Key negotiation method, device, electronic device and storage medium

Abstract

The present invention discloses a key negotiation method, device, electronic device and storage medium, and relates to the field of cryptographic security technology. The method includes: through a client, using a KGC master public key and a client identifier, verifying a client encryption public-private key pair, after the client encryption public-private key pair is verified, through a server, based on a client random number, a client identifier, a client encryption public key, a server random number, a server identifier, a server encryption public-private key pair and a KGC master public key, calculating a first session key; through a client, based on a server random number, a server identifier, a server encryption public key, a client random number, a client identifier, a client encryption public-private key pair and a KGC master public key, calculating a second session key, so that the client and the server perform data encryption transmission based on the first session key and the second session key. The technical solution of the embodiment of the present invention does not require the use of digital certificates, and is suitable for large, complex, and widely distributed scenarios with many users.

Description

Technical Field

[0001] The present invention relates to the field of cryptographic security technology, and in particular to a key negotiation method, device, electronic device and storage medium. Background Art

[0002] The key point of TLCP (Transport Layer Cryptography Protocol) technology lies in two-way identity authentication and key negotiation. In the traditional TLCP connection process, when the client and the server need to establish a secure connection, the client needs to first obtain the authentication certificate for identity authentication and the encryption certificate for key exchange provided by the server.

[0003] However, the use of digital certificates for information encryption and decryption and identity authentication is inefficient and requires large storage space. It also uses complex bilinear pairing operations, which are complex to operate and the deployment, management, and use processes are cumbersome. It is not suitable for large, complex, and widely distributed application scenarios with a large number of users. Summary of the invention

[0004] The present invention provides a key negotiation method, device, electronic device and storage medium. In the TLCP connection process, there is no need to use digital certificates, which improves the key negotiation efficiency, reduces the storage volume, simplifies the calculation process, is easy to deploy, simple to manage and easy to use. It is particularly suitable for large and complex application scenarios with a large number of users and wide distribution, and is suitable for large-scale application scenarios where clients and servers are connected.

[0005] According to one aspect of the present invention, a key negotiation method is provided, the method comprising:

[0006] Receive the client random number and client ID through the server, obtain the server random number, server ID, server encryption public and private key pair and KGC master public key, and feedback the server random number, server ID and KGC master public key to the client;

[0007] Receiving, through the client, the server random number, the server identifier and the KGC master public key fed back by the server, obtaining a client encryption public-private key pair, verifying the client encryption public-private key pair using the KGC master public key and the client identifier, and feeding back a client verification result to the server after the client encryption public-private key pair passes the verification;

[0008] The server receives the verification result of the client and sends the server encryption public key to the client;

[0009] Receiving the server encryption public key through the client, and sending the client encryption public key to the server;

[0010] Calculate, by the server, a first session key for establishing a session between the server and the client based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair, and the KGC master public key;

[0011] Through the client, based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair and the KGC master public key, a second session key for establishing a session between the client and the server is calculated, so that the client and the server perform data encryption data transmission based on the first session key and the second session key.

[0012] According to another aspect of the present invention, a key negotiation device is provided, the system comprising: a client and a server;

[0013] The server is used to receive the client random number and client identifier, obtain the server random number, server identifier, server encryption public and private key pair and KGC master public key, and feedback the server random number, server identifier and KGC master public key to the client;

[0014] The client is used to receive the server random number, the server identifier and the KGC master public key fed back by the server, obtain the client encryption public-private key pair, use the KGC master public key and the client identifier to verify the client encryption public-private key pair, and after the client encryption public-private key pair is verified, feed back a client verification result to the server;

[0015] The server is used to receive the verification result of the client and send the server encryption public key to the client;

[0016] The client is used to receive the server encryption public key and send the client encryption public key to the server;

[0017] The server is configured to calculate a first session key for establishing a session between the server and the client based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair, and the KGC master public key;

[0018] The client is used to calculate the second session key for establishing a session between the client and the server based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair and the KGC master public key, so that the client and the server perform data encryption data transmission based on the first session key and the second session key.

[0019] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0020] at least one processor; and

[0021] a memory communicatively connected to the at least one processor; wherein,

[0022] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the key negotiation method described in any embodiment of the present invention.

[0023] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the key negotiation method described in any embodiment of the present invention when executed.

[0024] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the key negotiation method according to any embodiment of the present invention is implemented.

[0025] The technical solution of the embodiment of the present invention is to receive the client random number and client identification through the server, obtain the server random number, server identification, server encryption public-private key pair and KGC master public key, and feedback the server random number, server identification and KGC master public key to the client; receive the server random number, server identification and KGC master public key fed back by the server through the client, obtain the client encryption public-private key pair, use the KGC master public key and client identification to verify the client encryption public-private key pair, and after the client encryption public-private key pair is verified, feedback the client verification result to the server; receive the client verification result through the server, and send the server encryption public key to the client; receive the server encryption public key through the client, and send the client encryption public key to the server; based on the client random number, client identification, client The first session key for establishing a session between the server and the client is calculated based on the server random number, server identification, server encryption public key, client random number, client identification, client encryption public-private key pair and KGC master public key; through the client, the second session key for establishing a session between the client and the server is calculated based on the server random number, server identification, server encryption public key, client random number, client identification, client encryption public-private key pair and KGC master public key, so that the client and the server can perform data encryption and data transmission based on the first session key and the second session key. In the TLCP establishment process, there is no need to use digital certificates, which improves the efficiency of key negotiation, reduces the storage amount, simplifies the calculation process, is easy to deploy, simple to manage and easy to use, and is particularly suitable for large-scale and complex application scenarios with a large number of users and wide distribution, and is suitable for large-scale application scenarios where clients and servers are established.

[0026] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 is a flowchart of a key negotiation method provided according to Embodiment 1 of the present invention;

[0029] Figure 2 is a flowchart of a key negotiation method provided according to Embodiment 2 of the present invention;

[0030] Figure 3is a flowchart of a key negotiation method provided according to Embodiment 2 of the present invention;

[0031] Figure 4 This is a schematic diagram of the structure of a key negotiation device provided according to Embodiment 3 of the present invention;

[0032] Figure 5 It is a structural schematic diagram of an electronic device for implementing the key negotiation method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] Embodiment 1

[0036] Figure 1 A flowchart of a key negotiation method provided in Embodiment 1 of the present invention. The embodiment of the present invention is applicable to the case where TLCP key negotiation is performed without a certificate. The method can be executed by a key negotiation system. The key negotiation system can be implemented in the form of hardware and / or software. The key negotiation system can be configured in an electronic device that carries a key negotiation function.

[0037] See also Figure 1 The key negotiation method shown includes:

[0038] S101. Receive the client random number and client identifier through the server, obtain the server random number, server identifier, server encryption public-private key pair and KGC master public key, and feedback the server random number, server identifier and KGC master public key to the client.

[0039] The server can be used to encrypt data transmission with the client. KGC (Key Generation Center) can be configured in the server. The server can perform pre-key negotiation with KGC, and then perform key negotiation with the client, thereby generating a key for the session between the server and the client. KGC can be used to generate and distribute keys. The server random number can be generated by the random number generator of the server. In a single key negotiation process, the server random number can be generated once. The randomness and security of the key generated by the server can be improved by the server random number. The server identifier can be used to uniquely identify the server. This facilitates the client to determine the identity of the server when encrypted data is transmitted between the server and the client. Exemplarily, the server identifier can be a server ID (Identification). The server encryption public-private key pair can be used to encrypt data transmitted by the server. The server encryption public-private key pair can be generated by pre-negotiation between the server and KGC. The KGC master public key can be generated by KGC for key negotiation between the server and the client. The client can be used to negotiate keys with the server and to transmit encrypted data with the server. The client random number can be generated by the client's random number generator. In a single key negotiation process, the client random number can be generated once. The client random number can improve the randomness and security of the key generated by the client. The client identifier can be used to uniquely identify the client. This facilitates the server to determine the identity of the client when encrypted data is transmitted between the client and the server. Exemplarily, the client identifier can be a client ID.

[0040] Specifically, through the client, a client random number is generated using the client random number generator. Through the client, the client identifier of the client can be obtained. Through the client, the client random number and the client identifier can be sent to the server. Through the server, the client random number and the client identifier can be received, and the server random number, the server identifier, the server encryption public-private key pair generated by the server generator of the server, and the KGC master public key generated by the server and KGC can be obtained. Through the server, the server random number, the server identifier and the KGC master public key can be fed back to the client.

[0041] Optionally, when the client sends the client random number and client identifier to the server, the client encryption suite and client handshake information can be sent to the server. When the server feeds back the server random number, server identifier and KGC master public key to the client, the server encryption suite and server handshake end information can be sent to the client. In this way, the selection of encryption suites between the client and the server and the handshake between the client and the server are realized.

[0042] S102. Receive the server random number, server identifier and KGC master public key fed back by the server through the client, obtain the client encryption public-private key pair, use the KGC master public key and client identifier to verify the client encryption public-private key pair, and after the client encryption public-private key pair is verified, feed back the client verification result to the server.

[0043] The client encryption public-private key pair can be used to encrypt data transmitted by the client. The client encryption public-private key pair can be generated by pre-negotiation between the client and KGC. The client verification result can be the result of the client passing the identity authentication of the server. It can be understood that the client verifies the client encryption public-private key pair through the KGC master public key and the client identifier, which is actually the authentication of the server configured with KGC using the KGC master public key.

[0044] Specifically, through the client, the server random number, server identifier and KGC master public key fed back by the server can be received, and the client encryption public-private key pair pre-generated by the client and KGC can be obtained. The KGC master public key and the client identifier can be used to generate a reference encryption public-private key pair. A consistency comparison can be performed between the reference encryption public-private key pair and the client encryption public-private key pair generated by the client. When the reference encryption public-private key pair and the client encryption public-private key pair are consistent, the client encryption public-private key pair verification passes. When the reference encryption public-private key pair and the client encryption public-private key pair are inconsistent, the client encryption public-private key pair verification fails. After the client encryption public-private key pair verification passes, the client verification result can be fed back to the server.

[0045] In an optional embodiment of the present invention, a server random number, a server identifier, and a KGC master public key fed back by the server are received through the client, and a client encryption public-private key pair is obtained. The KGC master public key and the client identifier are used to verify the client encryption public-private key pair, including: receiving the server random number, the server identifier, and the KGC master public key fed back by the server through the client, and obtaining the client encryption public-private key pair; obtaining a client fixed value, a first finite field element, a second finite field element, a first elliptic curve point coordinate, and a second elliptic curve point coordinate through the client, and splicing the client fixed value, the client identifier, the first finite field element, the second finite field element, the first elliptic curve point coordinate, the second elliptic curve point coordinate, and the coordinates of the KGC master public key to obtain a first client splicing result; performing hash calculation on the first client splicing result through the client to obtain a client hash value; performing bitwise calculation on the coordinates of the client encryption public key through the client. The method comprises the following steps: converting the first coordinate bit string and the second coordinate bit string to obtain the first coordinate bit string and the second coordinate bit string; obtaining the first constant value and the first modulus of the client through the client, and concatenating the first coordinate bit string, the second coordinate bit string, the client hash value, the first constant value of the client and the first modulus to obtain the second client concatenation result; performing hash calculation and modulus calculation on the second client concatenation result to obtain the first client multiple; performing the first client multiple point operation on the KGC master public key through the client, and summing the result with the client encryption public key to obtain the actual client public key; performing the client encryption private key multiple point operation on the elliptic curve point through the client to obtain the first verification key; performing consistency detection on the actual client public key and the first verification key through the client, and when the actual client public key and the first verification key are consistent, determining that the client encryption public-private key pair verification has passed; when the actual client public key and the first verification key are inconsistent, determining that the client encryption public-private key pair verification has failed.

[0046] The client fixed value may be a fixed value of the client. The client fixed values ​​between different clients may be the same or different. The first finite field element and the second finite field element are both elements in the finite field, and may be used to define an elliptic curve on the finite field. The first elliptic curve point coordinates and the second elliptic curve point coordinates may be the x, y coordinates of the elliptic curve point G. Among them, the elliptic curve point G is a base point of the elliptic curve, and its order is a prime number. The first client splicing result may be a direct splicing result of the client fixed value, the client identifier, the first finite field element, the second finite field element, the first elliptic curve point coordinates, the second elliptic curve point coordinates and the coordinates of the KGC master public key. The first client splicing result may be used to characterize the splicing result between the client secret parameter and the KGC secret parameter. The client hash value may be a hash calculation result of the first client splicing result. The first coordinate bit string and the second coordinate bit string may be the bit string conversion result of the coordinates of the client encryption public key. The first client fixed value may be used to perform the first client multiple calculation. The first modulus may be used to perform the first client multiple calculation. Exemplarily, the second client splicing result may be a direct splicing result between the first coordinate bit string, the second coordinate bit string, the first fixed value of the client, and the first multiple of the client. The first multiple of the client may be used to calculate the actual public key of the client. The actual public key of the client may be the actual public key of the client. The actual public key of the client may be calculated by the client encryption public key, the first multiple of the client, and the KGC master public key. The first verification key may be used to verify the consistency of the client encryption public key pair.

[0047] Exemplarily, the following formula may be used to calculate the client hash value:

[0048] ;

[0049] In the formula, H A is the client hash value; ENTL A Fixed value for the client; ID A is the client identifier; a is the first finite field element; b is the second finite field element; x G is the coordinate of the first elliptic curve point; y G is the coordinate of the first elliptic curve point; x pub and pub The coordinates of the KGC master public key.

[0050] The following formula can be used to calculate the client's first multiple:

[0051] ;

[0052] In the formula, The first multiple of the client; x WA1 is the first coordinate bit string; y WA1is the second coordinate bit string; H A is the client hash value; K A1 is the first fixed value of the client; j1 is the first modulus.

[0053] The following formula can be used to calculate the actual client public key:

[0054] ;

[0055] Where P A is the actual public key of the client; W A1 Encrypt the public key for the client; The first multiple of the client; P pub It is the KGC master public key.

[0056] The following formula can be used to calculate the first verification public key:

[0057] ;

[0058] In the formula, is the first verification public key; d A1 Encrypt the private key for the client; G is a base point of the elliptic curve, and its order is a prime number.

[0059] The following formula can be used to indicate that the client encryption public and private key pair verification has passed:

[0060] ;

[0061] Where P A The actual public key of the client; is the first verification public key.

[0062] This solution simplifies the complex calculation process, adopts simple multiple point operations and point addition operations, has a simple calculation method, and can improve the calculation efficiency of key negotiation.

[0063] S103: Receive the verification result from the client through the server, and send the server encryption public key to the client.

[0064] The server encryption public-private key pair may include a server encryption public key and a server encryption private key. The server encryption public-private key pair may be pre-generated and stored on the server. The server encryption public key is used to generate a second session key for establishing a session between the client and the server.

[0065] Optionally, when the server receives the verification result from the client and sends the server encryption public key to the client, it can send a server handshake completion message to the client. The server handshake completion message is used to indicate that the handshake between the server and the client has been completed. Exemplarily, the server handshake completion message can be "SERVER HELLOFINISHED!"

[0066] S104. Receive the server-side encrypted public key through the client, and send the client-side encrypted public key to the server.

[0067] The client encryption public-private key pair may include a client encryption public key and a client encryption private key. The client encryption public-private key pair may be pre-generated and stored on the client. The client encryption public key may be used to generate a first session key for establishing a session between the server and the client.

[0068] Optionally, when the client receives the client encryption public key and sends the client encryption public key to the server, the client handshake completion message may be sent to the server. The client handshake completion message is used to indicate that the handshake between the client and the server is completed. Exemplarily, the client handshake completion message may be "CLIENT HELLO FINISHED!"

[0069] S105. The server calculates the first session key for establishing a session between the server and the client based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair and the KGC master public key.

[0070] The first session key can be used to encrypt and decrypt the encrypted transmission data of the server.

[0071] Specifically, through the server, obtain the client according to the client random number, calculate the client elliptic curve point corresponding to the client random number; calculate the server elliptic curve point corresponding to the server random number according to the server random number; take out the server domain element from the server elliptic curve point, convert the data type of the server domain element to an integer, and calculate the server first parameter; perform a modulo n operation on the server encryption private key, the server first parameter and the server random number to obtain the first server partial private key; verify whether the client elliptic curve point satisfies the elliptic curve equation, if not, the negotiation fails; if so, the client elliptic curve point is obtained from the client elliptic curve equation. Take out the client domain element from the point, convert the data type of the client domain element into an integer using the same calculation method as the server-side elliptic curve point, and calculate the first parameter of the client; obtain the client fixed value, the first finite field element, the second finite field element, the first elliptic curve point coordinates and the second elliptic curve point coordinates; concatenate the client fixed value, the client identifier, the first finite field element, the second finite field element, the first elliptic curve point coordinates, the second elliptic curve point coordinates and the coordinates of the KGC master public key to obtain the first client concatenation result; perform a hash operation on the first client concatenation result to obtain the client hash value; The data type of the coordinates of the client encryption public key is converted to a bit string to obtain a first coordinate bit string and a second coordinate bit string; the first coordinate bit string, the second coordinate bit string and the client hash value are concatenated to obtain a second client concatenation result; the second client concatenation result is hashed and modulo-n operated to obtain a first client multiple, and the data type of the first client multiple is converted to an integer; the KGC master public key is subjected to a client first multiple point operation, and is summed with the client encryption public key to obtain the client actual public key; the server random number, the server domain element and the server encryption private key are subjected to a modulo-n operation to obtain The second server partial private key; perform a client domain element multiplication operation on the client's actual public key to obtain the client's first multiplication point; perform an addition operation on the client's first multiplication point and the client's elliptic curve point to obtain the client's second multiplication point; perform a multiplication operation on the client's second multiplication point and the second server partial private key to obtain the client's third multiplication point; concatenate the client's fixed value client third multiplication point, the client identifier, the server identifier, the client domain element and the server domain element to obtain a first dual-end concatenation result; perform a hash operation on the first dual-end concatenation result to obtain a first session key for establishing a session between the server and the client.

[0072] Exemplarily, the following formula may be used to calculate the client elliptic curve point corresponding to the client random number:

[0073] ;

[0074] In the formula, R A is the client elliptic curve point; r Ais a random number of the client; G is a base point of the elliptic curve, whose order is a prime number; x1 and y1 are elements of the client domain.

[0075] The following formula can be used to calculate the server-side elliptic curve point corresponding to the server-side random number:

[0076] ;

[0077] In the formula, R B is the server elliptic curve point; r B is a random number on the server side; G is a base point of the elliptic curve, whose order is a prime number; x2 and y2 are domain elements on the server side.

[0078] The following formula can be used to calculate the first parameter of the server:

[0079] ;

[0080] In the formula, is the first parameter of the server; w is the random exponent, w=128; x2 is the server domain element.

[0081] The following formula can be used to calculate the first server's partial private key:

[0082] ;

[0083] Where, t B Partial private key of the first server; d B1 Encrypt the private key for the server; The first parameter of the server; r B is the random number on the server; mod n is the modulus n operation, for example, 23 mod 7=2.

[0084] The following formula can be used to calculate the first parameter of the client:

[0085] ;

[0086] In the formula, is the first parameter of the client; w is the random index, w=128; x1 is the client domain element.

[0087] The client hash value can be calculated using the following formula:

[0088] ;

[0089] In the formula, H A is the client hash value; ENTL A Fixed value for the client; ID A is the client identifier; a is the first finite field element; b is the second finite field element; xG is the coordinate of the first elliptic curve point; y G is the coordinate of the second elliptic curve point; x pub and pub The coordinates of the KGC master public key.

[0090] The following formula can be used to calculate the client's first multiple:

[0091] ;

[0092] In the formula, The first multiple of the client; x WA1 is the first coordinate bit string; y WA1 is the second coordinate bit string; H A is the client hash value; mod n is the modulus n operation, for example, 23 mod 7=2.

[0093] The following formula can be used to calculate the actual client public key:

[0094] ;

[0095] Where P A is the actual public key of the client; W A1 Encrypt the public key for the client; The first multiple of the client; P pub It is the KGC master public key.

[0096] The following formula can be used to calculate the second server's partial private key:

[0097] ;

[0098] In the formula, u B Partial private key of the second server; B is the random number of the server; d B1 is the server encryption private key; x2 is the server domain element; mod n is the modulus n operation, for example, 23 mod 7=2.

[0099] The following formula can be used to calculate the client's first multiple point:

[0100] ;

[0101] In the formula, Q A1 is the first point of the client; x1 is the client domain element; P A The actual public key of the client.

[0102] The following formula can be used to calculate the client's second multiple points:

[0103] ;

[0104] In the formula, Q A2 Second times for the client; Q A1 The first multiple of the client; R A The client elliptic curve point.

[0105] The following formula can be used to calculate the client's third point:

[0106] ;

[0107] In the formula, Q A3 The third point of the client; u B Partial private key of the second server; Q A2 Second times points for the client.

[0108] The following formula can be used to calculate the first session key for establishing a session between the server and the client:

[0109] ;

[0110] In the formula, k B The first session key for establishing a session between the server and the client; ENTL A It is a fixed value for the client; Q A3 The third point of the client; ID A Client ID B is the server identifier; x1 is the client domain element; x2 is the server domain element.

[0111] Optionally, after the server calculates the first session key for establishing a session between the server and the client based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair, and the KGC master public key, the server may send a server encryption notification message to the client to allow the client to determine that the server can perform encrypted data transmission. Exemplarily, the client encryption notification message may be "SERVER YES".

[0112] S106. Calculate, through the client, the second session key for establishing a session between the client and the server based on the server random number, server identifier, server encryption public key, client random number, client identifier, client encryption public-private key pair and KGC master public key, so that the client and the server perform data encryption data transmission based on the first session key and the second session key.

[0113] The second session key can be used to encrypt and decrypt the encrypted transmission data of the client.

[0114] Specifically, through the client, obtain the server-side elliptic curve point corresponding to the server-side random number according to the server-side random number; calculate the client-side elliptic curve point corresponding to the client-side random number according to the client-side random number; take out the client domain element from the client-side elliptic curve point, convert the data type of the client domain element to an integer, and calculate the client's first parameter; perform a modulo-n operation on the client encryption private key, the client's first parameter, and the client's random number to obtain the first client partial private key; verify whether the server-side elliptic curve point satisfies the elliptic curve equation. If not, the negotiation fails; if so, the server-side elliptic curve point is obtained. The server-side domain element is taken out from the point, and the data type of the server-side domain element is converted into an integer using the same calculation method as the client-side elliptic curve point, and the first parameter of the server is calculated; the server-side fixed value, the first finite field element, the second finite field element, the first elliptic curve point coordinates and the second elliptic curve point coordinates are obtained; the server-side fixed value, the server-side identifier, the first finite field element, the second finite field element, the first elliptic curve point coordinates, the second elliptic curve point coordinates and the coordinates of the KGC master public key are spliced ​​to obtain the first server-side splicing result; the first server-side splicing result is hashed to obtain the server-side hash value; The data type of the coordinates of the server-side encrypted public key is converted to a bit string to obtain a third coordinate bit string and a fourth coordinate bit string; the third coordinate bit string, the fourth coordinate bit string and the server-side hash value are concatenated to obtain a second server-side concatenation result; the second server-side concatenation result is hashed and modulo-n operated to obtain the server-side first multiple, and the data type of the server-side first multiple is converted to an integer; the server-side first multiple point operation is performed on the KGC master public key, and the sum is obtained with the server-side encrypted public key to obtain the server-side actual public key; the server-side random number, the client domain element and the client-side encrypted private key are operated modulo-n to obtain The second client partial private key; perform a server domain element multiplication operation on the server actual public key to obtain the server first multiplication point; perform an addition operation on the server first multiplication point and the server elliptic curve point to obtain the server second multiplication point; perform a multiplication operation on the server second multiplication point and the second server partial private key to obtain the server third multiplication point; concatenate the server fixed value, the server third multiplication point, the server identifier, the client identifier, the server domain element and the client domain element to obtain a second dual-end concatenation result; perform a hash operation on the second dual-end concatenation result to obtain a second session key for establishing a session between the client and the server.

[0115] Exemplarily, the following formula may be used to calculate the server-side elliptic curve point corresponding to the server-side random number:

[0116] ;

[0117] In the formula, R B is the server elliptic curve point; r Bis a random number on the server side; G is a base point of the elliptic curve, whose order is a prime number; x2 and y2 are domain elements on the server side.

[0118] The following formula can be used to calculate the client elliptic curve point corresponding to the client random number:

[0119] ;

[0120] In the formula, R A is the client elliptic curve point; r A is a random number of the client; G is a base point of the elliptic curve, whose order is a prime number; x1 and y1 are elements of the client domain.

[0121] The following formula can be used to calculate the first parameter of the client:

[0122] ;

[0123] In the formula, is the first parameter of the client; w is the random index, w=128; x1 is the client domain element.

[0124] The following formula can be used to calculate the first client partial private key:

[0125] ;

[0126] Where, t A The first client's partial private key; d A1 Encrypt private key for the client; The first parameter of the client; r A is the client random number; mod n is the modulus n operation, for example, 23 mod 7=2.

[0127] The following formula can be used to calculate the first parameter of the server:

[0128] ;

[0129] In the formula, is the first parameter of the server; w is the random exponent, w=128; x2 is the server domain element.

[0130] The server hash value can be calculated using the following formula:

[0131] ;

[0132] In the formula, H B is the server hash value; ENTL B Fixed value for the server; ID B is the server identifier; a is the first finite field element; b is the second finite field element; xG is the coordinate of the first elliptic curve point; y G is the coordinate of the second elliptic curve point; x pub and pub The coordinates of the KGC master public key.

[0133] The following formula can be used to calculate the first multiple of the server:

[0134] ;

[0135] In the formula, The first multiple of the server; x WB1 is the third coordinate bit string; y WB1 is the fourth coordinate bit string; H B is the server hash value; mod n is the modulus n operation, for example, 23 mod 7=2.

[0136] The following formula can be used to calculate the actual public key of the server:

[0137] ;

[0138] Where P B is the actual public key of the server; W B1 Encrypt the public key for the server; The first multiple of the server; P pub It is the KGC master public key.

[0139] The following formula can be used to calculate the second client's partial private key:

[0140] ;

[0141] In the formula, u A Partial private key of the second client; A is the client random number; d A1 The encrypted private key for the client; x1 is the client domain element; mod n is the modulo n operation, for example, 23 mod 7=2.

[0142] The following formula can be used to calculate the first multiple of the server:

[0143] ;

[0144] In the formula, Q B1 is the first multiple point of the server; x1 is the domain element of the server; P B The actual public key of the server.

[0145] The following formula can be used to calculate the second multiple of the server point:

[0146] ;

[0147] In the formula, Q B2 The second point for the server; Q B1 The first point of the server; R B is the server elliptic curve point.

[0148] The following formula can be used to calculate the server's third point:

[0149] ;

[0150] In the formula, Q B3 The third point of the server; u A Q is the private key of the second client; B2 The second point for the server.

[0151] The following formula can be used to calculate the second session key for establishing a session between the client and the server:

[0152] ;

[0153] In the formula, k A The second session key for establishing a session between the client and the server; ENTL B It is a fixed value on the server side; Q B3 The third point of the server; ID A Client ID B is the server identifier; x1 is the client domain element; x2 is the server domain element.

[0154] Optionally, after calculating the second session key for establishing a session between the client and the server through the client based on the server random number, server identifier, server encryption public key, client random number, client identifier, client encryption public-private key pair and KGC master public key, the client can transmit client encryption notification information to the server through the client to make the server determine that the client can perform encrypted data transmission. Exemplarily, the server encryption notification information can be "CLIENT YES".

[0155] The technical solution of the embodiment of the present invention is to receive the client random number and client identification through the server, obtain the server random number, server identification, server encryption public-private key pair and KGC master public key, and feedback the server random number, server identification and KGC master public key to the client; receive the server random number, server identification and KGC master public key fed back by the server through the client, obtain the client encryption public-private key pair, use the KGC master public key and client identification to verify the client encryption public-private key pair, and after the client encryption public-private key pair is verified, feedback the client verification result to the server; receive the client verification result through the server, and send the server encryption public key to the client; receive the server encryption public key through the client, and send the client encryption public key to the server; based on the client random number, client identification, client The first session key for establishing a session between the server and the client is calculated based on the server random number, server identification, server encryption public key, client random number, client identification, client encryption public-private key pair and KGC master public key; through the client, the second session key for establishing a session between the client and the server is calculated based on the server random number, server identification, server encryption public key, client random number, client identification, client encryption public-private key pair and KGC master public key, so that the client and the server can perform data encryption and data transmission based on the first session key and the second session key. In the TLCP establishment process, there is no need to use digital certificates, which improves the efficiency of key negotiation, reduces the storage amount, simplifies the calculation process, is easy to deploy, simple to manage and easy to use, and is particularly suitable for large-scale and complex application scenarios with a large number of users and wide distribution, and is suitable for large-scale application scenarios where clients and servers are established.

[0156] In an optional embodiment of the present invention, after calculating the second session key for establishing a session between the client and the server based on the server random number, server identifier, server encryption public key, client random number, client identifier, client encryption public-private key pair and KGC master public key through the client, it also includes: through the client, feeding back a first encrypted notification message to the server, receiving a second encrypted notification message fed back by the server, obtaining information to be transmitted, and using the second session key to symmetrically encrypt the information to be transmitted to obtain ciphertext data to be transmitted, and sending it to the server; through the server, receiving the ciphertext data to be transmitted, using the first session key to decrypt the ciphertext data to be transmitted, and obtaining the information to be transmitted.

[0157] The first encryption notification information can be used to indicate that the client has completed key negotiation and notifies the server that data encryption transmission can be performed. The second encryption notification information can be used to indicate that the server has completed key negotiation and notifies the client that data encryption transmission can be performed. The first encryption notification information and the second encryption notification information have the same function, but the data sending end and the data receiving end are different. The information to be transmitted can be information transmitted from the client to the server. The ciphertext data to be transmitted can be the encryption result of the information to be transmitted.

[0158] Specifically, through the client, after calculating the second session key for establishing a session between the client and the server based on the server random number, server identifier, server encryption public key, client random number, client identifier, client encryption public-private key pair and KGC master public key, the client then feeds back the first encrypted notification information to the server, receives the second encrypted notification information fed back by the server, obtains the information to be transmitted from the client to the server, and uses the second session key and the corresponding first symmetric encryption algorithm to symmetrically encrypt the information to be transmitted to obtain the ciphertext data to be transmitted, and sends the ciphertext data to be transmitted to the server. Through the server, the ciphertext data to be transmitted is received, and the first session key and the corresponding first symmetric encryption algorithm are used to decrypt the ciphertext data to be transmitted to obtain the information to be transmitted. Exemplarily, the first symmetric encryption algorithm can be ECB (Electronic Codebook Mode).

[0159] This solution calculates the second session key for establishing a session between the client and the server through the client based on the server random number, server identifier, server encryption public key, client random number, client identifier, client encryption public-private key pair and KGC master public key, and then feeds back a first encrypted notification message to the server, receives the second encrypted notification message fed back by the server, obtains the information to be transmitted, and uses the second session key to symmetrically encrypt the information to be transmitted to obtain the ciphertext data to be transmitted, and sends it to the server, receives the ciphertext data to be transmitted through the server, uses the first session key to decrypt the ciphertext data to be transmitted, and obtains the information to be transmitted, thereby realizing encrypted data transmission between the client and the server and improving the data encryption transmission efficiency between the client and the server.

[0160] Optionally, a process similar to the above method can be used to transmit the data to be transmitted on the server to the client, thereby realizing encrypted data transmission between the server and the client, which can improve the efficiency of encrypted data transmission between the server and the client.

[0161] In an optional embodiment of the present invention, after calculating the first session key for establishing a session between the server and the client based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair and the KGC master public key through the server, the method includes: splitting the first session key to obtain a first actual session key and a first HMAC value; after calculating the second session key for establishing a session between the client and the server based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair and the KGC master public key through the client, the method includes: splitting the second session key to obtain a second actual session key and a second HMAC value; using the second session key to symmetrically encrypt the information to be transmitted to obtain the ciphertext data to be transmitted, and sending it to the server, the method includes: using The second actual session key is used to symmetrically encrypt the information to be transmitted to obtain the ciphertext data to be transmitted; the second HMAC value is used to symmetrically encrypt the ciphertext data to be transmitted to obtain the HMAC value of the ciphertext to be transmitted; the ciphertext data to be transmitted and the HMAC value of the ciphertext to be transmitted are combined to obtain the combined data to be transmitted, and sent to the server; the first session key is used to decrypt the ciphertext data to be transmitted to obtain the information to be transmitted, including: the first HMAC value is used to symmetrically encrypt the ciphertext data to be transmitted contained in the combined data to be transmitted to obtain a reference ciphertext HMAC value; a consistency check is performed on the reference ciphertext HMAC value and the ciphertext HMAC value to be transmitted contained in the combined data to be transmitted; when the reference ciphertext HMAC value and the ciphertext HMAC value to be transmitted are consistent, the first actual session key is used to decrypt the ciphertext data to be transmitted contained in the combined data to be transmitted to obtain the information to be transmitted.

[0162] The first actual session key can be used to decrypt the ciphertext data to be transmitted by the server, or to symmetrically encrypt the information to be transmitted by the client. The first HMAC can be used to re-encrypt the ciphertext data to be transmitted by the client, or to re-encrypt the ciphertext data to be transmitted by the server, so as to verify the integrity of the data transmitted by the server. The second actual session key can be used to decrypt the ciphertext data to be transmitted by the client, or to symmetrically encrypt the information to be transmitted by the server. The second HMAC value can be used to re-encrypt the ciphertext data to be transmitted by the server, or to re-encrypt the ciphertext data to be transmitted by the client, so as to verify the integrity of the data transmitted by the client. The reference ciphertext HMAC value can be the encryption result of the ciphertext data to be transmitted transmitted by the client. The reference ciphertext HMAC value can be used to verify the integrity of the encrypted data transmitted by the client.

[0163] Specifically, after the first session key for establishing a session between the server and the client is calculated through the server based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair and the KGC master public key, the first session key can be split according to a preset number of bits, such as 32 bits, to obtain a first actual session key with a front preset number of bits and a first HMAC value with a rear preset number of bits. Optionally, the preset number of bits of the first actual session key may be different from the preset number of bits of the first HMAC value. After the second session key for establishing a session between the client and the server is calculated through the client based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair and the KGC master public key, the second session key may be split according to the preset number of bits to obtain a second actual session key and a second HMAC value. Optionally, the preset number of bits of the second actual session key may be different from the preset number of bits of the second HMAC value. However, the preset number of digits of the first actual session key is the same as the preset number of digits of the second actual session key; and the preset number of digits of the first HMAC value is the same as the preset number of digits of the second HMAC value; the second actual session key and the corresponding first symmetric encryption algorithm are used to symmetrically encrypt the information to be transmitted to obtain the ciphertext data to be transmitted; the second HMAC value and the corresponding second symmetric encryption algorithm are used to symmetrically encrypt the ciphertext data to be transmitted to obtain the ciphertext HMAC value to be transmitted. The ciphertext data to be transmitted and the ciphertext HMAC value to be transmitted are directly combined to obtain the combined data to be transmitted, and sent to the server. Through the server, the first HMAC value and the corresponding second symmetric encryption algorithm are used to symmetrically encrypt the ciphertext data to be transmitted contained in the combined data to be transmitted to obtain the reference ciphertext HMAC value. The reference ciphertext HMAC value and the ciphertext HMAC value to be transmitted contained in the combined data to be transmitted are checked for consistency. When the reference ciphertext HMAC value and the ciphertext HMAC value to be transmitted are consistent, the first actual session key is used to decrypt the ciphertext data to be transmitted contained in the combined data to be transmitted to obtain the information to be transmitted. Exemplarily, the second symmetric encryption algorithm may be CBC (Cipher Block Chaining Mode).

[0164] This solution introduces a process of splitting the first session key and the second session key, as well as a secondary encryption process for the ciphertext data to be transmitted, thereby realizing integrity verification of the ciphertext data to be transmitted between the client and the server, and further improving the security and accuracy of encrypted data transmission between the client and the server.

[0165] Embodiment 2

[0166] Figure 2A flowchart of a key negotiation method provided for the second embodiment of the present invention. Based on the above embodiments, the present embodiment of the present invention further adds "before receiving the server random number, server identification and KGC master public key fed back by the server through the client, obtaining the client encryption public-private key pair, and using the KGC master public key and the client identification to verify the client encryption public-private key pair" and "before receiving the server random number, server identification and KGC master public key fed back by the server through the client, obtaining the client encryption public-private key pair, and using the KGC master public key and the client identification to verify the client encryption public-private key pair" and "before receiving the server random number, server identification and KGC master public key fed back by the server through the client, obtaining the client encryption public-private key pair, and using the KGC master public key and the client identification to verify the client encryption public-private key pair" and "after receiving the client encryption public-private key pair through the client, obtaining the client declaration public key and the client signature public-private key pair, and using the KGC master public key and the client identification to verify the client signature public-private key pair" and "after receiving the client encryption public-private key pair through the client, obtaining the client declaration public key and the client signature public-private key pair, and using the KGC master public key and the client identification to verify the client signature public-private key pair" and " The key pair is verified; through the client, after the client signature public-private key pair is verified, the server signature value is verified using the server-declared public key, the client random number and the client identifier; through the client, after the server signature value is verified, the server random number and the server identifier are signed using the client signature private key to obtain the client signature value, and the client signature value is sent to the server; through the server, the client signature value is received, and the client signature value is verified using the client-declared public key, the server random number and the server identifier. "After the client encryption public-private key pair is verified, the client verification result is fed back to the server" is concretized as "after the client signature value is verified, the client verification result is fed back to the server". On the basis of verifying the client encryption public-private key pair, a verification process for the client signature public-private key pair, the server signature value and the client signature value is introduced, which further improves the security of identity authentication between the client and the server, thereby improving the security of key negotiation between the client and the server. It should be noted that for the parts not described in detail in the embodiments of the present invention, reference can be made to the description of other embodiments.

[0167] See also Figure 2 The key negotiation method shown includes:

[0168] S201. Receive the client random number and client identifier through the server, obtain the server random number, server identifier, server encryption public-private key pair and KGC master public key, and feedback the server random number, server identifier and KGC master public key to the client.

[0169] In an optional embodiment of the present invention, before receiving the client random number and the client identifier through the server, obtaining the server random number, the server identifier, the server encryption public-private key pair and the KGC master public key, and feeding back the server random number, the server identifier and the KGC master public key to the client, it also includes: obtaining the server random number, the server identifier, the server declared public key, the server signature private key and the KGC master public key through the server; and calculating the server encryption public-private key pair and the server signature public-private key pair based on the server random number, the server identifier, the server declared public key, the server signature private key and the KGC master public key through the server.

[0170] The server encryption public-private key pair can be used to encrypt and decrypt data on the server. The server signature public-private key pair can be used to sign and verify data on the server.

[0171] Specifically, through the server, obtain the server identification, the server random number generated by the server random number generator, and the pre-generated server declaration public key, server signature private key and KGC master public key; perform point doubling operation on the server random number and elliptic curve point to obtain the server partial public key; obtain the server fixed value, the first finite field element, the second finite field element, the first elliptic curve point coordinates, the second elliptic curve point coordinates, and splice the server fixed value, the server identification, the first finite field element, the second finite field element, the first elliptic curve point coordinates, the second elliptic curve point coordinates and the coordinates of the KGC master public key to obtain the first server splicing result; perform hash operation on the first server splicing result Calculate to obtain the server hash value; obtain the first KGC random number and the second KGC random number, perform a doubling operation on the first KGC random number and the elliptic curve point, and sum them with the server's partial public key to obtain the server encryption public key; perform a doubling operation on the second KGC random number and the elliptic curve point, and sum them with the server's partial public key to obtain the server signature public key; convert the data type of the coordinate of the server's declared public key into a bit string to obtain the seventh coordinate bit string and the eighth coordinate bit string; concatenate the seventh coordinate bit string, the eighth coordinate bit string, the server hash value, the server's first fixed value and the modulus 1 to obtain the third server concatenation result; perform a hash calculation and Modulo n operation is performed to obtain the second multiple of the server, and the data type of the second multiple of the server is converted to an integer; the seventh coordinate bit string, the eighth coordinate bit string, the server hash value, the second fixed value of the server and the modulus 2 are concatenated to obtain the fourth server concatenation result; hash calculation and modulo n operation are performed on the fourth server concatenation result to obtain the third multiple of the server, and the data type of the third multiple of the server is converted to an integer; the KGC master private key is obtained, the second multiple of the server and the KGC master private key are multiplied, and the sum is obtained with the first KGC random number, and the above sum is performed modulo n operation to obtain the server partial encryption private key; the third multiple of the server and the KGC master private key are multiplied, and the sum is obtained with the second KGC random number, and the above sum is performed modulo n operation to obtain the server partial encryption private key; The server side partial encryption private key and the server side random number are summed modulo n to obtain the server side encryption private key; the server side partial signature private key and the server side random number are summed modulo n to obtain the server side signature private key; the server side partial signature private key and the server side random number are summed modulo n to obtain the server side signature private key; it is detected whether the server side encryption private key or the server side signature private key is 0; if so, it returns to execute the steps of obtaining the server side identifier, the server side random number generated by the server side random number generator, and the pre-generated server side declaration public key, server side signature private key and KGC master public key through the server side; if not, the server side encryption public-private key pair and the server side signature public-private key pair are output.

[0172] Exemplarily, the following formula may be used to calculate the server-side partial public key:

[0173] ;

[0174] Where U B Part of the public key of the server; r B is a random number on the server; G is a base point of the elliptic curve, and its order is a prime number.

[0175] The server hash value can be calculated using the following formula:

[0176] ;

[0177] In the formula, H B is the server hash value; ENTL B Fixed value for the server; ID B is the server identifier; a is the first finite field element; b is the second finite field element; x G is the coordinate of the first elliptic curve point; y G is the coordinate of the second elliptic curve point; x pub and pub The coordinates of the KGC master public key.

[0178] The following formula can be used to calculate the server encryption public key:

[0179] ;

[0180] Where W B1 is the server encryption public key; w1 is the first KGC random number, generated by the KGC random number generator, ; G is a base point of the elliptic curve, and its order is a prime number; U B This is the server's partial public key.

[0181] The following formula can be used to calculate the server signature public key:

[0182] ;

[0183] Where W B2 is the server signature public key; w2 is the second KGC random number, generated by the KGC random number generator, ; G is a base point of the elliptic curve, and its order is a prime number; U B This is the server's partial public key.

[0184] The following formula can be used to calculate the second multiple of the server:

[0185] ;

[0186] In the formula, The second multiple of the server; x WBCis the seventh coordinate bit string; y WBC is the eighth coordinate bit string; H B K is the server hash value; B1 is the first fixed value of the server; 1 is the modulus; mod n is the modulus n operation, for example, 23 mod 7=2.

[0187] The following formula can be used to calculate the server's third multiple:

[0188] ;

[0189] In the formula, The third multiple of the server; x WBC is the seventh coordinate bit string; y WBC is the eighth coordinate bit string; H B K is the server hash value; B1 is the first fixed value of the server; 2 is the modulus; mod n is the modulo n operation, for example, 23 mod 7=2.

[0190] The following formula can be used to calculate the server-side partial encryption private key:

[0191] ;

[0192] Where, t B1 is the server-side partial encryption private key; w1 is the first KGC random number, generated by the KGC random number generator, ; is the second multiple of the server; ms is the KGC master private key; mod n is the modulus n operation, for example, 23 mod7=2.

[0193] The following formula can be used to calculate the server-side partial signature private key:

[0194] ;

[0195] Where, t B2 is the server-side partial signature private key; w2 is the second KGC random number, generated by the KGC random number generator. ; is the third multiple of the server; ms is the KGC master private key; mod n is the modulus n operation, for example, 23 mod7=2.

[0196] The following formula can be used to calculate the server encryption private key:

[0197] ;

[0198] Where, d B1 Encrypt the private key for the server; B1 Encrypt the private key for the server part;B A random number on the server.

[0199] The following formula can be used to calculate the server signature private key:

[0200] ;

[0201] Where, d B2 Signature private key for the server; B2 Partial signature private key for the server; B A random number on the server.

[0202] The following formula can be used to represent the server-side encryption public and private key pair:

[0203] ;

[0204] Where, d B1 Encrypt the private key for the server; W B1 Encrypt the public key for the server.

[0205] The following formula can be used to represent the server-side signature public and private key pair:

[0206] ;

[0207] Where, d B2 W is the server signature private key; B2 Signature public key for the server.

[0208] This solution performs key negotiation in advance between the server and the KGC configured on the server to generate a server-side encryption public-private key pair and a server-side signature public-private key pair. On the one hand, the KGC negotiation process can be used to improve the security of the server-side encryption public-private key pair and the server-side signature public-private key pair. On the other hand, by pre-generating the server-side encryption public-private key pair and the server-side signature public-private key pair, the efficiency and accuracy of identity authentication and key negotiation using the server-side encryption public-private key pair and the server-side signature public-private key pair can be improved.

[0209] S202. Obtain the server declaration public key and the server signature private key through the server.

[0210] The server-side declared public key can be used to verify the server-side signature value. The server-side signature private key can be used to sign and verify the signature on the server. The server-side declared public key and the server-side signature private key can be pre-generated and stored on the server.

[0211] Specifically, the server declaration public key and the server signature private key stored in the local device can be obtained through the server.

[0212] S203: The server uses the server random number, the server declared public key and the server signature private key to sign the client random number and the client identifier, obtain the server signature value, and send the server signature value to the client.

[0213] The server signature value can be used to verify the legitimacy of the server. The server signature value contains both client information (i.e., client random number and client identifier) ​​and server key (i.e., server signature private key).

[0214] Specifically, the server performs a hash calculation on the server random number and the server declared public key to obtain the server second parameter; performs a doubling operation on the server second parameter and the elliptic curve point to obtain the server actual public key; performs a hash calculation and a modulus operation on the server actual public key to obtain the first server signature value; performs a hash calculation on the client random number, the client identifier and the first server signature value to obtain the server third parameter. The second server signature value can be calculated based on the server second parameter, the server third parameter and the server signature private key; the server signature value can be generated based on the first server signature value and the second server signature value, and the server signature value is sent to the client.

[0215] Exemplarily, the following formula may be used to calculate the second parameter of the server:

[0216] ;

[0217] In the formula, k B The second parameter of the server; r B is a random number on the server side, generated by the random number generator on the server side. ; K BC Declare the public key for the server.

[0218] The following formula can be used to calculate the actual public key of the server:

[0219] ;

[0220] Where P B is the actual public key of the server; k B is the second parameter of the server; G is a base point of the elliptic curve, and its order is a prime number.

[0221] The following formula can be used to calculate the first server signature value:

[0222] ;

[0223] In the formula, q B is the signature value of the first server; P B is the actual public key of the server; m is the exponent, m=32~256.

[0224] The following formula can be used to calculate the third parameter of the server:

[0225] ;

[0226] In the formula, c B The third parameter of the server; q B The signature value of the first server; message A Includes client random number and client identifier.

[0227] The following formula can be used to calculate the second server signature value:

[0228] ;

[0229] In the formula, s B k is the signature value of the second server; B The second parameter of the server; c B The third parameter of the server; d B2 Signature private key for the server.

[0230] The following formula can be used to represent the server signature value:

[0231] ;

[0232] In the formula, E B is the signature value of the server; q B is the signature value of the first server; B The signature value of the second server.

[0233] S204. Receive the server random number, server identifier and KGC master public key fed back by the server through the client, obtain the client encryption public-private key pair, and verify the client encryption public-private key pair using the KGC master public key and client identifier.

[0234] S205. After the client's encrypted public-private key pair is verified, the client's declared public key and the client's signature public-private key pair are obtained, and the client's signature public-private key pair is verified using the KGC master public key and the client's identifier.

[0235] Specifically, through the client, after the client encryption public-private key pair is verified, obtain the client declaration public key and the client signature public-private key pair, receive the server random number, server identifier and KGC master public key fed back by the server, and obtain the client signature public-private key pair; through the client, obtain the client fixed value, the first finite field element, the second finite field element, the first elliptic curve point coordinates and the second elliptic curve point coordinates; splice the client fixed value, the client identifier, the first finite field element, the second finite field element, the first elliptic curve point coordinates, the second elliptic curve point coordinates and the coordinates of the KGC master public key to obtain the first client splicing result; perform hash operation on the first client splicing result to obtain the client hash value; perform bit string conversion on the coordinates of the client signature public key to obtain the fifth coordinate bit string and the sixth coordinate bit string; obtain the client The second fixed value and the second modulus are used to concatenate the fifth coordinate bit string, the sixth coordinate bit string, the client hash value, the client second fixed value and the second modulus to obtain a third client concatenation result; the third client concatenation result is subjected to hash calculation and modulo n operation to obtain the client second multiple, and the data type of the client first multiple is converted to an integer; the KGC master public key is subjected to the client second multiple point operation, and is summed with the client signature public key to obtain the client actual public key; the elliptic curve point is subjected to the client signature private key multiple point operation to obtain the second verification public key; the client actual public key and the second verification key are subjected to consistency detection, and when the client actual public key and the second verification key are consistent, it is determined that the client signature public-private key pair verification has passed; when the client actual public key and the second verification key are inconsistent, it is determined that the client signature public-private key pair verification has failed.

[0236] Exemplarily, the following formula may be used to calculate the client hash value:

[0237] ;

[0238] In the formula, H A is the client hash value; ENTL A Fixed value for the client; ID A is the client identifier; a is the first finite field element; b is the second finite field element; x G is the coordinate of the first elliptic curve point; y G is the coordinate of the second elliptic curve point; x pub and pub The coordinates of the KGC master public key.

[0239] The following formula can be used to calculate the client's second multiple:

[0240] ;

[0241] In the formula, The second multiple of the client; xWA2 is the fifth coordinate bit string; y WA2 is the sixth coordinate bit string; H A is the client hash value; K A2 is the second fixed value of the client; j is the second modulus.

[0242] The following formula can be used to calculate the actual client public key:

[0243] ;

[0244] Where P A is the actual public key of the client; W A2 Sign the public key for the client; The second multiple of the client; P pub It is the KGC master public key.

[0245] The second verification public key can be calculated using the following formula:

[0246] ;

[0247] In the formula, is the second verification public key; d A2 is the client signature private key; G is a base point of the elliptic curve, and its order is a prime number.

[0248] The following formula can be used to indicate that the client signature public and private key pair verification has passed:

[0249] ;

[0250] Where P A The actual public key of the client; is the second verification public key.

[0251] S206. After the client's signature public and private key pair is verified, the server's signature value is verified using the server's declared public key, the client's random number, and the client's identifier.

[0252] Specifically, through the client, the first server signature value, the client identifier and the client random number can be hashed to obtain the server third parameter; the second server signature value and the elliptic curve point can be multiplied, the server third parameter and the client actual public key can be multiplied, and the above multiplication results are summed to obtain the server reference key; the server reference key can be hashed and modulo operated to obtain the first verification signature value; the first server signature value and the first verification signature value are compared for consistency, and when the first server signature value is consistent with the first verification signature value, the server signature value verification passes; when the first server signature value and the first verification signature value are inconsistent, the server signature value verification fails.

[0253] Exemplarily, a hash calculation may be performed on the first server signature value, the client identifier, and the client random number in the server signature value to calculate the server third parameter:

[0254] ;

[0255] In the formula, c B The third parameter of the server; q B The first server signature value received by the client; message A Includes client random number and client identifier.

[0256] The server reference key can be calculated using the following formula:

[0257] ;

[0258] In the formula, Q B is the reference key of the server; B is the signature value of the second server; G is a base point of the elliptic curve, and its order is a prime number; c B The third parameter of the server received by the client; P A The actual public key of the client.

[0259] The following formula can be used to calculate the first verification signature value:

[0260] ;

[0261] In the formula, is the first verification signature value; Q B is the server reference key; m is the exponent, m=32~256.

[0262] The following formula can be used to indicate that the server signature value has passed verification:

[0263] ;

[0264] In the formula, q B The signature value of the first server; is the first verification signature value.

[0265] S207. After the signature value of the server is verified, the client uses the client signature private key to sign the server random number and the server identifier to obtain the client signature value, and sends the client signature value to the server.

[0266] The client signature value can be used to verify the legitimacy of the client. The client signature value contains both the server information (i.e. the server random number and the server identifier) ​​and the client key (i.e. the client signature private key).

[0267] Specifically, the client performs a hash calculation on the client random number and the client declared public key to obtain the client second parameter; performs a doubling operation on the client second parameter and the elliptic curve point to obtain the client actual public key; performs a hash calculation and a modulus operation on the client actual public key to obtain the first client signature value; performs a hash calculation on the server random number, the server identifier and the first client signature value to obtain the client third parameter. The second client signature value can be calculated based on the client second parameter, the client third parameter and the client signature private key; the client signature value can be generated based on the first client signature value and the second client signature value, and the client signature value is sent to the server.

[0268] Exemplarily, the following formula may be used to calculate the second client parameter:

[0269] ;

[0270] In the formula, k A The second parameter of the client; r A is a client random number, generated by the client random number generator. ; K AC Assert the public key for the client.

[0271] The following formula can be used to calculate the actual client public key:

[0272] ;

[0273] Where P A is the actual public key of the client; k A is the second parameter of the client; G is a base point of the elliptic curve, and its order is a prime number.

[0274] The following formula can be used to calculate the first client signature value:

[0275] ;

[0276] In the formula, q A is the first client signature value; P A is the actual public key of the client; m is the exponent, m=32~256.

[0277] The following formula can be used to calculate the third parameter of the client:

[0278] ;

[0279] In the formula, c A The third parameter of the client; q A The signature value of the first client; message B Includes the server random number and server identifier.

[0280] The second client signature value can be calculated using the following formula:

[0281] ;

[0282] In the formula, s A k is the second client signature value; A The second parameter of the client; c A The third parameter of the client; d A2 Signing private key for the client.

[0283] The following formula can be used to represent the client signature value:

[0284] ;

[0285] In the formula, E A The client signature value; q A is the first client signature value; B The signature value for the second client.

[0286] S208. Receive the client signature value through the server, and verify the client signature value using the client declared public key, the server random number and the server identifier.

[0287] Specifically, through the server, the first client signature value, the server identifier and the server random number can be hashed to obtain the client third parameter; the second client signature value and the elliptic curve point can be multiplied, the client third parameter and the server actual public key can be multiplied, and the above multiplication results are summed to obtain the client reference key; the client reference key can be hashed and modulo operated to obtain a second verification signature value; the first client signature value and the second verification signature value are compared for consistency, and when the first client signature value is consistent with the second verification signature value, the client signature value verification passes; when the first client signature value is inconsistent with the second verification signature value, the client signature value verification fails.

[0288] Exemplarily, a hash calculation may be performed on the first client signature value, the server identifier, and the server random number in the client signature value to calculate the client third parameter:

[0289] ;

[0290] In the formula, c AThe third parameter of the client; q A The first client signature value received by the server; message B Includes the server random number and server identifier.

[0291] The client reference key can be calculated using the following formula:

[0292] ;

[0293] In the formula, Q A Reference key for the client; A is the second client signature value; G is a base point of the elliptic curve, and its order is a prime number; c A The third parameter of the client received by the server; P B The actual public key of the server.

[0294] The second verification signature value can be calculated using the following formula:

[0295] ;

[0296] In the formula, is the second verification signature value; Q A is the client reference key; m is the exponent, m=32~256.

[0297] The following formula can be used to indicate that the client signature value has passed verification:

[0298] ;

[0299] In the formula, q A is the first client signature value; It is the second verification signature value.

[0300] S209: After the client signature value is verified, the client verification result is fed back to the server.

[0301] S210. Receive the verification result from the client through the server, and send the server encryption public key to the client.

[0302] S211. Receive the server-side encrypted public key through the client, and send the client-side encrypted public key to the server.

[0303] S212. The server calculates the first session key for establishing a session between the server and the client based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair, and the KGC master public key.

[0304] S213. Calculate, through the client, the second session key for establishing a session between the client and the server based on the server random number, server identifier, server encryption public key, client random number, client identifier, client encryption public-private key pair and KGC master public key, so that the client and the server perform data encryption data transmission based on the first session key and the second session key.

[0305] The technical solution of the embodiment of the present invention is as follows: the server random number, server identification and KGC master public key fed back by the server are received through the client to obtain the client encryption public-private key pair, and the KGC master public key and client identification are used to verify the client encryption public-private key pair, and then the server declaration public key and the server signature private key are obtained through the server; the server random number, server declaration public key and server signature private key are used to sign the client random number and the client identification through the server to obtain the server signature value, and the server signature value is sent to the client, and the server random number, server identification and KGC master public key fed back by the server are received through the client to obtain the client encryption public-private key pair, and the KGC master public key and client identification are used to verify the client encryption public-private key pair, and then after the client encryption public-private key pair is verified, the client declaration public key and the client signature public-private key pair are obtained through the client, and the KGC master public key and the client signature public-private key pair are used to verify the client encryption public-private key pair. Identification, verify the client signature public-private key pair; through the client, after the client signature public-private key pair is verified, the server signature value is verified using the server-declared public key, the client random number and the client identifier; through the client, after the server signature value is verified, the server random number and the server identifier are signed using the client signature private key to obtain the client signature value, and the client signature value is sent to the server; through the server, the client signature value is received, and the client signature value is verified using the client-declared public key, the server random number and the server identifier. After the client signature value is verified, the client verification result is fed back to the server. On the basis of verifying the client encrypted public-private key pair, a verification process for the client signature public-private key pair, the server signature value and the client signature value is introduced, which further improves the security of identity authentication between the client and the server, thereby improving the security of key negotiation between the client and the server.

[0306] Figure 3 FIG. 1 is a flow chart of a key negotiation method. Based on the above embodiment, Figure 3 This is a preferred embodiment of the present invention. Figure 3 The key negotiation method shown includes:

[0307] S301. When the client needs to send a TCLP protocol connection message to the server, the client sends a client handshake message including a client random number, a client identifier, and a client encryption suite supported by the client to the server, thereby performing a handshake with the server.

[0308] S302. Through the server, after receiving the client handshake information sent by the client, the server obtains the server random number, server identifier, server encryption suite supported by the server, server declaration public key, server signature private key and KGC master public key, and sends the server response information and server handshake end information to the client.

[0309] The server response information includes the server random number, server identification, server encryption suites supported by the server, server declaration public key and KGC master public key, and server signature value. Specifically, the server signature value is obtained by signing the client random number and client identification with the service signature private key, and then handshaking with the client.

[0310] S303: After receiving the server response information and the server handshake completion information, the client sends a client handshake completion message to the server.

[0311] S304. Obtain the client encryption public-private key pair and the client signature public-private key pair through the client, and verify the client encryption public-private key pair using the KGC master public key and the client identifier.

[0312] S305: After the client's encrypted public-private key pair is verified, the client's signature public-private key pair is verified using the KGC master public key and the client's identifier.

[0313] S306. After the client's signature public and private key pair is verified, the server's signature value is verified using the server's declared public key, the client's random number, and the client's identifier.

[0314] S307: After the signature value of the server is verified, the client uses the client signature private key to sign the server random number and the server identifier to obtain the client signature value, and sends the client signature value to the server.

[0315] S308. Receive the client signature value through the server, and verify the client signature value using the client declared public key, the server random number and the server identifier.

[0316] S309: After the signature value of the client is verified, the server sends the server encrypted public key and the server handshake completion information to the client.

[0317] S310. After receiving the server encryption public key and the server handshake completion information sent by the server, the client sends the client encryption public key and the client handshake completion information to the server.

[0318] S311. Through the server, based on the client random number, client identifier, client encryption public key, server random number, server identifier, server encryption public-private key pair and KGC master public key, calculate the first session key, the first actual session key and the first HMAC value for establishing a session between the server and the client, and send client encryption notification information to the client.

[0319] Specifically, the first session key is split to obtain a first actual session key and a first HMAC value.

[0320] S312. Through the client, based on the server random number, server identifier, server encryption public key, client random number, client identifier, client encryption public-private key pair and KGC master public key, calculate the second session key, second actual session key and second HMAC value for session establishment between the client and the server, and send server encryption notification information to the server.

[0321] Specifically, the second session key is split to obtain a second actual session key and a second HMAC value.

[0322] S313. After receiving the server-side encrypted notification information in response from the server, the client uses the second actual session key to symmetrically encrypt the information to be transmitted to obtain the ciphertext data to be transmitted.

[0323] S314. Using the second HMAC value, the client performs symmetrical encryption on the ciphertext data to be transmitted, and obtains the HMAC value of the ciphertext data to be transmitted.

[0324] S315. The client combines the ciphertext data to be transmitted and the HMAC value of the ciphertext to be transmitted to obtain the combined data to be transmitted, and sends the combined data to the server.

[0325] S316. Through the server, the first HMAC value is used to symmetrically encrypt the ciphertext data to be transmitted contained in the combined data to be transmitted, and obtain a reference ciphertext HMAC value.

[0326] S317: Through the server, a consistency check is performed on the reference ciphertext HMAC value and the ciphertext HMAC value to be transmitted contained in the combined data to be transmitted.

[0327] S318. Through the server, when the HMAC value of the reference ciphertext is consistent with the HMAC value of the ciphertext to be transmitted, the first actual session key is used to decrypt the ciphertext data to be transmitted contained in the combined data to be transmitted, so as to obtain the information to be transmitted.

[0328] This scheme is a certificateless public key cryptographic system that does not use bilinear pairing operations, does not use digital certificates for information encryption and decryption and signature verification operations, and requires a small amount of storage. Among them, the server configured with KGC needs to save the server encryption private key, the server signature private key and the KGC master public key. Every time a client key is generated, the server needs to save the client identifier, the client declaration public key and the client signature public key. The storage required for a single client does not exceed 128 bytes. The storage overhead of the server configured with KGC is very small; and the client only needs to save system parameters, client private key, client public key and partial public key, and the client key storage is open The pin is also very small; in addition, this scheme does not use complex bilinear pairing operations, but only requires a small amount of multiple point operations and point addition operations, which has high computational efficiency. Compared with multiple point operations, the workload of point addition operations can be ignored. The computational efficiency of this scheme is obvious, and the overall efficiency has reached a new height; and the client cryptographic device only needs to support the ordinary elliptic curve cryptographic algorithm, and can use the existing chip. The client does not need to use a digital certificate, which is easy to deploy, simple to manage and convenient to use. It is particularly suitable for large-scale and complex application scenarios with a large number of users and wide distribution, and is suitable for large-scale application scenarios where the client and the server are connected. Specifically, compared with the traditional TLCP protocol connection process, it has the following advantages: (1) No digital certificate is required, and the client public key is self-certified. It can be understood that in the process of calculating the actual public key of the client through the client identifier and the client public key identifier, the authentication of the client public key is implicit, which is equivalent to realizing the function of the digital certificate, but it is simple and convenient in use, reduces the computational burden, and can also ensure the security of encrypted data transmission. (2) The client key can be revoked and regenerated. This can be understood as a major weakness of the IBC public key cryptography system is that the user key cannot be revoked. Once the user key is lost, it will fall into a very difficult dilemma. In the public key cryptography system of this scheme, a client can have multiple pairs of keys. The client key can be revoked and regenerated. Based on the correspondence of the client identifier, multiple client keys can be associated and identified, which effectively overcomes the shortcomings of the IBC public key cryptography system. (3) High computational efficiency. This can be understood as the bilinear pairing operation on the elliptic curve has very strict requirements on the selection of the curve. Usually, non-singular elliptic curves or some special constant curves are used. In addition, the bilinear pairing operation is quite complex and inefficient. According to calculations, this scheme can achieve bilinear pairing operations with the same security as elliptic curve cryptography, but the computational efficiency is 8-20 times lower than that of ordinary elliptic curve cryptography. The public key cryptography system of this scheme does not use bilinear pairing operations, which has an advantage in computational efficiency. (4) Small resource usage. This means that this solution does not use digital certificates, and the system does not need to store and transmit digital certificates. It occupies less storage resources and network bandwidth, which gives it a clear advantage in terms of resource usage.(5) Existing public key cryptographic algorithm chips can be used. This means that the scheme can use existing public key cryptographic algorithms and their parameters, fully utilize the advantages of public key cryptography, and directly use public key cryptographic algorithm chips, which is convenient for system implementation and easy to implement and promote. (6) It has a key revocation function. This means that in the certificateless system of the PKI system, the client's key pair generally has no validity period, so the old client key pair can still be used by attackers, which poses a security risk. However, the client key generation algorithm of this scheme adds a secret value parameter (i.e., the secret parameters of the server and client configured with KGC), so it has key revocation and update functions, and therefore has strong security.

[0329] Embodiment 3

[0330] Figure 4 A schematic diagram of the structure of a key negotiation system provided in Embodiment 3 of the present invention. The embodiment of the present invention is applicable to the case where TLCP key negotiation is performed without a certificate, the system can execute a key negotiation method, the system can be implemented in the form of hardware and / or software, and the system can be configured in an electronic device that carries a key negotiation function.

[0331] See also Figure 4The key agreement system shown includes: a client 401 and a server 402; the server 402 is used to receive a client random number and a client identifier, obtain a server random number, a server identifier, a server encrypted public-private key pair and a KGC master public key, and feed back the server random number, the server identifier and the KGC master public key to the client; the client 401 is used to receive the server random number, the server identifier and the KGC master public key fed back by the server, obtain the client encrypted public-private key pair, use the KGC master public key and the client identifier to verify the client encrypted public-private key pair, and after the client encrypted public-private key pair is verified, feed back the client verification result to the server; the server 402 is used to receive the client verification result and send the server encrypted public key to the client; the client 401 is used to receive the server encryption public key and send the client encryption public key to the server; the server 402 is used to calculate the first session key for establishing a session between the server and the client based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair and the KGC master public key; the client 401 is used to calculate the second session key for establishing a session between the client and the server based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair and the KGC master public key, so that the client and the server perform data encryption data transmission based on the first session key and the second session key.

[0332] The technical solution of the embodiment of the present invention is to receive the client random number and client identification through the server, obtain the server random number, server identification, server encryption public-private key pair and KGC master public key, and feedback the server random number, server identification and KGC master public key to the client; receive the server random number, server identification and KGC master public key fed back by the server through the client, obtain the client encryption public-private key pair, use the KGC master public key and client identification to verify the client encryption public-private key pair, and after the client encryption public-private key pair is verified, feedback the client verification result to the server; receive the client verification result through the server, and send the server encryption public key to the client; receive the server encryption public key through the client, and send the client encryption public key to the server; based on the client random number, client identification, client The first session key for establishing a session between the server and the client is calculated based on the server random number, server identification, server encryption public key, client random number, client identification, client encryption public-private key pair and KGC master public key; through the client, the second session key for establishing a session between the client and the server is calculated based on the server random number, server identification, server encryption public key, client random number, client identification, client encryption public-private key pair and KGC master public key, so that the client and the server can perform data encryption and data transmission based on the first session key and the second session key. In the TLCP establishment process, there is no need to use digital certificates, which improves the efficiency of key negotiation, reduces the storage amount, simplifies the calculation process, is easy to deploy, simple to manage and easy to use, and is particularly suitable for large-scale and complex application scenarios with a large number of users and wide distribution, and is suitable for large-scale application scenarios where clients and servers are established.

[0333] In an optional embodiment of the present invention, the server 402 includes: the server 402 is used to obtain the client encryption public-private key pair after receiving the server random number, the server identifier and the KGC master public key fed back by the server, and obtain the server declaration public key and the server signature private key before using the KGC master public key and the client identifier to verify the client encryption public-private key pair; the server 402 is used to use the server random number, the server declaration public key and the server signature private key to sign the client random number and the client identifier to obtain the server signature value, and send the server signature value to the client; the client 401 includes: the client 401 is used to obtain the client encryption public-private key pair after receiving the server random number, the server identifier and the KGC master public key fed back by the server, and use the KGC master public key and the client identifier to verify the client encryption public-private key pair Afterwards, after the client encryption public-private key pair is verified, the client declaration public key and the client signature public-private key pair are obtained, and the client signature public-private key pair is verified using the KGC master public key and the client identifier; the client 401 is used to verify the server signature value using the server declaration public key, the client random number and the client identifier after the client signature public-private key pair is verified; the client is used to sign the server random number and the server identifier using the client signature private key after the server signature value is verified, obtain the client signature value, and send the client signature value to the server; the server 402 is used to receive the client signature value, and verify the client signature value using the client declaration public key, the server random number and the server identifier; the client 401 is used to feedback the client verification result to the server after the client signature value is verified.

[0334] In an optional embodiment of the present invention, the server 402 includes: the server 402 is used to obtain a server random number, a server identifier, a server declared public key, a server signature private key and a KGC master public key; the server 402 is used to calculate a server encryption public-private key pair and a server signature public-private key pair based on the server random number, the server identifier, the server declared public key, the server signature private key and the KGC master public key.

[0335] In an optional embodiment of the present invention, the client 401 includes: the client 401 is used to receive the server random number, the server identifier and the KGC master public key fed back by the server, and obtain the client encryption public-private key pair; the client 401 is used to obtain the client fixed value, the first finite field element, the second finite field element, the first elliptic curve point coordinates and the second elliptic curve point coordinates, and splice the client fixed value, the client identifier, the first finite field element, the second finite field element, the first elliptic curve point coordinates, the second elliptic curve point coordinates and the coordinates of the KGC master public key to obtain a first client splicing result; the client 401 is used to perform hash calculation on the first client splicing result to obtain a client hash value; the client is used to perform bit string conversion on the coordinates of the client encryption public key to obtain a first coordinate bit string and a second coordinate bit string; the client 401 is used to obtain the client first fixed value and a first modulus, concatenating the first coordinate bit string, the second coordinate bit string, the client hash value, the client first constant and the first modulus to obtain a second client concatenation result; the client 401 is used to perform hash calculation and modulus calculation on the second client concatenation result to obtain a first client multiple; the client 401 is used to perform the client first multiple point operation on the KGC master public key, and sum it with the client encryption public key to obtain an actual client public key; the client 401 is used to perform the client encryption private key multiple point operation on the elliptic curve point to obtain a first verification key; the client 401 is used to perform consistency detection on the client actual public key and the first verification key, and when the client actual public key and the first verification key are consistent, it is determined that the client encryption public-private key pair verification has passed; when the client actual public key and the first verification key are inconsistent, it is determined that the client encryption public-private key pair verification has failed.

[0336] In an optional embodiment of the present invention, the system further includes: the client 401, which is used to calculate the second session key for establishing a session between the client and the server based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair and the KGC master public key, and then feedback the first encrypted notification information to the server, receive the second encrypted notification information fed back by the server, obtain the information to be transmitted, and use the second session key to symmetrically encrypt the information to be transmitted to obtain the ciphertext data to be transmitted, and send it to the server; the server 402 is used to receive the ciphertext data to be transmitted, use the first session key to decrypt the ciphertext data to be transmitted, and obtain the information to be transmitted.

[0337] In an optional embodiment of the present invention, the system further includes: the server 402, which is used to split the first session key to obtain a first actual session key and a first HMAC value after calculating the first session key for establishing a session between the server and the client based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair and the KGC master public key; the client 401, which is used to split the second session key to obtain a second actual session key and a second HMAC value after calculating the second session key for establishing a session between the client and the server based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair and the KGC master public key; the client 401 is used to use the second actual session key to transmit the information to be transmitted The client 401 is used to perform symmetric encryption on the ciphertext data to be transmitted by using the second HMAC value to perform symmetric encryption on the ciphertext data to be transmitted to obtain the ciphertext HMAC value to be transmitted; the client 401 is used to combine the ciphertext data to be transmitted and the ciphertext HMAC value to be transmitted to obtain the combined data to be transmitted, and send it to the server; the server 402 is used to perform symmetric encryption on the ciphertext data to be transmitted contained in the combined data to be transmitted by using the first HMAC value to obtain a reference ciphertext HMAC value; the server 402 is used to perform consistency check on the reference ciphertext HMAC value and the ciphertext HMAC value to be transmitted contained in the combined data to be transmitted; the server 402 is used to decrypt the ciphertext data to be transmitted contained in the combined data to be transmitted by using the first actual session key when the reference ciphertext HMAC value and the ciphertext HMAC value to be transmitted are consistent to obtain the information to be transmitted.

[0338] The key negotiation device provided in the embodiment of the present invention can execute the key negotiation method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0339] In the technical solution of the embodiment of the present invention, the acquisition, storage and application of the server random number, server identifier, server encryption public-private key pair, KGC master public key, client encryption public-private key pair, server declaration public key, server signature private key, client declaration public key, client signature public-private key pair, client fixed value, first finite field element, second finite field element, first elliptic curve point coordinates, second elliptic curve point coordinates, client first fixed value, first modulus and information to be transmitted, etc., all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0340] Embodiment 4

[0341] Figure 5 A schematic diagram of the structure of an electronic device 500 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0342] like Figure 5 As shown, the electronic device 500 includes at least one processor 501, and a memory connected to the at least one processor 501 in communication, such as a read-only memory (ROM) 502, a random access memory (RAM) 503, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 501 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 502 or the computer program loaded from the storage unit 508 to the random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 can also be stored. The processor 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0343] Multiple components in the electronic device 500 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the electronic device 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0344] The processor 501 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 501 executes the various methods and processes described above, such as a key negotiation method.

[0345] In some embodiments, the key agreement method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by processor 501, one or more steps of the key agreement method described above may be performed. Alternatively, in other embodiments, processor 501 may be configured to perform the key agreement method in any other appropriate manner (e.g., by means of firmware).

[0346] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0347] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0348] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0349] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0350] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0351] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS (Virtual Private Server) services.

[0352] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0353] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A key negotiation method, characterized in that: The method comprises: Receive the client random number and client ID through the server, obtain the server random number, server ID, server encryption public and private key pair and KGC master public key, and feedback the server random number, server ID and KGC master public key to the client; Obtain the server declaration public key and server signature private key through the server; The server uses the server random number, the server declaration public key and the server signature private key to sign the client random number and the client identifier to obtain a server signature value, and sends the server signature value to the client; Receiving, through the client, the server random number, the server identifier and the KGC master public key fed back by the server, obtaining a client encryption public-private key pair, and verifying the client encryption public-private key pair using the KGC master public key and the client identifier; After the client encryption public-private key pair is verified, obtaining the client declaration public key and the client signature public-private key pair, and verifying the client signature public-private key pair using the KGC master public key and the client identifier; After the client signature public and private key pair is verified, the server signature value is verified using the server declaration public key, the client random number and the client identifier; After the signature value of the server is verified, the client uses the client signature private key to sign the server random number and the server identifier to obtain the client signature value, and sends the client signature value to the server; The server receives the client signature value, and verifies the client signature value using the client declared public key, the server random number and the server identifier; After the signature value of the client is verified, the server sends the encrypted public key of the server to the client; Receiving the server encryption public key through the client, and sending the client encryption public key to the server; Calculate, by the server, a first session key for establishing a session between the server and the client based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair, and the KGC master public key; Through the client, based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair and the KGC master public key, a second session key for establishing a session between the client and the server is calculated, so that the client and the server perform data encryption data transmission based on the first session key and the second session key.

2. The method according to claim 1, characterized in that Before receiving the client random number and the client identifier through the server, obtaining the server random number, the server identifier, the server encryption public-private key pair and the KGC master public key, and feeding back the server random number, the server identifier and the KGC master public key to the client, the method further includes: Obtain the server random number, server identifier, server declaration public key, server signature private key, and KGC master public key through the server; The server side calculates a server side encryption public-private key pair and a server side signature public-private key pair based on the server side random number, the server side identifier, the server side declared public key, the server side signature private key and the KGC master public key through the server side.

3. The method according to claim 1, characterized in that The receiving, through the client, the server random number, the server identifier, and the KGC master public key fed back by the server, obtaining a client encryption public-private key pair, and verifying the client encryption public-private key pair using the KGC master public key and the client identifier, includes: Receiving, through the client, the server random number, the server identifier and the KGC master public key fed back by the server, and obtaining a client encryption public and private key pair; Obtaining, through the client, a client fixed value, a first finite field element, a second finite field element, a first elliptic curve point coordinate, and a second elliptic curve point coordinate, and splicing the client fixed value, the client identifier, the first finite field element, the second finite field element, the first elliptic curve point coordinate, the second elliptic curve point coordinate, and the coordinates of the KGC master public key to obtain a first client splicing result; By means of the client, hash calculation is performed on the first client concatenation result to obtain a client hash value; By means of the client, the coordinates of the client encryption public key are converted into a bit string to obtain a first coordinate bit string and a second coordinate bit string; Obtaining, through the client, a first fixed value and a first modulus of the client, and concatenating the first coordinate bit string, the second coordinate bit string, the client hash value, the first fixed value of the client, and the first modulus to obtain a second client concatenation result; By means of the client, performing hash calculation and modulus calculation on the second client concatenation result to obtain a first multiple of the client; By means of the client, performing the first multiple point operation of the client on the KGC master public key, and summing the sum with the client encryption public key, to obtain the client actual public key; By means of the client, performing a client encrypted private key multiplication operation on the elliptic curve point to obtain a first verification key; Through the client, a consistency check is performed on the actual public key of the client and the first verification key. When the actual public key of the client and the first verification key are consistent, it is determined that the client encryption public-private key pair verification has passed; when the actual public key of the client and the first verification key are inconsistent, it is determined that the client encryption public-private key pair verification has failed.

4. The method according to claim 1, characterized in that: After calculating, by the client, a second session key for establishing a session between the client and the server based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair, and the KGC master public key, the method further includes: Feedback the first encrypted notification information to the server through the client, receive the second encrypted notification information fed back by the server, obtain the information to be transmitted, and use the second session key to symmetrically encrypt the information to be transmitted to obtain the ciphertext data to be transmitted, and send it to the server; The ciphertext data to be transmitted is received through the server, and the ciphertext data to be transmitted is decrypted using the first session key to obtain the information to be transmitted.

5. The method according to claim 4, characterized in that After the first session key for establishing a session between the server and the client is calculated by the server based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair and the KGC master public key, the method includes: Splitting the first session key to obtain a first actual session key and a first HMAC value; After the second session key for establishing a session between the client and the server is calculated by the client based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair and the KGC master public key, the method includes: Splitting the second session key to obtain a second actual session key and a second HMAC value; The using the second session key to symmetrically encrypt the information to be transmitted to obtain the ciphertext data to be transmitted, and sending the ciphertext data to the server includes: Using the second actual session key, symmetrically encrypting the information to be transmitted to obtain ciphertext data to be transmitted; Using the second HMAC value, symmetrically encrypt the ciphertext data to be transmitted to obtain the ciphertext HMAC value to be transmitted; Combining the ciphertext data to be transmitted and the HMAC value of the ciphertext to be transmitted to obtain combined data to be transmitted, and sending the combined data to the server; The using the first session key to decrypt the ciphertext data to be transmitted to obtain the information to be transmitted includes: Using the first HMAC value, symmetrically encrypt the ciphertext data to be transmitted contained in the combined data to be transmitted to obtain a reference ciphertext HMAC value; Performing a consistency check on the reference ciphertext HMAC value and the ciphertext HMAC value to be transmitted contained in the combined data to be transmitted; When the reference ciphertext HMAC value is consistent with the ciphertext HMAC value to be transmitted, the first actual session key is used to decrypt the ciphertext data to be transmitted contained in the combined data to be transmitted to obtain the information to be transmitted.

6. A key agreement system, characterized in that: The system comprises: a client and a server; The server is used to receive the client random number and client identifier, obtain the server random number, server identifier, server encryption public and private key pair and KGC master public key, and feedback the server random number, server identifier and KGC master public key to the client; The server is used to obtain the server declaration public key and the server signature private key; The server is used to sign the client random number and the client identifier using the server random number, the server declaration public key and the server signature private key to obtain a server signature value, and send the server signature value to the client; The client is used to receive the server random number, the server identifier and the KGC master public key fed back by the server, obtain the client encryption public-private key pair, and verify the client encryption public-private key pair using the KGC master public key and the client identifier; The client is used to obtain the client declaration public key and the client signature public-private key pair after the client encryption public-private key pair is verified, and verify the client signature public-private key pair using the KGC master public key and the client identifier; The client is used to verify the server signature value using the server declared public key, the client random number and the client identifier after the client signature public and private key pair is verified; The client is used to sign the server random number and the server identifier using the client signature private key after the server signature value is verified, to obtain the client signature value, and send the client signature value to the server; The server is used to receive the client signature value, and verify the client signature value using the client declared public key, the server random number and the server identifier; The client is used to send the server-side encrypted public key to the client after the client signature value is verified; The client is used to receive the server encryption public key and send the client encryption public key to the server; The server is configured to calculate a first session key for establishing a session between the server and the client based on the client random number, the client identifier, the client encryption public key, the server random number, the server identifier, the server encryption public-private key pair, and the KGC master public key; The client is used to calculate the second session key for establishing a session between the client and the server based on the server random number, the server identifier, the server encryption public key, the client random number, the client identifier, the client encryption public-private key pair and the KGC master public key, so that the client and the server perform data encryption data transmission based on the first session key and the second session key.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the key negotiation method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the key negotiation method according to any one of claims 1 to 5 when executed.

9. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the key agreement method according to any one of claims 1 to 5.

Images