Order distribution authentication method and system based on SM2 digital signature in distributed cloud scene

Abstract

The invention relates to the technical field of distributed cloud scenes, in particular to an order distribution authentication method and system based on SM2 digital signatures in a distributed cloud scene, and the method comprises the following steps: achieving a digital signature generation algorithm and a digital signature verification algorithm through codes according to the SM2 digital signature algorithm principle, and accessing to a service management system and each cloud platform system. Each cloud platform system has a cloud platform id belonging to the cloud platform system, and the service management system stores the cloud platform ids of all the cloud platform systems; the method has the beneficial effects that the cloud platform systems dispersed in the cloud centers and the business management system of the headquarters are arranged in the distributed cloud scene, the orders of resource operation are recorded in the business management system, and the cloud platform systems can call the api interface of the business management system to obtain the corresponding orders after the related managers approve the orders, so that the management efficiency is improved. And corresponding operation of the resources is performed according to the order.

Description

Technical Field

[0001] The present invention relates to the technical field of distributed cloud scenarios, and specifically to an order allocation authentication method and system based on SM2 digital signature in a distributed cloud scenario. Background Art

[0002] With the rapid development of cloud computing technology and the introduction of the concept of distributed cloud, many local government departments have also cooperated with some cloud service providers to build local government cloud platforms, set up cloud centers, and deploy their own businesses on the cloud. Customers can use the cloud platform system to purchase, re-allocate, and unsubscribe resource instances. In order to standardize the resource operations of each cloud center, a business management system is set up. It is necessary to enter the order in the business management system first, and the relevant management personnel shall review and approve it. Then each cloud platform system calls the interface of the business management system to obtain its own order information, and perform resource operations according to the order, so as to achieve unified order entry and allocation by the business management system. Therefore, the security of the interaction between the cloud platform system and the business management system is particularly important. When a cloud platform system sends a message to the business management system, the signature generated by the digital signature algorithm is used for authentication. Even if someone pretends to be a cloud platform system to send a message, the business management system can also identify the source of the message through the signature verification operation. It is not the cloud platform system that has been connected to itself, and will not return the order information, which effectively ensures the credibility of the message sent by the cloud platform system to the business management system.

[0003] In order to fundamentally get rid of my country's dependence on foreign cryptographic technology and master the core information security technology from the cryptographic algorithm level, the National Cryptography Administration has launched the SM series of cryptographic algorithms. In recent years, the country has successively issued a number of policies and regulations to guide and regulate the construction of cryptographic applications in cloud platform systems. Therefore, many local government cloud platforms need to respond to government policies, carry out national cryptographic transformation, and pass the information system commercial cryptographic application security assessment. Implementing national cryptographic algorithms through system codes, using national cryptographic algorithms to protect data, and replacing international cryptographic algorithms in use are important parts of national cryptographic transformation.

[0004] The SM2 elliptic curve public key cryptography algorithm is a commercial cryptographic algorithm with independent intellectual property rights in my country. It is a type of ECC algorithm. It is based on the elliptic curve discrete logarithm problem. The computational complexity is exponential and the solution is difficult. With the development of cryptographic technology and computer technology, the commonly used 1024-bit RSA algorithm faces serious security threats. Summary of the invention

[0005] The purpose of the present invention is to provide an order allocation authentication method and system based on SM2 digital signature in a distributed cloud scenario to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: an order allocation authentication method based on SM2 digital signature in a distributed cloud scenario, the method comprising the following steps:

[0007] According to the principle of SM2 digital signature algorithm, the digital signature generation algorithm and digital signature verification algorithm are implemented with code, and connected to the business management system and various cloud platform systems;

[0008] Each cloud platform system has its own cloud platform ID, and the business management system stores the cloud platform IDs of all cloud platform systems;

[0009] Several pairs of keys are initialized for each cloud platform. Each key pair has an index. The cloud platform system saves the private key and the corresponding key index. The business management system needs to save the public keys and corresponding key indexes of all cloud platform systems in order to select the correct public key for signature verification.

[0010] When the cloud platform system performs an order acquisition operation, it first randomly obtains a private key, uses the private key to generate a digital signature algorithm for the message to be sent, and then sends the message, signature, key index, and cloud platform ID to the business management system;

[0011] When the business management system receives the interface call, it first queries and obtains the corresponding public key based on the cloud platform ID and key index, and uses the public key to perform the digital signature verification algorithm. If the verification passes, it is considered that the message is a message sent normally by a cloud platform system, and then the message content is parsed, the order information of the cloud platform system is queried and returned; if the verification fails, the message is considered to be forged and untrustworthy, and the message content is no longer parsed, and no order information is returned.

[0012] Preferably, the SM2 standard includes four parts: general principles, digital signature algorithm, key exchange protocol, and public key encryption algorithm. The digital signature algorithm is used, and the digital signature algorithm includes a digital signature generation algorithm and a digital signature verification algorithm. According to the general principles, a finite field and an elliptic curve are selected to generate a key pair, and the SM3 cryptographic hash algorithm and random number generator approved by the National Cryptography Administration are used;

[0013] The signer user A provides a self-identifiable ID A , remember ID A The length of entlen A Bit, and remember ENTL A is the integer entlen A The digital signature generator and the digital signature verifier both use the cryptographic hash function to obtain the hash value Z of user A. A , hash value Z A =H256 (ENTL A ∥ID A ∥a∥b∥x G ∥y G ∥x A ∥y A ), where a and b are the parameters of the elliptic curve equation, (x G ,y G ) is the coordinate of a base point G of the elliptic curve, (x A ,y A ) is the public key P of user A A The coordinates of a, b, x G ,y G 、x A ,y A The data types are converted to bit strings and used with ENTL A 、ID A Put them together and perform cryptographic hash function calculation to get the hash value Z A .

[0014] Preferably, the implementation process of the digital signature generation algorithm is as follows:

[0015] Input plaintext message M and hash value Z A ;

[0016] M and Z A Splicing

[0017] Use the cryptographic hash function H with a message digest length of v bits v ()right Compress to get e, and convert the data of e into an integer;

[0018] Use a random number generator to generate a random number k∈[1,n-1], where n is the order of the base point G;

[0019] Compute the elliptic curve point (x 1 ,y 1 )=[k]G, that is, k times the point G on the elliptic curve, and x 1 The data type is converted to an integer;

[0020] For e and x 1 The sum of is operated modulo n to obtain r;

[0021] If r=0 or r+k=n, return to the step of generating the random number k, obtain the random number k again and perform subsequent calculations;

[0022] Calculate s = ((1 + d A ) -1 ·(kr·dA ))mod n, where d A is the private key of user A;

[0023] If s=0, return to the step of generating the random number k, re-obtain the random number k and perform subsequent calculations;

[0024] Convert the data types of r and s into byte strings, and the digital signature of message M will be (r, s).

[0025] The implementation process of the digital signature verification algorithm is as follows:

[0026] Input is plaintext message M, hash value Z A , digital signature (r, s);

[0027] First check whether r∈[1,n-1] holds. If not, the verification fails.

[0028] Then check whether s∈[1,n-1] holds. If not, the verification fails.

[0029] M and Z A Splicing

[0030] Use the cryptographic hash function H with a message digest length of v bits v ()right Compress to get e, and convert the data of e into an integer;

[0031] Convert r and s to integers and calculate t = (r + s) mod n;

[0032] If t = 0, the verification fails;

[0033] Compute the elliptic curve point (x 1 ,y 1 )=[s]G+[t]P A , where P A is the public key of user A;

[0034] x 1 The data type is converted to an integer, and R is calculated as follows: 1 )mod n;

[0035] Check whether R=r holds true. If so, the verification succeeds. If not, the verification fails.

[0036] Preferably, when generating and verifying digital signatures, data format conversion processing is performed. When generating digital signatures, the plain text message in string format is converted into a byte array, and then the private key is determined, and the byte array is digitally signed using the private key to obtain a signature in byte array format. If the byte array signature is directly converted into a string, garbled characters will be obtained. Therefore, the byte array signature is first encrypted with Base64 and then converted into a string format to finally obtain a signature in string format.

[0037] When verifying a digital signature, first convert the string format message and signature into byte arrays. Since Base64 encryption was done when the signature was generated, the byte array of the signature is decrypted with Base64 to obtain the signature to be verified. Then determine the public key, and use the public key to perform the digital signature verification algorithm on the byte array format message and signature to obtain the verification result.

[0038] Preferably, there are cloud platform systems with multiple cloud centers in the distributed cloud scenario. Each cloud platform system has an ID. Headquarters managers use the business management system for overall management and control. The business management system stores the IDs of all cloud platform systems and regulates the resource operation behavior of each cloud center through order entry and order allocation. When a cloud center wants to obtain an order to operate on resources, it calls the API interface of the business management system through its own cloud platform system, sends messages in an agreed data format, interacts, and obtains the corresponding order information.

[0039] An order distribution authentication system based on SM2 digital signature in a distributed cloud scenario, the system comprising:

[0040] The algorithm generation module implements the digital signature generation algorithm and the digital signature verification algorithm in code according to the SM2 digital signature algorithm principle, and connects them to the business management system and various cloud platform systems;

[0041] Cloud platform ID storage module. Each cloud platform system has its own cloud platform ID, and the business management system stores the cloud platform IDs of all cloud platform systems.

[0042] The key generation module initializes and generates several pairs of keys for each cloud platform. Each key pair has an index. The cloud platform system saves the private key and the corresponding key index. The business management system needs to save the public keys and corresponding key indexes of all cloud platform systems in order to select the correct public key for signature verification.

[0043] The data transmission module, when the cloud platform system performs an order acquisition operation, first randomly obtains a private key, uses the private key to perform a digital signature generation algorithm on the message to be sent, and then sends the message, signature, key index, and cloud platform ID to the business management system;

[0044] Algorithm verification module, when the business management system receives the interface call, it first queries and obtains the corresponding public key based on the cloud platform ID and key index, and uses the public key to perform digital signature verification algorithm. If the verification passes, it is considered that the message is a message sent normally by a cloud platform system, and then the message content is parsed, the order information of the cloud platform system is queried and returned; if the verification fails, the message is considered to be forged and untrustworthy, and the message content will no longer be parsed and no order information will be returned.

[0045] Preferably, in the algorithm generation module, the SM2 standard includes four parts: general principles, digital signature algorithm, key exchange protocol, and public key encryption algorithm. The digital signature algorithm is used, and the digital signature algorithm includes a digital signature generation algorithm and a digital signature verification algorithm. According to the general principles, a finite field and an elliptic curve are selected to generate a key pair, and the SM3 cryptographic hash algorithm and random number generator approved by the National Cryptography Administration are used;

[0046] The signer user A provides a self-identifiable ID A , remember ID A The length of entlen A Bit, and remember ENTL A is the integer entlen A The digital signature generator and the digital signature verifier both use the cryptographic hash function to obtain the hash value Z of user A. A , hash value Z A =H 256 (ENTL A ∥ID A ∥a∥b∥x G ∥y G ∥x A ∥y A ), where a and b are the parameters of the elliptic curve equation, (x G ,y G ) is the coordinate of a base point G of the elliptic curve, (x A ,y A ) is the public key P of user A A The coordinates of a, b, x G ,y G 、x A ,y A The data types are converted to bit strings and used with ENTL A 、ID A Put them together and perform cryptographic hash function calculation to get the hash value Z A .

[0047] Preferably, the implementation process of the digital signature generation algorithm is as follows:

[0048] Input plaintext message M and hash value Z A ;

[0049] M and Z A Splicing

[0050] Use the cryptographic hash function H with a message digest length of v bits v ()right Compress to get e, and convert the data of e into an integer;

[0051] Use a random number generator to generate a random number k∈[1,n-1], where n is the order of the base point G;

[0052] Compute the elliptic curve point (x 1 ,y 1 )=[k]G, that is, k times the point G on the elliptic curve, and x 1 The data type is converted to an integer;

[0053] For e and x 1 The sum of is operated modulo n to obtain r;

[0054] If r=0 or r+k=n, return to the step of generating the random number k, obtain the random number k again and perform subsequent calculations;

[0055] Calculate s = ((1 + d A ) -1 ·(kr·d A ))mod n, where d A is the private key of user A;

[0056] If s=0, return to the step of generating the random number k, re-obtain the random number k and perform subsequent calculations;

[0057] Convert the data types of r and s into byte strings, and the digital signature of message M will be (r, s).

[0058] The implementation process of the digital signature verification algorithm is as follows:

[0059] Input is plaintext message M, hash value Z A , digital signature (r, s);

[0060] First check whether r∈[1,n-1] holds. If not, the verification fails.

[0061] Then check whether s∈[1,n-1] holds. If not, the verification fails.

[0062] M and Z A Splicing

[0063] Use the cryptographic hash function H with a message digest length of v bits v ()right Compress to get e, and convert the data of e into an integer;

[0064] Convert r and s to integers and calculate t = (r + s) mod n;

[0065] If t = 0, the verification fails;

[0066] Compute the elliptic curve point (x 1 ,y 1 )=[s]G+[t]P A , where P A is the public key of user A;

[0067] x 1 The data type is converted to an integer, and R is calculated as follows: 1 )mod n;

[0068] Check whether R=r holds true. If so, the verification succeeds. If not, the verification fails.

[0069] Preferably, when generating and verifying digital signatures, data format conversion processing is performed. When generating digital signatures, the plain text message in string format is converted into a byte array, and then the private key is determined, and the byte array is digitally signed using the private key to obtain a signature in byte array format. If the byte array signature is directly converted into a string, garbled characters will be obtained. Therefore, the byte array signature is first encrypted with Base64 and then converted into a string format to finally obtain a signature in string format.

[0070] When verifying a digital signature, first convert the string format message and signature into byte arrays. Since Base64 encryption was done when the signature was generated, the byte array of the signature is decrypted with Base64 to obtain the signature to be verified. Then determine the public key, and use the public key to perform the digital signature verification algorithm on the byte array format message and signature to obtain the verification result.

[0071] Preferably, the distributed cloud scenario has cloud platform systems of multiple cloud centers, each cloud platform system has an ID, and the headquarters managers use the business management system for overall management and control. The business management system stores the IDs of all cloud platform systems, and regulates the resource operation behavior of each cloud center through order entry and order allocation. When a cloud center wants to obtain an order to operate on resources, it calls the API interface of the business management system through its own cloud platform system, sends messages in an agreed data format, and interacts to obtain the corresponding order information.

[0072] Compared with the prior art, the present invention has the following beneficial effects:

[0073] The present invention proposes an order allocation authentication method and system based on SM2 digital signature in a distributed cloud scenario. In a distributed cloud scenario, there are cloud platform systems scattered in various cloud centers and a business management system at a headquarters. After the order for resource operation is entered in the business management system, the cloud platform system can call the API interface of the business management system to obtain the corresponding order after the relevant management personnel have approved it, so as to perform corresponding operations on resources according to the order. When a cloud platform system wants to interact with the business management system and obtain an order belonging to its own cloud center, it can use the national cryptographic algorithm SM2 digital signature generation algorithm to digitally sign the plaintext message to be sent, and send the message and the generated signature together to the business management system. After the business management system receives the message and signature, it performs a digital signature verification algorithm. After the verification is passed, the order information of the corresponding cloud platform is returned according to the content of the message. In this way, if someone illegally impersonates a cloud platform system and wants to obtain an order and perform illegal resource operations, the business management system performs a digital signature verification algorithm. If the verification fails, the order information can be refused to be returned, thereby providing a safe and reliable order allocation authentication method. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 A flow chart for generating a digital signature of the present invention;

[0075] Figure 2 This is a flow chart of digital signature verification of the present invention;

[0076] Figure 3 The data conversion process flow chart of the present invention;

[0077] Figure 4 This is a schematic diagram of a distributed cloud scenario of the present invention;

[0078] Figure 5 A logical diagram for implementing the docking of the cloud platform system of the present invention;

[0079] Figure 6 This is a logical diagram for implementing the docking of the business management system of the present invention. DETAILED DESCRIPTION

[0080] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0081] Example 1 Please refer to Figures 1 to 6 The present invention provides a technical solution: an order allocation authentication method based on SM2 digital signature in a distributed cloud scenario, the method comprising the following steps:

[0082] 1SM2 digital signature algorithm implementation

[0083] SM2 is my country's National Cryptography Administration The elliptic curve public key cryptography algorithm released on December 17, 2010 is different from international standards such as ECDSA and ECDH in terms of signature and key exchange. Instead, it adopts a more secure mechanism. It is based on the elliptic curve discrete logarithm problem, and its computational complexity is exponential, making it difficult to solve.

[0084] The SM2 standard includes four parts: general principles, digital signature algorithm, key exchange protocol, and public key encryption algorithm. The appendix of each part describes the relevant details and examples of implementation in detail. The digital signature algorithm used in this invention is given on the basis of the general principles. The digital signature algorithm includes a digital signature generation algorithm and a digital signature verification algorithm. It selects a finite field and an elliptic curve to generate a key pair according to the general principles, and uses the SM3 cryptographic hash algorithm and random number generator approved by the National Cryptography Administration.

[0085] User A, as the signer, needs to provide a distinguishable ID of his own A , remember ID A The length of entlen A Bit, and remember ENTL A is the integer entlen A The digital signature generator and the digital signature verifier both use the cryptographic hash function to obtain the hash value Z of user A. A , hash value Z A =H 256 (ENTL A ∥ID A ∥a∥b∥x G ∥y G ∥x A ∥y A ). Among them, a and b are the parameters of the elliptic curve equation, (x G ,y G ) is the coordinate of a base point G of the elliptic curve, (x A ,y A ) is the public key P of user A A The coordinates of a, b, x G ,y G 、x A ,y AThe data types are converted to bit strings and used with ENTL A 、ID A Put them together and perform cryptographic hash function calculation to get the hash value Z A .

[0086] The implementation principle of the digital signature generation algorithm is as follows Figure 1 As shown, the process is as follows:

[0087] Input plaintext message M and hash value Z A ;

[0088] M and Z A Splicing

[0089] Use the cryptographic hash function H with a message digest length of v bits v ()right Compress to get e, and convert the data of e into an integer;

[0090] Use a random number generator to generate a random number k∈[1,n-1], where n is the order of the base point G;

[0091] Compute the elliptic curve point (x 1 ,y 1 )=[k]G, that is, k times the point G on the elliptic curve, and x 1 The data type is converted to an integer;

[0092] For e and x 1 The sum of is operated modulo n to obtain r;

[0093] If r=0 or r+k=n, return to the step of generating the random number k, obtain the random number k again and perform subsequent calculations;

[0094] Calculate s = ((1 + d A ) -1 ·(kr·d A ))mod n, where d A is the private key of user A;

[0095] If s=0, return to the step of generating the random number k, re-obtain the random number k and perform subsequent calculations;

[0096] Convert the data types of r and s into byte strings, and the digital signature of message M will be (r, s).

[0097] The implementation principle of the digital signature verification algorithm is as follows Figure 2 As shown, the process is as follows:

[0098] Input is plaintext message M, hash value Z A, digital signature (r, s);

[0099] First check whether r∈[1,n-1] holds. If not, the verification fails.

[0100] Then check whether s∈[1,n-1] holds. If not, the verification fails.

[0101] M and Z A Splicing

[0102] Use the cryptographic hash function H with a message digest length of v bits v ()right Compress to get e, and convert the data of e into an integer;

[0103] Convert r and s to integers and calculate t = (r + s) mod n;

[0104] If t = 0, the verification fails;

[0105] Compute the elliptic curve point (x 1 ,y 1 )=[s]G+[t]P A , where P A is the public key of user A;

[0106] x 1 The data type is converted to an integer, and R is calculated as follows: 1 )mod n;

[0107] Check whether R=r holds true. If so, the verification succeeds. If not, the verification fails.

[0108] 2 Data Processing Implementation

[0109] The data processed by the SM2 digital signature algorithm is in byte array format. When the cloud platform system interacts with the business management system, the plain text messages sent are generally in string format. Therefore, data format conversion is required when generating and verifying digital signatures.

[0110] The data conversion process is as follows Figure 3 shown.

[0111] When generating a digital signature, first convert the plaintext message in string format into a byte array, then determine the private key, use the private key to generate a digital signature on the byte array, and obtain a signature in byte array format. At this time, if the byte array signature is directly converted into a string, garbled characters will be obtained, so the byte array signature is first encrypted with Base64, and then converted into a string format, and finally a signature in string format is obtained.

[0112] When verifying a digital signature, first convert the string format message and signature into a byte array. Since Base64 encryption was done when the signature was generated, the byte array of the signature is decrypted by Base64 to obtain the signature to be verified. Then determine the public key, use the public key to perform the digital signature verification algorithm on the byte array format message and signature, and you can get the verification result.

[0113] 3. System connection realization

[0114] Distributed cloud scenarios such as Figure 4 As shown in the figure, there are multiple cloud platform systems in cloud centers. Each cloud platform system has an ID. The headquarters managers use the business management system for overall management and control. The business management system stores the IDs of all cloud platform systems and regulates the resource operation behaviors of each cloud center through order entry and order allocation. When a cloud center wants to obtain an order to operate resources, it can call the API interface of the business management system through its own cloud platform system, send messages in the agreed data format, interact, and obtain the corresponding order information.

[0115] To implement the SM2 digital signature algorithm, a key pair needs to be generated when the system initializes data. Multiple key pairs are generated and saved for each cloud platform system, and index values ​​are assigned to these key pairs. The cloud platform system saves the private keys of these key pairs and the corresponding key indexes; the business management system saves the public keys of all cloud platform key pairs and the corresponding key indexes so that the correct public key can be selected later.

[0116] The logic of cloud platform system docking is as follows Figure 5 When a cloud platform system needs to obtain order information from its own cloud center, it generates a message that needs to obtain order information, then randomly specifies a key index, obtains the private key to be used according to the key index, uses the private key to perform a digital signature generation algorithm on the message, obtains a digital signature, assembles the message, digital signature, key index, and cloud platform system ID into a message in the agreed format, calls the interface of the business management system, and sends it to the business management system together.

[0117] The business management system docking implementation logic is as follows Figure 6As shown. When the interface of the business management system is called and a message from a cloud platform system is received, the message, digital signature, key index, and cloud platform system ID are taken out from the message, and the public key to be used is obtained according to the key index and cloud platform system ID. Then, the public key is used to perform a digital signature verification algorithm on the message and digital signature to obtain the verification result. If the verification is successful, the business management system parses the message content and returns the order information of the corresponding cloud platform system; otherwise, if the verification fails, it is considered that the source of the message is illegal or the message has been tampered with, and the message content is not parsed, and no order information is returned. Finally, a log data is generated for recording to facilitate subsequent troubleshooting.

[0118] Embodiment 2, based on embodiment 1, proposes an order allocation authentication system based on SM2 digital signature in a distributed cloud scenario, the system comprising:

[0119] The algorithm generation module implements the digital signature generation algorithm and the digital signature verification algorithm in code according to the SM2 digital signature algorithm principle, and connects them to the business management system and various cloud platform systems;

[0120] Cloud platform ID storage module. Each cloud platform system has its own cloud platform ID, and the business management system stores the cloud platform IDs of all cloud platform systems.

[0121] The key generation module initializes and generates several pairs of keys for each cloud platform. Each key pair has an index. The cloud platform system saves the private key and the corresponding key index. The business management system needs to save the public keys and corresponding key indexes of all cloud platform systems in order to select the correct public key for signature verification.

[0122] The data transmission module, when the cloud platform system performs an order acquisition operation, first randomly obtains a private key, uses the private key to perform a digital signature generation algorithm on the message to be sent, and then sends the message, signature, key index, and cloud platform ID to the business management system;

[0123] Algorithm verification module, when the business management system receives the interface call, it first queries and obtains the corresponding public key based on the cloud platform ID and key index, and uses the public key to perform digital signature verification algorithm. If the verification passes, it is considered that the message is a message sent normally by a cloud platform system, and then the message content is parsed, the order information of the cloud platform system is queried and returned; if the verification fails, the message is considered to be forged and untrustworthy, and the message content will no longer be parsed and no order information will be returned.

[0124] In the algorithm generation module, the SM2 standard includes four parts: general principles, digital signature algorithm, key exchange protocol, and public key encryption algorithm. The digital signature algorithm is used, which includes the digital signature generation algorithm and the digital signature verification algorithm. According to the general principles, finite fields and elliptic curves are selected to generate key pairs, and the SM3 cryptographic hash algorithm and random number generator approved by the National Cryptography Administration are used;

[0125] The signer user A provides a self-identifiable ID A , remember ID A The length of entlen A Bit, and remember ENTL A is the integer entlen A The digital signature generator and the digital signature verifier both use the cryptographic hash function to obtain the hash value Z of user A. A , hash value Z A =H 256 (ENTL A ∥ID A ∥a∥b∥x G ∥y G ∥x A ∥y A ), where a and b are the parameters of the elliptic curve equation, (x G ,y G ) is the coordinate of a base point G of the elliptic curve, (x A ,y A ) is the public key P of user A A The coordinates of a, b, x G ,y G 、x A ,y A The data types are converted to bit strings and used with ENTL A 、ID A Put them together and perform cryptographic hash function calculation to get the hash value Z A .

[0126] The implementation process of the digital signature generation algorithm is as follows:

[0127] Input plaintext message M and hash value Z A ;

[0128] M and Z A Splicing

[0129] Use the cryptographic hash function H with a message digest length of v bits v ()right Compress to get e, and convert the data of e into an integer;

[0130] Use a random number generator to generate a random number k∈[1,n-1], where n is the order of the base point G;

[0131] Compute the elliptic curve point (x 1 ,y 1 )=[k]G, that is, k times the point G on the elliptic curve, and x 1 The data type is converted to an integer;

[0132] For e and x 1 The sum of is operated modulo n to obtain r;

[0133] If r=0 or r+k=n, return to the step of generating the random number k, obtain the random number k again and perform subsequent calculations;

[0134] Calculate s = ((1 + d A ) -1 ·(kr·d A ))mod n, where d A is the private key of user A;

[0135] If s=0, return to the step of generating the random number k, re-obtain the random number k and perform subsequent calculations;

[0136] Convert the data types of r and s into byte strings, and the digital signature of message M will be (r, s).

[0137] The implementation process of the digital signature verification algorithm is as follows:

[0138] Input is plaintext message M, hash value Z A , digital signature (r, s);

[0139] First check whether r∈[1,n-1] holds. If not, the verification fails.

[0140] Then check whether s∈[1,n-1] holds. If not, the verification fails.

[0141] M and Z A Splicing

[0142] Use the cryptographic hash function H with a message digest length of v bits v ()right Compress to get e, and convert the data of e into an integer;

[0143] Convert r and s to integers and calculate t = (r + s) mod n;

[0144] If t = 0, the verification fails;

[0145] Compute the elliptic curve point (x1 ,y 1 )=[s]G+[t]P A , where P A is the public key of user A;

[0146] x 1 The data type is converted to an integer, and R is calculated as follows: 1 )mod n;

[0147] Check whether R=r holds true. If so, the verification succeeds. If not, the verification fails.

[0148] When generating and verifying digital signatures, data format conversion is performed. When generating digital signatures, the plain text message in string format is converted into a byte array, and then the private key is determined. The private key is used to generate a digital signature for the byte array to obtain a signature in byte array format. If the byte array signature is directly converted into a string, garbled characters will be obtained. Therefore, the byte array signature is first encrypted with Base64 and then converted into a string format to finally obtain a signature in string format.

[0149] When verifying a digital signature, first convert the string format message and signature into byte arrays. Since Base64 encryption was done when the signature was generated, the byte array of the signature is decrypted with Base64 to obtain the signature to be verified. Then determine the public key, and use the public key to perform the digital signature verification algorithm on the byte array format message and signature to obtain the verification result.

[0150] In the distributed cloud scenario, there are cloud platform systems of multiple cloud centers. Each cloud platform system has an ID. Headquarters managers use the business management system for overall management and control. The business management system stores the IDs of all cloud platform systems and regulates the resource operation behavior of each cloud center through order entry and order allocation. When a cloud center wants to obtain an order to operate on resources, it calls the API interface of the business management system through its own cloud platform system, sends messages in an agreed data format, and interacts to obtain the corresponding order information.

[0151] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An order allocation authentication method based on SM2 digital signature in a distributed cloud scenario, characterized by: The method comprises the following steps: According to the principle of SM2 digital signature algorithm, the digital signature generation algorithm and digital signature verification algorithm are implemented with code, and connected to the business management system and various cloud platform systems; Each cloud platform system has its own cloud platform ID, and the business management system stores the cloud platform IDs of all cloud platform systems; Several pairs of keys are initialized for each cloud platform. Each key pair has an index. The cloud platform system saves the private key and the corresponding key index. The business management system needs to save the public keys and corresponding key indexes of all cloud platform systems in order to select the correct public key for signature verification. When the cloud platform system performs an order acquisition operation, it first randomly obtains a private key, uses the private key to generate a digital signature algorithm for the message to be sent, and then sends the message, signature, key index, and cloud platform ID to the business management system; When the business management system receives the interface call, it first queries and obtains the corresponding public key based on the cloud platform ID and key index, and uses the public key to perform the digital signature verification algorithm. If the verification passes, it is considered that the message is a message sent normally by a cloud platform system, and then the message content is parsed, the order information of the cloud platform system is queried and returned; if the verification fails, the message is considered to be forged and untrustworthy, and the message content is no longer parsed, and no order information is returned.

2. According to claim 1, an order allocation authentication method based on SM2 digital signature in a distributed cloud scenario is characterized in that: The SM2 standard includes four parts: general principles, digital signature algorithm, key exchange protocol, and public key encryption algorithm. The digital signature algorithm is used, which includes the digital signature generation algorithm and the digital signature verification algorithm. According to the general principles, finite fields and elliptic curves are selected to generate key pairs, and the SM3 cryptographic hash algorithm and random number generator approved by the National Cryptography Administration are used. The signer user A provides a self-identifiable ID A , remember ID A The length of entlen A Bit, and remember ENTL A is the integer entlen A The digital signature generator and the digital signature verifier both use the cryptographic hash function to obtain the hash value Z of user A. A , hash value Z A =H 256 (ENTL A ||ID A ||a||b||x G ||y G ||x A ||y A ), where a and b are the parameters of the elliptic curve equation, (x G ,y G ) is the coordinate of a base point G of the elliptic curve, (x A ,y A ) is the public key P of user A A The coordinates of a, b, x G ,y G 、x A ,y A The data types are converted to bit strings and used with ENTL A 、ID A Put them together and perform cryptographic hash function calculation to get the hash value Z A .

3. According to claim 2, an order allocation authentication method based on SM2 digital signature in a distributed cloud scenario is characterized in that: The implementation process of the digital signature generation algorithm is as follows: Input plaintext message M and hash value Z A ; M and Z A Splicing Use the cryptographic hash function H with a message digest length of v bits v ()right Compress to get e, and convert the data of e into an integer; Use a random number generator to generate a random number k∈[1,n-1], where n is the order of the base point G; Calculate the elliptic curve point (x1, y1) = [k] G, that is, the k-times point G on the elliptic curve, and convert the data type of x1 to an integer; Perform a modulo n operation on the sum of e and x1 to obtain r; If r=0 or r+k=n, return to the step of generating the random number k, obtain the random number k again and perform subsequent calculations; Calculate s = ((1 + d A ) -1 ·(kr·d A ))mod n, where d A is the private key of user A; If s=0, return to the step of generating the random number k, re-obtain the random number k and perform subsequent calculations; Convert the data types of r and s into byte strings, and the digital signature of message M will be (r, s). The implementation process of the digital signature verification algorithm is as follows: Input is plaintext message M, hash value Z A , digital signature (r, s); First check whether r∈[1, n-1] holds. If not, the verification fails. Then check whether s∈[1, n-1] holds. If not, the verification fails. M and Z A Splice to get M; Use the cryptographic hash function H with a message digest length of v bits v () Compress M to obtain e, and convert the data of e into an integer; Convert r and s to integers and calculate t = (r + s) mod n; If t = 0, the verification fails; Calculate the elliptic curve point (x1, y1) = [s]G + [t]P A , where P A is the public key of user A; Convert the data type of x1 to an integer and calculate R = (e + x1) mod n; Check whether R=r holds true. If so, the verification succeeds. If not, the verification fails.

4. According to claim 3, an order allocation authentication method based on SM2 digital signature in a distributed cloud scenario is characterized in that: When generating and verifying digital signatures, data format conversion is performed. When generating digital signatures, the plain text message in string format is converted into a byte array, and then the private key is determined. The private key is used to generate a digital signature for the byte array to obtain a signature in byte array format. If the byte array signature is directly converted into a string, garbled characters will be obtained. Therefore, the byte array signature is first encrypted with Base64 and then converted into a string format to finally obtain a signature in string format. When verifying a digital signature, first convert the string format message and signature into byte arrays. Since Base64 encryption was done when the signature was generated, the byte array of the signature is decrypted with Base64 to obtain the signature to be verified. Then determine the public key, and use the public key to perform the digital signature verification algorithm on the byte array format message and signature to obtain the verification result.

5. According to claim 1, an order allocation authentication method based on SM2 digital signature in a distributed cloud scenario is characterized in that: In the distributed cloud scenario, there are cloud platform systems in multiple cloud centers. Each cloud platform system has an ID. Headquarters managers use the business management system for overall management and control. The business management system stores the IDs of all cloud platform systems and regulates the resource operation behavior of each cloud center through order entry and order allocation. When a cloud center wants to obtain an order to operate on resources, it calls the API interface of the business management system through its own cloud platform system, sends messages in an agreed data format, and interacts to obtain the corresponding order information.

6. An order distribution authentication system based on SM2 digital signature in a distributed cloud scenario according to the order distribution authentication method based on SM2 digital signature in a distributed cloud scenario according to any one of claims 1 to 5, characterized in that: The system comprises: The algorithm generation module implements the digital signature generation algorithm and the digital signature verification algorithm in code according to the SM2 digital signature algorithm principle, and connects them to the business management system and various cloud platform systems; Cloud platform ID storage module. Each cloud platform system has its own cloud platform ID, and the business management system stores the cloud platform IDs of all cloud platform systems. The key generation module initializes and generates several pairs of keys for each cloud platform. Each key pair has an index. The cloud platform system saves the private key and the corresponding key index. The business management system needs to save the public keys and corresponding key indexes of all cloud platform systems in order to select the correct public key for signature verification. The data transmission module, when the cloud platform system performs an order acquisition operation, first randomly obtains a private key, uses the private key to perform a digital signature generation algorithm on the message to be sent, and then sends the message, signature, key index, and cloud platform ID to the business management system; Algorithm verification module, when the business management system receives the interface call, it first queries and obtains the corresponding public key based on the cloud platform ID and key index, and uses the public key to perform digital signature verification algorithm. If the verification passes, it is considered that the message is a message sent normally by a cloud platform system, and then the message content is parsed, the order information of the cloud platform system is queried and returned; if the verification fails, the message is considered to be forged and untrustworthy, and the message content will no longer be parsed and no order information will be returned.

7. According to claim 6, an order allocation authentication system based on SM2 digital signature in a distributed cloud scenario is characterized in that: In the algorithm generation module, the SM2 standard includes four parts: general principles, digital signature algorithm, key exchange protocol, and public key encryption algorithm. The digital signature algorithm is used, which includes the digital signature generation algorithm and the digital signature verification algorithm. According to the general principles, finite fields and elliptic curves are selected to generate key pairs, and the SM3 cryptographic hash algorithm and random number generator approved by the National Cryptography Administration are used; The signer user A provides a self-identifiable ID A , remember ID A The length of entlen A Bit, and remember ENTL A is the integer entlen A The digital signature generator and the digital signature verifier both use the cryptographic hash function to obtain the hash value Z of user A. A , hash value Z A =H 256 (ENTL A ‖ID A ‖a‖b‖x G ‖y G ‖x A ‖y A ), where a and b are the parameters of the elliptic curve equation, (x G ,y G ) is the coordinate of a base point G of the elliptic curve, (x A ,y A ) is the public key P of user A A The coordinates of a, b, x G ,y G 、x A ,y A The data types are converted to bit strings and used with ENTL A、 ID A Put them together and perform cryptographic hash function calculation to get the hash value Z A .

8. According to claim 7, an order allocation authentication system based on SM2 digital signature in a distributed cloud scenario is characterized in that: The implementation process of the digital signature generation algorithm is as follows: Input plaintext message M and hash value Z A ; M and Z A Splicing Use the cryptographic hash function H with a message digest length of v bits v ()right Compress to get e, and convert the data of e into an integer; Use a random number generator to generate a random number k∈[1,n-1], where n is the order of the base point G; Calculate the elliptic curve point (x1, y1) = [k] G, that is, the k-times point G on the elliptic curve, and convert the data type of x1 to an integer; Perform a modulo n operation on the sum of e and x1 to obtain r; If r=0 or r+k=n, return to the step of generating the random number k, obtain the random number k again and perform subsequent calculations; Calculate s = ((1 + d A ) -1 ·(kr·d A ))mod n, where d A is the private key of user A; If s=0, return to the step of generating the random number k, re-obtain the random number k and perform subsequent calculations; Convert the data types of r and s into byte strings, and the digital signature of message M will be (r, s). The implementation process of the digital signature verification algorithm is as follows: Input is plaintext message M, hash value Z A , digital signature (r, s); First check whether r∈[1,n-1] holds. If not, the verification fails. Then check whether s∈[1,n-1] holds. If not, the verification fails. M and Z A Splice to get M; Use the cryptographic hash function H with a message digest length of v bits v () Compress M to obtain e, and convert the data of e into an integer; Convert r and s to integers and calculate t = (r + s) mod n; If t = 0, the verification fails; Calculate the elliptic curve point (x1, y1) = [s]G + [t]P A , where P A is the public key of user A; Convert the data type of x1 to an integer and calculate R = (e + x1) mod n; Check whether R=r holds true. If so, the verification is successful. If not, the verification fails.

9. The order allocation authentication system based on SM2 digital signature in a distributed cloud scenario according to claim 8 is characterized in that: When generating and verifying digital signatures, data format conversion is performed. When generating digital signatures, the plain text message in string format is converted into a byte array, and then the private key is determined. The private key is used to generate a digital signature for the byte array to obtain a signature in byte array format. If the byte array signature is directly converted into a string, garbled characters will be obtained. Therefore, the byte array signature is first encrypted with Base64 and then converted into a string format to finally obtain a signature in string format. When verifying a digital signature, first convert the string format message and signature into byte arrays. Since Base64 encryption was done when the signature was generated, the byte array of the signature is decrypted with Base64 to obtain the signature to be verified. Then determine the public key, and use the public key to perform the digital signature verification algorithm on the byte array format message and signature to obtain the verification result.

10. The order allocation authentication system based on SM2 digital signature in a distributed cloud scenario according to claim 9 is characterized in that: In the distributed cloud scenario, there are cloud platform systems of multiple cloud centers. Each cloud platform system has an ID. Headquarters managers use the business management system for overall management and control. The business management system stores the IDs of all cloud platform systems and regulates the resource operation behavior of each cloud center through order entry and order allocation. When a cloud center wants to obtain an order to operate on resources, it calls the API interface of the business management system through its own cloud platform system, sends messages in an agreed data format, and interacts to obtain the corresponding order information.

Images