Security negotiation method, device, system, equipment and medium for shared key

Abstract

The disclosed embodiments disclose a method, apparatus, system, device, and medium for secure negotiation of a shared key. The method includes: generating a first random number and sending the first random number; obtaining a first parameter based on a private key of an initiating end and a public key sent by a responding end; obtaining a third parameter based on the first random number, the first parameter, a second random number sent by the responding end, and a preset shared password; obtaining a first verification parameter based on a fourth random number sent by the responding end, the public key of the initiating end, the public key of the responding end, and the third parameter; and negotiating a shared key with the responding end when the first verification parameter and a sixth parameter sent by the responding end are identical. By adding a verification process for the peer device, the security of the shared key negotiation is guaranteed.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a method, apparatus, system, device, and medium for secure negotiation of a shared key. Background Art

[0002] To ensure the security of data communication between the initiator and the responder, the initiator and the responder usually negotiate a shared key before data transmission between the initiator and the responder, and use the shared key as the basis to ensure the security of subsequent data transmission between the two.

[0003] Currently, when the initiator and responder negotiate a shared key, they can use the SM2 key exchange protocol to create the shared key. The SM2 key exchange protocol allows the communicating parties to exchange information two or three times, combined with calculations, to obtain a shared key jointly determined by both parties. However, during the process of negotiating a shared key using the SM2 key exchange protocol, a third-party device may intercept the information transmitted between the initiator and responder, impersonate the initiator to negotiate a key with the responder, impersonate the responder to negotiate a key with the initiator, or even communicate with the initiator or responder based on the negotiated shared key, eavesdrop on data, and / or tamper with data, making communication security impossible.

[0004] Therefore, how to ensure the security of shared key negotiation has become a technical problem that needs to be solved urgently. Summary of the Invention

[0005] In order to solve the problems in the related art, the embodiments of the present disclosure provide a method, apparatus, system, device and medium for secure negotiation of a shared key.

[0006] In a first aspect, an embodiment of the present disclosure provides a method for secure negotiation of a shared key.

[0007] Specifically, the shared key security negotiation method is applied to an initiating end, and the method includes:

[0008] Generate a first random number and send the first random number;

[0009] Obtaining a private key of the initiator and a public key sent by the responder, and obtaining a first parameter according to the private key of the initiator and the public key of the responder;

[0010] Obtain a second random number and a preset shared password sent by the responding end, and obtain a third parameter according to the first random number, the first parameter, the second random number, and the shared password;

[0011] Obtaining a sixth parameter sent by the responding end, a fourth random number sent by the responding end, and a public key of the initiating end, and obtaining a first verification parameter according to the fourth random number, the public key of the initiating end, the public key of the responding end, and the third parameter;

[0012] When the first verification parameter and the sixth parameter are the same, negotiate a shared key with the responding end.

[0013] In one implementation of the present disclosure, before generating the first random number, the method further includes:

[0014] Obtaining a first shared password, and sending the first shared password to the verification device;

[0015] Generating a first random number includes:

[0016] When the first indication information of the verification device is received, the first shared password is used as the shared password and the first random number is generated. The first indication information is used to indicate that the first shared password is the same as the second shared password, and the second shared password is sent by the responding end.

[0017] In one implementation of the present disclosure, after obtaining the third parameter according to the first random number, the first parameter, the second random number, and the shared password, the method further includes:

[0018] generating a third random number, and sending the third random number;

[0019] A fifth parameter is obtained according to the third random number, the public key of the initiator, the public key of the responder, and the third parameter, and the fifth parameter is sent.

[0020] In one implementation of the present disclosure, the method further includes:

[0021] The public key of the initiator is obtained according to the private key of the initiator, and the public key of the initiator is sent.

[0022] In one implementation of the present disclosure, the private key of the initiator is determined by a random number generated by a random number generator of the initiator.

[0023] In one implementation of the present disclosure, the first parameter M1 satisfies:

[0024] M1=[d A ]P B ;

[0025] Among them, d A is the private key of the initiator, P B is the public key of the responding end.

[0026] In one implementation of the present disclosure, the third parameter Q1 satisfies:

[0027] Q1=CMAC(N1,M1||N2||S);

[0028] Wherein, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N1 is the first random number, M1 is the first parameter, N2 is the second random number, and S is the shared password.

[0029] In one implementation of the present disclosure, the first verification parameter l1 satisfies:

[0030] l1=CMAC(N B ,x B ||y B ||x A ||y A ||Q1);

[0031] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N B is the fourth random number, x B is the public key P of the responder B x coordinates, y coordinates on the elliptic curve B is the public key P of the responder B The y coordinate on the elliptic curve, x A is the public key P of the initiator A x coordinates, y coordinates on the elliptic curve A is the public key P of the initiator A The y coordinate on the elliptic curve, Q1 is the third parameter.

[0032] In one implementation of the present disclosure, the fifth parameter C A satisfy:

[0033] C A =CMAC(N A ,x A ||y A ||x B ||y B ||Q1);

[0034] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N A is the third random number, x B is the public key P of the responder B x coordinates, y coordinates on the elliptic curve B is the public key P of the responder B The y coordinate on the elliptic curve, xA is the public key P of the initiator A x coordinates, y coordinates on the elliptic curve A is the public key P of the initiator A The y coordinate on the elliptic curve, Q1 is the third parameter.

[0035] In one implementation of the present disclosure, the public key P of the initiator A satisfy:

[0036] P A =(x A ,y A )=[d A ]G;

[0037] Among them, x A is the public key P of the initiator A x coordinates, y coordinates on the elliptic curve A is the public key P of the initiator A The y coordinate on the elliptic curve, d A is the private key of the initiator, G is the base point of the elliptic curve, and [] is the multiple point operation on the elliptic curve.

[0038] In a second aspect, an embodiment of the present disclosure provides a method for secure negotiation of a shared key.

[0039] Specifically, the shared key security negotiation method is applied to the responding end, and the method includes:

[0040] Generate a second random number and send the second random number;

[0041] Obtaining the private key of the responding end and the public key sent by the initiating end, and obtaining a second parameter according to the private key of the responding end and the public key of the initiating end;

[0042] Obtain a first random number and a preset shared password sent by the initiator, and obtain a fourth parameter based on the first random number, the second parameter, the second random number, and the shared password;

[0043] Obtaining a fifth parameter sent by the initiator, a third random number sent by the initiator, and a public key of the responder, and obtaining a second verification parameter based on the third random number, the public key of the responder, the public key of the initiator, and the fourth parameter;

[0044] When the second verification parameter is the same as the fifth parameter, a shared key is negotiated with the initiator.

[0045] In one implementation of the present disclosure, before generating the second random number, the method further includes:

[0046] Obtaining a second shared password and sending the second shared password to the verification device;

[0047] Generating a second random number comprises:

[0048] When the first indication information of the verification device is received, the second shared password is used as the shared password and a second random number is generated, the first indication information is used to indicate that the first shared password is the same as the second shared password, and the first shared password is sent by the initiator.

[0049] In one implementation of the present disclosure, after obtaining the fourth parameter according to the first random number, the second parameter, the second random number, and the shared password, the method further includes:

[0050] generating a fourth random number, and sending the fourth random number;

[0051] Obtain a sixth parameter according to the fourth random number, the public key of the initiator, the public key of the responder, and the fourth parameter, and send the sixth parameter.

[0052] In one implementation of the present disclosure, the method further includes:

[0053] Obtain the public key of the responding end according to the private key of the responding end, and send the public key of the responding end.

[0054] In one implementation of the present disclosure, the private key of the responding end is determined by a random number generated by a random number generator of the responding end.

[0055] In one implementation of the present disclosure, the second parameter M2 satisfies:

[0056] M2=[d B ]P A ;

[0057] Among them, d B is the private key of the responding end, P A is the public key of the initiator.

[0058] In one implementation of the present disclosure, the fourth parameter Q2 satisfies:

[0059] Q2=CMAC(N1,M2||N2||S);

[0060] Wherein, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N1 is the first random number, M2 is the second parameter, N2 is the second random number, and S is the shared password.

[0061] In one implementation of the present disclosure, the second verification parameter l2 satisfies:

[0062] l2=CMAC(N A ,x A ||y A ||x B ||y B ||Q2);

[0063] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N A is the third random number, x B is the public key P of the responder B x coordinates, y coordinates on the elliptic curve B is the public key P of the responder B The y coordinate on the elliptic curve, x A is the public key P of the initiator A x coordinates, y coordinates on the elliptic curve A is the public key P of the initiator A The y coordinate on the elliptic curve, Q2 is the fourth parameter.

[0064] In one implementation of the present disclosure, the sixth parameter C B satisfy:

[0065] C B =CMAC(N B ,x B ||y B ||x A ||y A ||Q2);

[0066] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N B is the fourth random number, x B is the public key P of the responder B x coordinates, y coordinates on the elliptic curve B is the public key P of the responder B The y coordinate on the elliptic curve, x A is the public key P of the initiator A x coordinates, y coordinates on the elliptic curve A is the public key P of the initiator A The y coordinate on the elliptic curve, Q2 is the fourth parameter.

[0067] In one implementation of the present disclosure, the public key P of the responding end B satisfy:

[0068] P B =(xB ,y B )=[d B ]G;

[0069] Among them, x B is the public key P of the responder B x coordinates, y coordinates on the elliptic curve B is the public key P of the responder B The y coordinate on the elliptic curve, d B is the private key of the responding end, G is the base point of the elliptic curve, and [] is the multiple point operation on the elliptic curve.

[0070] In a third aspect, an embodiment of the present disclosure provides a secure negotiation device for a shared key.

[0071] Specifically, the shared key security negotiation device is applied to the initiating end, and the device includes:

[0072] a communication module, configured to generate a first random number and send the first random number;

[0073] The processing module is configured to obtain the private key of the initiator and the public key sent by the responder, and obtain a first parameter based on the private key of the initiator and the public key of the responder; obtain a second random number and a preset shared password sent by the responder, and obtain a third parameter based on the first random number, the first parameter, the second random number and the shared password; obtain a sixth parameter sent by the responder, a fourth random number sent by the responder and the public key of the initiator, and obtain a first verification parameter based on the fourth random number, the public key of the initiator, the public key of the responder and the third parameter; and when the first verification parameter and the sixth parameter are the same, negotiate a shared key with the responder.

[0074] In a fourth aspect, an embodiment of the present disclosure provides a secure negotiation device for a shared key.

[0075] Specifically, the shared key security negotiation device is applied to the responding end, and the device includes:

[0076] a communication module, configured to generate a second random number and send the second random number;

[0077] The processing module is configured to obtain the private key of the responding end and the public key sent by the initiating end, and obtain a second parameter based on the private key of the responding end and the public key of the initiating end; obtain a first random number and a preset shared password sent by the initiating end, and obtain a fourth parameter based on the first random number, the second parameter, the second random number and the shared password; obtain a fifth parameter sent by the initiating end, a third random number sent by the initiating end and the public key of the responding end, and obtain a second verification parameter based on the third random number, the public key of the responding end, the public key of the initiating end and the fourth parameter; and when the second verification parameter and the fifth parameter are the same, negotiate a shared key with the initiating end.

[0078] In a fifth aspect, an embodiment of the present disclosure provides a security negotiation system for a shared key, the system comprising:

[0079] an initiating end, configured to execute the method in the first aspect and any possible implementation manner of the first aspect; and

[0080] The responding end is used to execute the method in the second aspect and any possible implementation manner of the second aspect.

[0081] In a sixth aspect, an embodiment of the present disclosure provides a chip, the chip including a processor, the processor being configured to call a computer program in a memory to execute the method steps of the above-mentioned shared key security negotiation method.

[0082] In the seventh aspect, an embodiment of the present disclosure provides an electronic device comprising a memory and at least one processor, wherein the memory is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor to implement the above-mentioned first aspect or second aspect, and the method in any possible implementation of the first aspect or the second aspect.

[0083] In an eighth aspect, an embodiment of the present disclosure provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the first aspect or the second aspect, and the method in any possible implementation of the first aspect or the second aspect.

[0084] In the ninth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the first aspect or the second aspect, and a method in any possible implementation of the first aspect or the second aspect.

[0085] The technical effects provided by the embodiments of the present disclosure may include the following beneficial effects:

[0086] In the above technical solution, before the initiator and responder enter into formal shared key negotiation, the initiator verifies the identity of the responder by determining whether a locally generated first verification parameter is identical to a sixth parameter sent by the responder, and the responder verifies the identity of the initiator by determining whether a locally generated second verification parameter is identical to a fifth parameter sent by the initiator. If the first verification parameter and the sixth parameter are identical, and the second verification parameter and the fifth parameter are identical, the verification passes, and the two devices are deemed to be the correct devices with which to negotiate a key, and the formal shared key negotiation proceeds. By adding a verification process for the peer device at both the initiator and responder, the security of the subsequent shared key negotiation is guaranteed.

[0087] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] Other features, objectives and advantages of the present disclosure will become more apparent through the following detailed description of non-limiting embodiments in conjunction with the accompanying drawings. In the accompanying drawings:

[0089] Figure 1 A flowchart illustrating a method for secure negotiation of a shared key according to an embodiment of the present disclosure is shown;

[0090] Figure 2 Another flow chart showing a method for secure negotiation of a shared key according to an embodiment of the present disclosure is shown;

[0091] Figure 3 A schematic diagram illustrating communication interactions of a secure negotiation method for a shared key according to an embodiment of the present disclosure;

[0092] Figure 4 A structural block diagram of a secure negotiation device for a shared key according to an embodiment of the present disclosure is shown;

[0093] Figure 5 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown;

[0094] Figure 6 It is a structural diagram of a computer system suitable for implementing a secure negotiation method for a shared key according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0095] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0096] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, actions, components, parts, or combinations thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, actions, components, parts, or combinations thereof exist or are added.

[0097] It should also be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0098] As mentioned above, currently, when the initiator and responder negotiate a shared key, they can use the SM2 key exchange protocol to establish the shared key. The SM2 key exchange protocol satisfies the communicating parties by exchanging information two or three times and, combined with calculations, obtaining a shared key jointly determined by both parties. However, during the process of negotiating the shared key between the initiator and responder using the SM2 key exchange protocol, a third-party device may intercept the information transmitted between the initiator and responder, impersonate the initiator to negotiate a key with the responder, impersonate the responder to negotiate a key with the initiator, or even communicate with the initiator or responder based on the negotiated shared key, eavesdropping on data and / or tampering with it, making communication security impossible.

[0099] Taking the above-mentioned defects into consideration, the present disclosure proposes a method for secure negotiation of a shared key. Before the initiator and the responder enter into the negotiation of the shared key, the initiator verifies the identity of the responder by judging whether the first verification parameter generated locally is the same as the sixth parameter sent by the responder, and the responder verifies the identity of the initiator by judging whether the second verification parameter generated locally is the same as the fifth parameter sent by the initiator. When the first verification parameter and the sixth parameter are the same, and the second verification parameter and the fifth parameter are the same, the verification is passed, and the two parties are devices that are to negotiate a key with each other and have the correct identity, and then enter into the formal shared key negotiation. Since the verification process of the opposite device is added at the initiator and the responder, the security of the subsequent shared key negotiation is guaranteed.

[0100] Figure 1 A flowchart of a secure negotiation method for a shared key according to an embodiment of the present disclosure is shown.

[0101] like Figure 1 As shown, the method 100 may include steps 101 to 105, which may be implemented by the initiator, or performed by a physical device that can provide the initiator function, or performed by a component configured in the physical device (such as a chip, etc.), or performed by a module that can implement part or all of the initiator function, etc., and this application does not limit this.

[0102] For ease of understanding, the present disclosure uses the initiating end as an example to describe the method provided by the present disclosure. Detailed descriptions of each step in the method 100 are given below.

[0103] In step 101, a first random number is generated and sent;

[0104] In step 102, the private key of the initiator and the public key sent by the responder are obtained, and the first parameter is obtained according to the private key of the initiator and the public key of the responder;

[0105] In step 103, the second random number and the preset shared password sent by the responding end are obtained, and the third parameter is obtained according to the first random number, the first parameter, the second random number and the shared password;

[0106] In step 104, the sixth parameter sent by the responding end, the fourth random number sent by the responding end, and the public key of the initiating end are obtained, and the first verification parameter is obtained according to the fourth random number, the public key of the initiating end, the public key of the responding end, and the third parameter;

[0107] In step 105, when the first verification parameter and the sixth parameter are the same, a shared key is negotiated with the responding end.

[0108] In one embodiment of the present disclosure, the first random number may be generated by a random number generator of the initiating end and sent by the initiating end to the responding end.

[0109] In this disclosure, the initiator and responder each have a key pair, which is derived through an encryption algorithm. A key pair consists of a public key and a private key. The public key encrypts the session and verifies digital signatures, while the corresponding private key decrypts the session data. The private key is a non-public key that is kept private by the device (e.g., the initiator or responder).

[0110] For ease of distinction, this disclosure refers to the public key and private key contained in the initiator's key pair as the initiator's public key and the initiator's private key, respectively, and the public key and private key contained in the responder's key pair as the responder's public key and the responder's private key, respectively.

[0111] The responder can send the public key determined locally to the initiator. When the responder obtains its own public key locally, it sends the public key to the initiator.

[0112] In one embodiment of the present disclosure, the public key of the responding end may be represented as a coordinate on an elliptic curve, where the coordinate includes: an x-coordinate of the public key and a y-coordinate of the public key.

[0113] In the above step 102, the initiator may obtain the first parameter based on the first preset formula according to the local private key and the public key sent by the responder.

[0114] In one embodiment of the present disclosure, the second random number may be generated by a random number generator of the responding end and sent by the responding end to the initiating end.

[0115] In one embodiment of the present disclosure, the shared password is a password pre-negotiated between the initiator and the responder, and the shared password can be used to verify the identity of the peer device.

[0116] It should be understood that, for an initiator, a device communicating with the initiator may be referred to as a peer device, and correspondingly, for a responder, a device communicating with the responder may be referred to as a peer device.

[0117] Optionally, the shared password may consist of numbers and / or letters, such as "1A2B3C".

[0118] In the above step 103, the initiator may obtain the third parameter based on the second preset formula according to the first random number, the first parameter, the second random number and the shared password.

[0119] In one embodiment of the present disclosure, the sixth parameter may be used to characterize the identity of the peer device communicating with the initiator. In the present disclosure, the sixth parameter may be determined by the responder and sent to the initiator.

[0120] In one embodiment of the present disclosure, the fourth random number is determined by a random number generator at the responding end. Optionally, the fourth random number is different from the second random number.

[0121] In one embodiment of the present disclosure, the public key of the initiator may also be represented as a coordinate on an elliptic curve, where the coordinate includes: an x-coordinate of the public key and a y-coordinate of the public key.

[0122] In one embodiment of the present disclosure, the first verification parameter can be used to verify the identity of a peer device communicating with the initiator. In other words, the initiator can use the first verification parameter to verify whether the peer device communicating with it is a responder with the correct identity and intended for key negotiation with the initiator, or a potentially dangerous third-party device.

[0123] In the above step 104, the initiator may obtain the first verification parameter based on the third preset formula according to the fourth random number, the public key of the initiator, the public key of the responder and the third parameter.

[0124] In the above step 105, when the first verification parameter is the same as the sixth parameter, it indicates that the peer device communicating with the initiator is a responder with a correct identity and is about to perform key negotiation with the initiator, and the initiator can negotiate a shared key with the responder based on a preset key negotiation protocol; when the first verification parameter is different from the sixth parameter, it indicates that the peer device communicating with the initiator is not a responder with a correct identity and is about to perform key negotiation with the initiator, but a third-party device, and the initiator terminates the communication with the peer device, that is, does not perform key negotiation with the peer device.

[0125] Optionally, the key negotiation protocol may be an SM2 key negotiation protocol.

[0126] It should be noted that the above-mentioned first to third preset formulas can be found in the following description and will not be elaborated here.

[0127] In the above embodiment, the initiator generates a first random number and sends it to the responder. The first parameter is obtained based on the private key of the initiator and the public key sent by the responder. The third parameter is then obtained based on the generated first random number, the second random number sent by the responder, and the preset shared password. The first verification parameter is obtained based on the fourth random number sent by the responder, the public key of the initiator, the public key of the responder, and the third parameter. When it is determined that the first verification parameter is the same as the sixth parameter sent by the responder, the shared key is formally negotiated with the responder. Because the initiator adds a verification process for the peer device communicating with it before the initiator and the responder formally negotiate the shared key, the correct identity of the responder is ensured, thereby providing security for subsequent shared key negotiation. Once the initiator discovers that the verification has failed, it can detect the dangerous third-party device early and terminate the communication, avoiding the possibility of the shared key and communication data being stolen by the third-party device.

[0128] In one embodiment of the present disclosure, the first preset formula (1) mentioned above is as follows. In other words, the first parameter M1 satisfies:

[0129] M1=[d A ]P B ;(1)

[0130] Among them, d A is the private key of the initiator, P B The public key of the responder.

[0131] In one embodiment of the present disclosure, the second preset formula (2) mentioned above is as follows. In other words, the third parameter Q1 satisfies:

[0132] Q1=CMAC(N1,M1||N2||S);(2)

[0133] Wherein, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N1 is a first random number, M1 is a first parameter, N2 is a second random number, and S is a shared password.

[0134] In one embodiment of the present disclosure, the third preset formula (3) mentioned above is as follows. In other words, the first verification parameter l1 satisfies:

[0135] l1=CMAC(N B ,x B ||y B ||x A ||y A ||Q1);(3)

[0136] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N B is the fourth random number, x B The public key P of the responder B x coordinates, y coordinates on the elliptic curve B The public key P of the responder B The y coordinate on the elliptic curve, x A The public key P of the initiator A x coordinates, y coordinates on the elliptic curve A The public key P of the initiator A The y-coordinate on the elliptic curve, Q1 is the third parameter.

[0137] In one embodiment of the present disclosure, before step 101, i.e., generating the first random number, the method 100 may further include:

[0138] Obtaining a first shared password and sending the first shared password to the verification device;

[0139] Generating a first random number in step 101 may specifically include:

[0140] When receiving the first indication information from the verification device, the first shared password is used as the shared password and a first random number is generated. The first indication information is used to indicate that the first shared password is the same as the second shared password sent by the responding end.

[0141] In the present disclosure, the first shared password is a shared password pre-negotiated between the initiator and the responder for key negotiation and stored locally. The second shared password is a shared password pre-negotiated between the responder and the initiator for key negotiation and stored locally.

[0142] In this embodiment, to further ensure the security of shared key negotiation, a verification device can be deployed in addition to the initiator and responder. The initiator can send the locally stored first shared secret to the verification device. Simultaneously, the responder can send the locally stored second shared secret to the verification device. If the verification device determines that the first shared secret and the second shared secret are identical, verification is successful. The verification device can then send a first indication message to both the initiator and the responder, indicating that the first and second shared secrets are identical. Upon receiving this first indication message, the initiator can determine that the peer device it is communicating with is the correct responder with whom key negotiation is to proceed. Similarly, upon receiving this first indication message, the responder can also determine that the peer device it is communicating with is the correct initiator with whom key negotiation is to proceed. The initiator and responder can then proceed to step 101, performing a secondary verification. If the verification device determines that the first and second shared secrets are different, verification fails, and the verification device does not send the first indication message to the initiator and responder. If the initiator and responder do not receive this first indication message, communication ends without proceeding to step 101.

[0143] It should be understood that when the first shared password and the second shared password are the same, either shared password can be used as the preset shared password in the aforementioned step 103.

[0144] In one embodiment of the present disclosure, after step 103, i.e., obtaining the third parameter according to the first random number, the first parameter, the second random number, and the shared password, the method 100 may further include:

[0145] Generate a third random number and send the third random number;

[0146] A fifth parameter is obtained according to the third random number, the public key of the initiator, the public key of the responder, and the third parameter, and the fifth parameter is sent.

[0147] In one embodiment of the present disclosure, the third random number may be generated by a random number generator at the initiating end and sent by the initiating end to the responding end. Optionally, the third random number is different from the first random number.

[0148] In one embodiment of the present disclosure, the fifth parameter may be used to characterize the identity of the initiating end.

[0149] In this embodiment, in order to ensure that the responding end can normally verify the identity of the peer device with which it communicates, the initiating end can generate a random number again through a random number generator, and obtain a fifth parameter used to characterize its own identity based on the fourth preset formula according to the random number, the public key of the initiating end, the public key of the responding end and the third parameter obtained in step 103, and send the fifth parameter to the responding end for verification.

[0150] In one embodiment of the present disclosure, the fourth preset formula (4) mentioned above is as follows. In other words, the fifth parameter C A satisfy:

[0151] C A =CMAC(N A ,x A ||y A ||x B ||y B ||Q1);(4)

[0152] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N A is the third random number, x B The public key P of the responder B x coordinates, y coordinates on the elliptic curve B The public key P of the responder B The y coordinate on the elliptic curve, x A The public key P of the initiator A x coordinates, y coordinates on the elliptic curve A The public key P of the initiator A The y-coordinate on the elliptic curve, Q1 is the third parameter.

[0153] Optionally, when the CMAC() in the second to fourth preset formulas mentioned above uses a preset algorithm as the CMAC function of the block encryption function, the preset algorithm may be the national secret SM4 algorithm, or may be the advanced encryption standard (AES) algorithm or the data encryption standard (DES) algorithm. Preferably, the preset algorithm is the national secret SM4 algorithm.

[0154] In one embodiment of the present disclosure, the method 100 may further include:

[0155] Obtain the public key of the initiator based on the private key of the initiator and send the public key of the initiator.

[0156] In one embodiment of the present disclosure, the private key of the initiator is determined by a random number generated by a random number generator of the initiator.

[0157] In this embodiment, the initiator may use a random number generated by a random number generator as the private key of the initiator. When determining the public key of the initiator, the public key of the initiator may be obtained based on the private key of the initiator according to the fifth preset formula.

[0158] In one embodiment of the present disclosure, the fifth preset formula (5) mentioned above is as follows. In other words, the public key P of the initiator is A satisfy:

[0159] P A =(x A ,y A )=[d A ]G;(5)

[0160] Among them, x A The public key P of the initiator A x coordinates, y coordinates on the elliptic curve A The public key P of the initiator A The y coordinate on the elliptic curve, d A is the private key of the initiator, G is the base point of the elliptic curve, and [] is the multiple point operation on the elliptic curve.

[0161] Figure 2 Another flow chart of a method for securely negotiating a shared key according to an embodiment of the present disclosure is shown.

[0162] like Figure 2 As shown, the method 200 may include steps 201 to 205, which may be implemented by the responding end, or may be executed by a physical device that can provide the responding end function, or may be executed by a component configured in the physical device (such as a chip, etc.), or may be executed by a module that can implement part or all of the responding end functions, etc., and this application does not limit this.

[0163] For ease of understanding, the present disclosure uses the responding end as an example to describe the method provided by the present disclosure. Detailed descriptions of each step in method 200 are given below.

[0164] In step 201, a second random number is generated and sent;

[0165] In step 202, the private key of the responding end and the public key sent by the initiating end are obtained, and the second parameter is obtained according to the private key of the responding end and the public key of the initiating end;

[0166] In step 203, the first random number and the preset shared password sent by the initiator are obtained, and the fourth parameter is obtained according to the first random number, the second parameter, the second random number and the shared password;

[0167] In step 204, the fifth parameter sent by the initiator, the third random number sent by the initiator, and the public key of the responder are obtained, and the second verification parameter is obtained according to the third random number, the public key of the responder, the public key of the initiator, and the fourth parameter;

[0168] In step 205, when the second verification parameter and the fifth parameter are the same, a shared key is negotiated with the initiator.

[0169] In one embodiment of the present disclosure, the second random number may be generated by a random number generator of the responding end and sent by the responding end to the initiating end.

[0170] As can be seen from the introduction of the aforementioned method 100, the key pair of the responding end includes the private key of the responding end and the public key of the responding end, and the key pair of the initiating end includes the private key of the initiating end and the public key of the initiating end.

[0171] The initiator can also send the public key determined locally to the responder. When the initiator obtains its own public key locally, it sends the public key to the responder.

[0172] The public key of the initiator can be represented as a coordinate on the elliptic curve, and the coordinate includes: an x-coordinate of the public key and a y-coordinate of the public key.

[0173] In the above step 202, the responding end may obtain the second parameter based on the sixth preset formula according to the local private key and the public key sent by the initiating end.

[0174] As described in the aforementioned method 100, the first random number can also be generated by a random number generator on the initiator and sent by the initiator to the responder. Similarly, the shared password is a password pre-negotiated between the initiator and the responder. The responder can use the shared password to verify the identity of the communicating peer device.

[0175] In the above step 203, the responding end may obtain the fourth parameter based on the seventh preset formula according to the first random number, the second parameter, the second random number and the shared password.

[0176] In one embodiment of the present disclosure, the fifth parameter may be used to characterize the identity of the peer device communicating with the responding end. In the present disclosure, the fifth parameter may be determined by the initiating end and sent to the responding end.

[0177] In one embodiment of the present disclosure, the third random number is determined by a random number generator at the initiating end. Optionally, the third random number is different from the first random number.

[0178] In one embodiment of the present disclosure, the public key of the responding end may also be represented as a coordinate on an elliptic curve, where the coordinate includes: an x-coordinate of the public key and a y-coordinate of the public key.

[0179] In one embodiment of the present disclosure, the second verification parameter can be used to verify the identity of the peer device communicating with the responding end. In other words, the responding end can use the second verification parameter to verify whether the peer device communicating with it is the initiator with the correct identity and intended for key negotiation with the responding end, or a dangerous third-party device.

[0180] In the above step 204, the responding end may obtain the second verification parameter based on the eighth preset formula according to the third random number, the public key of the responding end, the public key of the initiating end and the fourth parameter.

[0181] In step 205, if the second verification parameter and the fifth parameter are the same, it indicates that the peer device communicating with the responding end is the correct initiator with whom the responding end intends to conduct key negotiation. The responding end can then negotiate a shared key with the initiator based on a preset key negotiation protocol. If the second verification parameter and the fifth parameter are different, it indicates that the peer device communicating with the responding end is not the correct initiator with whom the responding end intends to conduct key negotiation, but a third-party device. The responding end then terminates communication with the peer device, i.e., does not conduct key negotiation with the peer device. Optionally, the key negotiation protocol can be the SM2 key negotiation protocol.

[0182] It should be noted that the sixth to eighth preset formulas mentioned above can be found in the following description and will not be elaborated here.

[0183] In the above embodiment, a second random number is generated by the responding end and sent to the initiating end. The second parameter is obtained based on the private key of the responding end and the public key of the initiating end. The fourth parameter is then obtained based on the first random number sent by the initiating end, the second parameter, the generated second random number, and the shared password. The second verification parameter is obtained based on the third random number sent by the initiating end, the public key of the responding end, the public key of the initiating end, and the fourth parameter. When it is determined that the second verification parameter is the same as the fifth parameter sent by the initiating end, the shared key is formally negotiated with the initiating end. Because the responding end adds a verification process for the peer device communicating with it before the initiating end and the responding end formally negotiate the shared key, the correctness of the responding end's identity is ensured, thereby providing security for subsequent shared key negotiation. Once the initiating end discovers that the verification has failed, it can detect the dangerous third-party device early and terminate communication, avoiding the possibility of the shared key and communication data being stolen by the third-party device.

[0184] In one embodiment of the present disclosure, the aforementioned sixth preset formula (6) is as follows. In other words, the second parameter M2 satisfies:

[0185] M2=[d B ]P A ;(6)

[0186] Among them, d B is the private key of the responding end, P A The public key of the initiator.

[0187] In one embodiment of the present disclosure, the seventh preset formula (7) mentioned above is as follows. In other words, the fourth parameter Q2 satisfies:

[0188] Q2=CMAC(N1,M2||N2||S);(7)

[0189] Wherein, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N1 is a first random number, M2 is a second parameter, N2 is a second random number, and S is a shared password.

[0190] In one embodiment of the present disclosure, the eighth preset formula (8) mentioned above is as follows. In other words, the second verification parameter l2 satisfies:

[0191] l2=CMAC(N A ,x A ||y A ||x B ||y B ||Q2);(8)

[0192] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N A is the third random number, x B The public key P of the responder B x coordinates, y coordinates on the elliptic curve B The public key P of the responder B The y coordinate on the elliptic curve, x A The public key P of the initiator A x coordinates, y coordinates on the elliptic curve A The public key P of the initiator A The y-coordinate on the elliptic curve, Q2 is the fourth parameter.

[0193] In one embodiment of the present disclosure, before step 201, i.e., generating the second random number, the method 200 may further include:

[0194] Obtain a second shared password and send the second shared password to the verification device;

[0195] Generating the second random number in step 201 may specifically include:

[0196] When the first indication information of the verification device is received, the second shared password is used as the shared password and a second random number is generated. The first indication information is used to indicate that the first shared password is the same as the second shared password, and the first shared password is sent by the initiator.

[0197] As can be seen from the introduction of the aforementioned method 100, the second shared password is a shared password that is pre-negotiated between the responding end and the initiating end for key negotiation and stored locally. The first shared password is a shared password that is pre-negotiated between the initiating end and the responding end for key negotiation and stored locally.

[0198] In this embodiment, to further ensure the security of shared key negotiation, a verification device can be deployed in addition to the initiator and responder. The responder can send the locally stored second shared secret to the verification device. Simultaneously, the initiator can also send the locally stored first shared secret to the verification device. If the verification device determines that the first shared secret and the second shared secret are identical, verification is successful. The verification device can then send a first indication message to both the initiator and the responder, indicating that the first and second shared secrets are identical. Upon receiving this first indication message, the responder can determine that the peer device it is communicating with is the correct initiator for key negotiation. Similarly, upon receiving this first indication message, the initiator can also determine that the peer device it is communicating with is the correct responder for key negotiation. The initiator and responder can then proceed to step 201, performing a secondary verification. If the verification device determines that the first and second shared secrets are different, verification fails, and the verification device does not send the first indication message to the initiator and responder. If the initiator and responder do not receive this first indication message, communication ends without proceeding to step 201.

[0199] In one embodiment of the present disclosure, after step 203, i.e., obtaining the fourth parameter according to the first random number, the second parameter, the second random number, and the shared password, the method 200 may further include:

[0200] Generate a fourth random number and send the fourth random number;

[0201] Obtain a sixth parameter according to the fourth random number, the public key of the initiator, the public key of the responder, and the fourth parameter, and send the sixth parameter.

[0202] In one embodiment of the present disclosure, the fourth random number may be generated by a random number generator at the responding end and sent by the responding end to the initiating end. Optionally, the fourth random number is different from the second random number.

[0203] In one embodiment of the present disclosure, the sixth parameter may be used to characterize the identity of the responding end.

[0204] In this embodiment, in order to ensure that the initiating end can normally verify the identity of the peer device with which it communicates, the responding end can generate a random number again through a random number generator, and obtain a sixth parameter for representing its own identity based on the ninth preset formula according to the random number, the public key of the initiating end, the public key of the responding end and the fourth parameter obtained in step 203, and send the sixth parameter to the initiating end for verification.

[0205] In one embodiment of the present disclosure, the ninth preset formula (9) mentioned above is as follows. In other words, the sixth parameter C B satisfy:

[0206] C B =CMAC(N B ,x B ||y B ||x A ||y A ||Q2);(9)

[0207] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N B is the fourth random number, x B The public key P of the responder B x coordinates, y coordinates on the elliptic curve B The public key P of the responder B The y coordinate on the elliptic curve, x A The public key P of the initiator A x coordinates, y coordinates on the elliptic curve A The public key P of the initiator A The y-coordinate on the elliptic curve, Q2 is the fourth parameter.

[0208] Optionally, when the CMAC() in the seventh to ninth preset formulas mentioned above uses a preset algorithm as the CMAC function of the block encryption function, the preset algorithm can also be the national secret SM4 algorithm, or the AES algorithm or the DES algorithm. Preferably, the preset algorithm is the national secret SM4 algorithm.

[0209] In one embodiment of the present disclosure, the method 200 may further include:

[0210] Obtain the public key of the responder based on the private key of the responder and send the public key of the responder.

[0211] In one embodiment of the present disclosure, the private key of the responding end is determined by a random number generated by a random number generator of the responding end.

[0212] In this embodiment, the responding end may use a random number generated by a random number generator as the responding end's private key. When determining the responding end's public key, the responding end's public key may be obtained based on the responding end's private key and the tenth preset formula, thereby obtaining the initiating end's public key.

[0213] In one embodiment of the present disclosure, the tenth preset formula (10) mentioned above is as follows. In other words, the public key P of the responding end is B satisfy:

[0214] P B =(x B ,y B )=[d B ]G;(10)

[0215] Among them, xB The public key P of the responder B x coordinates, y coordinates on the elliptic curve B The public key P of the responder B The y coordinate on the elliptic curve, d B is the private key of the responder, G is the base point of the elliptic curve, and [] is the multiple point operation on the elliptic curve.

[0216] In order to facilitate understanding of the security negotiation method for shared keys provided by the present disclosure, Figure 3 An exemplary description is given. Figure 3 A schematic diagram illustrating communication interactions of a secure negotiation method for a shared key according to an embodiment of the present disclosure is shown.

[0217] like Figure 3 As shown, it includes an initiator, a verification device and a responder.

[0218] In A1, the initiator obtains the initiator's public key based on the initiator's private key, and in A2, the initiator sends the initiator's public key to the responder. Correspondingly, in B1, the responder obtains the responder's public key based on the responder's private key, and in B2, the responder sends the responder's public key to the initiator.

[0219] The initiator and responder enter a verification phase:

[0220] In A3, the initiator obtains the first shared password, and in A4, the initiator sends the first shared password to the verification device. Correspondingly, in B3, the responder obtains the second shared password, and in B4, the responder sends the second shared password to the verification device.

[0221] In C1, the verification device verifies whether the first shared password and the second shared password are the same. If the first shared password and the second shared password are the same, in C2, the verification device sends first indication information to the initiator and the responder.

[0222] When the initiating end and the responding end receive the first indication information, they preliminarily confirm that the opposite end device is a opposite end device that has passed a one-time verification and has a correct identity.

[0223] Then, the initiator and responder continue to enter the secondary verification phase:

[0224] In A5, the initiator generates a first random number, and in A6, sends the first random number to the responder. Correspondingly, in B5, the responder generates a second random number, and in B6, sends the second random number to the initiator.

[0225] In A7, the initiator obtains the private key of the initiator and the public key of the responder, and obtains the first parameter based on the private key of the initiator and the public key of the responder. In A8, the initiator obtains the second random number and the preset shared password of the responder, and obtains the third parameter based on the first random number, the first parameter, the second random number, and the shared password.

[0226] Accordingly, in step B7, the responder obtains the responder's private key and the initiator's public key, and obtains the second parameter based on the responder's private key and the initiator's public key. In step B8, the responder obtains the initiator's first random number and the preset shared password, and obtains the fourth parameter based on the first random number, the second parameter, the second random number, and the shared password.

[0227] In A9, the initiator generates a third random number, and in A10, sends the third random number to the responder. Correspondingly, in B9, the responder generates a fourth random number, and in B10, sends the fourth random number to the initiator.

[0228] In A11, the initiator obtains a fifth parameter based on the third random number, the initiator's public key, the responder's public key, and the third parameter, and in A12, sends the fifth parameter to the responder. Correspondingly, in B11, the responder obtains a sixth parameter based on the fourth random number, the initiator's public key, the responder's public key, and the fourth parameter, and in B12, sends the sixth parameter to the initiator.

[0229] In A13, the initiator obtains the sixth parameter of the responder, the fourth random number of the responder, and the public key of the initiator, and obtains the first verification parameter according to the fourth random number, the public key of the initiator, the public key of the responder, and the third parameter.

[0230] In A14, the initiator verifies whether the first verification parameter and the sixth parameter are the same. If they are the same, the secondary verification passes and the shared key negotiation phase begins.

[0231] Accordingly, in B13, the responder obtains the fifth parameter of the initiator, the third random number of the initiator and the public key of the responder, and obtains the second verification parameter based on the third random number, the public key of the responder, the public key of the initiator and the fourth parameter.

[0232] In B14, the responding end verifies whether the second verification parameter and the fifth parameter are the same. If they are the same, the secondary verification passes and the shared key negotiation phase begins.

[0233] It should be understood that the shared password negotiation phase is the process of creating a shared key by the initiator and the responder through the SM2 key exchange protocol.

[0234] Figure 3 The specific implementation process of each step shown can refer to the above Figure 1 and Figure 2 The description is not repeated here.

[0235] It should be understood that the operations involved in the above-mentioned initiator and responder can be executed by software in the initiator and responder, or by encryption hardware in the initiator and responder, and this disclosure does not limit this.

[0236] The following are embodiments of the apparatus disclosed herein, which can be used to execute embodiments of the method disclosed herein.

[0237] Figure 4 A structural block diagram of a security negotiation device for sharing a key according to an embodiment of the present disclosure is shown. The device can be implemented as part or all of an electronic device through software, hardware, or a combination of both.

[0238] like Figure 4 As shown, when the apparatus 400 is applied to an initiating end, the apparatus 400 may include:

[0239] The communication module 410 is configured to generate a first random number and send the first random number;

[0240] The processing module 420 is configured to obtain the private key of the initiator and the public key sent by the responder, and obtain the first parameter based on the private key of the initiator and the public key of the responder; obtain the second random number and the preset shared password sent by the responder, and obtain the third parameter based on the first random number, the first parameter, the second random number and the shared password; obtain the sixth parameter sent by the responder, the fourth random number sent by the responder and the public key of the initiator, and obtain the first verification parameter based on the fourth random number, the public key of the initiator, the public key of the responder and the third parameter; when the first verification parameter and the sixth parameter are the same, negotiate a shared key with the responder.

[0241] In one embodiment of the present disclosure, the processing module 420 is further configured to obtain a first shared password,

[0242] and the communication module 410 is further configured to send the first shared password to the verification device;

[0243] The communication module 410 is further configured to receive first indication information from the verification device;

[0244] The processing module 420 is also configured to use the first shared password as the shared password and generate a first random number when receiving the first indication information of the verification device. The first indication information is used to indicate that the first shared password is the same as the second shared password, and the second shared password is sent by the responding end.

[0245] In one embodiment of the present disclosure, the communication module 410 is further configured to generate a third random number and send the third random number;

[0246] The processing module 420 is further configured to obtain a fifth parameter according to the third random number, the public key of the initiator, the public key of the responder, and the third parameter.

[0247] The communication module 410 is further configured to send a fifth parameter.

[0248] In one embodiment of the present disclosure, the processing module 420 is further configured to obtain the public key of the initiator according to the private key of the initiator, and the communication module 410 is further configured to send the public key of the initiator.

[0249] In one embodiment of the present disclosure, the private key of the initiator is determined by a random number generated by a random number generator of the initiator.

[0250] In one embodiment of the present disclosure, the first parameter M1 satisfies:

[0251] M1=[d A ]P B ;

[0252] Among them, d A is the private key of the initiator, P B The public key of the responder.

[0253] In one embodiment of the present disclosure, the third parameter Q1 satisfies:

[0254] Q1=CMAC(N1,M1||N2||S);

[0255] Wherein, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N1 is a first random number, M1 is a first parameter, N2 is a second random number, and S is a shared password.

[0256] In one embodiment of the present disclosure, the first verification parameter l1 satisfies:

[0257] l1=CMAC(N B ,x B ||y B ||x A ||y A ||Q1);

[0258] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N B is the fourth random number, x B The public key P of the responder B x coordinates, y coordinates on the elliptic curve B The public key P of the responder B The y coordinate on the elliptic curve, x A The public key P of the initiator A x coordinates, y coordinates on the elliptic curveA The public key P of the initiator A The y-coordinate on the elliptic curve, Q1 is the third parameter.

[0259] In one embodiment of the present disclosure, the fifth parameter C A satisfy:

[0260] C A =CMAC(N A ,x A ||y A ||x B ||y B ||Q1);

[0261] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N A is the third random number, x B The public key P of the responder B x coordinates, y coordinates on the elliptic curve B The public key P of the responder B The y coordinate on the elliptic curve, x A The public key P of the initiator A x coordinates, y coordinates on the elliptic curve A The public key P of the initiator A The y-coordinate on the elliptic curve, Q1 is the third parameter.

[0262] In one embodiment of the present disclosure, the public key P of the initiator A satisfy:

[0263] P A =(x A ,y A )=[d A ]G;

[0264] Among them, x A The public key P of the initiator A x coordinates, y coordinates on the elliptic curve A The public key P of the initiator A The y coordinate on the elliptic curve, d A is the private key of the initiator, G is the base point of the elliptic curve, and [] is the multiple point operation on the elliptic curve.

[0265] like Figure 4 As shown, when the apparatus 400 is applied to a responding end, the apparatus 400 may include:

[0266] The communication module 410 is configured to generate a second random number and send the second random number;

[0267] The processing module 420 is configured to obtain the private key of the responding end and the public key sent by the initiating end, and obtain the second parameter based on the private key of the responding end and the public key of the initiating end; obtain the first random number and the preset shared password sent by the initiating end, and obtain the fourth parameter based on the first random number, the second parameter, the second random number and the shared password; obtain the fifth parameter sent by the initiating end, the third random number sent by the initiating end and the public key of the responding end, and obtain the second verification parameter based on the third random number, the public key of the responding end, the public key of the initiating end and the fourth parameter; when the second verification parameter and the fifth parameter are the same, negotiate a shared key with the initiating end.

[0268] In one embodiment of the present disclosure, the processing module 420 is further configured to obtain a second shared password.

[0269] and the communication module 410 is further configured to send a second shared password to the verification device;

[0270] The communication module 410 is further configured to receive first indication information from the verification device;

[0271] The processing module 420 is also configured to use the second shared password as the shared password and generate a second random number when receiving the first indication information of the verification device. The first indication information is used to indicate that the first shared password is the same as the second shared password, and the first shared password is sent by the initiator.

[0272] In one embodiment of the present disclosure, the communication module 410 is further configured to generate a fourth random number and send the fourth random number;

[0273] The processing module 420 is further configured to obtain a sixth parameter according to the fourth random number, the public key of the initiator, the public key of the responder, and the fourth parameter.

[0274] And the communication module 410 is further configured to send a sixth parameter.

[0275] In one embodiment of the present disclosure, the processing module 420 is further configured to obtain the public key of the responding end according to the private key of the responding end.

[0276] And the communication module 410 is further configured to send the public key of the responding end.

[0277] In one embodiment of the present disclosure, the private key of the responding end is determined by a random number generated by a random number generator of the responding end.

[0278] In one embodiment of the present disclosure, the second parameter M2 satisfies:

[0279] M2=[d B ]P A ;

[0280] Among them, d Bis the private key of the responding end, P A The public key of the initiator.

[0281] In one embodiment of the present disclosure, the fourth parameter Q2 satisfies:

[0282] Q2=CMAC(N1,M2||N2||S);

[0283] Wherein, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N1 is a first random number, M2 is a second parameter, N2 is a second random number, and S is a shared password.

[0284] In one embodiment of the present disclosure, the second verification parameter l2 satisfies:

[0285] l2=CMAC(N A ,x A ||y A ||x B ||y B ||Q2);

[0286] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N A is the third random number, x B The public key P of the responder B x coordinates, y coordinates on the elliptic curve B The public key P of the responder B The y coordinate on the elliptic curve, x A The public key P of the initiator A x coordinates, y coordinates on the elliptic curve A The public key P of the initiator A The y-coordinate on the elliptic curve, Q2 is the fourth parameter.

[0287] In one embodiment of the present disclosure, the sixth parameter C B satisfy:

[0288] C B =CMAC(N B ,x B ||y B ||x A ||y A ||Q2);

[0289] Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N B is the fourth random number, x B The public key P of the responder B x coordinates, y coordinates on the elliptic curve B The public key P of the responder BThe y coordinate on the elliptic curve, x A The public key P of the initiator A x coordinates, y coordinates on the elliptic curve A The public key P of the initiator A The y-coordinate on the elliptic curve, Q2 is the fourth parameter.

[0290] In one embodiment of the present disclosure, the public key P of the responding end B satisfy:

[0291] P B =(x B ,y B )=[d B ]G;

[0292] Among them, x B The public key P of the responder B x coordinates, y coordinates on the elliptic curve B The public key P of the responder B The y coordinate on the elliptic curve, d B is the private key of the responder, G is the base point of the elliptic curve, and [] is the multiple point operation on the elliptic curve.

[0293] The present disclosure also discloses a security negotiation system for a shared key, the system comprising:

[0294] Initiator, used to execute Figure 1 the method shown, or Figure 3 The method executed by the initiator in the illustrated embodiment; and

[0295] Response side, used for execution Figure 2 the method shown, or Figure 3 The method executed by the responding end in the illustrated embodiment.

[0296] In one achievable manner, the system further includes: a verification device, which is used to verify whether the first shared password sent by the initiator and the second shared password sent by the responder are the same; when the first shared password and the second shared password are the same, a first indication information is sent, which is used to indicate that the first shared password and the second shared password are the same.

[0297] The present disclosure also discloses an electronic device, Figure 5 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown. Figure 5 As shown, the electronic device 500 includes a memory 501 and a processor 502; wherein,

[0298] The memory 501 is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor 502 to implement the above method steps.

[0299] In one embodiment of the present disclosure, the electronic device 500 may further include a communication unit 503, which is configured to receive data from a peer device and / or send data to a peer device when executing the above method steps. When the communication unit 503 receives data from a peer device, it may temporarily store the data in the memory 501 or pass the data to the processor 502 for processing.

[0300] Figure 6 It is a structural diagram of a computer system suitable for implementing a secure negotiation method for a shared key according to an embodiment of the present disclosure.

[0301] like Figure 6 As shown, the computer system 600 includes a processing unit 601, which can perform various processes in the above-mentioned embodiments according to a program stored in a read-only memory (ROM) 602 or a flash memory (FLASH) or a program loaded from a storage unit 609 into a random access memory (RAM) 603. Various programs and data required for the operation of the computer system 600 are also stored in the RAM 603. The communication unit 604 can be used to receive data from a peer device and / or send data to a peer device when executing the above-mentioned method steps. The processing unit 601, ROM 602, RAM 603, and the communication unit 604 are connected to each other via a bus 605. An input / output (I / O) interface 606 is also connected to the bus 605.

[0302] The following components are connected to the I / O interface 606: an input section 607 including a keyboard, a mouse, etc.; an output section 608 including a cathode ray tube (CRT), a liquid crystal display (LCD), a speaker, etc.; a storage section 609 including a hard disk, etc.; and a communication section 610 including a network interface card such as a LAN card, a modem, etc. The communication section 610 performs communication processing via a network such as the Internet. A drive 611 is also connected to the I / O interface 606 as needed. A removable medium 612, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 611 as needed so that a computer program read therefrom can be installed into the storage section 609 as needed. Among them, the processing unit 601 can be implemented as a processing unit such as a CPU, a GPU, a TPU, an FPGA, or an NPU.

[0303] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the diagram or block diagram can represent a module, program segment or part of the code, and the module, program segment or part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, as well as the combination of boxes in the block diagram and / or flow chart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0304] The units or modules involved in the embodiments described in this disclosure may be implemented in software or hardware. The units or modules described may also be provided in a processor, and the names of these units or modules do not, in certain circumstances, constitute limitations on the units or modules themselves.

[0305] As another aspect, the present disclosure further provides a chip, the chip including a processor, the processor being configured to call a computer program in a memory to execute the above Figure 1 and Figure 3 The method executed by the initiator in the embodiment shown, or the execution of the above Figure 2 and Figure 3 The method executed by the responding end in the illustrated embodiment.

[0306] As another aspect, the present disclosure further provides a computer-readable storage medium. This computer-readable storage medium may be included in the apparatus described in the above embodiments, or may be a standalone computer-readable storage medium not incorporated into the apparatus. The computer-readable storage medium stores one or more programs, which are used by one or more processors to execute the methods described in the present disclosure.

[0307] As another aspect, the present disclosure further provides a computer program product, including a computer program / instruction, which implements a secure negotiation method for a shared key when the computer program / instruction is enabled.

[0308] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention herein is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the inventive concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

Claims

1. A method for secure negotiation of a shared key, characterized in that: The method is applied to an initiating end, and includes: Generate a first random number and send the first random number; Obtaining a private key of the initiator and a public key sent by the responder, and obtaining a first parameter according to the private key of the initiator and the public key of the responder; Obtain a second random number and a preset shared password sent by the responding end, and obtain a third parameter according to the first random number, the first parameter, the second random number, and the shared password; Obtaining a sixth parameter sent by the responding end, a fourth random number sent by the responding end, and a public key of the initiating end, and obtaining a first verification parameter according to the fourth random number, the public key of the initiating end, the public key of the responding end, and the third parameter; When the first verification parameter and the sixth parameter are the same, negotiate a shared key with the responding end.

2. The method according to claim 1, characterized in that Before generating the first random number, the method further includes: Obtaining a first shared password, and sending the first shared password to the verification device; Generating a first random number includes: When the first indication information of the verification device is received, the first shared password is used as the shared password and the first random number is generated. The first indication information is used to indicate that the first shared password is the same as the second shared password, and the second shared password is sent by the responding end.

3. The method according to claim 1, characterized in that After obtaining the third parameter according to the first random number, the first parameter, the second random number, and the shared password, the method further includes: generating a third random number, and sending the third random number; A fifth parameter is obtained according to the third random number, the public key of the initiator, the public key of the responder, and the third parameter, and the fifth parameter is sent.

4. The method according to claim 3, characterized in that The method further comprises: The public key of the initiator is obtained according to the private key of the initiator, and the public key of the initiator is sent.

5. The method according to claim 4, characterized in that The private key of the initiator is determined by a random number generated by a random number generator of the initiator.

6. The method according to any one of claims 1 to 5, characterized in that The first parameter M1 satisfies: M1=[d A ]P B ; Among them, d A is the private key of the initiator, P B is the public key of the responding end.

7. The method according to any one of claims 1 to 5, characterized in that The third parameter Q1 satisfies: Q1=CMAC(N1,M1||N2||S); Wherein, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N1 is the first random number, M1 is the first parameter, N2 is the second random number, and S is the shared password.

8. The method according to any one of claims 1 to 5, characterized in that The first verification parameter l1 satisfies: l1=CMAC(N B ,x B ||and B ||x A ||and A ||Q1); Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N B is the fourth random number, x B is the public key P of the responder B x coordinates, y coordinates on the elliptic curve B is the public key P of the responder B The y coordinate on the elliptic curve, x A is the public key P of the initiator A x coordinates, y coordinates on the elliptic curve A is the public key P of the initiator A The y coordinate on the elliptic curve, Q1 is the third parameter.

9. The method according to any one of claims 3 to 5, characterized in that The fifth parameter C A satisfy: C A =CMAC(N A ,x A ||y A ||x B ||y B ||Q1); Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N A is the third random number, x B is the public key P of the responder B x coordinates, y coordinates on the elliptic curve B is the public key P of the responder B The y coordinate on the elliptic curve, x A is the public key P of the initiator A x coordinates, y coordinates on the elliptic curve A is the public key P of the initiator A The y coordinate on the elliptic curve, Q1 is the third parameter.

10. The method according to claim 4, characterized in that The public key P of the initiator A satisfy: P A =(x A ,y A )=[d A ]G; Among them, x A is the public key P of the initiator A x coordinates, y coordinates on the elliptic curve A is the public key P of the initiator A The y coordinate on the elliptic curve, d A is the private key of the initiator, G is the base point of the elliptic curve, and [] is the multiple point operation on the elliptic curve.

11. A method for secure negotiation of a shared key, characterized in that: The method is applied to a responding end, and the method includes: Generate a second random number and send the second random number; Obtaining the private key of the responding end and the public key sent by the initiating end, and obtaining a second parameter according to the private key of the responding end and the public key of the initiating end; Obtain a first random number and a preset shared password sent by the initiator, and obtain a fourth parameter based on the first random number, the second parameter, the second random number, and the shared password; Obtaining a fifth parameter sent by the initiator, a third random number sent by the initiator, and a public key of the responder, and obtaining a second verification parameter based on the third random number, the public key of the responder, the public key of the initiator, and the fourth parameter; When the second verification parameter is the same as the fifth parameter, a shared key is negotiated with the initiator.

12. The method according to claim 11, characterized in that Before generating the second random number, the method further includes: Obtaining a second shared password and sending the second shared password to the verification device; Generating a second random number comprises: When the first indication information of the verification device is received, the second shared password is used as the shared password and a second random number is generated, the first indication information is used to indicate that the first shared password is the same as the second shared password, and the first shared password is sent by the initiator.

13. The method according to claim 11, characterized in that After obtaining the fourth parameter according to the first random number, the second parameter, the second random number, and the shared password, the method further includes: generating a fourth random number, and sending the fourth random number; Obtain a sixth parameter according to the fourth random number, the public key of the initiator, the public key of the responder, and the fourth parameter, and send the sixth parameter.

14. The method according to claim 13, wherein: The method further comprises: Obtain the public key of the responding end according to the private key of the responding end, and send the public key of the responding end.

15. The method according to claim 14, characterized in that The private key of the responding end is determined by a random number generated by a random number generator of the responding end.

16. The method according to any one of claims 11 to 15, characterized in that The second parameter M2 satisfies: M2=[d B ]P A ; Among them, d B is the private key of the responding end, P A is the public key of the initiator.

17. The method according to any one of claims 11 to 15, characterized in that The fourth parameter Q2 satisfies: Q2=CMAC(N1,M2||N2||S); Wherein, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N1 is the first random number, M2 is the second parameter, N2 is the second random number, and S is the shared password.

18. The method according to any one of claims 11 to 15, characterized in that The second verification parameter l2 satisfies: l2=CMAC(N A ,x A ||and A ||x B ||and B ||Q2); Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N A is the third random number, x B is the public key P of the responder B x coordinates, y coordinates on the elliptic curve B is the public key P of the responder B The y coordinate on the elliptic curve, x A is the public key P of the initiator A x coordinates, y coordinates on the elliptic curve A is the public key P of the initiator A The y coordinate on the elliptic curve, Q2 is the fourth parameter.

19. The method according to any one of claims 13 to 15, characterized in that The sixth parameter C B satisfy: C B =CMAC(N B ,x B ||y B ||x A ||y A ||Q2); Among them, CMAC() is a CMAC function that uses a preset algorithm as a block encryption function, N B is the fourth random number, x B is the public key P of the responder B x coordinates, y coordinates on the elliptic curve B is the public key P of the responder B The y coordinate on the elliptic curve, x A is the public key P of the initiator A x coordinates, y coordinates on the elliptic curve A is the public key P of the initiator A The y coordinate on the elliptic curve, Q2 is the fourth parameter.

20. The method according to claim 14, wherein The public key P of the responder B satisfy: P B =(x B ,y B )=[d B ]G; Among them, x B is the public key P of the responder B x coordinates, y coordinates on the elliptic curve B is the public key P of the responder B The y coordinate on the elliptic curve, d B is the private key of the responding end, G is the base point of the elliptic curve, and [] is the multiple point operation on the elliptic curve.

21. A security negotiation device for a shared key, characterized in that: The device is applied to an initiating end, and includes: a communication module, configured to generate a first random number and send the first random number; a processing module configured to obtain a private key of the initiator and a public key sent by the responder, and obtain a first parameter based on the private key of the initiator and the public key of the responder; obtain a second random number and a preset shared password sent by the responder, and obtain a third parameter based on the first random number, the first parameter, the second random number, and the shared password; obtain a sixth parameter sent by the responder, a fourth random number sent by the responder, and the public key of the initiator, and obtain a first verification parameter based on the fourth random number, the public key of the initiator, the public key of the responder, and the third parameter; When the first verification parameter and the sixth parameter are the same, negotiate a shared key with the responding end.

22. A security negotiation device for a shared key, characterized in that: The device is applied to a responding end, and includes: a communication module, configured to generate a second random number and send the second random number; The processing module is configured to obtain the private key of the responding end and the public key sent by the initiating end, and obtain a second parameter based on the private key of the responding end and the public key of the initiating end; obtain a first random number and a preset shared password sent by the initiating end, and obtain a fourth parameter based on the first random number, the second parameter, the second random number and the shared password; obtain a fifth parameter sent by the initiating end, a third random number sent by the initiating end and the public key of the responding end, and obtain a second verification parameter based on the third random number, the public key of the responding end, the public key of the initiating end and the fourth parameter; and when the second verification parameter and the fifth parameter are the same, negotiate a shared key with the initiating end.

23. A shared key security negotiation system, characterized in that: The system comprises: An initiator, configured to execute the method according to any one of claims 1 to 10; and The responding end is configured to execute the method according to any one of claims 11 to 20.

24. An electronic device, characterized in that: include: A memory and at least one processor; wherein the memory is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor to implement the method steps according to any one of claims 1 to 20.

25. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the method steps according to any one of claims 1 to 20 are implemented.

Images