Key generation method of SM9 identification algorithm based on physically unclonable function

Abstract

The application discloses a SM9 identification algorithm key generation method based on a physically unclonable function, and comprises the following steps: S1, based on a multipath effect, channel state information data acquisition, preprocessing and quantization coding are completed to obtain an encoding result containing a bit sequence; S2, a local sensitive hash algorithm is used to perform dimension reduction processing on the bit sequence in the encoding result, and a local matching pair is found and split hash is performed on the dimension-reduced bit sequence, so that a terminal device unique identifier is generated; and S3, wireless terminal public and private keys are generated according to the terminal device unique identifier and a national secret SM9 identification algorithm, which are used to realize digital signature and verification between a wireless terminal device and an access point. The application can effectively prevent an attacker from forging a user identity identifier to steal a key, and improves the reliability and security of a wireless communication system.

Description

Technical Field

[0001] The present application relates to the field of communication security technology, and in particular, to a method for generating a key for an SM9 identification algorithm based on a physically unclonable function. Background Art

[0002] Existing wireless communication systems transmit data over open wireless channels, making them vulnerable to device impersonation attacks and communication data forgery attacks. This presents a security risk when communicating parties authenticate each other, allowing attackers to impersonate each other using stolen keys. The cryptographic-based wireless device authentication technology provided by 802.11i has been a key defense against these attacks, but effective attack schemes have emerged. Therefore, to mitigate these attacks, a method is needed to bind the identity of a communicating entity to its key, thereby preventing identity theft due to key leakage.

[0003] In recent years, the emergence and rise of identity cryptography algorithms has provided a new approach to binding the identities of communicating entities to their keys. These algorithms provide a key generation and distribution mechanism that eliminates the need for third-party authentication and reduces overhead. During key negotiation, certificates are not required. Instead, user identities, such as IP addresses and MAC addresses, are used as public keys. A key generation center (KGC) calculates the user's private key based on the system master key and the user's identity. Both communicating parties can obtain each other's public key using their identities, thereby completing key negotiation and ensuring confidential communication.

[0004] However, existing identification cryptographic algorithms still have security risks in which attackers can impersonate users by forging user identification. Since the IP address and MAC address used as identification can be tampered with, attackers can disguise themselves as attack targets, thereby undermining the security of the communication process. Summary of the Invention

[0005] The present application provides a method for generating a key for an SM9 identification algorithm based on a physically unclonable function, in order to solve the technical problem that existing identification cryptographic algorithms still have a security risk that attackers can forge user identity identifiers and thereby impersonate the user.

[0006] The technical solutions adopted in this application are as follows:

[0007] A method for generating a key for an SM9 identification algorithm based on a physical unclonable function comprises the following steps:

[0008] S1. Based on the multipath effect, complete channel state information data collection, preprocessing, and quantization coding to obtain a coding result including a bit sequence;

[0009] S2. Use a local sensitive hashing algorithm to reduce the dimensionality of the bit sequence in the encoding result, and perform local matching pair search and split hashing on the bit sequence after dimensionality reduction to generate a unique identity identifier for the terminal device;

[0010] S3. Generate the public and private keys of the wireless terminal according to the unique identity identifier of the terminal device and the national secret SM9 identification algorithm, which are used to implement digital signature and verification between the wireless terminal device and the access point.

[0011] Furthermore, the step S1 specifically includes the steps of:

[0012] S11. Complete channel state information data acquisition based on the multipath effect, use the channel state information data amplitude sequence as the physical signal source of the physical unclonable function, and perform normalization processing on each channel state information data amplitude sequence;

[0013] S12, using the Laida criterion to pre-process the channel state information to remove random noise in the environment;

[0014] S13. Using two-dimensional image coding as a quantization scheme for the preprocessed channel state information to obtain a coding result including a bit sequence.

[0015] Furthermore, when normalizing each channel state information data amplitude sequence in step S11, a maximum-minimum value normalization method is used to normalize each channel state information data amplitude sequence.

[0016] Furthermore, the step S12 includes the steps of:

[0017] S121, extracting the amplitude value of the original data of the channel state information;

[0018] S122, performing abnormality detection on the amplitude value of the original data of the channel state information according to the Laida criterion;

[0019] S123 , averaging the raw data of the channel state information continuously collected through anomaly detection to remove random noise in the environment.

[0020] Furthermore, the step S13 specifically includes the following steps:

[0021] S131. Draw the data amplitude value of the channel state information as a curve on a two-dimensional plane, and fill the area below the curve with black, and keep the area above the curve white;

[0022] S132, constructing a two-dimensional rectangular grid with the data amplitude value of the channel state information as the length and the quantization level as the width, and color-coding the grid: the black part of the grid is coded as 1, and the pure white grid is coded as 0;

[0023] S133 , arranging the codes of each grid column from top to bottom according to the order of the data amplitude values ​​of the channel state information, and finally forming a coding result including a bit sequence.

[0024] Furthermore, the step S2 specifically includes the steps of:

[0025] S21. After equally dividing the bit sequence in the encoding result into multiple feature strings of equal length, perform data weighting and dimensionality reduction processing on the feature strings of equal length, and finally output a signature matrix;

[0026] S22. Use a local sensitive hashing algorithm to perform a hash operation on the signature matrix, finally aggregate the signatures into a hash bucket, and locally search for matching pairs to obtain a unique identity of the terminal device.

[0027] Furthermore, the step S21 specifically includes the following steps:

[0028] S211, dividing the bit sequence in the encoding result into multiple feature strings of equal length;

[0029] S212, assigning a weight k to each feature string of equal length according to its importance, and changing each bit of the feature string to "k" or "-k" according to whether it is "1" or "0";

[0030] S213: Accumulate all weighted feature strings and combine them to obtain a final sequence string;

[0031] S214. Perform dimensionality reduction processing on the merged sequence string. If a bit in the sequence string is greater than 0, it is recorded as 1, and if it is less than 0, it is recorded as 0. Output the signature corresponding to the bit sequence, combine multiple signatures, and finally output the signature matrix.

[0032] Furthermore, the step S22 specifically includes the following steps:

[0033] S221, dividing the signatures in the signature matrix into different segments, each segment containing a fixed number of rows;

[0034] S222. Hash each segment into a different hash bucket using a locality-sensitive hashing algorithm;

[0035] S223. Identify each hash bucket, combine the identifiers of the hash buckets where each segment of the signature is located, and obtain a unique identity identifier of the terminal device.

[0036] Furthermore, the step S3 specifically includes the steps of:

[0037] S31, input the unique identity of the terminal device as the user identity into the SM9 identification cryptographic algorithm to obtain the wireless terminal public key;

[0038] S32, SM9 The key generation center KGC generates a wireless terminal private key based on the signature of its master private key and user identity, and sends the private key to the corresponding user through a secure channel.

[0039] On the other hand, the present application also provides an SM9 identification algorithm key generation device based on a physical unclonable function, comprising:

[0040] The channel state information acquisition and processing module is used to complete the channel state information data acquisition, preprocessing, quantization coding based on the multipath effect to obtain the coding result containing the bit sequence;

[0041] A terminal device unique identifier generation module is used to use a local sensitive hashing algorithm to reduce the dimensionality of the bit sequence in the encoding result, and to perform local matching pair search and split hashing on the bit sequence after dimensionality reduction, thereby generating a terminal device unique identifier;

[0042] The wireless terminal public and private key generation module is used to generate the wireless terminal public and private keys based on the terminal device's unique identity identifier and the national secret SM9 identification algorithm, which is used to implement digital signature and verification between the wireless terminal device and the access point.

[0043] On the other hand, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, the steps of the SM9 identification algorithm key generation method based on the physical unclonable function are implemented.

[0044] On the other hand, the present application also provides a storage medium, which includes a stored program, and when the program is running, controls the device where the storage medium is located to execute the steps of the SM9 identification algorithm key generation method based on the physical unclonable function.

[0045] Compared with the existing technology, this application has the following beneficial effects:

[0046] The present application provides a method for generating a key of an SM9 identification algorithm based on a physical unclonable function. Compared with the existing method, the present application generates a unique identity identifier of a terminal device for a physical device based on a physical unclonable function. Since a more secure communication key is generated by combining the unique identity identifier of the terminal device physically bound to the terminal with the SM9 identification cryptographic algorithm, it can effectively prevent attackers from forging user identity identifiers and stealing keys, thereby solving the problem of attackers using stolen keys to impersonate identities when authenticating the identities of the communicating parties in traditional wireless communication systems. It can effectively prevent attackers from impersonating identities, thereby ensuring the security and reliability of wireless communication and improving the security of the wireless communication system.

[0047] In addition to the above-described purposes, features and advantages, the present application also has other purposes, features and advantages. The present application will be further described in detail below with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The drawings that constitute a part of this application are used to provide further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute improper limitations on this application.

[0049] In the attached figure:

[0050] Figure 1 This is a flow chart of the SM9 identification algorithm key generation method based on a physical unclonable function in a preferred embodiment of the present application.

[0051] Figure 2 It is a flow chart of the CSI preprocessing process in the preferred embodiment of the present application.

[0052] Figure 3 It is a flow chart of the quantization function in the preferred embodiment of the present invention.

[0053] Figure 4 It is a schematic diagram demonstrating the local sensitive hashing algorithm in the preferred embodiment of the present invention.

[0054] Figure 5 This is a schematic diagram of the module of the SM9 identification algorithm key generation device based on the physical unclonable function in the preferred embodiment of the present application.

[0055] Figure 6 This is a schematic block diagram of an electronic device entity according to a preferred embodiment of the present application.

[0056] Figure 7 It is a schematic diagram of the internal structure of a computer device according to a preferred embodiment of the present application. DETAILED DESCRIPTION

[0057] The embodiments of the present application are described in detail below with reference to the accompanying drawings, but the present application can be implemented in a variety of different ways defined and covered below.

[0058] like Figure 1 As shown, the preferred embodiment of the present application provides a method for generating a key of an SM9 identification algorithm based on a physical unclonable function, comprising the following steps:

[0059] S1. Based on the multipath effect, complete channel state information data collection, preprocessing, and quantization coding to obtain a coding result including a bit sequence;

[0060] S2. Use a local sensitive hashing algorithm to reduce the dimensionality of the bit sequence in the encoding result, and perform local matching pair search and split hashing on the bit sequence after dimensionality reduction to generate a unique identity identifier for the terminal device;

[0061] S3. Generate the public and private keys of the wireless terminal according to the unique identity identifier of the terminal device and the national secret SM9 identification algorithm, which are used to implement digital signature and verification between the wireless terminal device and the access point.

[0062] In response to the wireless communication security threats mentioned in the prior art, this embodiment provides an SM9 identification algorithm key generation method based on a physically unclonable function. This method physically binds the communication entity to its identity, that is, the identity is identified through the physical characteristics of the communication entity, and is unique and non-replicable. Therefore, a physically unclonable function can be used to achieve physical binding of the communication entity to its identity.

[0063] The input of a physical unclonable function (PUF) is a series of stimuli related to physical characteristics. Since the physical entity of the physical unclonable function (PUF) is inevitably exposed to random noise and uncontrollable changes in the physical environment, these factors will inevitably affect the response signal. Therefore, the PUF also needs to select an appropriate fuzzy function to reduce the adverse effects of noise perturbations, thereby outputting a unique identity related to the physical characteristics through the fuzzy function.

[0064] When using a physical unclonable function (PUF) to perform physical binding of an identity, it's necessary to consider the actual wireless communication system scenario and select appropriate physical characteristics of the wireless terminal as the PUF input. In wireless communication systems, under complex scattering and fading environments, the electromagnetic waves used to transmit signals experience significant fading and multipath effects. This makes the wireless channel characteristics of devices in different locations unique, univocal, non-replicable, and robust, making them suitable as the basis for constructing a PUF. A PUF can generate a unique identity for a physical device. Channel state information (CSI) reflects the characteristics of the wireless channel and device hardware. Since wireless channel characteristics are related to the location of the wireless terminal device, the CSI data of the wireless terminal can be used as the physical characteristic input of the PUF and applied to the identification of location-dependent wireless terminal devices.

[0065] In addition, in actual scenarios, due to the noise fluctuations and uncertainties brought by actual measurements during the channel state information CSI acquisition process, the generation of the wireless terminal's identity may be affected. Therefore, this embodiment adopts the local sensitive hashing (LSH) algorithm as the fuzzy function of the PUF to ensure that each communication entity outputs the unique identity of the terminal device in the presence of noise in the CSI. Finally, the identity physically bound to the terminal is combined with the existing SM9 identification cryptographic algorithm to generate a communication key to ensure the security and reliability of wireless communication.

[0066] To sum up, in response to the security issues existing in the identification cryptographic algorithm in the wireless communication system, compared with the existing methods, the present application generates a unique identity identifier for the terminal device for the physical device based on a physical unclonable function. Since a more secure communication key is generated by combining the unique identity identifier of the terminal device physically bound to the terminal with the SM9 identification cryptographic algorithm, it can effectively prevent attackers from forging user identity identifiers and stealing keys, and solves the problem of attackers using stolen keys to impersonate identities when the communicating parties are authenticated in traditional wireless communication systems. It can effectively prevent attackers from impersonating identities, thereby ensuring the security and reliability of wireless communications and improving the security of wireless communication systems.

[0067] Preferably, the step S1 specifically includes the steps of:

[0068] S11. Complete channel state information data acquisition based on the multipath effect, use the channel state information data amplitude sequence as the physical signal source of the physical unclonable function, and normalize each channel state information data amplitude sequence. Preferably, when performing the normalization process, use a maximum-minimum value normalization method to normalize each channel state information data amplitude sequence.

[0069] For example, in an Orthogonal Frequency Division Multiplexing (OFDM) wireless network (such as IEEE 802.11a / g / n), a set of CSI data is generated between each pair of antennas. Each set of CSI data is an array whose length is equal to the number of CSI values ​​in the OFDM mechanism. Each CSI value represents the channel frequency response sample value corresponding to the center frequency of the subcarrier with that number. Each set of CSI data is defined by the following formula:

[0070] CSI m，n =[esi -1 , csi -i+1 ,...,csi -1 ,csi0,csi1,...,csi i-1 , csi i ]

[0071] Where m and n are the antenna numbers of the transmitting and receiving ends respectively, and i is the subcarrier number. The CSI value corresponding to each subcarrier is a complex number, so another representation of CSI data is as follows:

[0072]

[0073] where |csi k | is the amplitude of the CSI value, ∠CSI m，n is the phase of the CSI value, and the amplitude array of a set of CSI data is recorded as |CSI m，n |, the phase array is denoted as ∠CSI m，n , m and n are the antenna numbers of the transmitter and receiver, respectively. CSI data is collected in a real indoor environment. Considering that PUF implementation must be robust, the CSI amplitude is used as the physical signal source of the PUF.

[0074] In a wireless network with a bandwidth of 20 MHz and 64 OFDM subcarriers for data transmission and a communication system with wireless terminals with single transmit and receive antennas, the receiver uses a channel estimation algorithm to obtain the CSI after receiving the data packet sent by the wireless terminal. The CSI is a complex matrix of size 1×1×64, expressed as CSI=m1,m2,...,m 52 The long training sequence used for channel estimation has an amplitude of 0 on the 12 subcarriers numbered -32, -31, -30, -29, -28, -27, 0, 27, 28, 29, 30, and 31. Therefore, the CSI values ​​on these subcarriers are not calculated by channel estimation and are therefore irrelevant to the wireless channel of the wireless device. These values ​​need to be removed before generating the CSI fingerprint. After removal, the complex matrix CSI' = u1, u2, ..., u with a size of 1 × 1 × 52 is obtained. 52 , each value represents the amplitude and phase of the corresponding subcarrier. The amplitude sequence of CSI is expressed as CSIA = a1, a2, ..., a 52 , then a i =|u i |(i=1, 2, ..., 52). In order to reduce the negative impact of amplitude variation on fingerprint recognition performance, it is necessary to extract the shape information of CSIA. This shape information is obtained by normalizing each CSI amplitude sequence by the maximum-minimum value. For CSIA, let:

[0075] a max =max(a1,a2,...,a 52 )

[0076] a min =min(a1,a2,...,a 52 )

[0077] The maximum-minimum normalization formula is as follows:

[0078]

[0079] The normalized CSI amplitude sequence is the CSI fingerprint CFP = c1, c2, ..., c 52 .

[0080] S12, using the Laida criterion to pre-process the channel state information to remove random noise in the environment;

[0081] Preferably, in step S12, the channel state information preprocessing specifically includes the following steps:

[0082] S121, extracting the amplitude value of the original data of the channel state information;

[0083] S122, performing abnormality detection on the amplitude value of the original data of the channel state information according to the Laida criterion;

[0084] S123 , averaging the raw data of the channel state information continuously collected through anomaly detection to remove random noise in the environment.

[0085] The process of CSI preprocessing is as follows Figure 2 As shown, based on the normalized CSI amplitude sequence CFP, this embodiment uses the Laida criterion to perform anomaly detection on the CFP, and finally takes the average value of the CSI amplitude sequence CFP that passes the anomaly detection to remove random noise in the environment and improve the reliability of the channel state information.

[0086] S13. Using two-dimensional image coding as a quantization scheme for the preprocessed channel state information to obtain a coding result including a bit sequence.

[0087] The preprocessed CSI data has initially met the robustness requirements of the PUF. Since the CSI amplitude value is continuous, it needs to be quantized and encoded. This embodiment uses a two-dimensional image encoding scheme as the quantization scheme, which specifically includes the following steps:

[0088] S131. Draw the data amplitude value of the channel state information as a curve on a two-dimensional plane, and fill the area below the curve with black, and keep the area above the curve white;

[0089] S132, constructing a two-dimensional rectangular grid with the data amplitude value of the channel state information as the length and the quantization level as the width, and color-coding the grid: the black part of the grid is coded as 1, and the pure white grid is coded as 0;

[0090] S133 , arranging the codes of each grid column from top to bottom according to the order of the data amplitude values ​​of the channel state information, and finally forming a coding result including a bit sequence.

[0091] Based on the above coding scheme, the quantization function flow chart designed in this embodiment based on the CSI data collected in the actual indoor environment is as follows: Figure 3 As shown. The upper bound of the distribution of CSI data amplitude values ​​collected in this embodiment in an actual indoor environment is approximately 256. Therefore, the quantization function is set to a range of (0, 256), a step size of 16, and a level of 16. The amount of CSI data per frame is determined by the number of antennas between the transmitter and receiver. The receiver device used in this embodiment has two antennas and stably generates two sets of CSI data, each set including 56 amplitude values, for a total of 112 amplitude values. These 112 amplitude values ​​are quantized to produce a 1792-bit sequence.

[0092] Preferably, the step S2 specifically includes the steps of:

[0093] S21. After equally dividing the bit sequence in the encoding result into multiple feature strings of equal length, perform data weighting and dimensionality reduction processing on the feature strings of equal length, and finally output a signature matrix;

[0094] Preferably, the method specifically includes the steps of:

[0095] S211, dividing the bit sequence in the encoding result into multiple feature strings of equal length;

[0096] S212, assigning a weight k to each feature string of equal length according to its importance, and changing each bit of the feature string to "k" or "-k" according to whether it is "1" or "0";

[0097] S213: Accumulate all weighted feature strings and combine them to obtain a final sequence string;

[0098] S214. Perform dimensionality reduction processing on the merged sequence string. If a bit in the sequence string is greater than 0, it is recorded as 1, and if it is less than 0, it is recorded as 0. The signature corresponding to the bit sequence is output. Multiple signatures are combined to finally output the signature matrix.

[0099] S22, using a local sensitive hash algorithm (such as SimHash algorithm) to perform a hash operation on the signature matrix, and finally aggregate it into a hash bucket, and locally search for matching pairs to obtain the unique identity of the terminal device (see Figure 4 ), preferably, specifically comprising the steps of:

[0100] S221, dividing the signatures in the signature matrix into different segments, each segment containing a fixed number of rows;

[0101] S222. Hash each segment into a different hash bucket using a locality-sensitive hashing algorithm;

[0102] S223. Identify each hash bucket, combine the identifiers of the hash buckets where each segment of the signature is located, and obtain a unique identity identifier of the terminal device.

[0103] This embodiment divides the signature into different segments, uses the local sensitive hashing algorithm to hash each segment into a different hash bucket for identification, and combines them to obtain the unique identity of the device. The advantage is that during the hashing process, the algorithm further reduces the dimensionality of the input data, so that input data with slight deviations can have a unique and stable output, further improving the robustness and reliability of the algorithm.

[0104] Preferably, the step S3 specifically includes the steps of:

[0105] S31, input the unique identity of the terminal device as the user identity into the SM9 identification cryptographic algorithm to obtain the wireless terminal public key;

[0106] S32, SM9 The key generation center KGC generates a wireless terminal private key based on the signature of its master private key and user identity, and sends the private key to the corresponding user through a secure channel.

[0107] In this embodiment, the public and private keys of the wireless terminal are obtained by inputting the terminal device's unique identity identifier as the user identity identifier into the national secret SM9 algorithm. The user identity identifier is generated based on the channel state information (CSI) of the communication channel and processed by the physical unclonable function (PUF). The user identity identifier is physically bound to the device and is tamper-proof and unique. Therefore, it can effectively prevent attackers from forging user identity identifiers and stealing keys. This solves the problem of attackers using stolen keys to impersonate each other during identity authentication in traditional wireless communication systems, thereby ensuring the security and reliability of wireless communication. After the terminal public and private keys are generated, the wireless terminal can securely authenticate with the access point.

[0108] like Figure 5 As shown, the present application also provides an SM9 identification algorithm key generation device based on a physical unclonable function, comprising:

[0109] The channel state information acquisition and processing module is used to complete the channel state information data acquisition, preprocessing, quantization coding based on the multipath effect to obtain the coding result containing the bit sequence;

[0110] A terminal device unique identifier generation module is used to use a local sensitive hashing algorithm to reduce the dimensionality of the bit sequence in the encoding result, and to perform local matching pair search and split hashing on the bit sequence after dimensionality reduction, thereby generating a terminal device unique identifier;

[0111] The wireless terminal public and private key generation module is used to generate the wireless terminal public and private keys based on the terminal device's unique identity identifier and the national secret SM9 identification algorithm, which is used to implement digital signature and verification between the wireless terminal device and the access point.

[0112] like Figure 6 As shown, another preferred embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the computer program, the steps of the SM9 identification algorithm key generation method based on the physical unclonable function in the above embodiment are implemented.

[0113] like Figure 7 As shown, another preferred embodiment of the present application further provides a computer device, which can be a terminal or a liveness detection server, and its internal structure diagram can be as shown in FIG. Figure 7 As shown. The computer device includes a processor, memory, and network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with other external computer devices via a network connection. When the computer program is executed by the processor, the steps of the above-mentioned SM9 identification algorithm key generation method based on a physically unclonable function are implemented.

[0114] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0115] A preferred embodiment of the present application also provides a storage medium, which includes a stored program, and when the program is running, controls the device where the storage medium is located to execute the steps of the SM9 identification algorithm key generation method based on the physical unclonable function in the above embodiment.

[0116] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0117] If the functions described in the method of this embodiment are implemented in the form of a software functional unit and sold or used as an independent product, they can be stored in a storage medium readable by one or more computing devices. Based on this understanding, the part of the embodiment of the present application that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computing device (which can be a personal computer, server, mobile computing device or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0118] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiment of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal translation scripting language JavaScript, etc.

[0119] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0120] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1The function specified in one or more boxes.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0122] Anything not described in detail in this application is a well-known technology to those skilled in the art. Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions of the present invention, and all of these should be included in the scope of the claims of the present invention.

Claims

1. A method for generating a key for an SM9 identification algorithm based on a physically unclonable function, characterized in that: The following steps are involved: S1. Based on the multipath effect, complete channel state information data collection, preprocessing, and quantization coding to obtain a coding result including a bit sequence; S2. Use a local sensitive hashing algorithm to reduce the dimensionality of the bit sequence in the encoding result, and perform local matching pair search and split hashing on the bit sequence after dimensionality reduction to generate a unique identity identifier for the terminal device, specifically including the following steps: S21, after equally dividing the bit sequence in the encoding result to obtain multiple feature strings of equal length, performing data weighting and dimensionality reduction processing on the feature strings of equal length, and finally outputting a signature matrix, specifically comprising the steps of: S211, dividing the bit sequence in the encoding result into multiple feature strings of equal length; S212, assigning a weight k to each feature string of equal length according to its importance, and changing each bit of the feature string to "k" or "-k" according to whether it is "1" or "0"; S213: Accumulate all weighted feature strings and combine them to obtain a final sequence string; S214. Perform dimensionality reduction processing on the merged sequence string. If a bit in the sequence string is greater than 0, it is recorded as 1, and if it is less than 0, it is recorded as 0. The signature corresponding to the bit sequence is output. Multiple signatures are combined to finally output the signature matrix. S22, using a local sensitive hashing algorithm to perform a hash operation on the signature matrix, finally aggregating the signatures into a hash bucket, and locally searching for matching pairs to obtain a unique identity of the terminal device, specifically including the following steps: S221, dividing the signatures in the signature matrix into different segments, each segment containing a fixed number of rows; S222. Hash each segment into a different hash bucket using a locality-sensitive hashing algorithm; S223. Identify each hash bucket, combine the identifiers of the hash buckets where each segment of the signature is located, and obtain the unique identity identifier of the terminal device; S3. Generate the public and private keys of the wireless terminal based on the unique identity identifier of the terminal device and the national secret SM9 identification algorithm, which are used to implement digital signature and verification between the wireless terminal device and the access point.

2. The method for generating a key using the SM9 identification algorithm based on a physical unclonable function according to claim 1, wherein: The step S1 specifically includes the following steps: S11. Complete channel state information data acquisition based on the multipath effect, use the channel state information data amplitude sequence as the physical signal source of the physical unclonable function, and perform normalization processing on each channel state information data amplitude sequence; S12, using the Laida criterion to pre-process the channel state information to remove random noise in the environment; S13. Using two-dimensional image coding as a quantization scheme for the preprocessed channel state information to obtain a coding result including a bit sequence.

3. The method for generating a key using the SM9 identification algorithm based on a physical unclonable function according to claim 2, wherein: When normalizing each channel state information data amplitude sequence in step S11, a maximum-minimum value normalization method is used to normalize each channel state information data amplitude sequence.

4. The method for generating a key for the SM9 identification algorithm based on a physical unclonable function according to claim 2, wherein: The step S12 includes the following steps: S121, extracting the amplitude value of the original data of the channel state information; S122, performing abnormality detection on the amplitude value of the original data of the channel state information according to the Laida criterion; S123 , averaging the raw data of the channel state information continuously collected through anomaly detection to remove random noise in the environment.

5. The method for generating a key for the SM9 identification algorithm based on a physical unclonable function according to claim 2, wherein: The step S13 specifically includes the following steps: S131. Draw the data amplitude value of the channel state information as a curve on a two-dimensional plane, and fill the area below the curve with black, and keep the area above the curve white; S132, constructing a two-dimensional rectangular grid with the data amplitude value of the channel state information as the length and the quantization level as the width, and color-coding the grid: the black part of the grid is coded as 1, and the pure white grid is coded as 0; S133 , arranging the codes of each grid column from top to bottom according to the order of the data amplitude values ​​of the channel state information, and finally forming a coding result including a bit sequence.

6. The method for generating a key for the SM9 identification algorithm based on a physical unclonable function according to claim 1, wherein: The step S3 specifically includes the following steps: S31, input the unique identity of the terminal device as the user identity into the SM9 identification cryptographic algorithm to obtain the wireless terminal public key; S32, SM9 The key generation center KGC generates a wireless terminal private key based on the signature of its master private key and user identity, and sends the private key to the corresponding user through a secure channel.

7. A device for generating a key for an SM9 identification algorithm based on a physical unclonable function, characterized in that: include: The channel state information acquisition and processing module is used to complete the channel state information data acquisition, preprocessing, quantization coding based on the multipath effect to obtain the coding result containing the bit sequence; The terminal device unique identifier generation module is used to use the local sensitive hashing algorithm to reduce the dimension of the bit sequence in the encoding result, and perform local matching pair search and split hash on the bit sequence after dimension reduction to generate the terminal device unique identifier. Specifically, it is used to: After the bit sequence in the encoding result is equally divided into multiple feature strings of equal length, the feature strings of equal length are subjected to data weighting and dimensionality reduction processing, and finally the signature matrix is ​​output. The specific steps include: Divide the bit sequence in the encoding result into multiple feature strings of equal length; Assign a weight k to each feature string of equal length according to its importance, and change it to "k" or "-k" depending on whether each bit of the feature string is "1" or "0"; Accumulate all weighted feature strings and merge them to obtain the final sequence string; Perform dimensionality reduction on the merged sequence string. If a bit in the sequence string is greater than 0, it is recorded as 1, and if it is less than 0, it is recorded as 0. Output the signature corresponding to the bit sequence, combine multiple signatures, and finally output the signature matrix; The signature matrix is ​​hashed using a local sensitive hashing algorithm, and finally aggregated into a hash bucket. A matching pair is locally searched to obtain the unique identity of the terminal device, specifically for: Divide the signatures in the signature matrix into different segments, each segment contains a fixed number of rows; Use the locality sensitive hashing algorithm to hash each segment into a different hash bucket; Identify each hash bucket and combine the identifiers of the hash buckets where each segment of the signature is located to obtain the unique identity of the terminal device; The wireless terminal public and private key generation module is used to generate the wireless terminal public and private keys based on the terminal device's unique identity identifier and the national secret SM9 identification algorithm, which is used to implement digital signature and verification between the wireless terminal device and the access point.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the SM9 identification algorithm key generation method based on the physical unclonable function as described in any one of claims 1 to 6 are implemented.

9. A storage medium comprising a stored program, characterized in that: When the program is running, the device where the storage medium is located is controlled to perform the steps of the SM9 identification algorithm key generation method based on a physical unclonable function as claimed in any one of claims 1 to 6.

Images