An efficient switching authentication method based on the state secret SM9 supporting batch authentication

Abstract

The present application relates to a kind of efficient switching authentication method based on state secret SM9 supports batch authentication.First, system initialization is carried out and relevant parameters are disclosed, and the identity information and signature private key of user and access point joining network are obtained.In the process of user movement, when the signal of connected access point is lower than threshold value, user will request switching authentication to the access point with stronger signal.The authentication process of the method of the present application only needs 2 times of handshaking, and supports batch authentication in dense user scene, with higher authentication efficiency.Not only meet the security requirements such as bidirectional authentication and key consistency, traceability, anti-replay attack, anti-middleman attack and front / backward security, but also support state secret algorithm, with higher security.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication. Background Technology

[0002] With the development of wireless network technology, online office work, mobile payment, and online shopping have gradually become popular lifestyles. While wireless networks bring us convenience, they also bring many security problems. Cryptographic algorithms, as a key technology for building a secure network environment, are fundamental to maintaining national cyberspace security. Identity authentication is the first line of defense in building network security. In wireless networks, the access point a user connects to changes with their location. As a user moves, if the signal strength of the access point they are connected to falls below a set threshold, the user will request to connect to an access point with a stronger signal. In this process, the handover authentication protocol used not only needs to verify the legitimacy of both parties but also needs to have high authentication efficiency to ensure that the user is unaware of the handover authentication process. However, most of the current mainstream handover authentication protocols are based on international cryptographic algorithms. These protocols not only have security issues and cannot meet my country's requirements for independent control over cyberspace security, but also suffer from low authentication efficiency. Strengthening the research and application of domestically developed cryptographic algorithms will help further improve my country's independent control in the field of network security. Summary of the Invention

[0003] The purpose of this invention is to solve the problems of low authentication efficiency and inability to support national cryptographic algorithms in the existing technology, and to provide an efficient switching authentication method based on the national cryptographic algorithm SM9 that supports batch authentication. This method only requires two handshakes to complete the switching authentication, which not only meets the security requirements of two-way authentication, key consistency, traceability, anti-replay attack, anti-man-in-the-middle attack, and front / back security, but also supports batch authentication in dense user scenarios, with higher authentication efficiency and good application value.

[0004] To achieve the above objectives, the technical solution of the present invention is: an efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication, comprising the following steps:

[0005] S1. The system initializes and generates and publishes relevant system parameters ρρ={βρ,g,N,P1,P2,H1,H2,hid,P pub}, where βρ is the bilinear pairing parameter and g is the multiplicative group G. T An element in the set of N is a large prime number, P1 and P2 are generators of the additive groups G1 and G2 respectively, H1 and H2 are two secure hash functions, hid is the function identifier, and P... pub It is the master public key; the system assigns identity IDs to users and access points (APs) in the network and generates a signing private key sk;

[0006] S2. If the current AP signal exceeds the preset threshold S during the user's movement (-30dBm ≥ S ≥ -120dBm), the user generates two random numbers r based on the system's publicly available parameter ρ. U ,a∈[1,N-1]; Calculate temporary variables K U =a·P1h U =H2(K U ||w U ||ts,N), where ts is the timestamp, calculate the temporary variable L = (r U -h U Mod N, check if L equals 0. If it does, select a new random number r. U Otherwise, calculate the temporary variable S. U =[L]sk U , where [L]sk U sk U L times, sk U The user signs the master private key; the user encapsulates the pre-computed signature to generate σ. U =(h U ,S U Add a timestamp ts and the message {ID} U ,K U ,ts,σ U Send a request to the AP to switch authentication, ID U User identification;

[0007] After receiving the authentication request, S3 and AP first verify whether the time difference between ts and the current system time is within 3 minutes. If so, they calculate the temporary variable. d1 = H1(ID) U ||hid,N), then calculate the temporary variable P based on the publicly available system parameters. U =[d1]P2+P pub u1 = e(S U ,P U ), w' U =u1·t1,h1=H2(K') U ||w' U ,N), and verify the validity of the signature, and σ U h U Compare with h1, if h U If the key and signature {K} do not match, it proves that the corresponding user is an illegitimate user, and the access request is rejected; otherwise, the pre-computed key and signature {K} will be used. AP ,σ AP Send to user for verification. K AP=b·P1, and calculate the session key PTK1 = b·K U r AP b is a random number;

[0008] S4. After the user receives the message returned by the AP, first calculate the temporary variable. d2 = H1(ID) AP ||hid,N)h AP =H2(K AP ||w AP ,N), ID AP The AP identifier is used, and then a temporary variable P is calculated based on the publicly available system parameters. A = [d2]P2+P pub u2=e(S AP ,P A ), w' AP =u2·t2 and h2=H2(K AP ||w' AP ,N),S AP =[L]sk AP ,sk AP Sign the master private key for AP, if h2 and h AP If there is a discrepancy, the AP is deemed illegitimate and access is denied; otherwise, the session key PTK2 = a·K is calculated. AP Complete the switching authentication process and use the same session key for encrypted communication;

[0009] S5. After each authentication, the user will calculate the next authentication key information and send it to the current access point, which will then forward it to surrounding access points. The user selects random numbers a, c ∈ [1, N-1] and calculates K. U =a·P1, C=c·P1, and encrypt and send the message {K} U The current access point is given the group key GK shared among access points, and the message authentication code mac = MAC(GK, ID) is calculated using the group key GK. U ||K U ||C), and send it to the surrounding access points for verification and storage; after receiving the message, the surrounding access points will verify the message authentication code, and if the verification is successful, they will save the user's authentication message in the information list;

[0010] S6. When the signal strength of the AP currently connected to by the user is lower than the threshold S, the user will request a switch authentication from the AP with the stronger signal, namely AP1, and the user will generate a signature σ. U =a+c·H1(ID) U ||K U |||C|ts), encapsulate the switching authentication key information into a message m = {ID} U ,KU ,ts,σ U And send it to AP1, requesting a switch of authentication;

[0011] S7. When AP1 receives a user's authentication request message, it checks if the user's information exists in the user information list. If not, access is denied, and the user will reapply for access authentication. If the information exists, it verifies whether the user's key message has expired and the validity of the signature. If expired or the signature is invalid, access is denied; otherwise, the pre-calculated key {K} is used. AP ,σ AP Send the message to the user for verification and calculate the session key PTK1 = b·K. U If more than two users apply for authentication at the same time, AP1 can choose batch authentication to improve authentication efficiency;

[0012] S8. After the user receives the message returned by AP1, first calculate... d1 = H1(ID) AP ||hid,N), then calculate P based on the publicly available system parameters. A =[d1]P2+P pub u1 = e(S AP ,P A Then calculate w' AP =u1·t1 and h1=H2(K AP ||w' AP ,N), if h1 and h AP If there is a discrepancy, AP1 is deemed illegitimate, and access is denied; otherwise, the session key PTK2 = a·K is calculated. AP At this point, the user and AP1 have completed two-way authentication and can transmit messages encrypted using the calculated session key.

[0013] In one embodiment of the present invention, the specific steps of initializing the system and generating and disclosing relevant system parameters in step S1 are as follows:

[0014] The system inputs a security parameter λ, and the Key Management Center (KMC) selects a byte to represent the signature private key generation function identifier hid; it selects a bilinear pairwise group βρ = {G1, G2, G...} T Let G1, G2, N be the bilinear pair G1×G2→G2. T P1 and P2 are generators of group G1 and G2 respectively, and the large prime number N > 2. 191 The system randomly selects s∈[1,N-1] as the master private key msk, and computes element P in G2. pub =[s]P2 is used as the master public key mpk to calculate G T element g = e(P1, P pub Choose a secure cryptographic hash function H1:{0,1}* →h0,H2:{0,1} * ×N→h0, h0∈[1,N-1]; Output and publish system parameters ρρ={βρ,g,N,P1,P2,H1,H2,hid,P pub}

[0015] In one embodiment of the present invention, the specific steps of step S1, in which the system assigns identity IDs to users and APs in the network and generates a signing private key sk, are as follows:

[0016] (1) The system inputs the user ID. U ∈{0,1} * Master private key msk; first calculate temporary variable t1 = H1(ID) U If t1 = 0, then regenerate the user ID. U And recalculate the temporary variable t1; otherwise, calculate the temporary variable t1. Then calculate the user's signature master private key sk. U = [t2]P1, and calculate the temporary variable g = e(P1, P pub );

[0017] (2) Input AP ID into the system AP ∈{0,1} * The master private key is msk; the AP first calculates the temporary variable t1 = H1(ID). AP If t1 = 0, then regenerate the AP identifier ID. AP And recalculate the temporary variable t1; otherwise, calculate the temporary variable t1. Then calculate the AP signature master private key sk. AP =[t2]P1;

[0018] (3) After the AP completes initialization, the AP will perform key pre-computation and store it in the cache; according to the publicly available system parameters, the temporary variable g = e(P1, P pub Select two random numbers r AP ,b∈[1,N-1], calculate the temporary variable K AP =b·P1,h AP =H2(K AP ||w AP ,N),L=(r AP -h AP ) mod N, check if L equals 0, if it equals 0, regenerate r. AP Otherwise, calculate the temporary variable S. AP =[L]sk AP .

[0019] In one embodiment of the present invention, the specific method for verifying the legality of the signature in step S3 is as follows:

[0020]

[0021] Prove w' using the above formula U With w U Consistent, therefore h' U =h U This proves that the corresponding user is a legitimate user.

[0022] In one embodiment of the present invention, in step S4, the same session key is:

[0023] PTK2=a·K AP =a·b·P1=b·a·P1=b·K U =PTK1.

[0024] In one embodiment of the present invention, the specific method for verifying the legality of the signature in step S7 is as follows:

[0025] σ U ·P1=K U +H1(ID U ||K U |||C|ts)·C.

[0026] In one embodiment of the present invention, the specific method for batch authentication in step S7 is as follows:

[0027]

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. Compared with other methods, this invention is designed based on the national cryptographic SM9 algorithm, which meets the security requirements of two-way authentication and key consistency, traceability, anti-replay attack, anti-man-in-the-middle attack and front / back security, and supports national cryptographic algorithms, thus providing higher security.

[0030] 2. The method of the present invention only requires two handshakes to complete user switching authentication, the authentication process is simple and the authentication efficiency is higher;

[0031] 3. The method of the present invention can support batch authentication of users, and the authentication efficiency is improved by nearly 100%.

[0032] Analysis shows that the efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication of the present invention has higher efficiency and better application and promotion potential. Attached Figure Description

[0033] Figure 1This is a flowchart illustrating an efficient switching authentication method based on the national cryptographic standard SM9 that supports batch authentication according to the present invention.

[0034] Figure 2 This is an example diagram of the authentication switching process of the present invention;

[0035] Figure 3 This is a flowchart of the access authentication method of the present invention;

[0036] Figure 4 This is a flowchart of the authentication switching method of the present invention;

[0037] Figure 5 This is a comparison chart of the efficiency of batch authentication and individual authentication in this invention. Detailed Implementation

[0038] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings.

[0039] See Figure 1-5 This invention discloses an efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication, which includes the following steps:

[0040] S1. The system initializes and generates and publishes relevant system parameters ρρ={βρ,g,N,P1,P2,H1,H2,hid,P pub}, where βρ is the bilinear pairing parameter and g is the multiplicative group G. T An element in the set of N is a large prime number, P1 and P2 are generators of the additive groups G1 and G2 respectively, H1 and H2 are two secure hash functions, hid is the function identifier, and P... pub It is the master public key; the system assigns identity IDs to users and access points (APs) in the network and generates a signing private key sk;

[0041] S2. If the current AP signal exceeds the preset threshold S during the user's movement (-30dBm ≥ S ≥ -120dBm), the user generates two random numbers r based on the system's publicly available parameter ρ. U ,a∈[1,N-1]; Calculate temporary variables K U =a·P1h U =H2(K U ||w U ||ts,N), where ts is the timestamp, calculate the temporary variable L = (r U -h U Mod N, check if L equals 0. If it does, select a new random number r. U Otherwise, calculate the temporary variable S. U =[L]sk U , where [L]sk U skU L times, sk U The user signs the master private key; the user encapsulates the pre-computed signature to generate σ. U =(h U ,S U Add a timestamp ts and the message {ID} U ,K U ,ts,σ U Send a request to the AP to switch authentication, ID U User identification;

[0042] After receiving the authentication request, S3 and AP first verify whether the time difference between ts and the current system time is within 3 minutes. If so, they calculate the temporary variable. d1 = H1(ID) U ||hid,N), then calculate the temporary variable P based on the publicly available system parameters. U =[d1]P2+P pub u1 = e(S U ,P U ), w' U =u1·t1,h1=H2(K') U ||w' U ,N), and verify the validity of the signature, and σ U h U Compare with h1, if h U If the key and signature {K} do not match, it proves that the corresponding user is an illegitimate user, and the access request is rejected; otherwise, the pre-computed key and signature {K} will be used. AP ,σ AP Send to user for verification. K AP =b·P1, and calculate the session key PTK1 = b·K U r AP b is a random number;

[0043] S4. After the user receives the message returned by the AP, first calculate the temporary variable. d2 = H1(ID) AP ||hid,N)h AP =H2(K AP ||w AP ,N), ID AP The AP identifier is used, and then a temporary variable P is calculated based on the publicly available system parameters. A = [d2]P2+P pub u2=e(S AP ,P A ), w' AP =u2·t2 and h2=H2(K AP ||w' AP,N),S AP =[L]sk AP ,sk AP Sign the master private key for AP, if h2 and h AP If there is a discrepancy, the AP is deemed illegitimate and access is denied; otherwise, the session key PTK2 = a·K is calculated. AP Complete the switching authentication process and use the same session key for encrypted communication;

[0044] S5. After each authentication, the user will calculate the next authentication key information and send it to the current access point, which will then forward it to surrounding access points. The user selects random numbers a, c ∈ [1, N-1] and calculates K. U =a·P1, C=c·P1, and encrypt and send the message {K} U The current access point is given the group key GK shared among access points, and the message authentication code mac = MAC(GK, ID) is calculated using the group key GK. U ||K U ||C), and send it to the surrounding access points for verification and storage; after receiving the message, the surrounding access points will verify the message authentication code, and if the verification is successful, they will save the user's authentication message in the information list;

[0045] S6. When the signal strength of the AP currently connected to by the user is lower than the threshold S, the user will request a switch authentication from the AP with the stronger signal, namely AP1, and the user will generate a signature σ. U =a+c·H1(ID) U ||K U |||C|ts), encapsulate the switching authentication key information into a message m = {ID} U ,K U ,ts,σ U And send it to AP1, requesting a switch of authentication;

[0046] S7. When AP1 receives a user's authentication request message, it checks if the user's information exists in the user information list. If not, access is denied, and the user will reapply for access authentication. If the information exists, it verifies whether the user's key message has expired and the validity of the signature. If expired or the signature is invalid, access is denied; otherwise, the pre-calculated key {K} is used. AP ,σ AP Send the message to the user for verification and calculate the session key PTK1 = b·K. U If more than two users apply for authentication at the same time, AP1 can choose batch authentication to improve authentication efficiency;

[0047] S8. After the user receives the message returned by AP1, first calculate... d1 = H1(ID) AP||hid,N), then calculate P based on the publicly available system parameters. A =[d1]P2+P pub u1 = e(S AP ,P A Then calculate w' AP =u1·t1 and h1=H2(K AP ||w' AP ,N), if h1 and h AP If there is a discrepancy, AP1 is deemed illegitimate, and access is denied; otherwise, the session key PTK2 = a·K is calculated. AP At this point, the user and AP1 have completed two-way authentication and can transmit messages encrypted using the calculated session key.

[0048] In step S1, the system initializes and generates and publishes relevant system parameters. The specific steps are as follows:

[0049] The system inputs a security parameter λ, and the Key Management Center (KMC) selects a byte to represent the signature private key generation function identifier hid; it selects a bilinear pairwise group βρ = {G1, G2, G...} T Let G1, G2, N be the bilinear pair G1×G2→G2. T P1 and P2 are generators of group G1 and G2 respectively, and the large prime number N > 2. 191 The system randomly selects s∈[1,N-1] as the master private key msk, and computes element P in G2. pub =[s]P2 is used as the master public key mpk to calculate G T element g = e(P1, P pub Choose a secure cryptographic hash function H1:{0,1} * →h0,H2:{0,1} * ×N→h0, h0∈[1,N-1]; Output and publish system parameters ρρ={βρ,g,N,P1,P2,H1,H2,hid,P pub}

[0050] In step S1, the system assigns identity IDs to users and APs in the network and generates a signing private key sk. The specific steps are as follows:

[0051] (1) The system inputs the user ID. U ∈{0,1} * Master private key msk; first calculate temporary variable t1 = H1(ID) U If t1 = 0, then regenerate the user ID. U And recalculate the temporary variable t1; otherwise, calculate the temporary variable t1. Then calculate the user's signature master private key sk. U= [t2]P1, and calculate the temporary variable g = e(P1, P pub );

[0052] (2) Input AP ID into the system AP ∈{0,1} * The master private key is msk; the AP first calculates the temporary variable t1 = H1(ID). AP If t1 = 0, then regenerate the AP identifier ID. AP And recalculate the temporary variable t1; otherwise, calculate the temporary variable t1. Then calculate the AP signature master private key sk. AP =[t2]P1;

[0053] (3) After the AP completes initialization, the AP will perform key pre-computation and store it in the cache; according to the publicly available system parameters, the temporary variable g = e(P1, P pub Select two random numbers r AP ,b∈[1,N-1], calculate the temporary variable K AP =b·P1,h AP =H2(K AP ||w AP ,N),L=(r AP -h AP ) mod N, check if L equals 0, if it equals 0, regenerate r. AP Otherwise, calculate the temporary variable S. AP =[L]sk AP .

[0054] In step S3, the specific method for verifying the validity of the signature is as follows:

[0055]

[0056] Prove w' using the above formula U With w U Consistent, therefore h' U =h U This proves that the corresponding user is a legitimate user.

[0057] In step S4, the same session key is:

[0058] PTK2=a·K AP =a·b·P1=b·a·P1=b·K U =PTK1.

[0059] In step S7, the specific method for verifying the validity of the signature is as follows:

[0060] σ U·P1=K U +H1(ID U ||K U |||C|ts)·C.

[0061] In step S7, the specific method for batch authentication is as follows:

[0062]

[0063] This invention employs the above technical solution to provide a highly efficient handover authentication method based on the national cryptographic standard SM9 and supporting batch authentication in the field of information security technology. First, the system initializes and publishes relevant parameters. Users joining the network and access points obtain identity information and signature private keys. During user movement, if the signal strength of the connected access point falls below a threshold, the user will request handover authentication from an access point with a stronger signal. The authentication process of this invention requires only two handshakes and supports batch authentication in dense user scenarios, resulting in higher authentication efficiency. It not only meets security requirements such as two-way authentication, key consistency, traceability, resistance to replay attacks, resistance to man-in-the-middle attacks, and front / back security, but also supports the national cryptographic standard algorithm, thus enhancing security.

[0064] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A highly efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication, characterized in that, Includes the following steps: S1. The system initializes and generates and publishes relevant system parameters ρρ={βρ,g,N,P1,P2,H1,H2,hid,P pub }, where βρ is the bilinear pairing parameter and g is the multiplicative group G. T An element in the set of N is a large prime number, P1 and P2 are generators of the additive groups G1 and G2 respectively, H1 and H2 are two secure hash functions, hid is the function identifier, and P... pub It is the master public key; the system assigns identity IDs to users and access points (APs) in the network and generates a signing private key sk; S2. If the current AP signal exceeds the preset threshold S during the user's movement (-30dBm ≥ S ≥ -120dBm), the user generates two random numbers r based on the system's publicly available parameter ρ. U ,a∈[1,N-1]; Calculate temporary variables K U =a·P1,h U =H2(K U ||w U ||ts,N), where ts is the timestamp, calculate the temporary variable L = (r U -h U Mod N, check if L equals 0. If it does, select a new random number r. U Otherwise, calculate the temporary variable S. U =[L]sk U , where [L]sk U sk U L times, sk U The user signs the master private key; the user encapsulates the pre-computed signature to generate σ. U =(h U ,S U Add a timestamp ts and the message {ID} U ,K U ,ts,σ U Send a request to the AP to switch authentication, ID U User identification; After receiving the authentication request, S3 and AP first verify whether the time difference between ts and the current system time is within 3 minutes. If so, they calculate the temporary variable. d1 = H1(ID) U ||hid,N), then calculate the temporary variable P based on the publicly available system parameters. U =[d1]P2+P pub u1 = e(S U ,P U ), w' U =u1·t1,h1=H2(K') U ||w' U ,N), and verify the validity of the signature, and σ U h U Compare with h1, if h U If the key and signature {K} do not match, it proves that the corresponding user is an illegitimate user, and the access request is rejected; otherwise, the pre-computed key and signature {K} will be used. AP ,σ AP Send to user for verification. K AP =b·P1, and calculate the session key PTK1 = b·K U r AP b is a random number; S4. After the user receives the message returned by the AP, first calculate the temporary variable. d2 = H1(ID) AP ||hid,N),h AP =H2(K AP ||w AP ,N), ID AP The AP identifier is used, and then a temporary variable P is calculated based on the publicly available system parameters. A = [d2]P2+P pub u2=e(S AP ,P A ), w' AP =u2·t2 and h2=H2(K AP ||w' AP ,N),S AP =[L]sk AP ,sk AP Sign the master private key for AP, if h2 and h AP If there is a discrepancy, the AP is deemed illegitimate and access is denied; otherwise, the session key PTK2 = a·K is calculated. AP Complete the switching authentication process and use the same session key for encrypted communication; S5. After each authentication, the user will calculate the next authentication key information and send it to the current access point, which will then forward it to surrounding access points. The user selects random numbers a, c ∈ [1, N-1] and calculates K. U =a·P1, C=c·P1, and encrypt and send the message {K} U The current access point is given the group key GK shared among access points, and the message authentication code mac = MAC(GK, ID) is calculated using the group key GK. U ||K U ||C), and send it to the surrounding access points for verification and storage; after receiving the message, the surrounding access points will verify the message authentication code, and if the verification is successful, they will save the user's authentication message in the information list; S6. When the signal strength of the AP currently connected to by the user is lower than the threshold S, the user will request a switch authentication from the AP with the stronger signal, namely AP1, and the user will generate a signature σ. U =a+c·H1(ID) U ||K U |||C|ts), encapsulate the switching authentication key information into a message m = {ID} U ,K U ,ts,σ U And send it to AP1, requesting a switch of authentication; S7. When AP1 receives a user's authentication request message, it checks if the user's information exists in the user information list. If not, access is denied, and the user will reapply for access authentication. If the information exists, it verifies whether the user's key message has expired and the validity of the signature. If expired or the signature is invalid, access is denied; otherwise, the pre-calculated key {K} is used. AP ,σ AP Send the message to the user for verification and calculate the session key PTK1 = b·K. U If more than two users apply for authentication at the same time, AP1 can choose batch authentication to improve authentication efficiency; S8. After the user receives the message returned by AP1, first calculate... d1 = H1(ID) AP ||hid,N), then calculate P based on the publicly available system parameters. A =[d1]P2+P pub u1 = e(S AP ,P A Then calculate w' AP =u1·t1 and h1=H2(K AP ||w' AP ,N), if h1 and h AP If there is a discrepancy, it proves that AP1 is illegitimate, and access is denied; otherwise... Calculate the session key PTK2 = a·K AP At this point, the user and AP1 have completed two-way authentication and can transmit messages encrypted using the calculated session key.

2. The efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication as described in claim 1, characterized in that, In step S1, the system initializes and generates and publishes relevant system parameters. The specific steps are as follows: The system inputs a security parameter λ, and the Key Management Center (KMC) selects a byte to represent the signature private key generation function identifier hid; it selects a bilinear pairwise group βρ = {G1, G2, G...} T Let G1, G2, N be the bilinear pair G1×G2→G2. T P1 and P2 are generators of group G1 and G2 respectively, and the large prime number N > 2. 191 The system randomly selects s∈[1,N-1] as the master private key msk, and computes element P in G2. pub =[s]P2 is used as the master public key mpk to calculate G T element g = e(P1, P pub Choose a secure cryptographic hash function H1:{0,1} * →h0,H2:{0,1} * ×N→h0, h0∈[1,N-1]; Output and publish system parameters ρρ={βρ,g,N,P1,P2,H1,H2,hid,P pub } 3. The efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication as described in claim 2, characterized in that, In step S1, the system assigns identity IDs to users and APs in the network and generates a signing private key sk. The specific steps are as follows: (1) The system inputs the user ID. U ∈{0,1} * Master private key msk; first calculate temporary variable t1 = H1(ID) U If t1 = 0, then regenerate the user ID. U And recalculate the temporary variable t1; otherwise, calculate the temporary variable t1. Then calculate the user's signature master private key sk. U = [t2]P1, and calculate the temporary variable g = e(P1, P pub ); (2) Input AP ID into the system AP ∈{0,1} * The master private key is msk; the AP first calculates the temporary variable t1 = H1(ID). AP If t1 = 0, then regenerate the AP identifier ID. AP And recalculate the temporary variable t1; otherwise, calculate the temporary variable t1. Then calculate the AP signature master private key sk. AP =[t2]P1; (3) After the AP completes initialization, the AP will perform key pre-computation and store it in the cache; according to the publicly available system parameters, the temporary variable g = e(P1, P pub Select two random numbers r AP ,b∈[1,N-1], calculate the temporary variable K AP =b·P1,h AP =H2(K AP ||w AP ,N),L=(r AP -h AP ) mod N, check if L equals 0, if it equals 0, regenerate r. AP Otherwise, calculate the temporary variable S. AP =[L]sk AP .

4. The efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication as described in claim 1, characterized in that, In step S3, the specific method for verifying the validity of the signature is as follows: Prove w' using the above formula U With w U Consistent, therefore h' U =h U This proves that the corresponding user is a legitimate user.

5. The efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication as described in claim 1, characterized in that, In step S4, the same session key is: PTK2=a·K AP =a·b·P1=b·a·P1=b·K U =PTK1。 6. The efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication as described in claim 1, characterized in that, In step S7, the specific method for verifying the legality of the user's signature is as follows: s U ·P1=K U +H1(ID U ||K U |||C|ts)·C。 7. The efficient switching authentication method based on the national cryptographic standard SM9 and supporting batch authentication as described in claim 1, characterized in that, In step S7, the specific method for AP1 batch authentication is as follows:

Images