A password-based authentication key agreement method and electronic device

Abstract

The application discloses a password-based authentication key agreement method and electronic equipment. In the method, a client generates a first target password according to a first random number and a first reference password in a first password file, and generates a first prime order group associated random number according to the first random number and a generator in a set prime order group; the first target password, the first prime order group associated random number and a first timestamp are sent to a server, and a second prime order group associated random number, a second timestamp and second ciphertext are received; a first intermediate secret value is calculated according to a second target password and the second prime order group associated random number, and a first reference identity, a first identity and the first random number; the second ciphertext is decrypted, and in the case that decryption verification is passed, a first session key is obtained according to the first intermediate secret value, the first target password, the first prime order group associated random number, the second target password and the second prime order group associated random number. The security is improved.

Description

Technical Field

[0001] This application relates to the field of key technology, and in particular to a password-based authentication key negotiation method and electronic device. Background Technology

[0002] Password-based Authenticated Key Agreement (PAKA) protocols enable participants to authenticate each other using a pre-shared low-entropy secret value (i.e., a password), and then jointly negotiate the final session key. This type of protocol is flexible to deploy, easy to maintain, and the passwords are simple and easy to remember. Furthermore, PAKA protocols do not require the involvement of public key infrastructure or key distribution centers, and they do not make excessive security assumptions.

[0003] PAKA protocols can be divided into two categories: symmetric PAKA protocols and asymmetric PAKA protocols. Symmetric PAKA protocols carry the risk of password leakage, while asymmetric PAKA protocols are susceptible to pre-computation attacks, and their application in asymmetric environments has significant limitations.

[0004] Therefore, it is particularly important to find a symmetric password authentication key negotiation scheme that protects the participants from information attacks and pre-computation attacks. Summary of the Invention

[0005] An exemplary embodiment of this application provides a password-based authentication key negotiation method and electronic device for negotiating a session key, thereby ensuring that the participants are protected from information attacks and pre-computation attacks.

[0006] According to a first aspect of an exemplary implementation, a password-based authentication key negotiation method is provided, applied to a client, comprising:

[0007] A first target password is generated based on a first random number and a first reference password in a first password file; and a first prime order group-associated random number is generated based on the first random number and a generator in a set prime order group; wherein, the first password file is determined based on the first password associated with the client, the first identity identifier, and the first random salt value;

[0008] Send the first target password, the first prime number group associated random number, and the first timestamp to the server;

[0009] Receive from the server a second target password generated based on a second reference password and a second random number, a second prime order group associated random number generated based on the second random number and a generator in a set prime order group, a second timestamp, and a second ciphertext calculated based on the second timestamp, the second reference password, and the second random number;

[0010] Based on the received second target password and the random number associated with the second prime number group, as well as the pre-stored first reference identity identifier, first identity identifier, and first random number, calculate the first intermediate secret value; wherein, the first reference identity identifier is obtained by hashing the first identity identifier;

[0011] Decrypt the second ciphertext, and if the decryption verification is successful, calculate the first session key based on the first intermediate secret value, the first target password, the first prime number group associated random number, the second target password, and the second prime number group associated random number.

[0012] According to a second aspect of an exemplary embodiment, a password-based authentication key negotiation method is provided, applied to a server, the method comprising:

[0013] Receive the first target password, the first prime number group associated random number, and the first timestamp from the client;

[0014] The second target password is generated based on the second random number and the second reference password in the second password file, and a second prime order group-associated random number is generated based on the second random number and a generator in the set prime order group; wherein, the second password file is determined based on the second password associated with the server, the second identity identifier, and the second random salt value;

[0015] Based on the received first target password and the first prime number group associated random number, as well as the pre-stored second reference identifier, second identity identifier, and second random number, calculate the second intermediate secret value; wherein, the second reference identifier is obtained by hashing the second identity identifier;

[0016] The second ciphertext is calculated based on the second timestamp, the second reference password, and the second random number.

[0017] Send the second target password, the second prime number group associated random number, the second timestamp, and the second ciphertext to the client;

[0018] Receive the first ciphertext generated by the client based on the first timestamp, the first target password, and the first random number;

[0019] Decrypt the first ciphertext, and if the decryption verification is successful, calculate the second session key based on the second intermediate secret value, the second target password, the second prime number group associated random number, the first target password, and the first prime number group associated random number.

[0020] According to a third aspect of an exemplary embodiment, a password-based authentication key negotiation apparatus is provided, which, in response to a user client, includes:

[0021] The first processing unit is configured to: generate a first target password based on a first random number and a first reference password in a first password file; and generate a first prime-order group-associated random number based on the first random number and a generator in a set prime-order group; wherein the first password file is determined based on the first password associated with the client, the first identity identifier, and the first random salt value.

[0022] The first transmission unit is used to send the first target password, the first prime number group-associated random number, and the first timestamp to the server.

[0023] The first transmission unit is further configured to: receive from the server a second target password generated according to a second reference password and a second random number, a second prime order group associated random number generated according to the second random number and a generator in a set prime order group, a second timestamp, and a second ciphertext calculated according to the second timestamp, the second reference password and the second random number;

[0024] The first processing unit is further configured to: calculate a first intermediate secret value based on the received second target password and a random number associated with a second prime number group, as well as a pre-stored first reference identity identifier, first identity identifier, and first random number; wherein the first reference identity identifier is obtained by hashing the first identity identifier;

[0025] The first processing unit is also used to: decrypt the second ciphertext, and, if the decryption verification is successful, calculate the first session key based on the first intermediate secret value, the first target password, the first prime number group associated random number, the second target password, and the second prime number group associated random number.

[0026] According to a fourth aspect of an exemplary embodiment, a password-based authentication key negotiation apparatus is provided, applied to a server, comprising:

[0027] The second transmission unit is used to: receive a first target password, a first prime number group-associated random number, and a first timestamp from the client;

[0028] The second processing unit is configured to: generate a second target password based on a second random number and a second reference password in a second password file; and generate a second prime-order group-associated random number based on the second random number and a generator in a set prime-order group; wherein the second password file is determined based on a second password associated with the server, a second identity identifier, and a second random salt value.

[0029] The second transmission unit is further configured to: calculate a second intermediate secret value based on the received first target password and a first prime number group associated random number, as well as a pre-stored second reference identifier, second identity identifier, and second random number; wherein the second reference identifier is obtained by hashing the second identity identifier;

[0030] The second processing unit is also used to: calculate the second ciphertext based on the second timestamp, the second reference password, and the second random number;

[0031] The second transmission unit is also used to: send the second target password, the second prime number group associated random number, the second timestamp, and the second ciphertext to the client;

[0032] The second transmission unit is further configured to: receive first ciphertext generated by the client based on the first timestamp, the first target password, and the first random number;

[0033] The second processing unit is also used to: decrypt the first ciphertext, and, if the decryption verification is successful, calculate the second session key based on the second intermediate secret value, the second target password, the second prime number group association random number, the first target password, and the first prime number group association random number.

[0034] According to a fifth aspect of an exemplary embodiment, an electronic device is provided, including a processor and a memory;

[0035] Memory is used to store computer program instructions;

[0036] The processor executes computer program instructions in memory to perform the methods provided in any of the foregoing aspects or any possible implementations of any of the foregoing aspects.

[0037] According to a sixth aspect of the exemplary embodiments, this application also provides a computer-readable storage medium storing a software program that, when read and executed by one or more processors, can implement the methods provided by any of the designs in any aspect.

[0038] According to a seventh aspect of an exemplary embodiment, this application provides a computer program product including computer instructions that, when executed by a computing device, cause the computing device to perform the methods provided in any of the foregoing aspects or any possible implementations thereof. The computer program product may be a software installation package, which can be downloaded and executed on a computing device when the methods provided in any of the foregoing aspects or any possible implementations thereof are required.

[0039] In this embodiment, the client generates a first password file based on the associated first password, first identity identifier, and first random salt value. Then, it generates a first target password based on a first random number and a first reference password in the first password file. Finally, it generates a first prime-order group-associated random number based on the first random number and a generator from a set prime-order group. This design stores a password file instead of plaintext passwords. Furthermore, the password file includes elements such as the password, identity identifier, and random salt value. Since the attacker does not know the random salt value, even if the password file is leaked, the protocol can resist pre-computation attacks, preventing the attacker from obtaining the password. In other words, even if the client's electronic device is attacked, it can still protect both parties from the impact of information leakage and pre-computation attacks. In addition, the client sends the first target password, the first prime number group-associated random number, and the first timestamp to the server; it receives from the server the second target password generated based on the second reference password and the second random number, the second prime number group-associated random number generated based on the second random number and a generator in the set prime number group, the second timestamp, and the second ciphertext calculated based on the second timestamp, the second reference password, and the second random number; it calculates the first intermediate secret value based on the received second target password, the second prime number group-associated random number, and the pre-stored first reference identity identifier, first identity identifier, and first random number; wherein the first reference identity identifier is obtained by hashing the first identity identifier; it decrypts the second ciphertext, and if the decryption verification is successful, it calculates the first session key based on the first intermediate secret value, the first target password, the first prime number group-associated random number, the second target password, and the second prime number group-associated random number. This design eliminates the need for bilinear pairing operations during the establishment of the session key between the client and server, relying instead on lightweight operations such as hashing, thus making it simple and efficient. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 An exemplary illustration shows an application scenario diagram of a password-based authentication key negotiation method provided in an embodiment of this application;

[0042] Figure 2 An exemplary flowchart illustrates a password-based authentication key negotiation method provided in an embodiment of this application;

[0043] Figure 3An exemplary flowchart illustrates another password-based authentication key negotiation method provided in an embodiment of this application;

[0044] Figure 4 An exemplary diagram illustrates a signaling diagram of a password-based authentication key negotiation method provided in an embodiment of this application;

[0045] Figure 5 An exemplary schematic diagram of a password-based authentication key negotiation device provided in an embodiment of this application is shown.

[0046] Figure 6 An exemplary schematic diagram of another password-based authentication key negotiation device provided in an embodiment of this application is shown;

[0047] Figure 7 An exemplary schematic diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0049] In this context, "first" refers to the client-related concept, and "second" refers to the server-related concept. For ease of understanding, the concepts involved in the embodiments of this application are explained as follows:

[0050]

[0051] Password authentication key exchange can be divided into two categories: symmetric password authentication key exchange negotiation and asymmetric password authentication key exchange negotiation. In a symmetric setup, the client and server authenticate each other by sharing the same password. However, there is a potential problem: if the server is compromised, the attacker can obtain the local password database and then use arbitrary passwords to impersonate other users. To mitigate the risk of password leakage, the concept of asymmetric password authentication key exchange was proposed. It allows the server to store verification elements associated with the password, instead of plaintext passwords. If the verification elements are leaked, the attacker needs more time to recover the password. However, Jarecki points out that these asymmetric PAKA schemes are susceptible to pre-computation attacks. Because the verification elements in these protocols are generated by converting the password through a deterministic one-way function, and the salt value is publicly transmitted during the key exchange phase, an attacker can pre-compute and list the function values ​​for all possible passwords, i.e., build a table of all passwords. Once the server is compromised, it can find the corresponding user's password.

[0052] To prevent pre-computation attacks, Jarecki et al. proposed a strongly secure asymmetric PAKA scheme. This scheme uses an unintentional pseudo-random function to generate password files for the server, eliminating the need to transmit the salt value from the server to the user during interactions, and preventing immediate password leakage even if server information is compromised. Bradley et al. proposed another general composable strongly secure asymmetric PAKA scheme. This algorithm employs a novel conditional key encapsulation mechanism and a general smooth projective hash function, resulting in only two message transmissions during interactions and avoiding hashing operations on groups.

[0053] However, in practical applications, it is very common for passwords to be stored on the client or device. For example, many users allow their browsers to save passwords, and any program running under the same user can access these passwords, making them easy targets for malware. Therefore, if the client is compromised, the security of the protocol will be threatened. Although the aforementioned strongly secure asymmetric password authentication key negotiation scheme can resist information leakage attacks and pre-computation attacks, the client becomes vulnerable to these attacks. Therefore, protecting both parties from information leakage attacks and pre-computation attacks is a problem that cannot be ignored. In addition, the asymmetric PAKA protocol is not suitable for all environments.

[0054] In summary, existing password-based authentication key negotiation protocols still face the following problems: (1) Existing symmetric PAKA protocols are at risk of password leakage; (2) In existing strongly secure asymmetric PAKA protocols, pre-computation attacks still exist on the client side, and the application of the scheme in asymmetric environments is limited; (3) Most PAKA protocols do not provide identity privacy protection. Therefore, how to design a symmetric password authentication key negotiation scheme that protects both parties from information leakage attacks and pre-computation attacks while satisfying identity privacy protection is an issue that deserves close attention.

[0055] To address this, this application provides a password-based authentication key negotiation method. In this method, during the initialization phase, the system sets common parameters. During the password file generation phase, since this phase is offline, both parties pre-calculate the password file. The password file is derived from the password, salt value, and identity. It contains two elements: one calculated from the password hash and salt value, and the other calculated from the salt value hash and the participant's identity. During the session key negotiation phase, the interaction between user devices is conducted online. Each user device selects a temporary key, then retrieves its own password file, generates the same temporary secret value using the password file and temporary key, verifies the identities of both parties, and generates a shared session key. This design provides identity privacy protection and resists information leakage attacks and pre-computation attacks.

[0056] After introducing the design concept of the embodiments of this application, the following is a brief introduction to the application scenarios to which the technical solutions of the embodiments of this application can be applied. It should be noted that the application scenarios described below are only for illustrating the embodiments of this application and are not intended to limit the scope. In specific implementation, the technical solutions provided by the embodiments of this application can be flexibly applied according to actual needs.

[0057] refer to Figure 1 The diagram illustrates an application scenario of a password-based authentication key negotiation method, where 11 represents an electronic device with a client deployed, and 12 represents a server. Optionally, in the scenario where the client and server negotiate a key, the negotiated key can be used to verify user access to the client. Furthermore, embodiments of this application can also be applied to key negotiation between two clients, where the negotiated key can be used for data transmission, etc. Figure 1 This is just an example and does not constitute a specific limitation.

[0058] To further illustrate the technical solutions provided in the embodiments of this application, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of this application provide method operation steps as shown in the following embodiments or drawings, the method may include more or fewer operation steps based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of this application.

[0059] The following is combined Figure 1 The application scenarios shown are for reference. Figure 2 The flowchart shown is a password-based authentication key negotiation method applied to a client, illustrating the technical solution provided in the embodiments of this application.

[0060] S201: The client generates a first target password based on a first random number and a first reference password in a first password file, and generates a first prime order group associated random number based on the first random number and a generator in a set prime order group.

[0061] The first password file is determined based on the first password, first identity identifier, and first random salt value associated with the client.

[0062] S202: The client sends the first target password, the first prime number group associated random number, and the first timestamp to the server.

[0063] S203: The client receives from the server a second target password generated based on a second reference password and a second random number, a second prime order group associated random number generated based on the second random number and a generator in a set prime order group, a second timestamp, and a second ciphertext calculated based on the second timestamp, the second reference password, and the second random number.

[0064] S204: The client calculates the first intermediate secret value based on the received second target password and the second prime number group associated random number, as well as the pre-stored first reference identity identifier, first identity identifier, and first random number.

[0065] The first reference identity identifier is obtained by hashing the first identity identifier.

[0066] S205: The client decrypts the second ciphertext, and if the decryption verification is successful, calculates the first session key based on the first intermediate secret value, the first target password, the first prime number group associated random number, the second target password, and the second prime number group associated random number.

[0067] In this embodiment, the client generates a first password file based on the associated first password, first identity identifier, and first random salt value. Then, it generates a first target password based on a first random number and a first reference password in the first password file. Finally, it generates a first prime-order group-associated random number based on the first random number and a generator from a set prime-order group. This design stores a password file instead of plaintext passwords. Furthermore, the password file includes elements such as the password, identity identifier, and random salt value. Since the attacker does not know the random salt value, even if the password file is leaked, the protocol can resist pre-computation attacks, preventing the attacker from obtaining the password. In other words, even if the client's electronic device is attacked, it can still protect both parties from the impact of information leakage and pre-computation attacks. In addition, the client sends the first target password, the first prime number group-associated random number, and the first timestamp to the server; it receives from the server the second target password generated based on the second reference password and the second random number, the second prime number group-associated random number generated based on the second random number and a generator in the set prime number group, the second timestamp, and the second ciphertext calculated based on the second timestamp, the second reference password, and the second random number; it calculates the first intermediate secret value based on the received second target password, the second prime number group-associated random number, and the pre-stored first reference identity identifier, first identity identifier, and first random number; wherein the first reference identity identifier is obtained by hashing the first identity identifier; it decrypts the second ciphertext, and if the decryption verification is successful, it calculates the first session key based on the first intermediate secret value, the first target password, the first prime number group-associated random number, the second target password, and the second prime number group-associated random number. This design eliminates the need for bilinear pairing operations during the establishment of the session key between the client and server, relying instead on lightweight operations such as hashing, thus making it simple and efficient.

[0068] In explanation Figure 2 Before the negotiation phase, the initialization phase and the password file generation phase will be explained first.

[0069] During the initialization phase, a prime group of order is denoted by G, with its order denoted by q, and g representing a generator in the prime group G. G The unit element in G is represented by G / 1. G This means removing 1. G The set. κ represents the security parameter, p(κ) represents a polynomial within κ and is the length of the session key. Four hash functions are set as follows: H:{0,1} * →{0,1} p(κ) ; Where H, H1, and H3 represent the cryptographic hash functions modeled as random oracles, and H2 represents... - Linear hash function. {0,1} * Represents a string of arbitrary length consisting of 0 or 1 bits, {0,1} p(κ) Represents a string of length p(κ) consisting of 0 or 1 bits; It represents any integer less than q.

[0070] In addition, in this embodiment of the application, the PAKA protocol includes a matching client-server list, allowing users to... The identity identifier is ID i He possesses a password file, which contains his password pw. i Identity ID i It is derived from a private random salt value. For each client-server matching pair (C A ,S B Their passwords are the same, namely pw A =pw B .

[0071] During the password file generation phase, client C A A salt value is randomly selected and called the first random salt value. This first random salt value can randomize the password and hash. Calculate the first reference password. Calculate the first reference identity identifier The first password file includes the first reference password hw A and the first reference identity identifier D A .

[0072] During the password file generation phase, client C B A salt value is randomly selected and called the second random salt value. This second random salt value can randomize the password and hash. Calculate the second reference password. Calculate the second reference identity. The second password file includes the second reference password hw B Second Reference Identity DB .

[0073] Based on the initialization phase and password file generation phase described above, the negotiation phase will be explained next.

[0074] When the client detects an input of password and identity, it can recognize the password and identity indicated in the operation and retrieve the first password file <File=(hw A D A The security of the operation is verified by using the method described above. If the password in the operation instruction is the same as the password in the first password file, and the identity identifier in the operation instruction is the same as the identity identifier in the first password file, then the current operation is ensured to be secure.

[0075] This design provides identity privacy protection, ensuring that the transmitted data does not reveal any identity-related information. Even if the password file is leaked, there is no way to obtain identity information without knowing the salt value.

[0076] Involving S201, client C A Select a random number (the first random number). Calculate the first target password Calculate the associated random numbers of the first prime group.

[0077] Involving S202, client C A The first target password is X. A The first prime-order group associated random number Y A and first time stamp T A Send to server S B In other words, (X) A ,Y A ,T A Send to server S B .

[0078] Involves S203, server S B Receive from client C A of (X) A ,Y A ,T A It can recognize the entered password and the entered identity, and retrieve the second password file <File=(hw B D B The system performs security verification by ensuring that the current environment is secure if the entered password is the same as the password indicated in the first password file and the entered identity is the same as the identity indicated in the first password file.

[0079] Server S BRandomly select a random number (the second random number). Calculate the second target password Calculate the random numbers associated with the second prime group. Server S B Check the first timestamp T A Whether it's fresh, that is, checking the current time relative to the first timestamp T. A Is the time difference less than a set time difference threshold? If it is less, then determine the first timestamp T. A Fresh.

[0080] Server S B Based on the received first target password and the first prime-order group associated random number, as well as the pre-stored second reference identifier, second identity identifier, and second random number, calculate the second intermediate secret value. For example, the second intermediate secret value can be calculated using the following formula:

[0081] Server S B The second ciphertext is calculated based on the second timestamp, the second reference password, and the second random number. For example, the second ciphertext can be calculated using the following formula:

[0082] Server S B Send the second target password, the second prime number group associated random number, the second timestamp, and the second ciphertext to the client; that is, send (X) to the client. B ,Y B ,T B E B Send to the client.

[0083] In S203, the client receives from the server a second target password generated based on a second reference password and a second random number, a second prime order group associated random number generated based on the second random number and a generator in a set prime order group, a second timestamp, and a second ciphertext calculated based on the second timestamp, the second reference password, and the second random number.

[0084] Among them, the client receives (X) B ,Y B ,T B E B This can be used to verify whether the time is fresh. For example, it can be determined that the time difference between the moment when the second target password, the second prime number group associated random number, the second timestamp, and the second ciphertext are received is less than a set time difference threshold.

[0085] Regarding S204, the client calculates the first intermediate secret value based on the received second target password, the second prime number group associated random number, and the pre-stored first reference identity identifier, first identity identifier, and first random number. For example, the first intermediate secret value can be calculated using the following formula:

[0086] Regarding S205, the client decrypts the second ciphertext. Specifically, when decrypting the second ciphertext, if conditions 1-3 are met simultaneously, the decryption verification is successful.

[0087] Condition 1: The timestamp obtained after decryption is equal to the second timestamp received.

[0088] The client decrypts the second ciphertext, obtaining a decryption result that includes a timestamp, a random number, and a reference password. This condition confirms that the decrypted timestamp matches the second timestamp T. B equal.

[0089] Condition 2: The prime number group associated with the random number obtained from decryption is equal to the second prime number group associated with the random number received.

[0090] In this context, the client can calculate a random number associated with a prime number group based on the decrypted random number. The condition involves determining whether this random number is associated with the second prime number group random number Y. B equal.

[0091] Condition 3: The target password calculated based on the decrypted random number and the decrypted reference password is equal to the received second target password.

[0092] The client uses hash function H2 to calculate the random number obtained from decryption and the reference password to determine the target password and the second target password X. B Are they equal?

[0093] If the client successfully decrypts and verifies the password, it calculates the first session key based on the first intermediate secret value, the first target password, the first prime number group associated random number, the second target password, and the second prime number group associated random number.

[0094] For example, the client sets the SID. A =X A ||Y A ||X B ||Y B And calculate the first session key K1:=H(tk) A ||sid A Additionally, the client computes the first ciphertext. The first encrypted message is then sent to the server. Finally, to avoid excessive data storage or subsequent data retrieval errors, the client can delete the intermediate parameters or variables used in the initialization phase, password file generation phase, and negotiation phase.

[0095] After receiving the first ciphertext, the server obtains a decryption result including a timestamp, a random number, and a reference password. Referring to the conditions 1-3 judgment process described above when the client decrypted the second ciphertext, the server calculates the second session key based on the second intermediate secret value, the second target password, the second prime-order group-related random number, the first target password, and the first prime-order group-related random number, after successful decryption verification.

[0096] For example, the server sets the SID. B =X A ||Y A ||X B ||Y B And calculate the second session key K2:=H(tk) B ||sid B Finally, to avoid excessive data storage or subsequent data retrieval errors, the server can delete intermediate parameters or variables used in the initialization phase, password file generation phase, and negotiation phase.

[0097] refer to Figure 3 The flowchart shown is a password-based authentication key negotiation method applied to a server, illustrating the technical solution provided in the embodiments of this application.

[0098] S301: The server receives the first target password, the first prime number group associated random number, and the first timestamp from the client.

[0099] S302: The server generates a second target password based on a second random number and a second reference password in a second password file, and generates a second prime-order group-associated random number based on the second random number and a generator in a set prime-order group.

[0100] The second password file is determined based on the second password associated with the server, the second identity, and the second random salt value.

[0101] S303: The server calculates the second intermediate secret value based on the received first target password, the first prime number group associated random number, and the pre-stored second reference identifier, second identity identifier, and second random number.

[0102] The second reference identifier is obtained by hashing the second identity identifier.

[0103] S304: The server calculates the second ciphertext based on the second timestamp, the second reference password, and the second random number.

[0104] S305: The server sends the second target password, the second prime number group associated random number, the second timestamp, and the second ciphertext to the client.

[0105] S306: The server receives the first ciphertext generated by the client based on the first timestamp, the first target password, and the first random number.

[0106] S307: The server decrypts the first ciphertext, and if the decryption verification is successful, calculates the second session key based on the second intermediate secret value, the second target password, the second prime number group associated random number, the first target password, and the first prime number group associated random number.

[0107] In this embodiment, the transmitted information does not reveal the identities of the participants, thus protecting their identities and achieving symmetric password key negotiation with identity privacy protection. It can protect both parties from information leakage attacks and pre-computation attacks. Furthermore, it primarily relies on lightweight operations such as hashing, XOR, and a small number of exponential operations, making it simple and efficient. In addition, this method also has the following advantages: resistance to impersonation and replay attacks, forward secrecy, forward security, and two-way authentication.

[0108] Prior to S301, in order to ensure the security of the operating environment, the server determined that the entered password was the same as the password indicated in the second password file, and that the entered identity was the same as the identity indicated in the second password file.

[0109] Before calculating the second intermediate secret value in S307, the server determines the time when it receives the first target password, the first prime order group associated random number, the first timestamp, and the first ciphertext, and the time difference between the first timestamp and the first timestamp is less than a set time difference threshold.

[0110] Regarding S307, if conditions 1 through 3 are met simultaneously when decrypting the first ciphertext, then the decryption verification can be considered successful.

[0111] Condition 1: The timestamp obtained after decryption is equal to the first timestamp received; and

[0112] Condition 2: The prime-order group-related random number calculated based on the decrypted random number is equal to the first prime-order group-related random number received; and

[0113] Condition 3: The target password calculated based on the random number obtained from decryption and the reference password obtained from decryption is equal to the first target password received.

[0114] It should be noted that, Figure 3 For details on how each step is implemented, please refer to [link / reference]. Figure 2 The steps are not detailed here.

[0115] In order to improve the technical solution of this application, Figure 4 A signaling diagram for a password-based authentication key negotiation method provided in this application embodiment. Figure 4 It should include at least the following steps:

[0116] S401: The client generates a first password file based on the associated first password, first identity identifier, and first random salt value.

[0117] S402: The client generates a first target password based on a first random number and a first reference password in a first password file, and generates a first prime order group associated random number based on the first random number and a generator in a set prime order group.

[0118] S403: The client sends the first target password, the first prime number group associated random number, and the first timestamp to the server.

[0119] S404: The server generates a second password file based on the second password associated with the server, the second identity, and the second random salt value.

[0120] S405: The server generates a second target password based on a second random number and a second reference password in a second password file, and generates a second prime-order group-associated random number based on the second random number and a generator in a set prime-order group.

[0121] S406: The server calculates the second intermediate secret value based on the received first target password, the first prime number group associated random number, and the pre-stored second reference identifier, second identity identifier, and second random number.

[0122] S407: The server calculates the second ciphertext based on the second timestamp, the second reference password, and the second random number.

[0123] S408: The server sends the second target password, the second prime number group associated random number, the second timestamp, and the second ciphertext to the client.

[0124] S409: The client decrypts the second ciphertext, and if the decryption verification is successful, calculates the first session key based on the first intermediate secret value, the first target password, the first prime number group associated random number, the second target password, and the second prime number group associated random number.

[0125] S410: The client generates the first ciphertext based on the first timestamp, the first target password, and the first random number.

[0126] S411: The client sends the first ciphertext to the server.

[0127] S412: The server decrypts the first ciphertext, and if the decryption verification is successful, calculates the second session key based on the second intermediate secret value, the second target password, the second prime number group associated random number, the first target password, and the first prime number group associated random number.

[0128] It should be noted that the order of the steps is only for illustrative purposes and does not constitute a strict limitation. For example, the client and server can generate password files one after the other, or simultaneously.

[0129] From the perspectives of functionality and security, the method of this application can resist offline password guessing attacks, replay attacks, server leakage attacks, two-way information leakage attacks, and pre-computation attacks, and provides two-way authentication, perfect forward security, and identity privacy protection. From the perspective of computational overhead, this method mainly employs lightweight operations, including a few exponential operations, ordinary hash operations, and XOR operations, in both the password file generation stage and the key negotiation stage. Compared with the pairwise operations and group-to-point hash operations used in most PAKA protocols, this method significantly reduces the amount of computation and the computation time. Therefore, this method has good advantages and practicality in terms of both security and computational cost.

[0130] like Figure 5 As shown, based on the same inventive concept, this application provides a password-based authentication key negotiation device for a user client. The device includes a first processing unit 51 and a first transmission unit 52.

[0131] The first processing unit 51 is configured to: generate a first target password based on a first random number and a first reference password in a first password file; and generate a first prime order group associated random number based on the first random number and a generator in a set prime order group; wherein the first password file is determined based on the first password associated with the client, the first identity identifier, and the first random salt value.

[0132] The first transmission unit 52 is used to send the first target password, the first prime number group associated random number, and the first timestamp to the server.

[0133] The first transmission unit 52 is further configured to: receive from the server a second target password generated according to a second reference password and a second random number, a second prime order group associated random number generated according to the second random number and a generator in a set prime order group, a second timestamp, and a second ciphertext calculated according to the second timestamp, the second reference password and the second random number;

[0134] The first processing unit 51 is further configured to: calculate a first intermediate secret value based on the received second target password and the second prime number group associated random number, as well as the pre-stored first reference identity identifier, first identity identifier, and first random number; wherein the first reference identity identifier is obtained by hashing the first identity identifier;

[0135] The first processing unit 51 is also used to: decrypt the second ciphertext, and, if the decryption verification is successful, calculate the first session key based on the first intermediate secret value, the first target password, the first prime number group association random number, the second target password, and the second prime number group association random number.

[0136] In one optional implementation, the first processing unit 51 is specifically configured to determine that the decryption verification has passed when decrypting the second ciphertext by means of the following method:

[0137] The timestamp obtained after decryption is equal to the second timestamp received; and

[0138] The prime-order group-related random number calculated based on the decrypted random number is equal to the received second prime-order group-related random number; and

[0139] The target password calculated based on the decrypted random number and the decrypted reference password is equal to the received second target password.

[0140] In an optional implementation, before generating the first target password based on the first random number and the first reference password in the first password file, the first processing unit 51 is further configured to:

[0141] In response to the input of a password and identity identifier, the client determines that the password indicated in the operation instruction is the same as the password indicated in the first password file, and that the identity identifier indicated in the operation instruction is the same as the identity identifier indicated in the first password file.

[0142] In an optional implementation, before calculating the first intermediate secret value, the first processing unit 51 is further configured to:

[0143] Determine the time when the second target password, the second prime number group associated random number, the second timestamp, and the second ciphertext are received, and the time difference between the received second timestamp and the time difference is less than a set time difference threshold.

[0144] Since this device is the same as the device in the method of this application embodiment, and the principle of the device in solving the problem is similar to that of the method, the implementation of the device can be referred to the implementation of the method, and the repeated parts will not be described again.

[0145] like Figure 6As shown, based on the same inventive concept, this application provides a password-based authentication key negotiation device for use on a server. The device includes a second transmission unit 61 and a second processing unit 62.

[0146] The second transmission unit 61 is used to: receive a first target password, a first prime number group associated random number, and a first timestamp from the client;

[0147] The second processing unit 62 is configured to: generate a second target password based on a second random number and a second reference password in a second password file; and generate a second prime order group-associated random number based on the second random number and a generator in a set prime order group; wherein the second password file is determined based on a second password associated with the server, a second identity identifier, and a second random salt value.

[0148] The second transmission unit 61 is further configured to: calculate a second intermediate secret value based on the received first target password and a first prime number group associated random number, as well as a pre-stored second reference identifier, second identity identifier, and second random number; wherein the second reference identifier is obtained by hashing the second identity identifier;

[0149] The second processing unit 62 is also used to: calculate the second ciphertext based on the second timestamp, the second reference password, and the second random number;

[0150] The second transmission unit 61 is also used to: send the second target password, the second prime number group associated random number, the second timestamp, and the second ciphertext to the client;

[0151] The second transmission unit 61 is further configured to: receive a first ciphertext generated by the client based on a first timestamp, a first target password and a first random number;

[0152] The second processing unit 62 is further configured to: decrypt the first ciphertext, and, if the decryption verification is successful, calculate the second session key based on the second intermediate secret value, the second target password, the second prime number group association random number, the first target password, and the first prime number group association random number.

[0153] In one optional implementation, the second processing unit 62 is specifically configured to determine that the decryption verification has passed when decrypting the first ciphertext by means of the following method:

[0154] The timestamp obtained after decryption is equal to the first timestamp received; and

[0155] The prime number group-related random number calculated based on the decrypted random number is equal to the first prime number group-related random number received; and

[0156] The target password calculated based on the decrypted random number and the decrypted reference password is equal to the first target password received.

[0157] In an optional implementation, before generating the second target password based on the second random number and the second reference password in the second password file, the second processing unit 62 is further configured to:

[0158] The server determines that the entered password is the same as the password indicated in the second password file, and that the entered identity is the same as the identity indicated in the second password file.

[0159] In one alternative implementation, before calculating the second intermediate secret value, the second processing unit 62 is further configured to:

[0160] The time at which the first target password, the first prime number group associated random number, the first timestamp, and the first ciphertext are received is determined to be less than a set time difference threshold.

[0161] Since this device is the same as the device in the method of this application embodiment, and the principle of the device in solving the problem is similar to that of the method, the implementation of the device can be referred to the implementation of the method, and the repeated parts will not be described again.

[0162] Based on the same inventive concept as the password-based authentication key negotiation method described above, this application also provides an electronic device. This electronic device (which can be a control device or control system within a smart device, or an external device communicating with the smart device, such as a desktop computer, laptop computer, smartphone, tablet computer, personal digital assistant (PDA), server, etc.) can be used. For example, if the electronic device is a desktop computer, the client can be deployed on the desktop computer. Figure 7 As shown, the electronic device may include a processor 71 and a memory 72.

[0163] The processor 71 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0164] Memory 72, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 72 may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0165] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned computer storage medium can be any available medium or data storage device that a computer can access, including but not limited to: mobile storage devices, random access memory (RAM), magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)) and other media capable of storing program code.

[0166] Alternatively, if the integrated units described above in this application are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes: mobile storage devices, random access memory (RAM), magnetic memory (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical memory (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor memory (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs), etc.) and other media capable of storing program code.

[0167] Based on the same inventive concept, this application also provides a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to execute any of the page switching methods described above. Since the principle by which the above computer program product solves the problem is similar to that of the page switching method, the implementation of the above computer program product can be referred to the implementation of the method, and repeated details will not be described again.

[0168] The above embodiments are only used to provide a detailed description of the technical solutions of this application. However, the description of the above embodiments is only for the purpose of helping to understand the methods of the embodiments of this application and should not be construed as a limitation on the embodiments of this application. Any changes or substitutions that can be easily conceived by those skilled in the art should be covered within the protection scope of the embodiments of this application.

Claims

1. A password-based authentication key negotiation method, characterized in that, include: A first target password is generated based on a first random number and a first reference password in a first password file; and a first prime order group-associated random number is generated based on the first random number and a generator in a set prime order group; wherein, the first password file is determined based on the first password associated with the client, the first identity identifier, and the first random salt value; Send the first target password, the first prime number group associated random number, and the first timestamp to the server; Receive from the server a second target password generated based on a second reference password and a second random number, a second prime order group associated random number generated based on the second random number and a generator in the set prime order group, a second timestamp, and a second ciphertext calculated based on the second timestamp, the second reference password, and the second random number; Based on the received second target password and the second prime number group associated random number, as well as the pre-stored first reference identity identifier, the first identity identifier, and the first random number, calculate the first intermediate secret value; wherein, the first reference identity identifier is obtained by hashing the first identity identifier; Decrypt the second ciphertext, and if the decryption verification is successful, calculate the first session key based on the first intermediate secret value, the first target password, the first prime number group association random number, the second target password, and the second prime number group association random number.

2. The method according to claim 1, characterized in that, The method further includes determining that the decryption verification has passed when decrypting the second ciphertext in the following manner: The timestamp obtained after decryption is equal to the second timestamp received; and The prime number group associated random number calculated based on the random number obtained from decryption is equal to the second prime number group associated random number received. and The target password calculated based on the decrypted random number and the decrypted reference password is equal to the received second target password.

3. The method according to claim 1, characterized in that, Before generating the first target password based on the first random number and the first reference password in the first password file, the method further includes: In response to the operation of inputting a password and identity identifier, the client determines that the password indicated by the operation is the same as the password indicated by the first password file, and that the identity identifier indicated by the operation is the same as the identity identifier indicated by the first password file.

4. The method according to claim 1, characterized in that, Before calculating the first intermediate secret value, the method further includes: The time difference between the moment when the second target password, the second prime number group-associated random number, the second timestamp, and the second ciphertext are received and the time difference between these two moments is less than a set time difference threshold.

5. A password-based authentication key negotiation method, characterized in that, include: Receive the first target password, the first prime number group associated random number, and the first timestamp from the client; A second target password is generated based on a second random number and a second reference password in a second password file; and a second prime order group-associated random number is generated based on the second random number and a generator in a set prime order group; wherein, the second password file is determined based on a second password associated with the server, a second identity identifier, and a second random salt value; Based on the received first target password and the first prime number group associated random number, as well as the pre-stored second reference identifier, second identity identifier, and second random number, calculate the second intermediate secret value; wherein, the second reference identifier is obtained by hashing the second identity identifier; Calculate the second ciphertext based on the second timestamp, the second reference password, and the second random number; The second target password, the second prime number group associated random number, the second timestamp, and the second ciphertext are sent to the client. Receive a first ciphertext generated by the client based on the first timestamp, the first target password, and the first random number; Decrypt the first ciphertext, and if the decryption verification is successful, calculate the second session key based on the second intermediate secret value, the second target password, the second prime number group associated random number, the first target password, and the first prime number group associated random number.

6. The method according to claim 5, characterized in that, The method further includes determining that the decryption verification is successful when decrypting the first ciphertext in the following manner: The timestamp obtained after decryption is equal to the first timestamp received; and The prime number group associated random number calculated based on the decrypted random number is equal to the first prime number group associated random number received. and The target password calculated based on the random number obtained from decryption and the reference password obtained from decryption is equal to the first target password received.

7. The method according to claim 5, characterized in that, Before generating the second target password based on the second random number and the second reference password in the second password file, the method further includes: The server determines that the input password is the same as the password indicated in the second password file, and that the input identity is the same as the identity indicated in the second password file.

8. The method according to claim 5, characterized in that, Before calculating the second intermediate secret value, the method further includes: The time at which the first target password, the first prime number group-associated random number, the first timestamp, and the first ciphertext are received is determined to be less than a set time difference threshold.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1 to 4 and 5 to 8.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When executed by a processor, the computer program instructions implement the steps of the method according to any one of claims 1 to 4 and 5 to 8.

Images