Identity verification method, CA certificate issuing method and device

Abstract

The invention discloses an identity verification method and device for multi-party security computing, and a CA certificate issuing method and device, and relates to the technical field of multi-party security computing, and the method comprises the steps: a query party device sends a connection establishment request to a queried party device; receiving a first verification message sent by the queried party equipment after receiving the connection establishment request, wherein the first verification message carries a CA certificate issued by the monitoring party equipment for the queried party equipment; extracting a universal name of the queried party equipment from the received CA certificate of the queried party equipment; and based on the extracted general name of the queried party device, determining whether the queried party device is a participant device granted a legal identity by the monitoring party device. By adopting the scheme, the identity verification of the queried party equipment is realized, the efficiency is higher, and the expansion is easier.

Description

Technical Field

[0001] The present application relates to the technical field of multi-party secure computing, and in particular to an identity authentication method, CA certificate issuance method and device for multi-party secure computing. Background Art

[0002] As an advanced cryptographic technology, multi-party secure computing (MPC) can realize multi-party collaborative computing while protecting data privacy, and has shown great potential in the fields of finance, medical care, government affairs, etc. However, the current MPC system still faces many challenges in network connection and identity authentication, which seriously restricts the widespread application and large-scale deployment of MPC technology.

[0003] Multi-party secure computation (MPC) requires collaborative computing by multiple parties, who are usually from institutions in different geographical areas. Traditionally, institutions are interconnected through dedicated network lines to ensure the security of data transmission. However, it often takes a long time to open a dedicated line, and due to the limitations of physical lines, some areas may not be able to establish a dedicated line connection. Although virtual dedicated lines have improved this problem to a certain extent, their time cost and flexibility remain major challenges. In addition, since data exchange is usually highly sensitive, it is not suitable to be forwarded through a dedicated line of a central node in most cases.

[0004] If multiple parties use the public Internet to implement multi-party secure computing, in order to ensure the security of data transmission, effective and efficient identity authentication is required between the multiple parties. Summary of the invention

[0005] The embodiments of the present application provide an identity authentication method, a CA certificate issuance method and a device for multi-party secure computing, so as to solve the problem existing in the prior art of how to realize identity authentication between multiple participants in multi-party secure computing.

[0006] The embodiment of the present application provides an identity authentication method for multi-party secure computing, which is applied to a participant device as a querying device in a multi-party secure computing system, wherein the multi-party secure computing system includes multiple participant devices and a monitoring device, wherein the multiple participant devices also include a queried device, wherein the monitoring device pre-issues CA certificates for the multiple participant devices, respectively, wherein the CA certificate of a participant device carries the public key of the participant device, and the public key of the participant device includes a common name assigned to the participant device by the monitoring device, wherein the method includes: Sending a connection establishment request to the queried device; Receiving a first verification message sent by the queried device after receiving the connection establishment request, wherein the first verification message carries a CA certificate issued by the monitoring device to the queried device; Extracting the common name of the queried device from the received CA certificate of the queried device; Based on the extracted common name of the queried device, it is determined whether the queried device is a participant device to which the monitoring device has granted a legal identity.

[0007] Furthermore, it also includes: A second verification message is sent to the queried device, wherein the second verification message carries the CA certificate issued by the monitoring device to the inquiring device, so that the queried device extracts the common name of the inquiring device from the received CA certificate of the inquiring device, and based on the extracted common name of the inquiring device, determines whether the inquiring device is a participating device with a legal identity granted by the monitoring device.

[0008] Furthermore, the common names respectively allocated by the monitoring party device to the multiple participating party devices have the same basic domain name and different prefixes; The step of determining whether the queried device is a participant device with a legal identity granted by the monitoring device based on the extracted common name of the queried device comprises: Determine whether the basic domain name contained in the common name of the queried device is consistent with the basic domain name contained in the common name of the querying device; If they are consistent, it is determined that the queried device is a participant device with a legal identity granted by the monitoring device; If there is no inconsistency, it is determined that the queried device is not a participant device with a legal identity granted by the monitoring device.

[0009] Furthermore, before sending the connection establishment request to the queried device, the method further includes: Sending an access address acquisition request to the monitoring device, wherein the access address acquisition request carries the ID information of the queried device, and the ID information of the queried device is allocated by the monitoring device to the queried device; Receiving an access address acquisition response sent by the monitoring device after receiving the access address acquisition request, wherein the access address acquisition response carries the access address of the queried device; The sending a connection establishment request to the queried device includes: Based on the access address of the queried device, a connection establishment request is sent to the queried device.

[0010] The embodiment of the present application also provides a CA certificate issuance method for multi-party secure computing, which is applied to a participant device in a multi-party secure computing system, wherein the multi-party secure computing system includes multiple participant devices and a monitoring device, and the method includes: The participant device receives the ID information and the common name assigned to the participant device and sent by the monitoring device based on the access address of the participant device, where the access address of the participant device is provided in advance by the participant device to the monitoring device, and the common names respectively assigned to the plurality of participant devices by the monitoring device have the same basic domain name and different prefixes; Based on the received common name, generating a private key and a public key including the common name of the participant device; Sending a certificate signature request CSR message to the monitoring party device, wherein the CSR message carries the public key of the participant device, so that the monitoring party device generates a CA certificate issued for the participant device, wherein the CA certificate of the participant device carries the public key of the participant device; Receive the CA certificate issued for the participant device and sent by the monitoring party device.

[0011] The embodiment of the present application also provides a CA certificate issuance method for multi-party secure computing, which is applied to a monitoring device in a multi-party secure computing system, wherein the multi-party secure computing system also includes multiple participating devices, and the method includes: Allocating ID information and common names to the participating devices, wherein the common names respectively allocated by the monitoring device to the plurality of participating devices have the same basic domain name and different prefixes; Based on the access address pre-provided by the participant device, send the participant device ID information and the common name assigned to the participant device, so that the participant device generates a private key and a public key including the common name of the participant device based on the received common name; Receive a certificate signing application (CSR) message sent by the participant's device, wherein the CSR message carries the public key of the participant's device; Generate a CA certificate issued for the participant's device, where the CA certificate of the participant's device carries the public key of the participant's device; The CA certificate issued to the participant device is sent.

[0012] The embodiment of the present application also provides an identity authentication device for multi-party secure computing, which is applied to a participant device as a querying device in a multi-party secure computing system, wherein the multi-party secure computing system includes a plurality of participant devices and a monitoring device, wherein the plurality of participant devices also include a queried device, and the device includes: A message sending module, used for sending a connection establishment request to the queried party device; A message receiving module, configured to receive a first verification message sent by the queried device after receiving the connection establishment request, wherein the first verification message carries a CA certificate issued by the monitoring device to the queried device; A name extraction module, used to extract the common name of the queried party device from the received CA certificate of the queried party device; The identity authentication module is used to determine whether the queried party device is a participant device with a legal identity granted by the monitoring party device based on the extracted common name of the queried party device.

[0013] Furthermore, the message sending module is also used to send a second verification message to the queried device, wherein the second verification message carries a CA certificate issued by the monitoring device to the querying device, so that the queried device extracts the common name of the querying device from the received CA certificate of the querying device, and based on the extracted common name of the querying device, determines whether the querying device is a participating device with a legal identity granted by the monitoring device.

[0014] Furthermore, the common names respectively allocated by the monitoring party device to the multiple participating party devices have the same basic domain name and different prefixes; The identity authentication module is specifically used to determine whether the basic domain name contained in the common name of the queried party device is consistent with the basic domain name contained in the common name of the querying party device; If they are consistent, it is determined that the queried device is a participant device with a legal identity granted by the monitoring device; If there is no inconsistency, it is determined that the queried device is not a participant device with a legal identity granted by the monitoring device.

[0015] Furthermore, the message sending module is further configured to send an access address acquisition request to the monitoring device before sending the connection establishment request to the queried device, wherein the access address acquisition request carries the ID information of the queried device, and the ID information of the queried device is allocated by the monitoring device to the queried device; The message receiving module is further configured to receive an access address acquisition response sent by the monitoring device after receiving the access address acquisition request, wherein the access address acquisition response carries the access address of the queried device; The message sending module is specifically configured to send a connection establishment request to the queried device based on the access address of the queried device.

[0016] The embodiment of the present application also provides a CA certificate issuing device for multi-party secure computing, which is applied to a participant device in a multi-party secure computing system, wherein the multi-party secure computing system includes a plurality of participant devices and a monitoring device, and the device includes: a name receiving module, configured to receive the ID information and the common name assigned to the participant device and sent by the monitoring device based on the access address of the participant device, wherein the access address of the participant device is provided in advance by the participant device to the monitoring device, and the common names respectively assigned by the monitoring device to the plurality of participant devices have the same basic domain name and different prefixes; A key generation module, configured to generate a private key and a public key including the common name of the participant device based on the received common name; A CSR message sending module is used to send a certificate signature application CSR message to the monitoring party device, wherein the CSR message carries the public key of the participating party device, so that the monitoring party device generates a CA certificate issued for the participating party device, wherein the CA certificate of the participating party device carries the public key of the participating party device; The certificate receiving module is used to receive the CA certificate issued to the participating party device and sent by the monitoring party device.

[0017] The embodiment of the present application further provides a CA certificate issuing device for multi-party secure computing, which is applied to a monitoring device in a multi-party secure computing system, wherein the multi-party secure computing system further includes a plurality of participating devices, and the device includes: A name allocation module, used to allocate ID information and common names to the participating devices, wherein the common names allocated by the monitoring device to the multiple participating devices respectively have the same basic domain name and different prefixes; a name sending module, configured to send the ID information and the common name assigned to the participant device to the participant device based on the access address pre-provided by the participant device, so that the participant device generates a private key and a public key containing the common name of the participant device based on the received common name; A CSR message receiving module, used to receive a certificate signature application CSR message sent by the participant device, wherein the CSR message carries the public key of the participant device; A certificate generation module, used to generate a CA certificate issued to the participant device, wherein the CA certificate of the participant device carries the public key of the participant device; The certificate sending module is used for the participant device to send the CA certificate issued to it.

[0018] An embodiment of the present application also provides an electronic device, including a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to: implement any of the above-mentioned identity authentication methods for multi-party secure computing, or implement any of the above-mentioned CA certificate issuance methods for multi-party secure computing applied to participating party devices, or implement any of the above-mentioned CA certificate issuance methods for multi-party secure computing applied to monitoring party devices.

[0019] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it implements any of the above-mentioned identity authentication methods for multi-party secure computing, or implements any of the above-mentioned CA certificate issuance methods for multi-party secure computing applied to a participating party device, or implements any of the above-mentioned CA certificate issuance methods for multi-party secure computing applied to a monitoring party device.

[0020] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the above-mentioned XXXX methods.

[0021] The beneficial effects of this application include: In the method provided in the embodiment of the present application, the monitoring device in the multi-party secure computing system pre-issues CA certificates for multiple participating devices respectively. The CA certificate of a participating device carries the public key of the participating device, and the public key of the participating device includes the common name assigned to the participating device by the monitoring device, so that during the identity authentication process, the querying device can extract the common name of the queried device from the received CA certificate of the queried device, and based on the extracted common name of the queried device, determine whether the queried device is a participating device with a legal identity granted by the monitoring device, thereby realizing identity authentication of the queried device. In addition, since the common name assigned by the monitoring device to the participating device belongs to an application layer message, it has higher efficiency and is easier to expand than using network side messages for identity authentication, which improves the scalability and maintainability of the multi-party secure computing system.

[0022] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings are used to provide a further understanding of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings: Figure 1 A flowchart of an identity authentication method for multi-party secure computing provided in an embodiment of the present application; Figure 2 A flowchart of a CA certificate issuance method for multi-party secure computing applied to a participant device provided in an embodiment of the present application; Figure 3 A flowchart of a CA certificate issuance method for multi-party secure computing applied to a monitoring device provided in an embodiment of the present application; Figure 4 This is a schematic diagram of the structure of a multi-party secure computing system in an embodiment of the present application; Figure 5 A flowchart of a CA certificate issuance method for multi-party secure computing provided in an embodiment of the present application; Figure 6 A flowchart of an identity authentication method for multi-party secure computing provided by another embodiment of the present application; Figure 7 This is a schematic diagram of the structure of a multi-party secure computing system in an embodiment of the present application; Figure 8 A schematic diagram of the structure of an identity authentication device for multi-party secure computing provided in an embodiment of the present application; Fig. 9 A schematic diagram of the structure of a CA certificate issuing device for multi-party secure computing applied to a participant device provided in an embodiment of the present application; Fig.10 A schematic diagram of the structure of a CA certificate issuing device for multi-party secure computing applied to a monitoring device provided in an embodiment of the present application; Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to provide an implementation scheme for how to implement identity authentication between multiple participants in multi-party secure computing, the embodiments of the present application provide an identity authentication method, a CA certificate issuance method and a device for multi-party secure computing. The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application and are not used to limit the present application. In addition, the embodiments in the present application and the features in the embodiments can be combined with each other if there is no conflict.

[0025] The embodiment of the present application provides an identity authentication method for multi-party secure computing, which is applied to a participant device as a querying device in a multi-party secure computing system. The multi-party secure computing system includes multiple participant devices and a monitoring device. The multiple participant devices also include a queried device. The monitoring device pre-issues CA certificates for the multiple participant devices. The CA certificate of a participant device carries the public key of the participant device. The public key of the participant device contains a common name assigned to the participant device by the monitoring device, such as Figure 1 As shown, the method includes: Step 11: Send a connection establishment request to the queried device; Step 12: receiving a first verification message sent by the queried device after receiving the connection establishment request, wherein the first verification message carries a CA certificate issued by the monitoring device to the queried device; Step 13: extract the common name of the queried device from the received CA certificate of the queried device; Step 14: Based on the extracted common name of the queried party device, determine whether the queried party device is a participant device with a legal identity granted by the monitoring party device.

[0026] Accordingly, the embodiment of the present application also provides a CA certificate issuance method for multi-party secure computing, which is applied to a participant device in a multi-party secure computing system. The multi-party secure computing system includes multiple participant devices and a monitoring device, such as Figure 2 , the method comprising: Step 21: The participant device receives the ID information and the common name assigned to the participant device by the monitoring device based on the access address of the participant device. The access address of the participant device is provided in advance by the participant device to the monitoring device. The common names assigned by the monitoring device to multiple participant devices respectively have the same basic domain name and different prefixes. Step 22: Based on the received common name, generate a private key and a public key including the common name of the participant's device; Step 23: Send a certificate signature request CSR message to the monitoring party device, the CSR message carries the public key of the participating party device, so that the monitoring party device generates a CA certificate issued for the participating party device, and the CA certificate of the participating party device carries the public key of the participating party device; Step 24: Receive the CA certificate issued for the participant device and sent by the monitoring device.

[0027] Accordingly, the embodiment of the present application also provides a CA certificate issuance method for multi-party secure computing, which is applied to a monitoring device in a multi-party secure computing system. The multi-party secure computing system also includes multiple participating devices, such as Figure 3 As shown, the method includes: Step 31: assigning ID information and a common name to the participating device, wherein the common names assigned by the monitoring device to the multiple participating devices have the same basic domain name and different prefixes; Step 32: Based on the access address pre-provided by the participant device, send the ID information and the common name assigned to the participant device to the participant device, so that the participant device generates a private key and a public key containing the common name of the participant device based on the received common name; Step 33: Receive a certificate signing application CSR message sent by the participant's device, where the CSR message carries the public key of the participant's device; Step 34: Generate a CA certificate issued for the participant's device, where the CA certificate of the participant's device carries the public key of the participant's device; Step 35: Send the CA certificate issued to the participant's device.

[0028] By adopting the above method provided in the embodiment of the present application, the monitoring device in the multi-party secure computing system pre-issues CA certificates for multiple participating devices respectively, and the CA certificate of a participating device carries the public key of the participating device, and the public key of the participating device contains the common name assigned to the participating device by the monitoring device, so that during the identity authentication process, the querying device can extract the common name of the queried device from the received CA certificate of the queried device, and based on the extracted common name of the queried device, determine whether the queried device is a participating device with a legal identity granted by the monitoring device, thereby realizing the identity authentication of the queried device, and because the common name assigned to the participating device by the monitoring device belongs to the application layer message, it has higher efficiency and is easier to expand than using network side messages for identity authentication, that is, it improves the scalability and maintainability of the multi-party secure computing system.

[0029] In the present application embodiment, Figure 4 As shown, the multi-party secure computing system includes multiple participating devices and monitoring devices, wherein the multiple participating devices are used to interact through messages and adopt privacy computing algorithms to implement multi-party secure computing. The monitoring device can act as a management party to issue CA certificates to multiple participating devices and issue network access addresses.

[0030] The following is a detailed description of the process of the monitoring device issuing CA certificates to multiple participating devices. Figure 5 As shown in the figure, the following steps are used to issue a CA certificate to each participating device: Step 51: The participant device provides an access address to the monitoring device.

[0031] The access address can be an external IP address and port information.

[0032] This step can be provided offline or sent online.

[0033] Step 52: The monitoring device allocates ID information and a common name (commonname) to the participant device.

[0034] In this step, the monitoring party device allocates ID information and a common name to the participant device according to the received access address of the participant device, and binds the allocated ID information with the common name and the access address respectively.

[0035] In the embodiment of the present application, the monitoring party device is a common name assigned to multiple participating party devices respectively, which can indicate that each participating party device is a device with a legal identity granted by the monitoring party device.

[0036] For example, the common names assigned to multiple participating devices have the same basic domain name and different prefixes. That is to say, the common names of multiple participating devices are different, but they all contain the same basic domain name. The same basic domain name indicates that each participating device is a device that is granted a legal identity by the monitoring device.

[0037] For example, the common names assigned to the three participating devices are a.mpc.com, b.mpc.com, and c.mpc.com, where mpc.com is the base domain name and a, b, and c are prefixes.

[0038] Step 53: The monitoring device sends the ID information and common name allocated to the participant device to the participant device based on the access address provided by the participant device.

[0039] Step 54: After receiving the assigned ID information and common name, the participant device generates a private key and a public key containing the common name of the participant device based on the common name.

[0040] Step 55: The participant device sends a CSR (Certificate Signing Request) message to the monitoring device. The CSR message carries the public key of the participant device.

[0041] Step 56: After receiving the CSR message, the monitoring device generates a CA certificate issued for the participant device. The CA certificate of the participant device carries the public key of the participant device.

[0042] Step 57: The monitoring device sends the CA certificate issued to the participating device.

[0043] After the monitoring device issues CA certificates to multiple participating devices respectively, when multiple participating devices need to perform multi-party secure computing through message interaction, they can first implement identity authentication based on their respective CA certificates. After the identity authentication is passed and it is confirmed that the other party has the legal identity granted by the monitoring device, the execution of the multi-party secure computing data service can be started, thereby ensuring the security of data interaction.

[0044] During the process of identity authentication and data service execution, there are querying devices and queried devices among the multiple participating devices. The identity authentication process is described in detail below. Figure 6 As shown, the following steps may be specifically included: Step 61: The querying device sends an access address acquisition request to the monitoring device. The access address acquisition request carries the ID information of the queried device.

[0045] Step 62: After receiving the access address acquisition request, the monitoring device sends an access address acquisition response to the querying device. The access address acquisition response carries the access address of the queried device.

[0046] In this step, the monitoring device can obtain the access address bound to the ID information carried in the access address acquisition request according to the bound ID information and access address, and generate an access address acquisition response carrying the access address.

[0047] In an embodiment of the present application, each participating device may also send an access address acquisition request to the monitoring device. After receiving the access address acquisition request, the monitoring device sends the ID information and corresponding access address of each participating device currently in a valid state in the multi-party secure computing system managed by the monitoring device to each participating device, for use by each participating device when it needs to communicate with other participating devices.

[0048] Step 63: The querying device sends a connection establishment request to the queried device based on the access address of the queried device.

[0049] The connection establishment request indicates that the querying device wishes to establish a network connection with the queried device so as to jointly perform data services of multi-party secure computing later.

[0050] Step 64: After receiving the connection establishment request, the queried device sends a first verification message to the querying device. The first verification message carries the CA certificate issued by the monitoring device to the queried device.

[0051] According to the above-mentioned process of issuing CA certificates, the CA certificate carries the public key of the queried device. The public key of the queried device contains the common name assigned by the monitoring device to the queried device, and the common name can indicate that the queried device is a device with a legal identity granted by the monitoring device.

[0052] For example, the common name may have the same base domain name as the common names of other party devices.

[0053] Step 65: The inquiring device extracts the common name of the queried device from the received CA certificate of the queried device.

[0054] Step 66: The querying device determines, based on the extracted common name of the queried device, whether the queried device is a participant device with a legal identity granted by the monitoring device.

[0055] In this step, it can be determined whether the basic domain name contained in the common name of the queried device is consistent with the basic domain name contained in the common name of the querying device; If they are consistent, it is determined that the queried device is a participant device that has been granted a legal identity by the monitoring device; If there is a mismatch, it is determined that the queried device is not a participant device with a legitimate identity granted by the monitoring device.

[0056] Step 67: The querying device sends a second verification message to the queried device. The second verification message carries the CA certificate issued by the monitoring device to the querying device.

[0057] According to the above process of issuing CA certificates, the CA certificate carries the public key of the querying device. The public key of the querying device contains the common name assigned to the querying device by the monitoring device, and the common name can indicate that the querying device is a device with a legal identity granted by the monitoring device.

[0058] For example, the common name may have the same base domain name as the common names of other party devices.

[0059] Step 68: The queried device extracts the common name of the querying device from the received CA certificate of the querying device.

[0060] Step 69: The queried device determines, based on the extracted common name of the inquiring device, whether the inquiring device is a participant device with a legal identity granted by the monitoring device.

[0061] In this step, it can be determined whether the basic domain name contained in the common name of the querying device extracted is consistent with the basic domain name contained in the common name of the queried device; If they are consistent, it is determined that the querying device is a participating device that has been granted a legal identity by the monitoring device; If there is a mismatch, it is determined that the querying device is not a participant device that has been granted a legitimate identity by the monitoring device.

[0062] Through the above Figure 6 The identity authentication method shown can start the data service of executing multi-party secure computing after the querying device and the queried device have passed mutual identity authentication. The specific data service execution process will not be described in detail here.

[0063] In the embodiment of the present application, on the participant device side, the step flow of the control plane and the data plane can be distinguished and executed by different entities, such as Figure 7 As shown, each participant device has an APP data service module and a DMZ (Demilitarized Zone) network access module. The above-mentioned identity authentication method and CA certificate issuance method can be completed by the DMZ network access module. After the identity authentication is passed, the APP data service module can execute the data service process of multi-party secure computing. Moreover, in the data service process, for the data interaction between multiple participant devices, the DMZ network access module implements forwarding according to the agreed communication protocol, thereby further ensuring the security of data interaction.

[0064] The CA certificate issuance method for multi-party secure computing and the identity authentication method provided in the embodiments of the present application address the deficiencies of security authentication at the network layer in the prior art, such as low efficiency and poor scalability. Application layer authentication based on CA is proposed. By moving the verification from the transport layer to the application layer, it has higher efficiency and is easier to expand, that is, it improves the scalability and maintainability of the multi-party secure computing system, and enables data to be securely transmitted over the Internet, thereby achieving rapid network opening. This method deeply recognizes the inevitability of cross-regional data transmission in multi-party secure computing, and provides an efficient and secure solution.

[0065] Moreover, compared with physical dedicated lines and virtual dedicated lines, the present application can realize data transmission via the Internet, overcome geographical area restrictions and line restrictions, improve the flexibility of the system, and adapt to the needs of more different geographical areas and network conditions.

[0066] In addition, by reducing the reliance on physical dedicated lines, this application can significantly reduce network construction and maintenance costs, especially for cross-regional and multi-institutional collaboration scenarios, where the cost advantage is even more obvious.

[0067] Based on the same inventive concept, according to the identity authentication method for multi-party secure computing provided in the above embodiment of the present application, accordingly, another embodiment of the present application also provides an identity authentication device for multi-party secure computing, which is applied to a participant device as a querying device in a multi-party secure computing system, wherein the multi-party secure computing system includes multiple participant devices and a monitoring device, and the multiple participant devices also include a queried device, and its structural diagram is shown as follows: Figure 8 As shown, specifically including: A message sending module 81 is used to send a connection establishment request to the queried device; A message receiving module 82, configured to receive a first verification message sent by the queried device after receiving the connection establishment request, wherein the first verification message carries a CA certificate issued by the monitoring device to the queried device; A name extraction module 83, configured to extract the common name of the queried device from the received CA certificate of the queried device; The identity verification module 84 is used to determine whether the queried party device is a participant device with a legal identity granted by the monitoring party device based on the extracted common name of the queried party device.

[0068] Furthermore, the message sending module 81 is also used to send a second verification message to the queried device, wherein the second verification message carries the CA certificate issued by the monitoring device to the querying device, so that the queried device extracts the common name of the querying device from the received CA certificate of the querying device, and based on the extracted common name of the querying device, determines whether the querying device is a participating device with a legal identity granted by the monitoring device.

[0069] Furthermore, the common names respectively allocated by the monitoring party device to the multiple participating party devices have the same basic domain name and different prefixes; The identity authentication module 84 is specifically used to determine whether the basic domain name contained in the common name of the queried device is consistent with the basic domain name contained in the common name of the querying device; If they are consistent, it is determined that the queried device is a participant device with a legal identity granted by the monitoring device; If there is no inconsistency, it is determined that the queried device is not a participant device with a legal identity granted by the monitoring device.

[0070] Further, the message sending module 81 is further configured to send an access address acquisition request to the monitoring device before sending the connection establishment request to the queried device, wherein the access address acquisition request carries the ID information of the queried device, and the ID information of the queried device is allocated by the monitoring device to the queried device; The message receiving module 82 is further configured to receive an access address acquisition response sent by the monitoring device after receiving the access address acquisition request, wherein the access address acquisition response carries the access address of the queried device; The message sending module 81 is specifically configured to send a connection establishment request to the queried device based on the access address of the queried device.

[0071] Based on the same inventive concept, according to the CA certificate issuance method for multi-party secure computing applied to a participant device provided in the above embodiment of the present application, accordingly, another embodiment of the present application also provides a CA certificate issuance device for multi-party secure computing, which is applied to a participant device in a multi-party secure computing system, wherein the multi-party secure computing system includes multiple participant devices and a monitoring device, and its structural diagram is as shown in FIG. Fig. 9 As shown, specifically including: The name receiving module 91 is used to receive the ID information and the common name assigned to the participant device and sent by the monitoring device based on the access address of the participant device, wherein the access address of the participant device is provided in advance by the participant device to the monitoring device, and the common names respectively assigned by the monitoring device to the plurality of participant devices have the same basic domain name and different prefixes; A key generation module 92, for generating a private key and a public key including the common name of the participant device based on the received common name; A CSR message sending module 93 is used to send a certificate signature application CSR message to the monitoring party device, wherein the CSR message carries the public key of the participant device, so that the monitoring party device generates a CA certificate issued for the participant device, wherein the CA certificate of the participant device carries the public key of the participant device; The certificate receiving module 94 is used to receive the CA certificate issued to the participant device and sent by the monitoring device.

[0072] Based on the same inventive concept, according to the CA certificate issuance method for multi-party secure computing applied to the monitoring party device provided in the above embodiment of the present application, accordingly, another embodiment of the present application also provides a CA certificate issuance device for multi-party secure computing, which is applied to the monitoring party device in the multi-party secure computing system, and the multi-party secure computing system also includes multiple participating party devices, and its structural schematic diagram is as shown in Fig.10As shown, specifically including: The name allocation module 1001 is used to allocate ID information and common names to the participating devices, wherein the common names allocated by the monitoring device to the multiple participating devices respectively have the same basic domain name and different prefixes; The name sending module 1002 is used to send the ID information and the common name assigned to the participant device to the participant device based on the access address pre-provided by the participant device, so that the participant device generates a private key and a public key containing the common name of the participant device based on the received common name; A CSR message receiving module 1003 is used to receive a certificate signature application CSR message sent by the participant device, wherein the CSR message carries the public key of the participant device; The certificate generation module 1004 is used to generate a CA certificate issued to the participant device, wherein the CA certificate of the participant device carries the public key of the participant device; The certificate sending module 1005 is used for the participant's device to send the CA certificate issued to it.

[0073] The functions of the above modules can correspond to Figure 1-Figure 3 , Figure 5-Figure 6 The corresponding processing steps in the shown process will not be repeated here.

[0074] The identity authentication device and CA certificate issuing device provided in the embodiments of the present application can be implemented by a computer program. Those skilled in the art should be able to understand that the above module division method is only one of many module division methods. If it is divided into other modules or not divided into modules, as long as the identity authentication device and CA certificate issuing device have the above functions, they should be within the protection scope of the present application.

[0075] The present application also provides an electronic device, such as Fig.11 As shown, it includes a processor 1101 and a machine-readable storage medium 1102, and the machine-readable storage medium 1102 stores machine-executable instructions that can be executed by the processor 1101, and the processor 1101 is prompted by the machine-executable instructions to: implement any of the above-mentioned identity authentication methods for multi-party secure computing, or, implement any of the above-mentioned CA certificate issuance methods for multi-party secure computing applied to participating party devices, or, implement any of the above-mentioned CA certificate issuance methods for multi-party secure computing applied to monitoring party devices.

[0076] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it implements any of the above-mentioned identity authentication methods for multi-party secure computing, or implements any of the above-mentioned CA certificate issuance methods for multi-party secure computing applied to a participating party device, or implements any of the above-mentioned CA certificate issuance methods for multi-party secure computing applied to a monitoring party device.

[0077] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the above-mentioned identity authentication methods for multi-party secure computing, or execute any of the above-mentioned CA certificate issuance methods for multi-party secure computing applied to a participating device, or execute any of the above-mentioned CA certificate issuance methods for multi-party secure computing applied to a monitoring device.

[0078] The machine-readable storage medium in the electronic device may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the processor.

[0079] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0080] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, computer-readable storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0081] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0082] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0083] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0084] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0085] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An identity authentication method for multi-party secure computing, characterized in that: A participant device used as a querying device in a multi-party secure computing system, the multi-party secure computing system comprising a plurality of participant devices and a monitoring device, the plurality of participant devices also comprising a queried device, the monitoring device pre-issues CA certificates for the plurality of participant devices respectively, the CA certificate of a participant device carries the public key of the participant device, the public key of the participant device contains a common name assigned to the participant device by the monitoring device, the method comprising: Sending a connection establishment request to the queried device; Receiving a first verification message sent by the queried device after receiving the connection establishment request, wherein the first verification message carries a CA certificate issued by the monitoring device to the queried device; Extracting the common name of the queried device from the received CA certificate of the queried device; Based on the extracted common name of the queried device, it is determined whether the queried device is a participant device to which the monitoring device has granted a legal identity.

2. The method according to claim 1, characterized in that Also includes: A second verification message is sent to the queried device, wherein the second verification message carries the CA certificate issued by the monitoring device to the inquiring device, so that the queried device extracts the common name of the inquiring device from the received CA certificate of the inquiring device, and based on the extracted common name of the inquiring device, determines whether the inquiring device is a participating device with a legal identity granted by the monitoring device.

3. The method according to claim 1, characterized in that The common names respectively allocated by the monitoring party device to the multiple participating party devices have the same basic domain name and different prefixes; The step of determining whether the queried device is a participant device with a legal identity granted by the monitoring device based on the extracted common name of the queried device comprises: Determine whether the basic domain name contained in the common name of the queried device is consistent with the basic domain name contained in the common name of the querying device; If they are consistent, it is determined that the queried device is a participant device with a legal identity granted by the monitoring device; If there is no inconsistency, it is determined that the queried device is not a participant device with a legal identity granted by the monitoring device.

4. The method according to claim 1, characterized in that Before sending the connection establishment request to the queried device, the method further includes: Sending an access address acquisition request to the monitoring device, wherein the access address acquisition request carries the ID information of the queried device, and the ID information of the queried device is allocated by the monitoring device to the queried device; Receiving an access address acquisition response sent by the monitoring device after receiving the access address acquisition request, wherein the access address acquisition response carries the access address of the queried device; The sending a connection establishment request to the queried device includes: Based on the access address of the queried device, a connection establishment request is sent to the queried device.

5. A CA certificate issuance method for multi-party secure computing, characterized in that: A participant device applied to a multi-party secure computing system, the multi-party secure computing system comprising a plurality of participant devices and a monitoring device, the method comprising: The participant device receives the ID information and the common name assigned to the participant device and sent by the monitoring device based on the access address of the participant device, where the access address of the participant device is provided in advance by the participant device to the monitoring device, and the common names respectively assigned to the plurality of participant devices by the monitoring device have the same basic domain name and different prefixes; Based on the received common name, generating a private key and a public key including the common name of the participant device; Sending a certificate signature request CSR message to the monitoring party device, wherein the CSR message carries the public key of the participant device, so that the monitoring party device generates a CA certificate issued for the participant device, wherein the CA certificate of the participant device carries the public key of the participant device; Receive the CA certificate issued for the participant device and sent by the monitoring party device.

6. A method for issuing CA certificates for multi-party secure computing, characterized in that: A monitoring device applied to a multi-party secure computing system, wherein the multi-party secure computing system further comprises a plurality of participating devices, and the method comprises: Allocating ID information and common names to the participating devices, wherein the common names respectively allocated by the monitoring device to the plurality of participating devices have the same basic domain name and different prefixes; Based on the access address pre-provided by the participant device, send the participant device ID information and the common name assigned to the participant device, so that the participant device generates a private key and a public key including the common name of the participant device based on the received common name; Receive a certificate signing application (CSR) message sent by the participant's device, wherein the CSR message carries the public key of the participant's device; Generate a CA certificate issued for the participant's device, where the CA certificate of the participant's device carries the public key of the participant's device; The CA certificate issued to the participant device is sent.

7. An identity authentication device for multi-party secure computing, characterized in that: A participant device used as a querying device in a multi-party secure computing system, the multi-party secure computing system comprising a plurality of participant devices and a monitoring device, the plurality of participant devices also comprising a queried device, the apparatus comprising: A message sending module, used for sending a connection establishment request to the queried party device; A message receiving module, configured to receive a first verification message sent by the queried device after receiving the connection establishment request, wherein the first verification message carries a CA certificate issued by the monitoring device to the queried device; A name extraction module, used to extract the common name of the queried party device from the received CA certificate of the queried party device; The identity authentication module is used to determine whether the queried party device is a participant device with a legal identity granted by the monitoring party device based on the extracted common name of the queried party device.

8. A CA certificate issuing device for multi-party secure computing, characterized in that: A participant device applied to a multi-party secure computing system, the multi-party secure computing system comprising a plurality of participant devices and a monitoring device, the apparatus comprising: a name receiving module, configured to receive the ID information and the common name assigned to the participant device and sent by the monitoring device based on the access address of the participant device, wherein the access address of the participant device is provided in advance by the participant device to the monitoring device, and the common names respectively assigned by the monitoring device to the plurality of participant devices have the same basic domain name and different prefixes; A key generation module, configured to generate a private key and a public key including the common name of the participant device based on the received common name; A CSR message sending module is used to send a certificate signature application CSR message to the monitoring party device, wherein the CSR message carries the public key of the participating party device, so that the monitoring party device generates a CA certificate issued for the participating party device, wherein the CA certificate of the participating party device carries the public key of the participating party device; The certificate receiving module is used to receive the CA certificate issued to the participating party device and sent by the monitoring party device.

9. A CA certificate issuing device for multi-party secure computing, characterized in that: A monitoring device applied to a multi-party secure computing system, wherein the multi-party secure computing system further includes a plurality of participating devices, and the apparatus includes: A name allocation module, used to allocate ID information and common names to the participating devices, wherein the common names allocated by the monitoring device to the multiple participating devices respectively have the same basic domain name and different prefixes; a name sending module, configured to send the ID information and the common name assigned to the participant device to the participant device based on the access address pre-provided by the participant device, so that the participant device generates a private key and a public key containing the common name of the participant device based on the received common name; A CSR message receiving module, used to receive a certificate signature application CSR message sent by the participant device, wherein the CSR message carries the public key of the participant device; A certificate generation module, used to generate a CA certificate issued to the participant device, wherein the CA certificate of the participant device carries the public key of the participant device; The certificate sending module is used for the participant device to send the CA certificate issued to it.

10. An electronic device, characterized in that: The method comprises a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to: implement any of the methods described in claims 1-4, or implement the method described in claim 5, or implement the method described in claim 6.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements any one of the methods of claims 1 to 4, or implements the method of claim 5, or implements the method of claim 6.

Images