Session key exchange method, system, device, computer equipment and storage medium

Abstract

The present application relates to a session key exchange method, apparatus, computer equipment, storage medium and computer program product. The method comprises: generating an initiator error-introduced encryption key, a first error recovery parameter and a first message verification value; obtaining an authenticator password verification value, and generating a first exchange message based on the authenticator password verification value, the initiator error-introduced encryption key, the first error recovery parameter and the first message verification value; sending the first exchange message to the responder; receiving a second exchange message sent by the responder; generating a third message verification value when the second message verification value is verified; generating an initiator session key based on the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter; and sending the third exchange message to the responder. The use of this method can improve communication and computing efficiency.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a session key exchange method, system, apparatus, computer equipment, storage medium, and computer program product. Background Art

[0002] Authenticated key exchange (AKE) provides confidentiality, authentication, and integrity protection for data communications in an open network environment and is the core mechanism of network security protocols. In the identity-based authenticated key exchange (AKE, ID-AKE) protocol, the communicating parties use arbitrary identity identifiers as public keys and establish shared session keys on public channels, simplifying the complex key management process in traditional public key infrastructure-based cryptographic technologies. Lattice cryptography schemes are known as the most promising cryptographic systems in the post-quantum era and are gradually being widely used to construct various cryptographic systems, such as public key encryption schemes, signature schemes, collision-resistant hash functions, key exchange protocols, and functional encryption schemes.

[0003] The lattice-based AKE protocol is implemented by combining the existing public key encryption system with post-quantum certificateless key exchange. However, this method generally has complex public key management and high communication and computational costs. The lattice-based ID-AKE protocol based on the Bi-ISIS and CBi-ISIS problems still has relatively complex operations on matrix vectors, and does not have perfect forward security and cannot resist temporary key leakage attacks. The existing identity-based authenticated key exchange protocol based on the RLWE problem still has low computational efficiency while providing two-way authentication and perfect forward security.

[0004] In summary, traditional authenticated key exchange protocols, while ensuring the security of two-way authentication, generally have the problem of low communication and computing efficiency. Summary of the Invention

[0005] Based on this, it is necessary to provide a session key exchange method, apparatus, computer device, computer-readable storage medium and computer program product that can improve communication and computing efficiency in order to address the above technical problems.

[0006] In a first aspect, the present application provides a session key exchange method, applied to an initiator, the method comprising:

[0007] Generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, and generate a first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value;

[0008] The first exchange message is sent to the responder; the responder is configured to generate a responder error introduction encryption key; if the first message verification value is verified, a second error recovery parameter, a third error recovery parameter, and a second message verification value are generated; and a second exchange message is generated based on the responder error introduction encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value.

[0009] receiving the second exchange message sent by the responder; generating a third message verification value if the second message verification value is verified successfully; generating an initiator session key based on the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter;

[0010] A third exchange message generated based on the third message verification value is sent to the responder; the responder is used to generate a responder session key according to the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter when the third message verification value is verified successfully.

[0011] In one embodiment, generating an initiator error-introduced encryption key, a first error recovery parameter, and a first message authentication value includes:

[0012] Determining an initiator's temporary private key and an initiator's error based on random sampling of discrete distribution data in the public parameters; generating an initiator's error introduction encryption key based on the initiator's temporary private key and the initiator's error;

[0013] Determining a first composite parameter of the initiator based on the initiator's static private key, the responder's identity hash, and the initiator's temporary private key; processing the first composite parameter of the initiator through a cross-approximation function to obtain the first error recovery parameter; the initiator's static private key is obtained by a key generation center based on the system master private key; the responder's identity hash includes a mapping value of the responder's identity information in the hash function;

[0014] The first message verification value is obtained according to the initiator identity hash, the responder identity hash and the first error recovery value.

[0015] In one embodiment, generating a third message verification value when the second message verification value is verified to be successful includes:

[0016] In the case where the encryption key incorrectly introduced by the responder belongs to an element in the target set, determining the initiator's second composite parameter based on the responder identity hash, the initiator's static private key, and the encryption key incorrectly introduced by the responder; determining the initiator's third composite parameter based on the initiator's temporary private key and the encryption key incorrectly introduced by the responder;

[0017] Processing the initiator's second composite parameter and the second error recovery parameter through a coordination function to obtain a second error recovery value; processing the initiator's third composite parameter and the third error recovery parameter through a coordination function to obtain a third error recovery value;

[0018] Obtaining a second message verification calculation value based on the authenticator password verification value, the initiator's incorrectly introduced encryption key, the responder's incorrectly introduced encryption key, the first error recovery value, the first error recovery value, and the third error recovery value, and verifying consistency between the second message verification calculation value and the second message verification value;

[0019] If the verification is successful, the third message verification value is obtained according to the authenticator's password verification value, the initiator's erroneously introduced encryption key, the responder's erroneously introduced encryption key, the first error recovery value, the second error recovery value, and the third error recovery value.

[0020] In one embodiment, generating the initiator session key according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter includes:

[0021] determining the first error recovery value, the second error recovery value, and the third error recovery value according to the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter;

[0022] The initiator session key is generated according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery value, the second error recovery value and the third error recovery value.

[0023] In a second aspect, the present application provides a session key exchange method, applied to a responder, the method comprising:

[0024] Receiving a first exchange message sent by an initiator; the initiator is configured to generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtaining an authenticator password verification value, and generating the first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value;

[0025] generating a responder error introduction encryption key; generating a second error recovery parameter, a third error recovery parameter, and a second message verification value if the first message verification value is verified successfully; and generating a second exchange message based on the responder error introduction encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value;

[0026] The second exchange message is sent to the initiator; the initiator is configured to generate a third message verification value if the second message verification value is verified successfully; and generate an initiator session key based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter;

[0027] Receive a third exchange message sent by the initiator that is generated based on the third message verification value; when the third message verification value is verified successfully, generate a responder session key according to the authenticator password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter.

[0028] In one embodiment, generating a response party error introducing an encryption key includes:

[0029] Determine the responder's temporary private key and responder error based on random sampling of discrete distribution data in the public parameters;

[0030] The responder error introduction encryption key is generated according to the responder temporary private key and the responder error.

[0031] In one embodiment, when the first message verification value is verified, generating the second error recovery parameter, the third error recovery parameter, and the second message verification value includes:

[0032] In a case where the encryption key erroneously introduced by the initiator belongs to an element in the target set, determining a first composite parameter of the responder according to the initiator identity hash, the static private key of the responder, and the encryption key erroneously introduced by the initiator; processing the first composite parameter of the responder and the first error recovery parameter through a coordination function to obtain a first error recovery value;

[0033] Obtaining a first message verification calculation value according to the initiator identity hash, the responder identity hash, and the first error recovery value, and verifying consistency between the first message verification calculation value and the first message verification value;

[0034] If the verification is successful, determining a second composite parameter of the responder based on the initiator identity hash, the responder static private key, and the responder temporary key; processing the second composite parameter of the responder through a cross approximation function to obtain a second error recovery parameter; processing the first composite parameter of the responder through an approximate rounding function to obtain a second error recovery value;

[0035] Determining a third composite parameter of the responder according to the encryption key erroneously introduced by the initiator and the temporary key of the responder; processing the third composite parameter of the responder by a cross approximation function to obtain a third error recovery parameter; processing the third composite parameter of the responder by an approximate rounding function to obtain a third error recovery value;

[0036] The second message verification value is obtained according to the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery value, the second error recovery value and the third error recovery value.

[0037] In one embodiment, when the third message verification value is verified successfully, generating a responder session key according to the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter includes:

[0038] determining the first error recovery value, the second error recovery value, and the third error recovery value according to the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter;

[0039] The responder session key is generated according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery value, the second error recovery value and the third error recovery value.

[0040] In a third aspect, the present application provides a session key exchange system, the system comprising: an initiator and a responder;

[0041] The initiator is configured to generate an initiator error introduction encryption key, the first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, generate a first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value; and send the first exchange message to the responder;

[0042] The responder is configured to generate a responder error introduction encryption key; if the first message verification value is verified, generate the second error recovery parameter, the third error recovery parameter, and the second message verification value; generate a second exchange message based on the responder error introduction encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value; and send the second exchange message to the initiator;

[0043] The initiator is configured to receive the second exchange message; generate a third message verification value if the second message verification value is verified successfully; and generate an initiator session key based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter;

[0044] The initiator is configured to generate a third exchange message based on the third message verification value; and send the third exchange message to the responder;

[0045] The responder is used to generate a responder session key based on the authenticator password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter when the third message verification value is verified successfully.

[0046] In a fourth aspect, the present application further provides a session key exchange device, applied to an initiator, the device comprising:

[0047] A first exchange message generation module is configured to generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, and generate a first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value;

[0048] A first exchange message sending module is configured to send the first exchange message to the responder; the responder is configured to generate a responder error introduction encryption key; if the first message verification value is verified, a second error recovery parameter, a third error recovery parameter, and a second message verification value are generated; and a second exchange message is generated based on the responder error introduction encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value.

[0049] an initiator session generation module, configured to receive the second exchange message sent by the responder; generate a third message verification value if the second message verification value is verified successfully; and generate an initiator session key based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter;

[0050] A third exchange message sending module is configured to send a third exchange message generated based on the third message verification value to the responder; the responder is configured to generate a responder session key based on the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter when the third message verification value is verified successfully.

[0051] In a fifth aspect, the present application further provides a session key exchange device, applied to a responder, the device comprising:

[0052] A first exchange message receiving module is configured to receive a first exchange message sent by an initiator; the initiator is configured to generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, and generate the first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value;

[0053] A second exchange message generation module is configured to generate a responder error introduction encryption key; generate a second error recovery parameter, a third error recovery parameter, and a second message verification value when the first message verification value is verified; and generate a second exchange message based on the responder error introduction encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value;

[0054] a second exchange message sending module, configured to send the second exchange message to the initiator; the initiator is configured to generate a third message verification value if the second message verification value is verified successfully; and generate an initiator session key according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter;

[0055] The responder session key generation module is used to receive the third exchange message sent by the initiator and generated based on the third message verification value; when the third message verification value is verified successfully, the responder session key is generated according to the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter.

[0056] In a sixth aspect, the present application further provides a computer device. The computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements: the steps of the method described in any one of the first aspects above; or the steps of the method described in any one of the second aspects above.

[0057] In a seventh aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements: the steps of the method described in any one of the first aspects above; or the steps of the method described in any one of the second aspects above.

[0058] In an eighth aspect, the present application further provides a computer program product, comprising a computer program that, when executed by a processor, implements: the steps of the method described in any one of the first aspects; or the steps of the method described in any one of the second aspects.

[0059] The above-mentioned session key exchange method, system, apparatus, computer device, storage medium and computer program product, in which the initiator generates a first exchange message based on the authenticator's password verification value, the initiator's incorrectly introduced encryption key, the first error recovery parameter and the first message verification value and sends it to the responder; the responder verifies the first message verification value, and then generates a second exchange message based on the responder's incorrectly introduced encryption key, the second error recovery parameter, the third error recovery parameter and the second message verification value and sends it to the initiator; the initiator then verifies the second message verification value, generates a third message verification value and sends it to the responder, and simultaneously generates the initiator's session key; the responder verifies the third message verification value, and then generates the responder's session key based on the same data as the initiator. Through three message interactions and verifications, the key exchange process is completed, so that both parties generate the same session key. The lattice-based cryptographic algorithm is used, has the ability to resist known quantum attacks, avoids the calculation process of the master public key and matrix vector, can resist temporary key leakage attacks and provides perfect forward security, while ensuring the security of two-way authentication, improving the communication and computing efficiency of the protocol implementation process. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A diagram illustrating an application environment of a session key exchange method in one embodiment;

[0061] Figure 2 1 is a flow chart of a session key exchange method according to an embodiment;

[0062] Figure 3 1 is a flow chart of a session key exchange method according to another embodiment;

[0063] Figure 4 is a protocol interaction diagram of a session key exchange method in one embodiment;

[0064] Figure 5 is a structural block diagram of a session key exchange device in one embodiment;

[0065] Figure 6 is a structural block diagram of a session key exchange device in another embodiment;

[0066] Figure 7 is a diagram of the internal structure of a computer device in one embodiment;

[0067] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in another embodiment. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0069] The session key exchange method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the key generation center 110 is connected to the authenticator 120 , which includes an initiator 121 and a responder 122 . The initiator 121 is connected to the responder 122 .

[0070] The authenticator 120 can be a terminal or a server. The terminal can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server can be implemented as a standalone server or a server cluster consisting of multiple servers.

[0071] In one embodiment, Figure 2 As shown, a session key exchange method is provided, which is applied to Figure 1 Taking the initiator 121 as an example, the following steps are included:

[0072] S210, generate an initiator error introduction encryption key, a first error recovery parameter and a first message verification value; obtain the authenticator password verification value, and generate a first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter and the first message verification value.

[0073] It should be noted that the initiator is denoted as U A , the responder is denoted as U B .

[0074] Among them, the encryption key introduced by the initiator is the key used by the initiator to introduce an error term into the temporary private key to resist quantum attack. The encryption key introduced by the initiator is denoted as x A .

[0075] The first error recovery parameter is used to form a first exchange message and sent to the responder, so that the responder calculates a first error recovery value. The first error recovery parameter is recorded as w1.

[0076] The first message verification value is used to construct the first exchange message and send it to the responder. This allows the responder to verify whether the first message verification values ​​calculated by the responder and the initiator are consistent, ensuring the correctness of data transmission and preventing tampering. If the data is sent by a fraudulent user, the correctness of the message is verified to ensure data transmission security. The first message verification value is denoted as k1.

[0077] The authenticator's password verification value, representing both the initiator and responder's password verification value, indicates the authenticator's identity and is used to construct the first exchange message sent to the responder, ensuring the responder's identity. The sender's password verification value is denoted as A, and the responder's password verification value is denoted as B.

[0078] The first exchange message is a message for the user sender and the responder to exchange keys. Generally, the first exchange message is a combination of the above data, such as (A, B, x A ,w1,k1).

[0079] S220: Send a first exchange message to the responder.

[0080] Among them, the responder is used to generate a responder error-introduced encryption key; when the first message verification value is verified, a second error recovery parameter, a third error recovery parameter and a second message verification value are generated; and a second exchange message is generated based on the responder error-introduced encryption key, the second error recovery parameter, the third error recovery parameter and the second message verification value.

[0081] S230, receiving the second exchange message sent by the responder; generating a third message verification value when the second message verification value is verified successfully; generating the initiator's session key according to the authenticator's password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter.

[0082] The second exchange message is a message for the user sender and the responder to exchange keys. Generally, the second exchange message is recorded as (x B ,w2,w3,k2).

[0083] The second message verification value is used to form the second exchange message and to verify whether the second message verification values ​​calculated by the responder and the initiator are consistent, thereby ensuring the security of data transmission. The second message verification value is denoted as k2.

[0084] The third message verification value is used to form a third exchange message and sent to the responder, so that the responder can verify whether the third message verification values ​​calculated by the responder and the initiator are consistent, thereby ensuring the security of data transmission. The first message verification value is denoted as k3.

[0085] The second error recovery parameter is obtained from the second exchange message sent by the responder, so that the initiator calculates the second error recovery value. The second error recovery parameter is recorded as w2.

[0086] The third error recovery parameter is obtained from the second exchange message sent by the responder, so that the initiator calculates the third error recovery value. The second error recovery parameter is recorded as w3.

[0087] The initiator's session key is the session key calculated by the initiator and used for subsequent data communication. The initiator's session key is denoted as K AB .

[0088] S240: Send a third exchange message generated based on the third message verification value to the responder.

[0089] Among them, the responder is used to generate the responder session key according to the authenticator password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter when the third message verification value is verified successfully.

[0090] In a specific embodiment, the third message verification value is the content of the third exchange message.

[0091] In this embodiment, the initiator generates a first exchange message based on the authenticator's password verification value, the initiator's incorrectly introduced encryption key, the first error recovery parameter, and the first message verification value, and sends it to the responder; the responder verifies the first message verification value, and then generates a second exchange message based on the responder's incorrectly introduced encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value, and sends it to the initiator; the initiator then verifies the second message verification value, generates a third message verification value, and sends it to the responder, while generating the initiator's session key; the responder verifies the third message verification value, and then generates the responder's session key based on the same data as the initiator. Through three message interactions and verifications, the key interaction process is completed, so that both parties generate the same session key. A lattice-based cryptographic algorithm is adopted, which has the ability to resist known quantum attacks, avoids the calculation process of the master public key and the matrix vector, can resist temporary key leakage attacks and provides perfect forward security. While ensuring the security of two-way authentication, the communication and computing efficiency of the protocol implementation process are improved.

[0092] In one embodiment, generating an initiator error introduction encryption key, a first error recovery parameter and a first message verification value includes: determining an initiator error introduction encryption key and an initiator error based on random sampling from discrete distribution data in a public parameter; generating an initiator error introduction encryption key based on the initiator temporary private key and the initiator error; determining an initiator first composite parameter based on an initiator static private key, a responder identity hash and an initiator temporary private key; obtaining a first error recovery parameter by processing the initiator first composite parameter through a cross approximation function; the initiator static private key is obtained by a key generation center based on a system master private key; the responder identity hash includes a mapping value of the responder identity information in the hash function; and obtaining a first message verification value based on the initiator identity hash, the responder identity hash and the first error recovery value.

[0093] Among them, discrete distribution data includes discrete Gaussian distribution, such as χ β is a discrete Gaussian distribution with parameters

[0094] Among them, the generation of encryption key introduced by the initiator's error requires first fusing the fixed elements of the public parameters and the initiator's temporary private key, and then weighting the fusion term and the initiator's error to obtain the result. For example, x A =a·r A +e' A ∈R q The initiator's temporary private key and the initiator's error are randomly sampled. The initiator's temporary private key is recorded as r A , the initiator’s error is recorded as e′ A .

[0095] For example, the initiator randomly samples r A ,e′ A ←χ β , r A As user A's temporary private key, then calculate x A =a·r A +e' A ∈R q and z A1 =h B ·sk A +a·r A ,calculate and Then calculate

[0096] In this embodiment, the error term is successfully introduced into the initiator's encryption key, and the cross approximation function and the approximate rounding function are introduced using data such as the temporary private key and the static private key, and the first composite parameter and the first error recovery value of the initiator are obtained respectively. Then, the identity hashes of the initiator and the responder are cascaded, and the cascade result and the first error recovery value are message authenticated, and the message authentication code is used as the first message verification value, thereby realizing the generation of exchange messages and verification values ​​and ensuring the security of the interaction process.

[0097] In one embodiment, when the second message verification value is verified, generating a third message verification value includes:

[0098] In the case that the encryption key incorrectly introduced by the responder belongs to an element in the target set, the initiator's second composite parameter is determined based on the responder's identity hash, the initiator's static private key and the responder's incorrectly introduced encryption key, and the initiator's third composite parameter is determined based on the initiator's temporary private key and the responder's incorrectly introduced encryption key.

[0099] For example, the initiator verifies x B ∈R q Is it true? If not, reject it. If true, calculate z A2 =h B ·sk A +x B ,y A =r A ·x B , where z A2 The second composite parameter of the initiator, y A It is the third composite parameter of the initiator.

[0100] The second composite parameter and the second error recovery parameter of the initiator are processed by the coordination function to obtain a second error recovery value; the third composite parameter and the third error recovery parameter of the initiator are processed by the coordination function to obtain a third error recovery value.

[0101] For example, we calculate σ2=rec(2z A2 ,w2) and σ3=rec(2y A ,w3).

[0102] A second message verification calculation value is obtained based on the authenticator's password verification value, the initiator's erroneously introduced encryption key, the responder's erroneously introduced encryption key, the first error recovery value, the first error recovery value, and the third error recovery value, and the consistency of the second message verification calculation value and the second message verification value is verified; if the verification passes, a third message verification value is obtained based on the authenticator's password verification value, the initiator's erroneously introduced encryption key, the responder's erroneously introduced encryption key, the first error recovery value, the second error recovery value, and the third error recovery value.

[0103] For example, check whether k2 is equal to If it is not true, reject and end the interaction; if it is true, calculate

[0104] In this embodiment, the security of the data during the interaction process is guaranteed by sequentially verifying the first composite parameter and the second message verification value of the responder. The third message verification value and the initiator's session key are then calculated using the verification results, thereby successfully generating the session key on the initiator's side while ensuring security.

[0105] In one embodiment, generating an initiator session key based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter includes:

[0106] The first error recovery value, the second error recovery value and the third error recovery value are determined based on the first error recovery parameter, the second error recovery parameter and the third error recovery parameter; the initiator session key is generated based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery value, the second error recovery value and the third error recovery value.

[0107] In this embodiment, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter are first generated and used for message interaction of the authenticator, and then the first error recovery value, the second error recovery value and the third error recovery value are calculated and used to generate the session key, thereby improving the efficiency of calculation and communication during the protocol implementation process.

[0108] In one embodiment, Figure 3 As shown, a session key exchange method is provided, which is applied to Figure 1 Taking the responder 122 as an example, the following steps are included:

[0109] S310: Receive a first exchange message sent by an initiator.

[0110] Among them, the initiator is used to generate an initiator error introduction encryption key, a first error recovery parameter and a first message verification value; obtain the authentication party password verification value, and generate a first exchange message based on the authentication party password verification value, the initiator error introduction encryption key, the first error recovery parameter and the first message verification value.

[0111] S320, generate a responder error-introduced encryption key; if the first message verification value is verified successfully, generate a second error recovery parameter, a third error recovery parameter and a second message verification value; generate a second exchange message based on the responder error-introduced encryption key, the second error recovery parameter, the third error recovery parameter and the second message verification value.

[0112] The responder's incorrectly introduced encryption key is the responder's key used to introduce an error term into the temporary private key to resist quantum attacks. The responder's incorrectly introduced encryption key is denoted as x B .

[0113] The second error recovery parameter is used to form a second exchange message and sent to the initiator, so that the initiator calculates a second error recovery value. The second error recovery parameter is recorded as w2.

[0114] The third error recovery parameter is used to form a second exchange message and sent to the initiator, so that the initiator calculates a third error recovery value. The third error recovery parameter is recorded as w3.

[0115] The second message verification value is used to form a second exchange message and sent to the initiator, so that the initiator can verify whether the second message verification values ​​calculated by the responder and the initiator are consistent, thereby ensuring the security of data transmission. The second message verification value is denoted as k2.

[0116] The second exchange message is a message for the user sender and the responder to exchange keys. Generally, the second exchange message is a combination of the above data, such as (x B ,w2,w3,k2).

[0117] S330: Send a second exchange message to the initiator.

[0118] The initiator is configured to generate a third message verification value when the second message verification value is verified successfully; and generate an initiator session key based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter;

[0119] S340, receiving the third exchange message generated based on the third message verification value sent by the initiator; when the third message verification value is verified successfully, generating the responder session key according to the authenticator password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter.

[0120] The third message verification value verifies whether the second message verification values ​​calculated by the responder and the initiator are consistent, thereby ensuring the security of data transmission. The third message verification value is denoted as k3.

[0121] The responder session key is the session key calculated by the responder and used for subsequent data communication. The initiator session key is denoted as K BA .

[0122] In one embodiment, generating a responder error introduction encryption key includes: determining a responder temporary private key and a responder error based on random sampling from discrete distribution data in public parameters; and generating a responder error introduction encryption key based on the responder temporary private key and the responder error.

[0123] For example, corresponding to the operation of the initiator, the responder randomly selects r B ,e′ B ←χ β , and calculate x B =a·r B +e' B ∈R q .

[0124] In one embodiment, when the first message verification value is verified, generating the second error recovery parameter, the third error recovery parameter, and the second message verification value includes:

[0125] In the case where the encryption key erroneously introduced by the initiator belongs to an element in the target set, the first composite parameter of the responder is determined based on the initiator's identity hash, the responder's static private key and the initiator's erroneously introduced encryption key; the first composite parameter of the responder and the first error recovery parameter are processed through the coordination function to obtain the first error recovery value.

[0126] For example, verify x A ∈R q Is it true? If not, reject it. If it is true, calculate z B1 =h A ·sk B +x A and σ1=rec(2z B1 ,w1).

[0127] According to the initiator identity hash, the responder identity hash and the first error recovery value, a first message verification calculation value is obtained, and the consistency of the first message verification calculation value and the first message verification value is verified; if the verification is passed, the responder second composite parameter is determined according to the initiator identity hash, the responder static private key and the responder temporary key; the responder second composite parameter is processed by a cross approximation function to obtain a second error recovery parameter; the responder first composite parameter is processed by an approximate rounding function to obtain a second error recovery value.

[0128] For example, check whether k1 is equal to MAC σ1 (hA ||h B ), if they are not equal, the user will reject and stop the interaction, if they are equal, calculate z B2 =h A ·sk B +a·r B , and

[0129] The third composite parameter of the responder is determined based on the encryption key erroneously introduced by the initiator and the temporary key of the responder; the third composite parameter of the responder is processed by a cross approximation function to obtain a third error recovery parameter; the third composite parameter of the responder is processed by an approximate rounding function to obtain a third error recovery value.

[0130] For example, calculate y B =x A ·r B , and

[0131] A second message verification value is obtained according to the authenticator password verification value, the initiator's incorrectly introduced encryption key, the responder's incorrectly introduced encryption key, the first error recovery value, the second error recovery value, and the third error recovery value.

[0132] For example, calculate

[0133] In this embodiment, the error term is successfully introduced into the responder's error-introduced encryption key, and the sender's error-introduced encryption key is verified, thereby completing the calculation of the responder's first composite parameter and the first error recovery value, and then verifying the first message verification value, and calculating the responder's second composite parameter, the second error recovery parameter, and the second error recovery value, and then calculating the responder's third composite parameter, the third error recovery parameter, and the third error recovery value, and successfully completing the calculation of the second message verification value, thereby improving the security during the message interaction process.

[0134] In one embodiment, when the third message verification value is verified successfully, generating a responder session key according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter includes:

[0135] The first error recovery value, the second error recovery value and the third error recovery value are determined according to the first error recovery parameter, the second error recovery parameter and the third error recovery parameter; the responder session key is generated according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery value, the second error recovery value and the third error recovery value.

[0136] For example, user U B After receiving the message, check whether k3 is equal to Finally calculate the session key K BA =H2(A||B||x A ||x B ||σ1||σ2||σ3).

[0137] In this embodiment, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter are first generated and used for message interaction of the authenticator, and then the first error recovery value, the second error recovery value and the third error recovery value are calculated and used to generate the session key, thereby improving the efficiency of calculation and communication during the protocol implementation process.

[0138] Reference below Figure 4 , a session key exchange method is described in detail using a specific embodiment. It is worth noting that the following description is only for illustrative purposes and is not intended to limit the application.

[0139] like Figure 4 As shown, the session key exchange method provided in this application is an identity-based authentication key exchange protocol. The protocol is based on the error-based learning problem on the ring and is constructed using a Peikert-type error coordination mechanism. It can resist known quantum attacks in the post-quantum era, meet perfect forward security, resist temporary key leakage attacks, and has better efficiency.

[0140] The protocol consists of participating users and a key generating center (KGC). The user entity is an honest user and the key generating center is a trusted third party. i ∈U’s identity is ID i Each user has a pair of long-term public and private keys, where the public key is their identity information. KGC uses the system's master private key, public parameters, and identity information to generate a static private key for each user. This key is then distributed to each user through an authentication channel, so the static private key corresponds to their identity information.

[0141] The user participation protocol consists of three phases: initialization phase, key generation phase, and session key establishment phase. Generally, the initialization phase and key generation phase are performed by the KGC, while the session key establishment phase is performed by the user.

[0142] The KGC first runs the initialization phase to set public parameters and generate the system's master private key. During the key generation phase, all clients send their identity information to the KGC and simultaneously obtain their respective static private keys, also known as long-term private keys. During the session key establishment phase, users verify their identities using temporary and static private keys while generating a common session key.

[0143] In the initialization phase: the system generates public parameters. The public parameters generated by the system are public and can be used by all participating users.

[0144] Specifically, let κ be a security parameter, n be a power of 2, f(n) = x n +1,q=2 ω(logn) +1 is an odd prime number such that qmod2n=1. Randomly select s←χ β As the system master private key. Let H1: {0,1} * →R q is a hash function, H2:{0,1} * →{0,1} κ is a key derivation function, where κ is the length in bits of the final session key. Here the hash function and the key derivation function are simulated as random oracles, and MAC is a message authentication algorithm. Let a denote a q A fixed element uniformly randomly selected from is given to all users. Let χ β is a discrete Gaussian distribution with parameters The key generation center is a trusted third party that extracts the corresponding static private key for each participant.

[0145] In the key generation phase: KGC randomly selects s←χ β As the system master private key, and then the identity ID i User U i Generate the corresponding static private key sk i =h i ·s+e i , where h i =H1(ID i ) is a ring R q The element in e i ←χ β .

[0146] The key exchange phase is as follows:

[0147] (1) User U A (Initiator) performs the following operations:

[0148] a) Random sampling r A ,e' A ←χ β , r A As user A's temporary private key, then calculate x A =a·r A +e' A ∈R q and z A1 =h B ·sk A +a·rA b) Calculation and Then calculate c) Finally, (A, B, x A ,w1,k1) is sent to participant U B .

[0149] (2) User U B (Responder) receives the message (A, B, x A ,w1,k1), then do the following:

[0150] a) Randomly select r B ,e' B ←χ β , and calculate x B =a·r B +e' B ∈R q ; b) Verify x A ∈R q Is it true? If not, reject it. If it is true, do the following operations; c) Calculate z B1 =h A ·sk B +x A and σ1=rec(2z B1 ,w1); d) Check whether k1 is equal to If they are not equal, the user will reject and stop the interaction. If they are equal, the following operations will be performed; e) Calculate z B2 =h A ·sk B +a·r B , and f) Then calculate y B =x A ·r B , and and calculate g) Send the message (x B ,w2,w3,k2) is sent to user U A .

[0151] (3) User U A Received message (x B ,w2,w3,k2), then do the following: a) Verify x B ∈R q Is it true? If not, reject it. Otherwise, do the following: b) Calculate z A2 =h B ·sk A +x B ,yA =r A ·x B ,σ2=rec(2z A2 ,w2) and σ3=rec(2y A ,w3); c) Check if k2 is equal to If not, reject and end the interaction. If true, perform the following operations; d) then calculate Send message k3 to user U B ; e) Finally calculate the session key K AB =H2(A||B||x A ||x B ||σ1||σ2||σ3), and complete the session.

[0152] (4) User U B After receiving the message, do the following: a) Check if k3 is equal to b) Finally calculate the session key K BA =H2(A||B||x A ||x B ||σ1||σ2||σ3), and complete the session.

[0153] Correctness analysis of the description of the above ID-AKE protocol:

[0154] Assume that q is an odd prime number such that q>16β 2 n 3 / 2 +8βn 1 / 2 The two parties U A and U B By honestly following the above protocol to establish the session key, both parties can compute the same session key with significant probability.

[0155] Proof of correctness analysis:

[0156] If user U A Calculated z A1 (z A2 ,y A ) and user U B Calculated z B1 (z B2 ,y B ) is close enough, then there is Specifically, if |z A1 -z B1 | A2 -z B2 | A -y B ​​|

[0157] z A1 =h B ·sk A +a·r A =h B ·h A ·s+h B ·e A +a·r A

[0158] z B1 =h A ·sk B +x A =h A ·h B ·s+h A ·e B +a·r A +e' A

[0159] Then z A1 -z B1 =h B e A -h A e B -e' A According to Lemma 1.2, Lemma 1.1 and the triangle inequality, we can get Therefore, the same σ1 can be calculated; similarly, the same σ2 and σ3 can be obtained. Therefore, both parties can obtain the same session key.

[0160] Lemma 1.1 For any s, t∈R, there exists and Lemma 1.2 For any real number exist

[0161] In this embodiment, the characters used and their specific meanings are shown in Table 1.

[0162] character meaning character meaning s System master private key <![CDATA[ID i ]]> Authenticator serial number A The initiator's password verification value B The responder's password verification value <![CDATA[x A ]]> The initiator mistakenly introduced the encryption key <![CDATA[x B ]]> The responder mistakenly introduced the encryption key <![CDATA[r A ]]> Initiator's temporary private key <![CDATA[r B ]]> Responder's temporary private key <![CDATA[e′ A ]]> Initiator error <![CDATA[e′ B ]]> Responder Error <![CDATA[h A ]]> Originator identity hash <![CDATA[h B ]]> Responder Identity Hash <![CDATA[sk A ]]> Initiator's static private key <![CDATA[sk B ]]> Responder static private key <![CDATA[z A1 ]]> The first composite parameter of the initiator <![CDATA[z A2 ]]> Initiator's second composite parameter <![CDATA[z B1 ]]> Responder's first composite parameter <![CDATA[z B2 ]]> Responder second composite parameter <![CDATA[y A ]]> Initiator's third composite parameter <![CDATA[y B ]]> Responder third composite parameter <![CDATA[w1]]> First error recovery parameter <![CDATA[w2]]> Second error recovery parameter <![CDATA[w3]]> The third error recovery parameter <![CDATA[σ1]]> First error recovery value <![CDATA[σ2]]> Second error recovery value <![CDATA[σ3]]> Third error recovery value <![CDATA[k1]]> First message verification value <![CDATA[k2]]> Second message verification value <![CDATA[k3]]> Third message verification value a Fixed elements in common parameters <![CDATA[K AB ]]> Initiator session key <![CDATA[K BA ]]> Responder Session Key

[0163] Table 1

[0164] It should be noted that the Peikert error coordination mechanism in this scheme is embodied in: introducing the coordination function Rec and the cross approximation function <·>2:=Z q ​→Z2, calculate the value of σ and apply it to the interaction between users and the session key process, thereby successfully recovering the error caused by the small error term introduced by the lattice-based cryptographic algorithm to ensure post-quantum security, and ensuring the generated session key K BA and K AB The consistency of the session key ensures the reliability of subsequent communication between users using the session key.

[0165] The identity-based authentication key exchange protocol provided in this embodiment has the following advantages:

[0166] (1) From the perspective of efficiency and security, the difficulty of the identity-based authentication key exchange protocol provided in this application is based on the assumption of error-based learning problem on the ring, and adopts a lattice-based cryptographic algorithm that can resist known quantum attacks.

[0167] Specifically, as "a) random sampling r A ,e' A ←χ β , then calculate x A =a·r A +e' A ∈R q "Steps. Even if the cracker gets x A , and know a, but due to the error e′ A With the introduction of r A ; For example, "z A1 =h B ·sk A +a·r A " steps, the cracker also cannot get A's private key sk A .

[0168] (2) Unlike other lattice-based key exchange methods, the system key includes the system master private key and the master public key. The identity-based authentication key exchange protocol provided by this application does not need to calculate the master public key and the user's public key during the key generation phase, which overcomes the complexity of matrix-vector operations and effectively reduces the computing resource overhead consumed by the protocol implementation.

[0169] (3) Compared with similar schemes, the identity-based authentication key exchange protocol provided by this application has certain advantages in security, computational and communication overhead.

[0170] Specifically, compared with the ID-AKE protocol proposed by Islam et al. and the ID-AKE protocol proposed by Gupta et al., the communication complexity is reduced from O(nlog 2 n) is reduced to O(nlogn), saving communication resources and energy consumption, and reducing communication delay time.

[0171] (4) The identity-based authentication key exchange protocol provided by this application can resist temporary key leakage attacks, that is, even if the selected temporary key is exposed, the protocol can still ensure the security of the session key without knowing the static private key.

[0172] (5) The identity-based authentication key exchange protocol provided by this application also provides two-way authentication and perfect forward security. Even if the long-term key used to generate the session key is leaked, it will not cause the leakage of the session key used in the previous communication, and will not expose the content of the previous communication. In other words, after the session is completed, even if the adversary later obtains the private keys of all participants, it cannot obtain the previously calculated session key because it does not know the temporary private key.

[0173] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0174] Based on the same inventive concept, embodiments of the present application also provide a session key exchange system for implementing the aforementioned session key exchange method. The solution provided by this system is similar to the solution described in the aforementioned method. Therefore, the specific limitations in one or more of the following session key exchange system embodiments can be found in the aforementioned limitations on the session key exchange method and will not be further elaborated here.

[0175] In one embodiment, a session key exchange system is provided, the system comprising: an initiator and a responder;

[0176] The initiator is configured to generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, generate a first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value; and send the first exchange message to the responder;

[0177] The responder is configured to generate a responder error introduction encryption key; if the first message verification value is verified successfully, generate a second error recovery parameter, a third error recovery parameter, and a second message verification value; generate a second exchange message based on the responder error introduction encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value; and send the second exchange message to the initiator;

[0178] The initiator is configured to receive the second exchange message; generate a third message verification value if the second message verification value is verified successfully; and generate an initiator session key based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter;

[0179] The initiator is configured to generate a third exchange message based on the third message verification value; and send the third exchange message to the responder;

[0180] The responder is used to generate a responder session key based on the authenticator password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter when the third message verification value is verified successfully.

[0181] Based on the same inventive concept, embodiments of the present application also provide a session key exchange device for implementing the aforementioned session key exchange method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations in one or more of the following session key exchange device embodiments can be found in the aforementioned limitations on the session key exchange method and will not be further elaborated here.

[0182] In one embodiment, Figure 5 As shown, a session key exchange device is provided, which is applied to the initiator. The device includes: a first exchange message generating module 501, a first exchange message sending module 502, an initiator session generating module 503, and a third exchange message sending module 504, wherein:

[0183] The first exchange message generation module 501 is configured to generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, and generate a first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value;

[0184] The first exchange message sending module 502 is configured to send a first exchange message to the responder; the responder is configured to generate a responder error introduction encryption key; if the first message verification value is verified, a second error recovery parameter, a third error recovery parameter, and a second message verification value are generated; and a second exchange message is generated based on the responder error introduction encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value.

[0185] The initiator session generation module 503 is configured to receive the second exchange message sent by the responder; generate a third message verification value if the second message verification value is verified successfully; and generate an initiator session key based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter.

[0186] The third exchange message sending module 504 is used to send a third exchange message generated based on the third message verification value to the responder; the responder is used to generate a responder session key based on the authenticator password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter when the third message verification value is verified successfully.

[0187] In one embodiment, Figure 6 As shown, a session key exchange device is provided, which is applied to a responder. The device includes: a first exchange message receiving module 601, a second exchange message generating module 602, a second exchange message sending module 603, and a responder session key generating module 604, wherein:

[0188] The first exchange message receiving module 601 is configured to receive a first exchange message sent by an initiator; the initiator is configured to generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, and generate a first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value;

[0189] The second exchange message generation module 602 is configured to generate a responder error introduction encryption key; generate a second error recovery parameter, a third error recovery parameter, and a second message verification value when the first message verification value is verified; and generate a second exchange message based on the responder error introduction encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value.

[0190] The second exchange message sending module 603 is configured to send the second exchange message to the initiator; the initiator is configured to generate a third message verification value if the second message verification value is verified successfully; and generate the initiator's session key based on the authenticator's password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter;

[0191] The responder session key generation module 604 is used to receive the third exchange message sent by the initiator that is generated based on the third message verification value; when the third message verification value is verified successfully, the responder session key is generated according to the authenticator password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter.

[0192] Each module in the session key exchange apparatus described above may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in hardware form, or may be stored in a memory in the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0193] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store keys and related data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a session key exchange method is implemented.

[0194] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 8As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a session key exchange method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse.

[0195] Those skilled in the art will understand that Figure 7 and Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0196] In one embodiment, a computer device includes a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0197] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0198] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0199] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0200] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided in this application may be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, etc., but are not limited to these.

[0201] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0202] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A session key exchange method, characterized in that: Applied to the initiator, the method includes: Generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, and generate a first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value; the initiator error introduction encryption key is a key used by the initiator to introduce an error term into a temporary private key to resist quantum attacks; The first exchange message is sent to the responder; the responder is used to generate a responder error introduction encryption key; if the first message verification value is verified, a second error recovery parameter, a third error recovery parameter, and a second message verification value are generated; a second exchange message is generated based on the responder error introduction encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value; the responder error introduction encryption key is a key of the responder used to introduce an error term into a temporary private key to resist quantum attacks; receiving the second exchange message sent by the responder; generating a third message verification value if the second message verification value is verified successfully; generating an initiator session key based on the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter; A third exchange message generated based on the third message verification value is sent to the responder; the responder is used to generate a responder session key according to the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter when the third message verification value is verified successfully.

2. The method according to claim 1, characterized in that The generating of the initiator error introduction encryption key, the first error recovery parameter and the first message verification value comprises: Determining an initiator's temporary private key and an initiator's error based on random sampling of discrete distribution data in the public parameters; generating an initiator's error introduction encryption key based on the initiator's temporary private key and the initiator's error; Determining a first composite parameter of the initiator based on the initiator's static private key, the responder's identity hash, and the initiator's temporary private key; processing the first composite parameter of the initiator through a cross-approximation function to obtain the first error recovery parameter; the initiator's static private key is obtained by a key generation center based on the system master private key; the responder's identity hash includes a mapping value of the responder's identity information in the hash function; The first message verification value is obtained according to the initiator identity hash, the responder identity hash and the first error recovery value.

3. The method according to claim 2, characterized in that The generating a third message verification value when the second message verification value is verified to be successful includes: In the case where the encryption key incorrectly introduced by the responder belongs to an element in the target set, determining the initiator's second composite parameter based on the responder identity hash, the initiator's static private key, and the encryption key incorrectly introduced by the responder; determining the initiator's third composite parameter based on the initiator's temporary private key and the encryption key incorrectly introduced by the responder; Processing the initiator's second composite parameter and the second error recovery parameter through a coordination function to obtain a second error recovery value; processing the initiator's third composite parameter and the third error recovery parameter through a coordination function to obtain a third error recovery value; Obtaining a second message verification calculation value based on the authenticator password verification value, the initiator's incorrectly introduced encryption key, the responder's incorrectly introduced encryption key, the first error recovery value, the first error recovery value, and the third error recovery value, and verifying consistency between the second message verification calculation value and the second message verification value; If the verification is successful, the third message verification value is obtained according to the authenticator's password verification value, the initiator's erroneously introduced encryption key, the responder's erroneously introduced encryption key, the first error recovery value, the second error recovery value, and the third error recovery value.

4. The method according to claim 3, characterized in that The generating of the initiator session key according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter includes: determining the first error recovery value, the second error recovery value, and the third error recovery value according to the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter; The initiator session key is generated according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery value, the second error recovery value and the third error recovery value.

5. A session key exchange method, characterized in that: Applied to the responder, the method includes: The first exchange message is received by the initiator; the initiator is configured to generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, and generate the first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value; the initiator error introduction encryption key is a key used by the initiator to introduce an error term into a temporary private key to resist quantum attacks; Generate a responder error-introduced encryption key; if the first message verification value is verified, generate a second error recovery parameter, a third error recovery parameter, and a second message verification value; generate a second exchange message based on the responder error-introduced encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value; the responder error-introduced encryption key is a key of the responder used to introduce an error term into a temporary private key to resist quantum attacks; The second exchange message is sent to the initiator; the initiator is configured to generate a third message verification value if the second message verification value is verified successfully; and generate an initiator session key based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter; Receive a third exchange message sent by the initiator that is generated based on the third message verification value; when the third message verification value is verified successfully, generate a responder session key according to the authenticator password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter.

6. The method according to claim 5, characterized in that The generating responder error introduction encryption key comprises: Determine the responder's temporary private key and responder error based on random sampling of discrete distribution data in the public parameters; The responder error introduction encryption key is generated according to the responder temporary private key and the responder error.

7. The method according to claim 6, characterized in that The generating, when the first message verification value is verified to be successful, a second error recovery parameter, a third error recovery parameter, and a second message verification value, comprises: In a case where the encryption key erroneously introduced by the initiator belongs to an element in the target set, determining a first composite parameter of the responder according to the initiator identity hash, the static private key of the responder, and the encryption key erroneously introduced by the initiator; processing the first composite parameter of the responder and the first error recovery parameter through a coordination function to obtain a first error recovery value; Obtaining a first message verification calculation value according to the initiator identity hash, the responder identity hash, and the first error recovery value, and verifying consistency between the first message verification calculation value and the first message verification value; If the verification is successful, determining a second composite parameter of the responder based on the initiator identity hash, the responder static private key, and the responder temporary key; processing the second composite parameter of the responder through a cross approximation function to obtain a second error recovery parameter; processing the first composite parameter of the responder through an approximate rounding function to obtain a second error recovery value; Determining a third composite parameter of the responder according to the encryption key erroneously introduced by the initiator and the temporary key of the responder; processing the third composite parameter of the responder by a cross approximation function to obtain a third error recovery parameter; processing the third composite parameter of the responder by an approximate rounding function to obtain a third error recovery value; The second message verification value is obtained according to the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery value, the second error recovery value and the third error recovery value.

8. The method according to claim 7, characterized in that The step of generating a responder session key according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter when the third message verification value is verified successfully comprises: determining the first error recovery value, the second error recovery value, and the third error recovery value according to the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter; The responder session key is generated according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery value, the second error recovery value and the third error recovery value.

9. A session key exchange system, characterized in that: The system includes: an initiator and a responder; The initiator is configured to generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, and generate a first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value; and send the first exchange message to the responder; the initiator error introduction encryption key is a key used by the initiator to introduce an error term into a temporary private key to resist quantum attacks; The responder is configured to generate a responder error-introduced encryption key; upon verification of the first message verification value, generate a second error recovery parameter, a third error recovery parameter, and a second message verification value; generate a second exchange message based on the responder error-introduced encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value; and send the second exchange message to the initiator; the responder error-introduced encryption key is a key of the responder used to introduce an error term into a temporary private key to resist quantum attacks; The initiator is configured to receive the second exchange message; generate a third message verification value if the second message verification value is verified successfully; and generate an initiator session key based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter; The initiator is configured to generate a third exchange message based on the third message verification value; and send the third exchange message to the responder; The responder is used to generate a responder session key based on the authenticator password verification value, the initiator's error-introduced encryption key, the responder's error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter when the third message verification value is verified successfully.

10. A session key exchange device, characterized in that: Applied to an initiator, the device includes: A first exchange message generation module is configured to generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, and generate a first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value; the initiator error introduction encryption key is a key used by the initiator to introduce an error term into a temporary private key to resist quantum attacks; A first exchange message sending module is configured to send the first exchange message to the responder; the responder is configured to generate a responder error-introduced encryption key; if the first message verification value is verified, a second error recovery parameter, a third error recovery parameter, and a second message verification value are generated; a second exchange message is generated based on the responder error-introduced encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value; the responder error-introduced encryption key is a key of the responder used to introduce an error term into a temporary private key to resist quantum attacks; an initiator session generation module, configured to receive the second exchange message sent by the responder; generate a third message verification value if the second message verification value is verified successfully; and generate an initiator session key based on the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter; A third exchange message sending module is configured to send a third exchange message generated based on the third message verification value to the responder; the responder is configured to generate a responder session key based on the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter when the third message verification value is verified successfully.

11. A session key exchange device, characterized in that: Applied to a responder, the device includes: A first exchange message receiving module is configured to receive a first exchange message sent by an initiator; the initiator is configured to generate an initiator error introduction encryption key, a first error recovery parameter, and a first message verification value; obtain an authenticator password verification value, and generate the first exchange message based on the authenticator password verification value, the initiator error introduction encryption key, the first error recovery parameter, and the first message verification value; the initiator error introduction encryption key is a key used by the initiator to introduce an error term into a temporary private key to resist quantum attacks; A second exchange message generation module is configured to generate a responder error-introduced encryption key; if the first message verification value is verified successfully, generate a second error recovery parameter, a third error recovery parameter, and a second message verification value; generate a second exchange message based on the responder error-introduced encryption key, the second error recovery parameter, the third error recovery parameter, and the second message verification value; the responder error-introduced encryption key is a key of the responder used to introduce an error term into a temporary private key to resist quantum attacks; a second exchange message sending module, configured to send the second exchange message to the initiator; the initiator is configured to generate a third message verification value if the second message verification value is verified successfully; and generate an initiator session key according to the authenticator password verification value, the initiator error introduction encryption key, the responder error introduction encryption key, the first error recovery parameter, the second error recovery parameter, and the third error recovery parameter; The responder session key generation module is used to receive the third exchange message sent by the initiator and generated based on the third message verification value; when the third message verification value is verified successfully, the responder session key is generated according to the authenticator password verification value, the initiator error-introduced encryption key, the responder error-introduced encryption key, the first error recovery parameter, the second error recovery parameter and the third error recovery parameter.

12. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the processor implements: the steps of the method according to any one of claims 1 to 4; or the steps of the method according to any one of claims 5 to 8.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the computer program implements: the steps of the method according to any one of claims 1 to 4; or the steps of the method according to any one of claims 5 to 8.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements: the steps of the method according to any one of claims 1 to 4; or the steps of the method according to any one of claims 5 to 8.

Images