A backward secure certificateless authentication and key agreement method

Abstract

The present invention relates to a backward-secure certificateless authentication and key negotiation method, which belongs to the technical field of cryptography and solves the problem in the prior art that certificateless authentication and key negotiation schemes cannot achieve backward security for the communication parties. The method comprises the following steps: a key generation center outputs system parameters and secretly stores a master key based on input security parameters, wherein the system parameters include a hash function for generating a random state value of a fixed bit length, and the system parameters are system parameters of a communication system composed of several user terminals; the key generation center and each user terminal generate a public-private key pair for each user terminal based on the system parameters, the user identity of the user terminal, and the master key; and user terminals to be in a conversation perform authentication based on their respective public-private key pairs, system parameters, and identity information of both parties, generate a session key between the user terminals, and update the common state value between the user terminals based on the session key and the common state value between the user terminals.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptography, and in particular to a backward secure certificateless authentication and key negotiation method. Background Art

[0002] Authenticated key agreement schemes ensure that any two networked nodes can mutually authenticate each other and negotiate a secure session key in a public network. In certificateless cryptography, users and a trusted authority jointly generate long-term private keys for each user. This ensures that even if the trusted authority is compromised, the adversary cannot decrypt the user's communication data or impersonate the user. Certificateless authenticated key agreement schemes combine the functions of authenticated key agreement and certificateless cryptography, ensuring that even if the trusted authority is compromised, the adversary cannot impersonate the user and establish a session key.

[0003] Currently, most information systems require the stability and security of long-term private keys. Replacing long-term private keys can lead to several issues and risks. For example, it can increase security risks through misconfiguration, key leaks, or unnecessary complexity. It can also require updating all systems and applications that use the private key, leading to unnecessary workload and time costs. Furthermore, if the private key is used in a digital certificate, replacing the long-term private key can disrupt the certificate's trust chain, as each replacement requires re-obtaining and re-verifying the certificate. In systems requiring identity authentication, replacing the long-term private key can also cause business interruptions or increase system instability.

[0004] However, existing certificateless authenticated key agreement schemes cannot guarantee security after a user's long-term private key is leaked, i.e., backward security. Therefore, after a long-term private key is leaked, it must be replaced to ensure the security of communication data. Summary of the Invention

[0005] In view of the above analysis, the embodiments of the present invention aim to provide a backward secure certificateless authentication and key agreement method to solve the problem that existing certificateless authentication and key agreement schemes cannot achieve backward security for the communicating parties.

[0006] An embodiment of the present invention provides a backward secure certificateless authentication and key agreement method, comprising the following steps:

[0007] The key generation center outputs system parameters based on the input security parameters and secretly stores the master key, wherein the system parameters include a hash function for generating a random state value of a fixed bit length, and the system parameters are system parameters of a communication system composed of multiple user terminals;

[0008] The key generation center and each user terminal generate a public-private key pair for each user terminal according to the system parameters, the user identity of the user terminal and the master key; and

[0009] The user terminals to be in conversation authenticate each other based on their respective public-private key pairs, the system parameters, and the identity information of both parties, generate a session key between the user terminals, and update the common state value between the user terminals based on the session key and the common state value between the user terminals.

[0010] Based on a further improvement of the above method, during the first communication between the user terminals to be in a conversation, the user terminals to be in a conversation perform authentication based on the respective public-private key pairs, the system parameters, and the identity information of both parties, generate a session key between the user terminals, and update the common state value between the user terminals based on the session key and the common state value, including:

[0011] Each of the user terminals to be engaged in the conversation generates its own random challenge value according to the system parameters;

[0012] The user terminals generate a common session key and a common state value based on the other party's random challenge value, the public key, identity information of both parties and the system parameters; and

[0013] The user terminals perform identity authentication between each other based on the common session key, determine the validity of the common session key, and update the common state value between the user terminals based on the session key and the common state value.

[0014] Based on a further improvement of the above method, during the nth communication between the user terminals to be in a conversation, where n is an integer greater than 1, the user terminals to be in a conversation perform authentication based on their respective public-private key pairs, the system parameters, and identity information of both parties, generate a session key between the user terminals, and update the common state value between the user terminals based on the session key and the common state value between the user terminals, including:

[0015] Each of the user terminals to be engaged in the conversation generates its own random challenge value according to the system parameters;

[0016] The user terminals generate a common session key based on the other party's random challenge value, the public key, identity information of both parties, the system parameters, and the common state value; and

[0017] The user terminals perform identity authentication between each other based on the common session key, determine the validity of the common session key, and update the common state value between the user terminals based on the session key and the common state value.

[0018] Based on a further improvement of the above method, the key generation center and each user terminal generate a public-private key pair for each user terminal according to the system parameters, the user identity of the user terminal, and the master key, including:

[0019] Step S10: The user terminal performs the following steps:

[0020] generating a first private key and a first private key intermediate value according to the system parameters;

[0021] Sending the user identity of the user terminal and the first private key intermediate value to the key generation center;

[0022] Step S20: The key generation center performs the following steps:

[0023] Generate a second private key and a public key according to the system parameters, the master key, the first private key intermediate value, and the user identity;

[0024] Sending the second private key and the public key to the user terminal;

[0025] Step S30: The user terminal executes the following steps:

[0026] verifying the second private key and the public key according to the system parameters;

[0027] If the verification is successful, the private key of the user terminal is obtained according to the first private key and the second private key, and the public key is set as the public key of the user terminal.

[0028] Based on a further improvement of the above method, the key generation center outputs the system parameters and secretly stores the master key according to the input security parameters, including the key generation center performing the following operations:

[0029] Select a large prime number p and the coefficients a and b of the elliptic curve, and construct the elliptic curve E:y 2 =x 3 +ax+bmod p;

[0030] Select an additive cyclic group G1 on the elliptic curve E with a prime order q and a generator G.

[0031] Select the symmetric encryption algorithm Enc(.): And the symmetric decryption algorithm Dec(.): Among them, {0,1}* is a bit string composed of 0 and 1 of any length, The value space of the symmetric encryption key, determined by the security parameters;

[0032] Select hash function h1: Hash function h2: {0,1}*→Z q *, hash function h3: {0,1}*→{0,1} ls , hash function h4: {0,1}*→G1, where {0,1}* is a bit string of 0 and 1 of any length, is the value space of the symmetric encryption key, Z q * is the set of integers less than q and coprime to q, {0,1} ls is a bit string composed of any 0s and 1s with a fixed bit length of ls;

[0033] From Z q * randomly selects the master key s and uses the formula P pub =sG calculates the master public key P pub ;as well as

[0034] Set the parameters G1, a, b, p, q, G, Enc(.), Dec(.), h1, h2, h3, P pub The output is a system parameter, and the master key s is kept secret; h3 is a hash function used to generate a random state value of a fixed bit length.

[0035] Based on a further improvement of the above method, the key generation center and each user terminal generate a public-private key pair for each user terminal according to the system parameters, the user identity of the user terminal, and the master key, including:

[0036] Step S100: The user terminal executes the following steps:

[0037] From Z q * randomly selects the first private key u and calculates the first private key intermediate value U according to the formula U=uG;

[0038] Sending the user identity ID of the user terminal and the first private key intermediate value U to the key generation center;

[0039] Step S200: The key generation center performs the following steps:

[0040] From Z q *Select a random number w;

[0041] The second private key t and public key P are calculated according to the following formula:

[0042] W=wG,P=U+W,λ=h2(P pub ,id,P),t=w+λs;

[0043] Sending the second private key t and the public key P to the user terminal;

[0044] Step S300: The user terminal executes the following steps:

[0045] According to the formula O=P+λP pub Calculate the parameter O, where λ = h2(P pub ,id,P);

[0046] Verify whether the equation O = (u + t) G holds true;

[0047] If the equation O=(u+t)G holds, the first private key u and the second private key t are added together to obtain the private key of the user terminal, and the public key P is set as the public key of the user terminal.

[0048] Based on a further improvement of the above method, each of the user terminals to be engaged in a session generates its own random challenge value according to the system parameters, including:

[0049] From Z q *Select a random challenge value r and calculate the random challenge intermediate value R according to the formula R=rG or the formula R=O+rG;

[0050] The random challenge intermediate value R, the identity information of each user terminal, and the public key of each user terminal are sent to the other user terminal to be connected.

[0051] Based on a further improvement of the above method, the user terminals generate a common session key and a common state value based on the other party's random challenge value, the public key, the identity information of both parties and the system parameters, including:

[0052] After receiving the random challenge intermediate value R of user terminal B, user terminal A B , user terminal B's identity information id B , user terminal B's public key P B Then perform the following steps:

[0053] According to the formula PS=(r A +s A )(R B +P B +λ B P pub ) Calculate the shared secret value PS, where λ B =h2(P pub ,id B ,P B );

[0054] According to the formula K=h1(PS,id A ,RA ,id B ,R B ) Calculate the symmetric encryption key K;

[0055] According to the formula state=h3(PS,id A ,R A ,id B ,R B ) Calculate the state value state;

[0056] Calculate the shared intermediate value PM according to the formula PM = h4(K, state);

[0057] Encryption Calculation C A =Enc K (PM⊕R A ), and the ciphertext C A Sent to user terminal B, where Enc K (PM⊕R A ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (PM⊕R A ) for encryption;

[0058] After receiving the random challenge intermediate value R from user terminal A, user terminal B A , user terminal A's identity information id A , user terminal A's public key P A Then perform the following steps:

[0059] According to the formula PS=(r B +s B )(R A +P A +λ A P pub ) Calculate the shared secret value PS, where λ A =h2(P pub ,id A ,P A );

[0060] According to the formula K=h1(PS,id A ,R A ,id B ,R B ) Calculate the symmetric encryption key K;

[0061] According to the formula state=h3(PS,id A ,R A ,id B ,R B ) Calculate the state value state;

[0062] Calculate the shared intermediate value according to the formula PM = h4(K, state);

[0063] Encryption Calculation C B =Enc K (PM⊕R B ), the ciphertext C B Sent to user terminal A, where Enc K (PM⊕R B ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (PM⊕R B ) for encryption.

[0064] Based on a further improvement of the above method, the user terminals generate a common session key based on the other party's random challenge value, the public key, the identity information of both parties, the system parameters, and the common state value, including:

[0065] The user terminal generates a shared secret value according to its private key, the random challenge value, the random challenge intermediate value of another user terminal to be in session, the identity information, the public key, and the system parameters;

[0066] The user terminal generates a common symmetric key based on its random challenge intermediate value, the shared secret value, the identity information, and the random challenge intermediate value, the identity information, the common state value, and the system parameters of another user terminal to be in session; and

[0067] The user terminal encrypts the plaintext information using the common symmetric key and sends the encrypted ciphertext information to the other user terminal to be connected.

[0068] Based on a further improvement of the above method, the user terminals generate a common session key based on the other party's random challenge value, the public key, the identity information of both parties, the system parameters, and the common state value, including:

[0069] After receiving the random challenge intermediate value R of user terminal B, user terminal A B , user terminal B's identity information id B , user terminal B's public key P B Then perform the following steps:

[0070] According to the formula PS=(r A +s A )(R B +P B +λ B P pub ) Calculate the shared secret value PS, where λ B =h2(P pub ,idB ,P B );

[0071] According to the formula K=h1(PS,state,id A ,R A ,id B ,R B ) Calculate the symmetric encryption key K;

[0072] Encryption Calculation C A =Enc K (R A ), the ciphertext C A Sent to user terminal B, where Enc K (R A ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (R A ) for encryption;

[0073] After receiving the random challenge intermediate value R from user terminal A, user terminal B A , user terminal A's identity information id A , user terminal A's public key P A Then perform the following steps:

[0074] According to the formula PS=(r B +s B )(R A +P A +λ A P pub ) Calculate the shared secret value PS, where λ A =h2(P pub ,id A ,P A );

[0075] According to the formula K=h1(PS,state,id A ,R A ,id B ,R B ) Calculate the symmetric encryption key K;

[0076] Encryption Calculation C B =Enc K (R B ), the ciphertext C B Sent to user terminal A, where Enc K (R B ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (R B ) for encryption.

[0077] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0078] 1. The present invention is based on a certificateless cryptographic system, which does not require a central authority to manage a large number of certificates and solves the security issues caused by a single point of failure of a trusted center.

[0079] 2. The present invention realizes forward security for both communicating parties. Even if the long-term keys of both communicating parties are leaked, the communication data before the key is leaked can still be kept confidential.

[0080] 3. The present invention realizes the backward identity security of the communicating parties. Even if the long-term keys of the communicating parties are leaked, the adversary still cannot impersonate the communicating parties to communicate.

[0081] 4. The solution of the present invention does not require bilinear pairing operations and can achieve lower computational and communication overheads.

[0082] In the present invention, the above-mentioned technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of the present invention will be described in the following description, and some advantages will become apparent from the description or be learned through practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the contents particularly pointed out in the description and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. Throughout the drawings, the same reference symbols denote the same components.

[0084] Figure 1 4 is a flow chart of a backward secure certificateless authentication and key agreement method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0085] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, and are not used to limit the scope of the present invention.

[0086] Figure 1 The figure is a flowchart of a backward secure certificateless authentication and key agreement method according to an embodiment of the present invention.

[0087] The following combination Figure 1 An embodiment of the present invention will be described.

[0088] like Figure 1 As shown, the backward secure certificateless authentication and key agreement method includes:

[0089] Step 101: The key generation center outputs system parameters based on the input security parameters and secretly stores the master key. The system parameters include a hash function for generating a random state value of a fixed bit length. The system parameters are system parameters of a communication system composed of several user terminals.

[0090] In this embodiment, a key generation center (KGC) can output system parameters and a master key based on an initialization algorithm. This initialization algorithm takes a security parameter as input and outputs system parameters and a master key for the communication system consisting of the KGC and multiple user terminals. By having the KGC output system parameters and master keys, this embodiment implements a certificateless cryptographic system, eliminating the need for the KGC to manage a large number of certificates and addressing the security concerns associated with a single point of failure in the KGC.

[0091] In some embodiments, the initialization algorithm includes performing the following operations:

[0092] The algorithm takes the security parameter κ as input and performs the following operations:

[0093] 1. Select a large prime number p and the coefficients a and b of the elliptic curve, and construct the elliptic curve E:y 2 =x 3 +ax+bmod p.

[0094] 2. Select an additive cyclic group G1 with order prime number q on the elliptic curve E, whose generator is G.

[0095] 3. Select the symmetric encryption algorithm Enc(.): And the symmetric decryption algorithm Dec(.): Among them, {0,1}* is a bit string composed of 0 and 1 of any length, is the value space of the symmetric encryption key, The security parameter κ may be the security level of the communication system. For example, if the security level of the communication system is high, the number of possible values ​​of the symmetric encryption key is M. If the security level of the communication system is medium, the number of possible values ​​of the symmetric encryption key is N, where M is greater than N.

[0096] 4. Select hash function h1: Hash function h2: {0,1}*→Z q * and hash function h3: {0,1}*→{0,1} ls , hash function h4: {0,1}*→G1, where {0,1}* is a bit string of 0 and 1 of any length, is the symmetric encryption key, Zq * is the set of integers less than q and coprime to q, {0,1} ls It is a bit string composed of any 0s and 1s with a fixed bit length of 1s.

[0097] 5. From Z q * randomly selects the master key s and uses the formula P pub =sG calculates the master public key P pub .

[0098] 6. Set the parameters G1, a, b, p, q, G, Enc(.), Dec(.), h1, h2, h3, P pub The output is the system parameters, and the master key s is kept secret.

[0099] Step 102: The key generation center and each user terminal generate a public-private key pair for each user terminal according to the system parameters, the user identity of the user terminal and the master key.

[0100] In this embodiment, a user key generation algorithm can be used to generate a private key for each user terminal. Otherwise, a return symbol (⊥) indicates algorithm failure. The user key generation algorithm can be jointly executed by each user terminal and the key generation center. The user key generation algorithm can take system parameters, user identity, and the master key of the key generation center as input to generate a private key for each user. Otherwise, a return symbol (⊥) indicates algorithm failure.

[0101] In some embodiments, the user key generation algorithm includes the following steps:

[0102] Step S10: The user terminal performs the following steps:

[0103] A first private key and a first private key intermediate value are generated according to the system parameters.

[0104] The user identity of the user terminal and the first private key intermediate value are sent to the key generation center.

[0105] Step S20: The key generation center performs the following steps:

[0106] A second private key and a public key are generated according to the system parameters, the master key, the first private key intermediate value, and the user identity.

[0107] The second private key and the public key are sent to the user terminal.

[0108] Step S30: The user terminal executes the following steps:

[0109] The second private key and the public key are verified according to the system parameters.

[0110] If the verification is successful, the private key of the user terminal is obtained according to the first private key and the second private key, and the public key is set as the public key of the user terminal.

[0111] The following describes steps S10 to S30 in conjunction with a specific implementation method, taking a user terminal as an example.

[0112] Assuming id represents the user identity of the user terminal, in step S10, the user terminal performs the following operations:

[0113] 1. From Z q * randomly selects part of the private key u as the first private key, denoted as u←Z q *.

[0114] 2. Calculate the intermediate value U of this part of the private key u, and the calculation formula is: U = uG.

[0115] 3. The user terminal sends its user identity ID and intermediate value U to the key generation center KGC.

[0116] In step S20, the KGC performs the following operations:

[0117] 1. From Z q *Select a random number w, denoted as w←Z q *.

[0118] 2. Calculate the random number intermediate value W, the calculation formula is W = wG, and then calculate the user terminal's public key P and another part of the private key t as the second private key according to the following formula:

[0119] P=U+W,λ=h2(P pub ,id,P), t=w+λs.

[0120] 3. Return (P, t) to the user terminal through a secure channel.

[0121] In step S30, the user terminal performs the following operations:

[0122] 1. Calculate λ = h2(P pub ,id,P) and O=P+λP pub .

[0123] 2. Verify whether the equation O=(u+t)G holds.

[0124] 3. If the equation holds, calculate the private key of the user terminal s = u + t, and set the public key of the user terminal to P.

[0125] It should be noted that the first private key may be a partial private key u in the above specific implementation manner, and the second private key may be another partial private key t in the above specific implementation manner.

[0126] Step 103: The user terminals to be engaged in a conversation perform authentication based on their respective public-private key pairs, the system parameters, and the identity information of both parties, generate a session key between the user terminals, and update the common state value between the user terminals based on the session key and the common state value between the user terminals.

[0127] In this embodiment, user terminals can perform identity authentication through a key agreement algorithm. The key agreement algorithm can be a probabilistic algorithm that takes the identities and public-private key pairs of the sender and receiver of the user terminal as input and implements identity authentication through multiple stages of interaction.

[0128] In some embodiments, when a user terminal sender and a receiver communicate for the first time, the key agreement algorithm includes the following steps:

[0129] Step S40: Each of the user terminals to be connected generates its own random challenge value according to the system parameters.

[0130] Step S50: The user terminals generate a common session key and a common state value based on the other party's random challenge value, the public key, identity information of both parties and the system parameters.

[0131] Step S60: The user terminals perform identity authentication based on the common session key, determine the validity of the common session key, and update the common state value between the user terminals based on the session key and the common state value.

[0132] Steps S40 to S60 are described below with reference to a specific implementation.

[0133] Assume that the user identity of user terminal A is id A , whose public and private key pair is (P A ,s A ), the user identity of user terminal B is id B , whose public and private key pair is (P B ,s B ). User terminal A and user terminal B can obtain the session key through the following three stages, the first stage corresponds to step S40, the second stage corresponds to step S50, and the third stage corresponds to step S60.

[0134] Phase 1: User terminal A performs the following process:

[0135] 1. Choose a random challenge value r A←Z q *, and calculate the random challenge median value R A =r A G.

[0136] 2. Randomly challenge the middle value R A 、id A 、P A Sent to user terminal B.

[0137] User terminal B performs the following process:

[0138] 1. Choose a random challenge value r B ←Z q *, and calculate the random challenge median value R B =r B G.

[0139] 2. Randomly challenge the middle value R B 、id B 、P B Sent to user terminal A.

[0140] Phase 2: Receiving R B 、id B 、P B After that, user terminal A performs the following process:

[0141] 1. Calculate the shared secret value PS = (r A +s A )(R B +P B +λ B P pub ), where λ B =h2(P pub ,id B ,P B ).

[0142] 2. Calculate the symmetric encryption key K = h1(PS,id A ,R A ,id B ,R B ) and state value state=h3(PS,id A ,R A ,id B ,R B ).

[0143] 3. Calculate the shared intermediate value PM = h4(K, state).

[0144] 4. Encryption Calculation C A =Enc K (PM⊕R A ), the ciphertext CA Sent to user terminal B, where Enc K (PM⊕R A ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (PM⊕R A ) for encryption.

[0145] Receive R A 、id A 、P A After that, user terminal B performs the following process:

[0146] 1. Calculate the shared secret value PS = (r B +s B )(R A +P A +λ A P pub ), where λ A =h2(P pub ,id A ,P A ).

[0147] 2. Calculate the symmetric encryption key K = h1(PS,id A ,R A ,id B ,R B ) and state value state=h3(PS,id A ,R A ,id B ,R B ).

[0148] 3. Calculate the shared intermediate value PM = h4(K, state).

[0149] 4. Encryption Calculation C B =Enc K (PM⊕R B ), the ciphertext C B Sent to user terminal A, where Enc K (PM⊕R B ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (PM⊕R B ) for encryption.

[0150] Phase 3: Receiving C B After that, user terminal A performs the following process:

[0151] 1. Decrypt M B =Dec K (C B ), where Dec K (C B) indicates the use of symmetric decryption algorithm Dec(.) and symmetric key K to decrypt the ciphertext message C B Decrypt to get the plaintext M B .

[0152] 2. Calculate PM' = M B ⊕R B , and determine whether PM' and PM are equal. If PM' and PM are not equal, the execution is terminated.

[0153] 3. Update the state value state = h3 (state, K, id A ,id B ) and set the session key to K.

[0154] Receive C A After that, user terminal B performs the following process:

[0155] 1. Decrypt M A =Dec K (C A ), where Dec K (C A ) indicates the use of symmetric decryption algorithm Dec(.) and symmetric key K to decrypt the ciphertext message C A Decrypt.

[0156] 2. Calculate PM' = M A ⊕R A , and determine whether PM' and PM are equal. If PM' and PM are not equal, the execution is terminated.

[0157] 3. Update the state value state = h3 (state, K, id A ,id B ) and set the session key to K.

[0158] In some embodiments, when the user terminal sender and the receiver communicate for the nth time (n is an integer greater than 1), the key agreement algorithm includes the following steps:

[0159] Step S70: Each of the user terminals to be engaged in the conversation generates its own random challenge value according to the system parameters.

[0160] Step S80: The user terminals generate a common session key based on the other party's random challenge value, the public key, identity information of both parties, the system parameters, and the common state value.

[0161] Step S90: The user terminals perform identity authentication based on the common session key, determine the validity of the common session key, and update the common state value between the user terminals based on the session key and the common state value.

[0162] Steps S70 to S90 are described below with reference to a specific implementation.

[0163] Assume that the user identity of user terminal A is id A , whose public and private key pair is (P A ,s A ), the user identity of user terminal B is id B , whose public and private key pair is (P B ,s B ). User terminal A and user terminal B can obtain the session key through the following three stages, the first stage corresponds to step S70, the second stage corresponds to step S80, and the third stage corresponds to step S90.

[0164] Phase 1: User terminal A performs the following process:

[0165] 1. Choose a random challenge value r A ←Z q *, and calculate the random challenge median value R A =O A +r A G.

[0166] 2. Randomly challenge the middle value R A 、id A 、P A Sent to user terminal B.

[0167] User terminal B performs the following process:

[0168] 1. Choose a random challenge value r B ←Z q *, and calculate the random challenge median value R B =O B +r B G.

[0169] 2. Randomly challenge the middle value R B 、id B 、P B Sent to user terminal A.

[0170] Phase 2: Receiving R B 、id B 、P B After that, user terminal A performs the following process:

[0171] 1. Calculate the shared secret value PS = (r A +s A )(R B +P B +λ B Ppub ), where λ B =h2(P pub ,id B ,P B ).

[0172] 2. Calculate the symmetric encryption key K = h1(PS, state, id A ,R A ,id B ,R B ).

[0173] 3. Encryption Calculation C A =Enc K (R A ), the ciphertext C A Sent to user terminal B, where Enc K (R A ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (R A ) for encryption.

[0174] Receive R A 、id A 、P A After that, user terminal B performs the following process:

[0175] 1. Calculate the shared secret value PS = (r B +s B )(R A +P A +λ A P pub ), where λ A =h2(P pub ,id A ,P A ).

[0176] 2. Calculate the symmetric encryption key K = h1(PS, state, id A ,R A ,id B ,R B ).

[0177] 3. Encryption Calculation C B =Enc K (R B ), the ciphertext C B Sent to user terminal A, where Enc K (R B ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (R B ) for encryption.

[0178] Phase 3: Receiving C B After that, user terminal A performs the following process:

[0179] 1. Decrypt R B '=Dec K (C B ), where Dec K (C B ) indicates the use of symmetric decryption algorithm Dec(.) and symmetric key K to decrypt the ciphertext message C B Decrypt.

[0180] 2. Determine R B ' and R B Are they equal? ​​If R B ' and R B If they are not equal, execution is terminated.

[0181] 3. Update the state value state = h3 (state, K, id A ,id B ) and set the session key to K.

[0182] Receive C A After that, user terminal B performs the following process:

[0183] 1. Decrypt R A '=Dec K (C A ), where Dec K (C A ) indicates the use of symmetric decryption algorithm Dec(.) and symmetric key K to decrypt the ciphertext message C A Decrypt.

[0184] 2. Determine R A ' and R A Are they equal? ​​If R A ' and R A If they are not equal, execution is terminated.

[0185] 3. Update the state value state = h3 (state, K, id A ,id B ) and set the session key to K.

[0186] In this embodiment, the challenge-response mechanism ensures that even if an adversary obtains the user's private key, they cannot decrypt the previously sent message, thereby achieving forward security and forward identity security for both parties in communication. For example, in the first stage, user terminal A generates a random challenge value r A , that is, the challenge-response mechanism can be activated, thereby ensuring the forward security and forward identity security of both communicating parties.

[0187] In this embodiment, the communicating parties ensure through a jointly maintained state value that even if the user's private key is leaked, an adversary cannot impersonate the user to generate session keys for subsequent communications, thereby achieving backward identity security for the communicating parties. Even if the long-term keys of the communicating parties are leaked, an adversary still cannot impersonate the communicating parties to communicate.

[0188] Another embodiment of a backward secure certificateless authentication and key agreement method according to the present invention includes the following steps:

[0189] First, the key generation center executes the initialization algorithm, which includes:

[0190] The algorithm takes the security parameter κ as input and performs the following operations:

[0191] 1. Select a large prime number p and the coefficients a and b of the elliptic curve, and construct the elliptic curve E:y 2 =x 3 +ax+bmod p.

[0192] 2. Select an additive cyclic group G1 with order prime number q on the elliptic curve E, whose generator is G.

[0193] 3. Select the symmetric encryption algorithm Enc(.): And the symmetric decryption algorithm Dec(.): Among them, {0,1}* is a bit string composed of 0 and 1 of any length, is the value space of the symmetric encryption key, The security parameter κ may be the security level of the communication system. For example, if the security level of the communication system is high, the number of possible values ​​of the symmetric encryption key is M. If the security level of the communication system is medium, the number of possible values ​​of the symmetric encryption key is N, where M is greater than N.

[0194] 4. Select hash function h1: Hash function h2: {0,1}*→Z q * and hash function h3: {0,1}*→{0,1} ls , hash function h4: {0,1}*→G1, where {0,1}* is a bit string of 0 and 1 of any length, is the symmetric encryption key, Z q * is the set of integers less than q and coprime to q, {0,1} ls It is a bit string composed of any 0s and 1s with a fixed bit length of 1s.

[0195] 5. From Z q * randomly selects the master key s and uses the formula P pub=sG calculates the master public key P pub .

[0196] 6. Set the parameters G1, a, b, p, q, G, Enc(.), Dec(.), h1, h2, h3, P pub The output is the system parameters, and the master key s is kept secret.

[0197] Secondly, the key generation center and the user terminal jointly execute the user key generation algorithm, which includes:

[0198] Let id represent the user identity of the user terminal. The user terminal and the key generation center interact as follows:

[0199] First, the user terminal performs the following operations:

[0200] 1. From Z q * randomly selects part of the private key u, denoted as u←Z q *.

[0201] 2. Calculate the intermediate value U of this part of the private key u, and the calculation formula is: U = uG.

[0202] 3. The user terminal sends its user identity ID and intermediate value U to KGC.

[0203] Next, the key generation center performs the following operations:

[0204] 1. From Z q *Select a random number w, denoted as w←Z q *.

[0205] 2. Calculate the random number intermediate value W, the calculation formula is W = wG, and then calculate the user terminal's public key P and another part of the private key t according to the following formula:

[0206] P=U+W,λ=h2(P pub ,id,P), t=w+λs.

[0207] 3. Return (P, t) to the user terminal through a secure channel.

[0208] Finally, the user terminal performs the following operations:

[0209] 1. Calculate λ = h2(P pub ,id,P) and O=P+λP pub .

[0210] 2. Verify whether the equation O=(u+t)G holds.

[0211] 3. If the equation holds, calculate the private key of the user terminal s = u + t, and set the public key of the user terminal to P.

[0212] Finally, the user terminals execute a key agreement algorithm, which includes:

[0213] Assume that the user identity of user terminal A is id A , whose public and private key pair is (P A ,s A ), the user identity of user terminal B is id B , whose public and private key pair is (P B ,s B ).

[0214] The communication between user terminals A and B requires the maintenance of a state. When user terminals A and B communicate for the first time, the communication process is as follows:

[0215] Phase 1: User terminal A performs the following process:

[0216] 1. Choose a random challenge value r A ←Z q *, and calculate the random challenge median value R A =r A G.

[0217] 2. Randomly challenge the middle value R A 、id A 、P A Sent to user terminal B.

[0218] User terminal B performs the following process:

[0219] 1. Choose a random challenge value r B ←Z q *, and calculate the random challenge median value R B =r B G.

[0220] 2. Randomly challenge the middle value R B 、id B 、P B Sent to user terminal A.

[0221] Phase 2: Receiving R B 、id B 、P B After that, user terminal A performs the following process:

[0222] 1. Calculate the shared secret value PS = (r A +s A )(R B +P B +λB P pub ), where λ B =h2(P pub ,id B ,P B ).

[0223] 2. Calculate the symmetric encryption key K = h1(PS,id A ,R A ,id B ,R B ) and state value state=h3(PS,id A ,R A ,id B ,R B ).

[0224] 3. Calculate the shared intermediate value PM = h4(K, state).

[0225] 4. Encryption Calculation C A =Enc K (PM⊕R A ), the ciphertext C A Sent to user terminal B, where Enc K (PM⊕R A ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (PM⊕R A ) for encryption.

[0226] Receive R A 、id A 、P A After that, user terminal B performs the following process:

[0227] 1. Calculate the shared secret value PS = (r B +s B )(R A +P A +λ A P pub ), where λ A =h2(P pub ,id A ,P A ).

[0228] 2. Calculate the symmetric encryption key K = h1(PS,id A ,R A ,id B ,R B ) and state value state=h3(PS,id A ,R A ,id B ,R B ).

[0229] 3. Calculate the shared intermediate value PM = h4(K, state).

[0230] 4. Encryption Calculation C B =Enc K (PM⊕R B ), the ciphertext C B Sent to user terminal A, where Enc K (PM⊕R B ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (PM⊕R B ) for encryption.

[0231] Phase 3: Receiving C B After that, user terminal A performs the following process:

[0232] 1. Decrypt M B =Dec K (C B ), where Dec K (C B ) indicates the use of symmetric decryption algorithm Dec(.) and symmetric key K to decrypt the ciphertext message C B Decrypt.

[0233] 2. Calculate PM' = M B ⊕R B , and determine whether PM' and PM are equal. If PM' and PM are not equal, the execution is terminated.

[0234] 3. Update the state value state = h3 (state, K, id A ,id B ) and set the session key to K.

[0235] Receive C A After that, user terminal B performs the following process:

[0236] 1. Decrypt M A =Dec K (C A ), where Dec K (C A ) indicates the use of symmetric decryption algorithm Dec(.) and symmetric key K to decrypt the ciphertext message C A Decrypt.

[0237] 2. Calculate PM' = M A ⊕R A , and determine whether PM' and PM are equal. If PM' and PM are not equal, the execution is terminated.

[0238] 3. Update the state value state = h3 (state, K, id A ,id B ) and set the session key to K.

[0239] When user terminal A and user terminal B communicate for the nth time (n is an integer greater than 1), the communication process is as follows:

[0240] Phase 1: User terminal A performs the following process:

[0241] 1. Choose a random challenge value r A ←Z q *, and calculate the random challenge median value R A =O A +r A G.

[0242] 2. Randomly challenge the middle value R A 、id A 、P A Sent to user terminal B.

[0243] User terminal B performs the following process:

[0244] 1. Choose a random challenge value r B ←Z q *, and calculate the random challenge median value R B =O B +r B G.

[0245] 2. Randomly challenge the middle value R B 、id B 、P B Sent to user terminal A.

[0246] Phase 2: Receiving R B 、id B 、P B After that, user terminal A performs the following process:

[0247] 1. Calculate the shared secret value PS = (r A +s A )(R B +P B +λ B P pub ), where λ B =h2(P pub ,id B ,P B ).

[0248] 2. Calculate the symmetric encryption key K = h1(PS, state, id A ,RA ,id B ,R B ).

[0249] 3. Encryption Calculation C A =Enc K (R A ), the ciphertext C A Sent to user terminal B, where Enc K (R A ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (R A ) for encryption.

[0250] Receive R A 、id A 、P A After that, user terminal B performs the following process:

[0251] 1. Calculate the shared secret value PS = (r B +s B )(R A +P A +λ A P pub ), where λ A =h2(P pub ,id A ,P A ).

[0252] 2. Calculate the symmetric encryption key K = h1(PS, state, id A ,R A ,id B ,R B ).

[0253] 3. Encryption Calculation C B =Enc K (R B ), the ciphertext C B Sent to user terminal A, where Enc K (R B ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (R B ) for encryption.

[0254] Phase 3: Receiving C B After that, user terminal A performs the following process:

[0255] 1. Decrypt R B '=Dec K (C B ), where Dec K (C B) indicates the use of symmetric decryption algorithm Dec(.) and symmetric key K to decrypt the ciphertext message C B Decrypt.

[0256] 2. Determine R B ' and R B Are they equal? ​​If R B ' and R B If they are not equal, execution is terminated.

[0257] 3. Update the state value state = h3 (state, K, id A ,id B ) and set the session key to K.

[0258] Receive C A After that, user terminal B performs the following process:

[0259] 1. Decrypt R A '=Dec K (C A ), where Dec K (C A ) indicates the use of symmetric decryption algorithm Dec(.) and symmetric key K to decrypt the ciphertext message C A Decrypt.

[0260] 2. Determine R A ' and R A Are they equal? ​​If R A ' and R A If they are not equal, execution is terminated.

[0261] 3. Update the state value state = h3 (state, K, id A ,id B ) and set the session key to K.

[0262] The embodiments described above have at least the following beneficial technical effects:

[0263] 1. The present invention is based on a certificateless cryptographic system, which does not require a central authority to manage a large number of certificates and solves the security issues caused by a single point of failure of a trusted center.

[0264] 2. The present invention realizes forward security for both communicating parties. Even if the long-term keys of both communicating parties are leaked, the communication data before the key is leaked can still be kept confidential.

[0265] 3. The present invention realizes the backward identity security of the communicating parties. Even if the long-term keys of the communicating parties are leaked, the adversary still cannot impersonate the communicating parties to communicate.

[0266] 4. The solution of the present invention does not require bilinear pairing operations and can achieve lower computational and communication overheads.

[0267] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed in the present invention should be covered by the scope of protection of the present invention.

Claims

1. A backward secure certificateless authentication and key agreement method, characterized in that: The steps include: The key generation center outputs system parameters based on the input security parameters and secretly stores the master key, wherein the system parameters include a hash function for generating a random state value of a fixed bit length, and the system parameters are system parameters of a communication system composed of multiple user terminals; The key generation center and each user terminal generate a public-private key pair for each user terminal according to the system parameters, the user identity of the user terminal and the master key; and The user terminals to be engaged in a conversation perform authentication based on their respective public-private key pairs, the system parameters, and identity information of both parties, generate a session key between the user terminals, and update a common state value between the user terminals based on the session key and the common state value between the user terminals; The key generation center outputs the system parameters based on the input security parameters and secretly stores the master key, including the key generation center performing the following operations: Select a large prime number p and the coefficients a and b of the elliptic curve, and construct the elliptic curve E:y 2 =x 3 +ax+bmod p; Select an additive cyclic group G1 on the elliptic curve E with a prime order q and a generator G. Select the symmetric encryption algorithm Enc(.): And the symmetric decryption algorithm Dec(.): Among them, {0,1}* is a bit string composed of 0 and 1 of any length, The value space of the symmetric encryption key, determined by the security parameters; Select hash function h1: Hash function h2: {0,1}*→Z q *, hash function h3: {0,1}*→{0,1} ls , hash function h4: {0,1}*→G1, where {0,1}* is a bit string of 0 and 1 of any length, is the value space of the symmetric encryption key, Z q * is the set of integers less than q and coprime to q, {0,1} ls is a bit string composed of any 0s and 1s with a fixed bit length of ls; From Z q * randomly selects the master key s and uses the formula P pub =sG calculates the master public key P pub ;as well as Set the parameters G1, a, b, p, q, G, Enc(.), Dec(.), h1, h2, h3, P pub The output is a system parameter, and the master key s is kept secret; h3 is a hash function used to generate a random state value of a fixed bit length.

2. The backward secure certificateless authentication and key agreement method according to claim 1, wherein: During the first communication between the user terminals to be in a conversation, the user terminals to be in a conversation authenticate each other based on their respective public-private key pairs, the system parameters, and identity information of both parties, generate a session key between the user terminals, and update the common state value between the user terminals based on the session key and the common state value between the user terminals, including: Each of the user terminals to be engaged in the conversation generates its own random challenge value according to the system parameters; The user terminals generate a common session key and a common state value based on the other party's random challenge value, the master public key, identity information of both parties and the system parameters; and The user terminals perform identity authentication between each other based on the common session key, determine the validity of the common session key, and update the common state value between the user terminals based on the session key and the common state value.

3. The backward secure certificateless authentication and key agreement method according to claim 2, wherein: During the nth communication between the user terminals to be in a conversation, where n is an integer greater than 1, the user terminals to be in a conversation authenticate each other based on their respective public-private key pairs, the system parameters, and identity information of both parties, generate a session key between the user terminals, and update the common state value between the user terminals based on the session key and the common state value between the user terminals, including: Each of the user terminals to be engaged in the conversation generates its own random challenge value according to the system parameters; The user terminals generate a common session key based on the other party's random challenge value, the public key, identity information of both parties, the system parameters, and the common state value; and The user terminals perform identity authentication between each other based on the common session key, determine the validity of the common session key, and update the common state value between the user terminals based on the session key and the common state value.

4. The backward secure certificateless authentication and key agreement method according to claim 3, wherein: The key generation center and each user terminal generating a public-private key pair for each user terminal according to the system parameters, the user identity of the user terminal, and the master key includes: Step S10: The user terminal performs the following steps: generating a first private key and a first private key intermediate value according to the system parameters; Sending the user identity of the user terminal and the first private key intermediate value to the key generation center; Step S20: The key generation center performs the following steps: Generate a second private key and a public key according to the system parameters, the master key, the first private key intermediate value, and the user identity; Sending the second private key and the public key to the user terminal; Step S30: The user terminal executes the following steps: verifying the second private key and the public key according to the system parameters; If the verification is successful, the private key of the user terminal is obtained according to the first private key and the second private key, and the public key is set as the public key of the user terminal.

5. The backward secure certificateless authentication and key agreement method according to claim 4, characterized in that: The step S10 includes: the user terminal performs the following steps: From Z q * randomly selects the first private key u and calculates the first private key intermediate value U according to the formula U=uG; Sending the user identity ID of the user terminal and the first private key intermediate value U to the key generation center; The step S20 includes: the key generation center performs the following steps: From Z q *Select a random number w; The second private key t and public key P are calculated according to the following formula: W=wG,P=U+W,λ=h2(P pub ,id,P),t=w+λs; Sending the second private key t and the public key P to the user terminal; The step S30 includes: the user terminal performs the following steps: According to the formula O=P+λP pub Calculate the parameter O, where λ = h2(P pub ,id,P); Verify whether the equation O = (u + t) G holds true; If the equation O=(u+t)G holds, the first private key u and the second private key t are added together to obtain the private key of the user terminal, and the public key P is set as the public key of the user terminal.

6. The backward secure certificateless authentication and key agreement method according to claim 5, characterized in that: Each of the user terminals to be engaged in the session generates its own random challenge value according to the system parameters, including: From Z q *Select a random challenge value r and calculate the random challenge intermediate value R according to the formula R=rG or the formula R=O+rG; The random challenge intermediate value R, the identity information of each user terminal, and the public key of each user terminal are sent to the other user terminal to be connected.

7. The backward secure certificateless authentication and key agreement method according to claim 6, wherein: The user terminals generating a common session key and a common state value according to the random challenge value of the other party, the public key, identity information of both parties and the system parameters include: The user terminal generates a shared secret value according to its private key, the random challenge value, the random challenge intermediate value of another user terminal to be in session, the identity information, the public key, and the system parameters; The user terminal generates a common symmetric key and a common state value according to its random challenge intermediate value, the shared secret value, the identity information, and the random challenge intermediate value, the identity information, and the system parameters of another user terminal to be in session; and The user terminal encrypts the plaintext information using the common symmetric key and sends the encrypted ciphertext information to the other user terminal to be connected.

8. The backward secure certificateless authentication and key agreement method according to claim 7, wherein: The user terminals generating a common session key and a common state value according to the random challenge value of the other party, the public key, identity information of both parties and the system parameters include: After receiving the random challenge intermediate value R of user terminal B, user terminal A B , user terminal B's identity information id B , user terminal B's public key P B Then perform the following steps: According to the formula PS=(r A +s A )(R B +P B +λ B P pub ) Calculate the shared secret value PS, where λ B =h2(P pub ,id B ,P B ); According to the formula K=h1(PS,id A ,R A ,id B ,R B ) Calculate the symmetric encryption key K; According to the formula state=h3(PS,id A ,R A ,id B ,R B ) Calculate the state value state; Calculate the shared intermediate value PM according to the formula PM = h4(K, state); Encryption Calculation C A =Enc K (PM⊕R A ), and the ciphertext C A Sent to user terminal B, where Enc K (PM⊕R A ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (PM⊕R A ) for encryption; After receiving the random challenge intermediate value R from user terminal A, user terminal B A , user terminal A's identity information id A , user terminal A's public key P A Then perform the following steps: According to the formula PS=(r B +s B )(R A +P A +λ A P pub ) Calculate the shared secret value PS, where λ A =h2(P pub ,id A ,P A ); According to the formula K=h1(PS,id A ,R A ,id B ,R B ) Calculate the symmetric encryption key K; According to the formula state=h3(PS,id A ,R A ,id B ,R B ) Calculate the state value state; Calculate the shared intermediate value according to the formula PM = h4(K, state); Encryption Calculation C B =Enc K (PM⊕R B ), the ciphertext C B Sent to user terminal A, where Enc K (PM⊕R B ) indicates the use of symmetric encryption algorithm Enc(.) and symmetric key K to encrypt the plaintext message (PM⊕R B ) for encryption.

9. The backward secure certificateless authentication and key agreement method according to claim 6, wherein: The user terminals generating a common session key according to the random challenge value of the other party, the public key, identity information of both parties, the system parameters, and the common state value include: The user terminal generates a shared secret value according to its private key, the random challenge value, the random challenge intermediate value of another user terminal to be in session, the identity information, the public key, and the system parameters; The user terminal generates a common symmetric key based on its random challenge intermediate value, the shared secret value, the identity information, and the random challenge intermediate value, the identity information, the common state value, and the system parameters of another user terminal to be in session; and The user terminal encrypts the plaintext information using the common symmetric key and sends the encrypted ciphertext information to the other user terminal to be connected.

Images