; the first hash algorithm, the second hash algorithm, the third hash algorithm, and the private key of the first UE are all selected by the authoritative center and sent to the first UE.

[0092] In a possible implementation, the first UE may calculate the negotiation value according to the following formula:

[0093]

[0094] Wherein, i represents the first UE, j represents the second UE, and H represents the first hash algorithm. k represents the private key of the first UE. i Represents the first random number. i Represents the second random number. k i , t i ∈Z p H1 represents the second hash algorithm. i H2 represents the third hash function. i represents the ID of the second UE. e represents a bilinear mapping, e: G×G→G T ; g represents the generator of G.

[0095] For example, see Figure 4 , Figure 4 A schematic diagram of sending negotiation information provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the first UE with ID IDi can send corresponding negotiation information to other UEs in the group.

[0096] S103. The first UE sends negotiation information corresponding to each UE in the group except the first UE.

[0097] The specific process of the first UE sending negotiation information to other UEs can refer to the above Figure 1 The central authority center 200 sends relevant parameters to the user equipment 100, which will not be repeated here.

[0098] S104. The first UE receives negotiation information sent by each UE in the group except the first UE.

[0099] The process of calculating the negotiation information by each UE except the first UE may refer to the above S102 and will not be repeated here.

[0100] S105: The first UE determines a candidate session key based on the received negotiation information and the key derivation function.

[0101] A key derivation function is selected by the central authority and sent to each UE in the group. The key derivation function f:(k, x)→y generates a value y that is computationally indistinguishable from a true random number. Given the key k, x can be mapped to y (the bit length of y can be twice that of x).

[0102] Optionally, the key derivation function may be a hash-based message authentication code (HMAC)-based key derivation function (HKDF). Specific details may be referred to in the RFC5869 protocol and will not be repeated here.

[0103] In a possible implementation, the first UE may calculate the candidate session key according to the following formula:

[0104]

[0105] Where n represents the number of user devices in the group, K1 represents the verification information encryption key, and K2 represents the candidate session key.

[0106] S106. The first UE receives verification information sent by each UE in the group except the first UE.

[0107] The verification information is determined by each UE based on the symmetric encryption algorithm for its ID and the first parameter corresponding to the UE, which is determined by the UE based on the received negotiation information. The symmetric encryption algorithm is selected by the authoritative center and sent to each UE in the group.

[0108] In a possible implementation, taking the second UE other than the first UE in the group as an example, the verification information of the second UE received by the first UE is calculated by the second UE according to the following formula:

[0109]

[0110] Among them, C j Indicates the verification information sent by the second UE. (IDj , v j ) represents the first parameter, v j The calculation process can refer to the v in S102 above. i , no more details.

[0111] Optionally, the symmetric encryption algorithm may be an Advanced Encryption Standard (AES) encryption algorithm or other symmetric encryption algorithms, etc. This embodiment of the present application does not impose any limitation on this.

[0112] For example, see Figure 5 , Figure 5 A schematic diagram of receiving verification information provided in an embodiment of the present application is shown as follows: Figure 5 As shown, the first UE with ID IDi can receive corresponding verification information sent by other UEs in the group.

[0113] S107. The first UE decrypts the verification information based on a symmetric encryption algorithm to obtain a first parameter.

[0114] For example, the first UE may decrypt the verification information according to the symmetric encryption algorithm based on the verification information encryption key K1 obtained when calculating the candidate session key in S105 to obtain the first parameter.

[0115] Optionally, the first UE may decrypt according to the following formula to obtain the first parameter corresponding to the second UE:

[0116]

[0117] S108. If the first parameter satisfies a preset rule, the first UE determines the candidate session key as the target session key.

[0118] In a possible implementation, the preset rules are specifically:

[0119] Optionally, if the first parameter does not satisfy a preset rule, the first UE may stop the key negotiation, or re-initiate the key negotiation, etc. This embodiment of the present application does not impose a limitation on this.

[0120] In the key negotiation method provided in the embodiment of the present application, the first UE can implement identity-based anonymous authentication group key negotiation through one round of interaction of negotiation information and verification information, which improves the efficiency of key negotiation compared with the existing two-round interaction protocol.

[0121] In some possible embodiments, before S101 above, the first UE may also initiate registration with the authoritative center and receive relevant parameters sent by the authoritative center. In this case, before S101 above, the method may further include the following two steps:

[0122] Step 1: The first UE sends registration information to the authority center.

[0123] The registration information may include a unique identifier of the first UE. For example, taking the first UE as a mobile phone, the registration information may include the MSISDN of the user corresponding to the first UE, or the IMEI of the first UE itself, etc. This embodiment of the present application does not limit this.

[0124] Step 2: The first UE receives the ID of the first UE and the key of the first UE sent by the authority center; the key of the first UE is a random number s randomly selected by the authority center and generated based on the ID of the first UE, the second hash algorithm, the master private key and the master public key; the master public key and the master private key are used by the authority center to obtain the security parameter In and generate a bilinear group (p, g, G, G T ) and the bilinear map e: G×G→G T Then, it is calculated according to the following formula:

[0125] msk=s, mpk=(p,g,G,G T , H, H1, H2)

[0126] Among them, msk represents the master private key; mpk represents the master public key. p represents G and G T The level.

[0127] For example, the authority center can first initialize, obtain the security parameter λ input by the administrator, and then generate a bilinear group (p, g, G, G) according to the preset group generation algorithm. T ) and a bilinear map e: G×G→G T , then, the authority center can randomly select three hash functions: H: {0, 1} * →Z p , H1: {0, 1} * →G, H2: {0, 1} * →G and a key derivation function f.

[0128] Bilinear mapping (or bilinear pairing) e: G×G→G T It is a mapping that satisfies bilinearity, non-degeneracy and computability, which maps two elements in the prime order group G to the prime order group G. T For example, the Weil pair defined on a supersingular elliptic curve is a bilinear mapping that satisfies the conditions.

[0129] Optionally, the first hash function, the second hash function, and the third hash function can all be instantiated by SHA and MD5.

[0130] In addition, the authoritative center can select a symmetric encryption algorithm SE = (Keg, Enc, Dec).

[0131] Then, the authority center can also randomly select a random number s∈Z p The system's master private key is msk=s. The system's master public key is mpk=(p, g, G, G T , H, H1, H2).

[0132] Finally, the authority center can send the relevant parameters determined in the above initialization process to each UE in the group. The specific sending process can refer to the above Figure 1 The authoritative center 200 sends relevant parameters to the user equipment 100 as described above, which will not be repeated here.

[0133] For example, see Figure 6 , Figure 6 The registration diagram provided in the embodiment of this application is as follows: Figure 6 As shown, the first UE with ID IDi and the second UE with ID IDj can respectively send registration information to the authoritative center and respectively receive relevant parameters sent by the authoritative center.

[0134] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. It should be easy to realize that the technical goals in this field are combined with the units and algorithm steps of each example described in the embodiments disclosed herein, and the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional technical goals can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0135] In an exemplary embodiment, the present application also provides a key agreement device, which can be applied to the first UE. Figure 7 A schematic diagram of the composition of the key agreement device provided in an embodiment of the present application is shown as follows: Figure 7 As shown, the apparatus may include: an acquisition module 701 , a processing module 702 , and a sending module 703 .

[0136] The acquisition module 701 is configured to randomly select a first random number and a second random number.

[0137] Processing module 702 is used to calculate the negotiation information corresponding to each UE in the group except the first UE based on the first random number and the second random number; wherein the negotiation information includes Ri, Ai, Vi, σij; Ri is determined based on the first hash algorithm, the private key of the first UE, and the first random number; Ai is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the first random number; Vi is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the second random number; σij is determined based on the second hash algorithm, the ID of the first UE, the first hash algorithm, the private key of the first UE, the first random number, the third hash algorithm, and the ID of the second UE; the second UE is the UE corresponding to the negotiation information; the first hash algorithm, the second hash algorithm, the third hash algorithm, and the private key of the first UE are all selected by the authoritative center and sent to the first UE.

[0138] The sending module 703 is configured to send negotiation information corresponding to each UE in the group except the first UE.

[0139] The acquisition module 701 is further configured to receive negotiation information sent by each UE in the group except the first UE.

[0140] The processing module 702 is further configured to determine a candidate session key based on the received negotiation information and a key derivation function; the key derivation function is selected by the authoritative center and sent to each UE in the group.

[0141] The acquisition module 701 is also used to receive verification information sent by each UE in the group except the first UE; wherein the verification information is determined by each UE based on the ID of the UE and the first parameter corresponding to the UE based on the symmetric encryption algorithm, and the first parameter corresponding to the UE is determined by the UE based on the received negotiation information; the symmetric encryption algorithm is selected by the authoritative center and sent to each UE in the group.

[0142] The processing module 702 is further configured to decrypt the verification information based on a symmetric encryption algorithm to obtain a first parameter; if the first parameter satisfies a preset rule, determine the candidate session key as the target session key.

[0143] In some possible embodiments, the processing module 702 is specifically configured to calculate the negotiation information according to the following formula:

[0144]

[0145] Wherein, i represents the first UE; j represents the second UE; H represents the first hash algorithm; represents the private key of the first UE; k i represents the first random number; ti represents the second random number; k i , t i ∈Z p ; H1 represents the second hash algorithm; ID i represents the ID of the first UE; H2 represents the third hash function; ID i represents the ID of the second UE; e represents a bilinear mapping, e: G×G→G T ; g represents the generator of G. The negotiation information is specifically {(R i , A i , V i ,{σ i，j} j∈[1，n]，j≠i )}i∈[1,n],i≠j.

[0146] In some other possible embodiments, the processing module 702 is specifically configured to calculate the candidate session key according to the following formula:

[0147]

[0148] Where n represents the number of user devices in the group; K1 represents the verification information encryption key; and K2 is the candidate session key.

[0149] In some other possible embodiments, the verification information of the second UE received by the acquisition module 701 is calculated by the second UE according to the following formula:

[0150]

[0151] Among them, C j Indicates the verification information sent by the second UE; (ID j , v j ) represents the first parameter.

[0152] In some other possible embodiments, the preset rules are specifically:

[0153] In some other possible embodiments, before the acquisition module 701 randomly selects the first random number and the second random number, the sending module 703 is further used to send registration information to the authoritative center; the acquisition module 701 is further used to receive the ID of the first UE and the key of the first UE sent by the authoritative center; the key of the first UE is a random number s randomly selected by the authoritative center and generated based on the ID of the first UE, the second hash algorithm, the master private key and the master public key; the master public key and the master private key are used by the authoritative center to obtain the security parameter λ and generate a bilinear group (p, g, G, G T ) and the bilinear map e: G×G→G T Then, it is calculated according to the following formula:

[0154] msk=s, mpk=(p,g,G,G T , H, H1, H2)

[0155] Among them, msk represents the master private key; mpk represents the master public key.

[0156] It should be noted that Figure 7 The division of modules in the figure is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. For example, two or more functions may be integrated into a single processing module. This embodiment of the present application does not limit this. The above-mentioned integrated modules may be implemented in the form of hardware or software functional modules. This embodiment of the present application does not limit this.

[0157] In an exemplary embodiment, the present application also provides a readable storage medium, including: an execution instruction, which, when executed on an electronic device, enables the electronic device to execute any one of the methods provided in the above embodiments.

[0158] In an exemplary embodiment, the present application also provides a computer program product including computer-executable instructions, which, when executed on an electronic device, enables the electronic device to execute any one of the methods provided in the above embodiments.

[0159] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer-executable instructions. When the computer-executable instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer-executable instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer-executable instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more media that can be integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0160] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple components. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0161] Although the present application has been described with reference to specific features and embodiments thereof, it is apparent that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely illustrative of the present application as defined by the appended claims and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, the present application is intended to include such modifications and variations as fall within the scope of the claims of the present application and their equivalents.

[0162] The above is only a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A key negotiation method, characterized in that: The method is applied to any first user equipment UE in a group, and the method includes: The first UE randomly selects a first random number and a second random number; The first UE calculates negotiation information corresponding to each UE in the group except the first UE based on the first random number and the second random number; wherein the negotiation information includes Ri, Ai, Vi, and σij; Ri is determined based on the first hash algorithm, the private key of the first UE, and the first random number; Ai is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the first random number; Vi is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the second random number; σij is determined based on the second hash algorithm, the ID of the first UE, the first hash algorithm, the private key of the first UE, the first random number, the third hash algorithm, and the ID of the second UE; the second UE is the UE corresponding to the negotiation information; the first hash algorithm, the second hash algorithm, the third hash algorithm, and the private key of the first UE are all selected by the authoritative center and sent to the first UE; The first UE calculates negotiation information corresponding to each UE in the group except the first UE based on the first random number and the second random number, including: The first UE calculates V in the negotiation information according to the following formula i : Wherein, i represents the first UE; H represents the first hash algorithm; H1 represents the second hash algorithm; ID i represents the ID of the first UE; i Indicates a first parameter corresponding to the first UE; represents the private key of the first UE; i represents the second random number, t i ∈Z p , H:{0,1} * →Z p ; The first UE sends, to each UE in the group except the first UE, negotiation information corresponding to each UE; The first UE receives negotiation information sent by each UE in the group except the first UE; The first UE determines a candidate session key based on the received negotiation information and a key derivation function; the key derivation function is selected by the authoritative center and sent to each UE in the group; The first UE receives verification information sent by each UE in the group except the first UE; wherein the verification information is determined by each UE based on an ID of the UE and a first parameter corresponding to the UE using a symmetric encryption algorithm; the symmetric encryption algorithm is selected by the authoritative center and sent to each UE in the group; and the verification information of the second UE received by the first UE is calculated by the second UE according to the following formula: Wherein, j represents the second UE; C j Indicates the verification information sent by the second UE; Enc indicates the encryption operation; K1 indicates the verification information encryption key; ID j represents the ID of the second UE; represents the private key of the second UE, t j represents a second random number randomly selected by the second UE; j Indicates the first parameter corresponding to the second UE; Decrypting, by the first UE, the verification information based on the symmetric encryption algorithm to obtain a first parameter; If the first parameter satisfies a preset rule, the first UE determines the candidate session key as the target session key; the preset rule is specifically:

2. The method according to claim 1, characterized in that The first UE calculates negotiation information corresponding to each UE in the group except the first UE based on the first random number and the second random number, further comprising: The first UE calculates V in the negotiation information according to the following formula i Other information: A i =e(X i ,g); Among them, k i represents the first random number; k i ∈Z p ; H2 represents the third hash function; e represents the bilinear mapping, e:G×G→G T ; g represents the generator of G; the negotiation information is specifically {(R i ,A i ,V i ,{σ i,j } j∈[1,n],j≠i )} i∈[1,n],i≠j .

3. The method according to claim 2, characterized in that The first UE determines, based on the received negotiation information and the key derivation function, a candidate session key, including: The first UE calculates the candidate session key according to the following formula: Wherein, n represents the number of user devices in the group; K2 is the candidate session key.

4. The method according to claim 1, wherein Before the first UE randomly selects the first random number and the second random number, the method further includes: The first UE sends registration information to the authoritative center; The first UE receives the ID of the first UE and the key of the first UE sent by the authoritative center; The key of the first UE is a random number s randomly selected by the authoritative center and generated based on the ID of the first UE, the second hash algorithm, the master private key and the master public key; the master public key and the master private key are used by the authoritative center to obtain the security parameter λ and generate a bilinear group (p, g, G, G T ) and the bilinear map e:G×G→G T Then, it is calculated according to the following formula: msk=s、mpk=(p,g,G,G T ,H,H1,H2); Among them, msk represents the master private key; mpk represents the master public key.

5. The method according to any one of claims 1 to 4, characterized in that The key derivation function is a key derivation function HKDF based on a hash message authentication code HMAC.

6. A key agreement device, characterized in that: The device is applied to a first user equipment UE in a group, and includes: an acquisition module, a processing module, and a sending module; The acquisition module is used to randomly select a first random number and a second random number; The processing module is configured to calculate negotiation information corresponding to each UE in the group except the first UE based on the first random number and the second random number; wherein the negotiation information includes Ri, Ai, Vi, and σij; Ri is determined based on the first hash algorithm, the private key of the first UE, and the first random number; Ai is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the first random number; Vi is determined based on the ID of the first UE, the second hash algorithm, the first hash algorithm, the private key of the first UE, and the second random number; σij is determined based on the second hash algorithm, the ID of the first UE, the first hash algorithm, the private key of the first UE, the first random number, the third hash algorithm, and the ID of the second UE; the second UE is the UE corresponding to the negotiation information; the first hash algorithm, the second hash algorithm, the third hash algorithm, and the private key of the first UE are all selected by the authoritative center and sent to the first UE; The processing module is specifically configured to calculate the V in the negotiation information according to the following formula: i : Wherein, i represents the first UE; H represents the first hash algorithm; H1 represents the second hash algorithm; ID i represents the ID of the first UE; i Indicates a first parameter corresponding to the first UE; represents the private key of the first UE; i represents the second random number, t i ∈Z p , H:{0,1} * →Z p ; The sending module is configured to send negotiation information corresponding to each UE in the group except the first UE; The acquisition module is further configured to receive negotiation information sent by each UE in the group except the first UE; The processing module is further configured to determine a candidate session key based on the received negotiation information and a key derivation function; the key derivation function is selected by the authoritative center and sent to each UE in the group; The acquisition module is further configured to receive verification information sent by each UE in the group except the first UE; wherein the verification information is determined by each UE based on an ID of the UE and a first parameter corresponding to the UE using a symmetric encryption algorithm; the symmetric encryption algorithm is selected by the authoritative center and sent to each UE in the group; and the verification information of the second UE received by the acquisition module is calculated by the second UE according to the following formula: Wherein, j represents the second UE; C j Indicates the verification information sent by the second UE; Enc indicates the encryption operation; K1 indicates the verification information encryption key; ID j represents the ID of the second UE; represents the private key of the second UE, t j represents a second random number randomly selected by the second UE; j Indicates the first parameter corresponding to the second UE; The processing module is further configured to decrypt the verification information based on the symmetric encryption algorithm to obtain a first parameter; if the first parameter satisfies a preset rule, the candidate session key is determined as the target session key; the preset rule is specifically:

7. An electronic device, characterized in that: The electronic device includes: a processor and a memory; The memory stores instructions executable by the processor; When the processor is configured to execute the instructions, the electronic device implements the method according to any one of claims 1 to 5.

8. A readable storage medium, characterized in that: The readable storage medium includes: software instructions; When the software instructions are executed in an electronic device, the electronic device is enabled to implement the method according to any one of claims 1 to 5.

Images