Communication method and device, equipment, storage medium and program product

Abstract

The invention provides a communication method and device, equipment, a storage medium and a program product. The method is applied to a first device, and the method comprises the following steps: generating a first secret key and a second secret key, and sending the second secret key to a second device; receiving a first ciphertext sent by a second device; the first ciphertext is generated by encrypting the first message by the second device according to the second key; obtaining a first polynomial according to the first key and the first ciphertext; obtaining a first target sharing factor by increasing the number of sharing factors of the coefficients of the first polynomial; wherein the coefficient of the first polynomial is expressed by a first target sharing factor; determining a third key according to the first target sharing factor, the second key and the first ciphertext corresponding to the coefficient of the first polynomial; and encrypting a second message to be sent according to the third key and then sending the encrypted message to the second device, or decrypting a third message sent by the second device according to the third key.

Description

Technical Field

[0001] The present application relates to the field of quantum technology, and is related to but not limited to communication methods and devices, equipment, storage media, and program products. Background Art

[0002] In the masking scheme of the Kyber algorithm, arithmetic masking and Boolean masking are used at the same time. Number-Theoretic Transform (NTT), Inverse NTT (NTT -1 ), polynomial addition, subtraction, and multiplication are protected by arithmetic masks, and hashing, polynomial sampling, and other calculations are protected by Boolean masks. The calculated data is also converted to mask type as needed. Although the theoretical security of the Kyber algorithm is guaranteed, it still faces threats such as side channel attacks and fault injection attacks in actual use. In security scenarios, additional security measures are often required, which makes the calculation cost larger. Summary of the invention

[0003] The present application provides a communication method, apparatus, device, storage medium, and program product, wherein:

[0004] In a first aspect, an embodiment of the present application provides a communication method, the method comprising: the method is applied to a first device, the method comprising: generating a first key and a second key, and sending the second key to a second device; receiving a first ciphertext sent by the second device; the first ciphertext is generated by the second device encrypting a first message according to the second key; according to the first key and the first ciphertext, a first polynomial is obtained; by increasing the number of sharing factors of the coefficients of the first polynomial, a first target sharing factor is obtained; wherein the coefficients of the first polynomial are represented by the first target sharing factor; determining a third key according to the first target sharing factor, the second key and the first ciphertext corresponding to the coefficients of the first polynomial respectively; encrypting the second message to be sent according to the third key and sending it to the second device, or decrypting the third message sent by the second device according to the third key.

[0005] In a second aspect, an embodiment of the present application provides a communication device, comprising: a generating module, configured to generate a first key and a second key, and send the second key to a second device; a receiving module, configured to receive a first ciphertext sent by the second device; the first ciphertext is generated by the second device encrypting a first message according to the second key; a first obtaining module, configured to obtain a first polynomial according to the first key and the first ciphertext; a second obtaining module, configured to obtain a first target sharing factor by increasing the number of sharing factors of the coefficients of the first polynomial; wherein the coefficients of the first polynomial are represented by the first target sharing factor; a determining module, configured to determine a third key according to the first target sharing factor, the second key and the first ciphertext corresponding to the coefficients of the first polynomial respectively; a sending module, configured to encrypt the second message to be sent according to the third key and send it to the second device; a decryption module, configured to decrypt the third message sent by the second device according to the third key.

[0006] In a third aspect, an embodiment of the present application provides a first device, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, and when the processor executes the program, the method described in the first aspect is implemented.

[0007] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the method described in the first aspect when the computer program is executed by a processor.

[0008] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the method described in the first aspect.

[0009] In an embodiment of the present application, a first key and a second key are generated, the second key is sent to a second device, and a first ciphertext generated by encrypting a first message based on the second key is received by the second device; in the process of determining a third key based on the received first ciphertext, the number of sharing factors of the coefficients of the first polynomial obtained based on the first key and the first ciphertext is increased to obtain a first target sharing factor; wherein the coefficients of the first polynomial are represented by the first target sharing factor; based on the first target sharing factor, a third key is determined to achieve communication with the second device based on the third key. In this way, in the process of subsequent processing based on the coefficients of the first polynomial, since the number of sharing factors used to represent the coefficients of the first polynomial is greater, a greater number of sharing factors must be obtained to determine the actual values ​​of the coefficients of the first polynomial, thereby improving the security of communication by increasing the cost of attack.

[0010] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0012] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0013] Figure 1 A schematic diagram of exchanging keys provided for this application;

[0014] Figure 2 A schematic diagram of an implementation flow of a communication method provided in an embodiment of the present application;

[0015] Figure 3 A schematic diagram of an implementation flow of obtaining a first target sharing factor provided in an embodiment of the present application;

[0016] Figure 4 A schematic diagram of an implementation process for determining a third key provided in an embodiment of the present application Figure 1 ;

[0017] Figure 5 A schematic diagram of an implementation flow of obtaining a second target sharing factor provided in an embodiment of the present application;

[0018] Figure 6 A schematic diagram of an implementation process for determining a third key provided in an embodiment of the present application Figure 2 ;

[0019] Figure 7 A schematic diagram of an implementation process for determining a third key provided in an embodiment of the present application Figure 3 ;

[0020] Figure 8 A schematic diagram of a decapsulation structure provided in an embodiment of the present application;

[0021] Fig. 9 A schematic diagram of an implementation process for enhancing the security of vulnerable locations provided in an embodiment of the present application;

[0022] Fig.10 A schematic diagram of the structure of a communication device provided in an embodiment of the present application;

[0023] Fig.11 A schematic diagram of the structure of a first device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the specific technical solution of the present application will be further described in detail below in conjunction with the drawings in the embodiments of the present application. The following embodiments are used to illustrate the present application, but are not used to limit the scope of the present application.

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0026] In the following description, reference is made to “some embodiments”, “this embodiment”, “embodiments of the present application” and examples, etc., which describe a subset of all possible embodiments, but it can be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0027] To facilitate understanding of the technical solutions of the embodiments of the present application, the following describes the related technologies or terms of the embodiments of the present application. The following related technologies or related terms as optional solutions can be combined with the technical solutions of the embodiments of the present application at will, and they all belong to the protection scope of the embodiments of the present application.

[0028] (1) Key Encapsulation Algorithm

[0029] Key encapsulation algorithms are mainly used to securely exchange symmetric keys between communicating parties. The sender and receiver can securely share a random session key to ensure that only the legitimate communicating parties can decrypt and read the information. In practical applications, key encapsulation algorithms are widely used in various scenarios, such as protecting the security of transaction data in the financial services industry or ensuring the security of communications in the telecommunications industry. Standards organizations such as the National Institute of Standards and Technology (NIST) and the Internet Engineering Task Force (IETF) have published standards for a variety of key encapsulation algorithms, which are widely used in practical systems.

[0030] (2) Kyber Algorithm

[0031] The Kyber algorithm is currently the only algorithm established by NIST as a post-quantum key encapsulation mechanism, and it has the ability to resist quantum computer attacks. The Kyber algorithm first constructs a public key encryption framework (hereinafter referred to as Kyber.CPAPKE) that is secure under chosen plaintext attacks (Indistinguishability under Chosen Plaintext Attack, IND-CPA), and then obtains a key encapsulation mechanism (hereinafter referred to as Kyber.CCAKEM) that is secure under chosen ciphertext attacks (Indistinguishability under Chosen Ciphertext Attack, IND-CCA) by using a suitable variant of the FO (Fujisaki-Okamoto) transformation.

[0032] Kyber.CCAKEM consists of three parts: key generation Kyber.CCAKEM.KeyGen, key encapsulation Kyber.CCAKEM.Enc, and key decapsulation Kyber.CCAKEM.Dec.

[0033] The way to exchange keys using the Kyber algorithm is as follows Figure 1 As shown, communication party A generates key sk and key pk (i.e., sk, pk=CCAKEM.KeyGen()); communication party A sends key pk to communication party B; communication party B encapsulates the randomly generated message m with key pk to obtain ciphertext ct and shared key K (i.e., Ct, K=CCAKEM.Enc(pk)); communication party B sends ciphertext ct to communication party A; communication party A decapsulates the received ciphertext ct to obtain shared key K (K=CCAKEM.Dec(ct)); communication party A and communication party B communicate through shared key K. In other words, by using the Kyber algorithm, the shared key K is successfully and securely exchanged, and then the shared key K can be used as the key of the symmetric cryptographic system for communication.

[0034] In the Kyber algorithm, the key generation phase generates a private key and a public key. The private key is a vector composed of polynomials with "small" coefficients, while the public key contains two elements: a random polynomial matrix and a polynomial vector. The random polynomial matrix is ​​randomly generated, and the polynomial vector is obtained based on the polynomial matrix, the error vector and the private key, that is, t = As + e; where t represents the polynomial vector, A represents the random polynomial matrix, s represents the private key, and e represents the error vector. In the encryption phase, the message is encrypted using the public key. The encryption process involves multiple randomly generated vectors and polynomials, as well as an error polynomial. These elements work together on the message to generate a ciphertext. In the decryption phase, the ciphertext is decrypted using the private key. The decryption process involves a series of mathematical operations on the ciphertext to eventually recover the original message.

[0035] (3) Sharing Factor

[0036] The shared factor is used to recover the shared key generated during the encapsulation phase during the decapsulation process of the Kyber algorithm. This shared key is the basis for communication between the two parties of the algorithm and is used in the subsequent data encryption or decryption process.

[0037] (4) Mask

[0038] In the Kyber algorithm, masking is a technique used to enhance the security of the Kyber algorithm by processing sensitive data to prevent attackers from obtaining key information through side channel attacks and other means. Masking technology usually involves applying random or pseudo-random numbers to certain intermediate values ​​or keys in the algorithm to hide their true values.

[0039] Masking eliminates the statistical information generated by fixed keys by adding randomness to secret information during execution. During each run, the secret information is split into multiple shared factors, so the value actually participating in the subsequent algorithm calculation changes each time, which can effectively defend against statistical side channel attacks. According to the generation method of shared factors, common masks include arithmetic masks and Boolean masks. A data protected by an N-order mask will be divided into N+1 parts. The original key value can be restored if and only if these N+1 secret values ​​are obtained at the same time.

[0040] For arithmetic masking, the shared factors are restored to their original values ​​by addition, i.e. x = x 1 +…+x n , with arithmetic mask values, which are convenient for linear calculations such as addition, subtraction, and multiplication. For Boolean masks, the shared factors are restored to their original values ​​through XOR calculations, that is, x = x 1 ⊕…⊕x n, which is convenient for bit operations. In the masking scheme of the post-quantum cryptographic algorithm, both are needed, so it is also necessary to be able to convert between the two masking methods, namely arithmetic mask to Boolean mask conversion (A2B) and Boolean mask to arithmetic mask conversion (B2A).

[0041] In the related art, in the masking scheme of the Kyber algorithm, arithmetic masking and Boolean masking are used at the same time. -1 Arithmetic mask protection is used for calculations such as , polynomial addition, subtraction, and multiplication, and Boolean mask protection is used for calculations such as hashing and polynomial sampling. The calculated data is also converted to the mask type as needed.

[0042] However, the related art has the following disadvantages:

[0043] In Kyber’s masking scheme, each coefficient of the message polynomial M with arithmetic mask is compressed into a one-bit value of the message m’ with Boolean mask through a multi-bit to single-bit A2B conversion. When the masking order is low, the single-bit data with mask is easier to model and distinguish than the data in other positions due to the small number of bits.

[0044] If the number of mask orders of the overall scheme is increased, the overhead will increase significantly. Usually, the computational overhead of an N-order mask protection scheme is at least N+1 times that of an unprotected scheme.

[0045] Based on the above analysis, the present application provides a communication method. Figure 2 A schematic diagram of an implementation flow of a communication method provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the method may include the following steps 201 to 207:

[0046] Step 201, generating a first key and a second key, and sending the second key to a second device;

[0047] Step 202, receiving a first ciphertext sent by a second device; the first ciphertext is generated by the second device encrypting the first message according to the second key;

[0048] Step 203, obtaining a first polynomial according to the first key and the first ciphertext;

[0049] Step 204, obtaining a first target sharing factor by increasing the number of sharing factors of the coefficients of the first polynomial; wherein the coefficients of the first polynomial are represented by the first target sharing factor;

[0050] Step 205, determining a third key according to the first target shared factor, the second key and the first ciphertext corresponding to the coefficients of the first polynomial respectively;

[0051] Step 206, encrypting the second message to be sent according to the third key and sending the message to the second device;

[0052] Step 207: decrypt the third message sent by the second device according to the third key.

[0053] In the embodiment of the present application, the execution order of step 206 and step 207 is not limited.

[0054] It can be understood that in the embodiment of the present application, a first key and a second key are generated, the second key is sent to the second device, and the first ciphertext generated by the second device encrypting the first message based on the second key is received; in the process of determining the third key based on the received first ciphertext, the number of sharing factors of the coefficients of the first polynomial obtained based on the first key and the first ciphertext is increased to obtain the first target sharing factor; wherein the coefficients of the first polynomial are represented by the first target sharing factor; based on the first target sharing factor, the third key is determined to achieve communication with the second device based on the third key. In this way, in the process of subsequent processing based on the coefficients of the first polynomial, since the number of sharing factors used to represent the coefficients of the first polynomial is larger, a larger number of sharing factors must be obtained to determine the actual value of the coefficients of the first polynomial, thereby improving the security of communication by increasing the cost of attack.

[0055] In the embodiments of the present application, the first device or the second device may be a computer processing device, a mobile phone, a tablet computer, a laptop computer, a PDA, a wearable device, etc., which is not specifically limited here.

[0056] It should be understood that in the embodiment of the present application, the coefficients of the first polynomial are represented by the sharing factors corresponding to the coefficients; the sharing factors corresponding to the coefficients are determined based on the actual values ​​of the coefficients and the masks corresponding to the coefficients; the mask order is positively correlated with the number of the sharing factors. In other words, increasing the number of sharing factors of the coefficients of the first polynomial can increase the mask order of the coefficients of the first polynomial.

[0057] The following describes further optional implementations and related terms of each of the above steps.

[0058] In step 201, a first key and a second key are generated, and the second key is sent to a second device.

[0059] In some embodiments, generating the first key and the second key can be understood as key generation. As a possible implementation, the first device generates a private key and a public key; and sends the public key to the second device.

[0060] In step 202, a first ciphertext sent by the second device is received; the first ciphertext is generated by the second device encrypting a first message according to the second key.

[0061] It should be understood that in the embodiments of the present application, the first message is not limited. In some embodiments, the first message is randomly generated by the second device.

[0062] In some embodiments, the second device encrypting the first message according to the second key can be understood as key encapsulation.

[0063] In step 203, a first polynomial is obtained according to the first key and the first ciphertext.

[0064] It should be understood that in the embodiment of the present application, obtaining the first polynomial based on the first key and the first ciphertext can be understood as an implementation step of the key decapsulation process.

[0065] In step 204, a first target sharing factor is obtained by increasing the number of sharing factors of the coefficients of the first polynomial; wherein the coefficients of the first polynomial are represented by the first target sharing factor.

[0066] It should be understood that in the embodiment of the present application, increasing the number of shared factors of the coefficients of the first polynomial can increase the mask order of the coefficients of the first polynomial; wherein the mask order is positively correlated with the number of shared factors;

[0067] In some embodiments, Figure 3 A schematic diagram of an implementation flow of obtaining a first target sharing factor provided in an embodiment of the present application is as follows: Figure 3 As shown, the first target sharing factor can be obtained through the following steps 301 to 303:

[0068] Step 301, generating N sharing factors; wherein the formats of the generated N sharing factors are determined by the formats of the sharing factors of the coefficients of the first polynomial; the values ​​of the generated N sharing factors are first values; N is greater than or equal to 1;

[0069] Step 302, refreshing the generated N sharing factors and the corresponding sharing factors of the coefficients of the first polynomial through a mask refresh function to obtain a first target sharing factor;

[0070] Step 303, repeat the above steps until each coefficient of the first polynomial has been executed, and the first target sharing factors corresponding to the coefficients of the first polynomial are obtained.

[0071] It should be understood that in the embodiment of the present application, the first value is not limited. In some embodiments, the first value is 0. In the embodiment of the present application, the actual value of N is also not limited, and N can be determined based on the number of current sharing factors of the coefficients of the first polynomial and the number of target sharing factors of the coefficients of the first polynomial.

[0072] In the embodiment of the present application, the mask refresh function is not limited. The input of the refresh mask function is data with an A-order mask, and the output is data also with an A-order mask, but the value of the sharing factor is randomly regenerated, and the randomly generated sharing factors are merged to obtain the original data.

[0073] Exemplarily, as a possible implementation, if the coefficients of the first polynomial are protected by an A-order mask (i.e., the number of shared factors of the coefficients is A+1), and the target mask order is A+N, then the mask order is increased as follows:

[0074] 1. Generate N shared factors of the same format as the shared factors of the coefficients of the first polynomial, whose values ​​are 0.

[0075] 2. The original A+1 shared factors and the newly generated N shared factors are used as inputs of the mask refresh function.

[0076] 3. After calculation of the mask refresh function, A+N+1 shared factors with random values ​​are output, and the output A+N+1 shared factors can be combined to obtain the coefficients they represent.

[0077] The above steps are repeatedly performed until each coefficient of the first polynomial has been subjected to the above steps, thereby achieving the goal of increasing the masking order of the coefficients of the first polynomial to A+N.

[0078] The value of the mask order is the number of shared factors minus 1.

[0079] In step 205, a third key is determined based on the first target shared factor, the second key and the first ciphertext corresponding to the coefficients of the first polynomial respectively.

[0080] In some embodiments, Figure 4 A schematic diagram of an implementation process for determining a third key provided in an embodiment of the present application Figure 1 ,like Figure 4 As shown, the third key can be determined through the following steps 401 to 404:

[0081] Step 401, compressing first target shared factors corresponding to the coefficients of the first polynomial to obtain a plurality of first bits;

[0082] Step 402, concatenate multiple first bits to obtain a fourth message;

[0083] Step 403, combining the sharing factors of the fourth message to obtain a second target sharing factor; wherein the fourth message is represented by the second target sharing factor;

[0084] Step 404: Determine a third key based on the second target shared factor, the second key, and the first ciphertext.

[0085] It should be understood that in the embodiment of the present application, the sharing factors of the fourth message are merged to reduce the number of sharing factors of the fourth message, thereby reducing the mask order of the fourth message.

[0086] It can be understood that in the embodiment of the present application, the first target sharing factors corresponding to the coefficients of the first polynomial are compressed to obtain multiple first bits; the multiple first bits are concatenated to obtain the fourth message; the sharing factors of the fourth message are combined to obtain the second target sharing factor; the third key is determined according to the second target sharing factor, the second key and the first ciphertext. In this way, since the number of sharing factors of the fourth message is reduced after the fourth message is obtained, the computational overhead of the communication can be reduced while improving the security of the communication.

[0087] It should be understood that in the embodiment of the present application, the sharing factors of the first target corresponding to the coefficients of the first polynomial are compressed to obtain the first bit. Considering that the first bit has a small number of bits and is easier to be distinguished by modeling, before obtaining the first bit, the number of sharing factors of the coefficients of the first polynomial is increased, so that the number of sharing factors representing the first bit is also increased, thereby increasing the attack cost of the first bit, thereby improving the security of communication.

[0088] Since the fourth message is obtained by concatenating multiple first bits, that is, even if the number of sharing factors representing the first bit is not increased, the number of sharing factors representing the fourth message is relatively large. In other words, even if the number of sharing factors representing the first bit is not increased, the security of the fourth message is relatively high.

[0089] Based on this, after concatenating multiple first bits with increased numbers of sharing factors, the number of sharing factors of the obtained fourth message is reduced, which can reduce the computational overhead of communication while ensuring the security of communication.

[0090] In some embodiments, the number of the second target sharing factors is the same as the number of sharing factors of the coefficients of the first polynomial.

[0091] In some embodiments, Figure 5A schematic diagram of an implementation flow of obtaining a second target sharing factor provided in an embodiment of the present application is as follows: Figure 5 As shown, the second target sharing factor can be obtained through the following steps 501 to 503:

[0092] Step 501, selecting N+1 sharing factors from the sharing factors of the fourth message;

[0093] Step 502, merging N+1 sharing factors to obtain a merged sharing factor;

[0094] Step 503: Use the combined sharing factor and the unselected sharing factor as the second target sharing factor.

[0095] It should be understood that in the embodiments of the present application, the specific selection method for selecting N+1 sharing factors from the sharing factors of the fourth message is not limited. In some embodiments, N+1 sharing factors are selected in order from the sharing factors of the fourth message. In other embodiments, N+1 sharing factors are randomly selected from the sharing factors of the fourth message. The specific implementation method for merging N+1 sharing factors is not limited. In some embodiments, the mask of the fourth message is an arithmetic mask, and the N+1 sharing factors are accumulated to obtain the merged sharing factors. In some embodiments, the mask of the fourth message is a Boolean mask, and the N+1 sharing factors are XORed to obtain the merged sharing factors.

[0096] Exemplarily, as a possible implementation, if the fourth message is protected by an A+N order mask and needs to be restored to an A order mask, the method of reducing the mask order is as follows:

[0097] 1. Randomly or sequentially select N+1 shared factors from A+N+1 shared factors.

[0098] 2. Merge the selected shared factors according to the mask type, such as summing all shared factors for arithmetic mask and XORing all shared factors for Boolean mask. At this time, a merged result is obtained as a shared factor of the data.

[0099] 3. The sharing factors obtained in step 2 and the unselected sharing factors in step 1, totaling A+1, are used as sharing factors for the data, and these A+1 sharing factors are combined to obtain the fourth message.

[0100] In some embodiments, Figure 6 A schematic diagram of an implementation process for determining a third key provided in an embodiment of the present application Figure 2 ,like Figure 6 As shown, the third key can be determined through the following steps 601 to 604:

[0101] Step 601, hashing the second target shared factor and the second key to obtain a second polynomial;

[0102] Step 602, performing hash processing on the second polynomial and multiple values ​​to obtain multiple first byte groups respectively; wherein the multiple values ​​are randomly generated;

[0103] Step 603, obtaining a third target sharing factor by increasing the number of sharing factors of the first byte group; wherein the first byte group is represented by the third target sharing factor;

[0104] Step 604: Determine a third key according to the third target shared factor, the second key and the first ciphertext.

[0105] It should be understood that in the embodiment of the present application, the number of sharing factors of the first byte group is increased to increase the mask order of the first byte group.

[0106] It can be understood that in the embodiment of the present application, the second target sharing factor and the second key are hashed to obtain a second polynomial; the second polynomial and multiple numerical values ​​are hashed to obtain multiple first byte groups respectively; the third target sharing factor is obtained by increasing the number of sharing factors of the first byte group; the third key is determined according to the third target sharing factor, the second key and the first ciphertext. In this way, in the process of subsequent processing based on the first byte group, since the number of sharing factors used to represent the first byte group is larger, the number of sharing factors used to represent the bit value in the first byte group is also larger, thereby increasing the attack cost of the bit value in the first byte group, thereby improving the security of communication by increasing the attack cost.

[0107] In some embodiments, a third target sharing factor is obtained by increasing the number of sharing factors of the first byte group, including: generating N sharing factors; wherein the format of the generated N sharing factors is determined by the format of the sharing factors of the first byte group; the values ​​of the generated N sharing factors are first values; N is greater than or equal to 1; refreshing the generated N sharing factors and the corresponding sharing factors of the first byte group through a mask refresh function to obtain a third target sharing factor; repeating the above steps until each first byte group has executed the above steps to obtain the third target sharing factors corresponding to the first byte groups respectively.

[0108] For example, as a possible implementation, if the first byte group is protected by an A-order mask (that is, the number of sharing factors of the first byte group is A+1), and the target mask order is A+N, the mask order is increased as follows:

[0109] 1. Generate N sharing factors in the same format as the sharing factors of the first byte group, whose values ​​are 0.

[0110] 2. The original A+1 shared factors and the newly generated N shared factors are used as inputs of the mask refresh function.

[0111] 3. After calculation of the mask refresh function, A+N+1 shared factors with random values ​​are output, and the output A+N+1 shared factors can be combined to obtain the corresponding first byte group.

[0112] The above steps are repeatedly performed until each first byte group has performed the above steps, thereby achieving the mask order of the first byte group being increased to A+N.

[0113] In some embodiments, the third target sharing factor includes: a plurality of groups of sub-target sharing factors; wherein the sub-target sharing factors are used to represent bit values ​​in the first byte group; Figure 7 A schematic diagram of an implementation process for determining a third key provided in an embodiment of the present application Figure 3 ,like Figure 7 As shown, the third key can be determined through the following steps 701 to 703:

[0114] Step 701, multiple groups of sub-goal sharing factors in the third goal sharing factor are sampled multiple times to obtain multiple third polynomials; i groups of sub-goal sharing factors are sampled once; i is greater than or equal to 1;

[0115] Step 702, combining the sharing factors of the coefficients of the third polynomial to obtain a fourth target sharing factor; wherein the coefficients of the third polynomial are represented by the fourth target sharing factor;

[0116] Step 703: Determine the third key according to the fourth target shared factor, the second key and the first ciphertext corresponding to the coefficients of the third polynomial.

[0117] It should be understood that in the embodiment of the present application, merging the shared factors of the coefficients of the third polynomial can reduce the number of shared factors of the coefficients of the third polynomial, thereby reducing the mask order of the third polynomial.

[0118] It can be understood that in the embodiment of the present application, multiple groups of sub-target sharing factors in the third target sharing factor are sampled multiple times to obtain multiple third polynomials, and i groups of sub-target sharing factors are sampled at a time; the sharing factors of the coefficients of the third polynomial are merged to obtain the fourth target sharing factor; the third key is determined according to the fourth target sharing factor, the second key and the first ciphertext corresponding to the coefficients of the third polynomial. In this way, since the number of sharing factors of the third polynomial is reduced after the third polynomial is obtained, the computational overhead of communication can be reduced while improving the security of communication.

[0119] It should be understood that in the embodiments of the present application, the actual value of i is not limited. In some embodiments, i is 2; in other embodiments, i is 3.

[0120] It should be understood that in the embodiment of the present application, multiple groups of sub-target sharing factors in the third target sharing factor are sampled, and i groups of sub-target sharing factors are sampled at a time. Considering that the number of bits obtained by sampling is small, it is easier to be distinguished by modeling. Therefore, before sampling, the number of sharing factors of the first byte group is increased, so that the number of sharing factors representing the bit values ​​in the first byte group obtained by sampling is increased, thereby increasing the attack cost of the sampled bit values, thereby improving the security of communication.

[0121] Since the coefficients of the third polynomial are obtained by sampling multiple groups of sub-target sharing factors in the third target sharing factor multiple times, that is, even if the number of sharing factors representing the first byte group is not increased, the number of sharing factors representing the third polynomial is also large. In other words, even if the number of sharing factors representing the first byte group is not increased, the security of the third polynomial is also high.

[0122] Based on this, the number of shared factors of the coefficients of the obtained third polynomial is reduced, which can reduce the computational overhead of communication while ensuring the security of communication.

[0123] For example, as a possible implementation, if the coefficients of the third polynomial are protected by an A+N order mask and need to be restored to an A order mask, the mask order is reduced as follows:

[0124] 1. Randomly or sequentially select N+1 shared factors from A+N+1 shared factors.

[0125] 2. Merge the selected shared factors according to the mask type, such as summing all shared factors for arithmetic mask and XORing all shared factors for Boolean mask. At this time, a merged result is obtained as a shared factor of the data.

[0126] 3. The shared factors obtained in step 2 and the shared factors not selected in step 1, totaling A+1, are used as the shared factors of the data; wherein, after combining these A+1 shared factors, the coefficients of the third polynomial they represent can be obtained.

[0127] Repeat the above steps until each coefficient of the third polynomial has been processed.

[0128] In step 206, the second message to be sent is encrypted according to the third key and then sent to the second device.

[0129] In step 207, the third message sent by the second device is decrypted according to the third key.

[0130] The following examples describe possible implementations of the communication methods described in one or more of the above embodiments.

[0131] The embodiment of the present application provides a method for improving the security of vulnerable positions of the Kyber masking scheme (i.e., an example of a communication method). The method provides targeted protection for vulnerable points in the Kyber algorithm (i.e., an example of vulnerable positions), adds an additional mask order at the vulnerable position, and restores the mask order to the order used by the Kyber algorithm after the calculation is completed. Therefore, only the calculation overhead at the protected position (i.e., an example of the vulnerable position) is increased. Compared with the overall increase in the mask order, the overhead is greatly reduced.

[0132] This application proposes a mask protection scheme (i.e., an example of a communication method) for enhancing the security of a key position (i.e., an example of a vulnerable position) for the mask-protected Kyber algorithm. By adjusting the number of sharing factors of the secret information of the vulnerable position, the overall overhead is less affected while the security of the position is increased. Specifically, it includes:

[0133] 1. In the Kyber algorithm, before compressing the message polynomial coefficients to a single bit of the message, a mask refresh operation is used to increase the number of shared factors, that is, a higher-order mask is used at that position; or in the Kyber algorithm, before sampling multiple masked byte groups, the mask order of multiple masked byte groups is increased so that the bit values ​​in the masked byte groups use a higher-order mask.

[0134] 2. When converting mask A2B, use the modified mask order for conversion; or when converting mask B2A, use the modified mask order for conversion

[0135] 3. After all coefficients are converted, the obtained bits with masks are concatenated into a message, and then some shared factors are merged to reduce the mask order to the original order; or the obtained polynomial vector e is obtained 1 、e 2 , polynomial e 3 The shared factors of are combined to reduce the mask order to the original order.

[0136] It should be understood that in the embodiments of the present application, the mask scheme is widely used due to its high security. And a major disadvantage of the mask scheme is the additional computational overhead. Usually in practical applications, a mask of a higher order is not used for protection. In the Kyber algorithm, there are operations on single-bit or a small amount of bit data. At this time, a lower-order mask (such as a first-order or second-order mask) is used for protection, and the security in the face of template attacks is lower than that of other multi-bit data positions. By increasing the mask order before this type of vulnerable position, the mask order is restored after being separated from the vulnerable point calculation, thereby effectively improving the security of the vulnerable position, so that the security of the entire mask scheme can be improved. At the same time, the operation used in the embodiments of the present application is possessed by the mask scheme itself, and the function or operation implemented by the original scheme can be completed, so it has good practicality and versatility.

[0137] The communication method provided in the embodiment of the present application is aimed at the decapsulation part of the Kyber algorithm using mask protection. The decapsulation structure of the Kyber algorithm is as follows: Figure 8 As shown, Figure 8 As shown, 801 and 802 are the vulnerable positions targeted by the communication method provided in the embodiment of the present application, KDF represents the key derivation function, and PRF represents the pseudo-random function; in the decapsulation process, arithmetic masks and Boolean masks are used. When different types of masks are used in the previous and subsequent calculations, mask conversion is required.

[0138] The specific process of decapsulation of the Kyber algorithm modified in this application is as follows:

[0139] 1. The message polynomial M (i.e., an example of the first polynomial) is calculated and solved by the Kyber.CPAPKE key s and the ciphertext c (i.e., an example of the first ciphertext), where M is a polynomial with 256 coefficients.

[0140] 2. Each coefficient of the polynomial M corresponds to a bit of the message m' (i.e., an example of the fourth message), and the corresponding bit value is obtained by compressing the coefficients of the polynomial M. Before performing the compression calculation, the order of the mask used for each coefficient of the polynomial M is increased by increasing the mask order.

[0141] 3. Perform compression calculation on the polynomial M after increasing the mask order. Each coefficient (the first target shared factor involved in the calculation) is used to calculate a bit of the message m' (i.e., an example of the first bit). At this time, the mask order corresponding to the bit is the increased order.

[0142] 4. Modify the mask used for the message m' to reduce the number of shared factors representing the message m', and reduce the number of shared factors representing the message m' to the number of shared factors corresponding to the coefficients of the polynomial M.

[0143] 5. Hash the message m' with the public key hash value to get (ie, an example of the third key) and r' (ie, an example of the second polynomial).

[0144] 6. Hash r' and a value Nonce that is used only once (ie, an example of multiple values) to obtain multiple masked byte groups (ie, an example of multiple first byte groups), and increase the mask order of the multiple masked byte groups.

[0145] 7. According to the sampling requirements of the decapsulation process in the Kyber algorithm, a coefficient of the polynomial (i.e., an example of the third polynomial) is obtained using 2 or 3 bit center binomial sampling (CBD). The order of the mask used is increased by increasing the mask order before sampling.

[0146] 8. Sample the polynomial vector e from the byte group after increasing the mask order 1 、e 2 , polynomial e 3 , the mask order of these data is the order after the increase. Among them, the polynomial vector e 1 、e 2 is composed of polynomials. 1 、e 2 and e 3 Each is an example of a third polynomial.

[0147] 9. For e 1 、e 2 、e 3 The used mask is modified to reduce the number of sharing factors and restore the mask order of the masked byte group before the promotion.

[0148] 10. Obtain the polynomial matrix A and polynomial vector t from the public key.

[0149] 11. Calculate u′=Ae 1 +e 2 , v′=te 1 +e 3 +decompress(m′). The calculation of u′ and v′ is only used to illustrate the multiplication case, and the matrix transposition calculation is not considered.

[0150] 12. Use the masked ciphertext comparison method to determine whether the result in 11 is consistent with the input ciphertext.

[0151] 13. If the comparison result is consistent, the correct shared key is returned

[0152] 14. If the comparison result is inconsistent, the hash result of part z in the KEM key and the ciphertext c is returned.

[0153] In the above calculations, all are masked calculations, and the secret data is divided into multiple shared factors.

[0154] Fig. 9 A schematic diagram of an implementation process for enhancing the security of vulnerable locations provided in an embodiment of the present application is as follows: Fig. 9 As shown, the security of the vulnerable location can be enhanced through the following steps 901 to 904:

[0155] Step 901, determine the vulnerable position.

[0156] Step 902, increasing the mask order.

[0157] Among them, increasing the mask order corresponds to the above step 2 (each coefficient of the polynomial M corresponds to a bit of the message m', and the corresponding bit value is obtained by compressing the coefficient of the polynomial M. Before the compression (Compress) calculation, the order of the mask used is increased by increasing the mask order) or step 7 (according to the sampling requirements of the decapsulation process in the Kyber algorithm, 2 or 3 bits of central binomial sampling (CBD) are used to obtain a coefficient of the polynomial. Before sampling, the order of the mask used is increased by increasing the mask order).

[0158] Step 903, perform security calculation.

[0159] Among them, the increased mask order corresponds to the above step 3 (compression calculation is performed with the polynomial M after the increased mask order, and each coefficient is calculated to obtain a bit of the message m', and the mask order corresponding to the bit is the increased order) or step 8 (sample the polynomial vector e from the byte group after the increased mask order) 1 、e 2 , polynomial e 3 , at this time, the mask order of these data is the improved order).

[0160] Step 904, reducing the mask order.

[0161] Among them, increasing the mask order corresponds to the above step 4 (modifying the mask used for message m', reducing the number of shared factors representing message m', and reducing the number of shared factors representing message m' to the mask order corresponding to the coefficients of polynomial M) or step 9 (modifying the mask used for message m', reducing the number of shared factors representing message m' to the mask order corresponding to the coefficients of polynomial M) 1 、e 2 、e 3 The mask used is modified to reduce the number of sharing factors and restore the mask order of the masked byte group before the promotion).

[0162] First, analyze the Kyber algorithm to determine the vulnerable position. The vulnerable position targeted by this application is a single bit or a small number of bits of secret information in the Kyber algorithm process. Such secret information is more easily modeled to leak information. In the decapsulation process of the Kyber algorithm, the single bit value of the message m' is the vulnerable position, and the polynomial coefficient generated by a small number of bits of the byte group also belongs to the vulnerable position. Afterwards, before calculating the target data, the mask order is increased so that the position has higher security. After the mask order is increased, the calculation corresponding to the target position is performed. At this time, the secret data is protected by the mask with the increased order. After the calculation is completed, the mask order is reduced. Other subsequent calculations continue to be performed with the original mask order.

[0163] In the embodiment of the present application, by increasing the mask order before this type of vulnerable position and restoring the mask order after completing the operation of the vulnerable position, the security of the vulnerable position is effectively improved, thereby improving the security of the entire mask scheme.

[0164] Among them, for the method of increasing the mask order, first increase the 0-value sharing factor, and then refresh the data mask through the mask refresh function, so that the number of sharing factors increases, that is, the mask order increases. If the original data (which can be the coefficients of the polynomial M or the byte group with mask) is protected by the A-order mask, and the target mask order is A+N, the method of increasing the mask order is as follows:

[0165] 1, generate N shared factors in the same format as the original data, whose value is 0.

[0166] 2. The A+1 shared factors of the original data and the newly generated N shared factors are used as the input of the mask refresh function.

[0167] 3. After the calculation of the mask refresh function, A+N+1 shared factors with random values ​​are output, and the output A+N+1 shared factors can be combined to obtain their representative data. At this point, the mask order is improved.

[0168] It should be noted that the mask refresh function used is a necessary component of the mask scheme. If the input of the function is data with an N-order mask, the output is data with the same N-order mask, but the value of the shared factor is randomly generated again.

[0169] In some embodiments, the method of reducing the mask order is implemented by directly merging redundant shared factors. If the current data (which can be a message m' or a polynomial vector e) is 1 、e 2 , polynomial e 3) is protected by A+N order mask and needs to be restored to A order mask. The way to reduce the mask order is as follows:

[0170] 1. Randomly or sequentially select N+1 shared factors from A+N+1 shared factors.

[0171] 2. Merge the selected shared factors according to the mask type, such as summing all shared factors for arithmetic mask and XORing all shared factors for Boolean mask. At this time, a merged result is obtained as a shared factor of the data.

[0172] 3. The shared factors obtained in step 2 and the shared factors not selected in step 1 are A+1 in total, which are used as the shared factors of the data, and these shared factors are combined to obtain the current data. At this point, the mask order reduction is completed.

[0173] The method of enhancing the security of the mask proposed in this application can not only be used in the above two vulnerable locations, but can also be arbitrarily configured into the steps of the Kyber algorithm process according to needs, and is used to locally improve the security of the mask scheme with a small amount of overhead. In addition, the security of similar vulnerable locations or usage requirements in other post-quantum cryptographic algorithms can also be improved.

[0174] In the embodiment of the present application, the order of the mask is increased by first adding a sharing factor with a value of 0, and then using the existing mask refresh operation in the mask algorithm system, while the order of the mask is reduced by merging redundant sharing factors, and only an XOR operation is required. Therefore, the method is easy to apply in various scenarios.

[0175] In the embodiment of the present application, the mask order is increased only at the target position (ie, an example of a vulnerable position), and the computational overhead at this position is increased, but it does not affect the computational overhead at other positions, so the overhead impact is small.

[0176] In some embodiments, the security enhancement method for the target vulnerable position can also be to obtain a single-bit result, concatenate it with several noise bits, and then use it as a whole. When concatenating to obtain the message m', the noise bits are ignored and only the bit positions with information are operated.

[0177] It should be noted that although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.; or, steps in different embodiments may be combined into a new technical solution.

[0178] Based on the foregoing embodiments, an embodiment of the present application provides a communication device, which includes the modules included and the units included in the modules, which can be implemented by a processor; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be an AI acceleration engine (such as NPU, etc.), GPU, central processing unit (CPU), microprocessor (MPU), digital signal processor (DSP) or field programmable gate array (FPGA), etc.

[0179] Fig.10 A schematic diagram of the structure of a communication device provided in an embodiment of the present application is shown in FIG. Fig.10 As shown, the communication device 100 includes a generating module 1001, a receiving module 1002, a first obtaining module 1003, a second obtaining module 1004, a determining module 1005, a sending module 1006 and a decryption module 1007, wherein:

[0180] A generating module 1001 is configured to generate a first key and a second key, and send the second key to a second device;

[0181] The receiving module 1002 is configured to receive a first ciphertext sent by the second device; the first ciphertext is generated by the second device encrypting the first message according to the second key;

[0182] A first obtaining module 1003 is configured to obtain a first polynomial according to the first key and the first ciphertext;

[0183] A second obtaining module 1004 is configured to obtain a first target sharing factor by increasing the number of sharing factors of the coefficients of the first polynomial; wherein the coefficients of the first polynomial are represented by the first target sharing factor;

[0184] A determination module 1005 is configured to determine a third key according to the first target shared factor, the second key and the first ciphertext respectively corresponding to the coefficients of the first polynomial;

[0185] A sending module 1006, configured to encrypt the second message to be sent according to the third key and then send the encrypted message to the second device;

[0186] The decryption module 1007 is configured to decrypt the third message sent by the second device according to the third key.

[0187] In some embodiments, the determination module 1005 is configured to compress the first target sharing factors corresponding to the coefficients of the first polynomial to obtain multiple first bits; concatenate the multiple first bits to obtain a fourth message; merge the sharing factors of the fourth message to obtain a second target sharing factor; wherein the fourth message is represented by the second target sharing factor; and determine the third key based on the second target sharing factor, the second key and the first ciphertext.

[0188] In some embodiments, the determination module 1005 is configured to hash the second target sharing factor and the second key to obtain a second polynomial; hash the second polynomial and multiple numerical values ​​to obtain multiple first byte groups respectively; wherein the multiple numerical values ​​are randomly generated; obtain a third target sharing factor by increasing the number of sharing factors of the first byte group; wherein the first byte group is represented by the third target sharing factor; and determine the third key based on the third target sharing factor, the second key and the first ciphertext.

[0189] In some embodiments, the third target sharing factor includes: multiple groups of sub-target sharing factors; wherein the sub-target sharing factors are used to represent the bit values ​​in the first byte group; the determination module 1005 is configured to sample multiple groups of the sub-target sharing factors in the third target sharing factor multiple times to obtain multiple third polynomials; wherein i groups of the sub-target sharing factors are sampled at a time; wherein i is greater than or equal to 1; the sharing factors of the coefficients of the third polynomial are merged to obtain a fourth target sharing factor; wherein the coefficients of the third polynomial are represented by the fourth target sharing factor; the third key is determined according to the fourth target sharing factors, the second key and the first ciphertext corresponding to the coefficients of the third polynomial.

[0190] In some embodiments, the second obtaining module 1004 is configured to generate N sharing factors; wherein the format of the generated N sharing factors is determined by the format of the sharing factors of the coefficients of the first polynomial; the values ​​of the generated N sharing factors are first values; N is greater than or equal to 1; the generated N sharing factors and the corresponding sharing factors of the coefficients of the first polynomial are refreshed through a mask refresh function to obtain a first target sharing factor; repeat the above steps until each coefficient of the first polynomial has executed the above steps to obtain the first target sharing factors corresponding to the coefficients of the first polynomial.

[0191] In some embodiments, the merging of the sharing factors of the fourth message to obtain a second target sharing factor includes: selecting N+1 sharing factors from the sharing factors of the fourth message; merging the N+1 sharing factors to obtain a merged sharing factor; and using the merged sharing factor and the unselected sharing factor as the second target sharing factor.

[0192] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0193] It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit. It may also be implemented in the form of a combination of software and hardware.

[0194] It should be noted that in the embodiment of the present application, if the above method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly embodied in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions to enable the first device to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific combination of hardware and software.

[0195] This embodiment of the application provides a first device, Fig.11 A schematic diagram of the structure of a first device provided in an embodiment of the present application is shown in FIG. Fig.11 As shown, the first device 110 includes a memory 1101 and a processor 1102, wherein the memory 1101 stores a computer program that can be run on the processor 1102, and the processor 1102 implements the steps in the method provided in the above embodiment when executing the program.

[0196] It should be noted that the memory 1101 is configured to store instructions and applications executable by the processor 1102, and can also cache data to be processed or processed by the processor 1102 and various modules in the first device 110 (for example, image data, audio data, voice communication data, and video communication data), which can be implemented through flash memory (FLASH) or random access memory (Random Access Memory, RAM).

[0197] An embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the method provided in the above embodiment are implemented.

[0198] An embodiment of the present application provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the steps of the method provided in the above method embodiment.

[0199] It should be noted here that the description of the above first device, storage medium and computer program product embodiments is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the first device, storage medium and computer program product embodiments of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0200] It should be understood that "one embodiment" or "an embodiment" or "some embodiments" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in one embodiment" or "in some embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments. The above description of each embodiment tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. For the sake of brevity, this article will not repeat them.

[0201] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, object A and / or object B can represent three situations: object A exists alone, object A and object B exist at the same time, and object B exists alone.

[0202] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0203] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as: multiple modules or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or modules can be electrical, mechanical or other forms.

[0204] The modules described above as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules; they may be located in one place or distributed on multiple network units; some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0205] In addition, all functional modules in the embodiments of the present application may be integrated into one processing unit, or each module may be a separate unit, or two or more modules may be integrated into one unit; the above-mentioned integrated modules may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0206] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, etc., various media that can store program codes.

[0207] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for the first device to execute all or part of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks or optical disks.

[0208] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0209] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0210] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0211] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A communication method, characterized in that: The method is applied to a first device, and the method includes: generating a first key and a second key, and sending the second key to a second device; receiving a first ciphertext sent by the second device; the first ciphertext is generated by the second device encrypting the first message according to the second key; Obtaining a first polynomial according to the first key and the first ciphertext; Obtaining a first target sharing factor by increasing the number of sharing factors of coefficients of the first polynomial; wherein the coefficients of the first polynomial are represented by the first target sharing factor; Determine a third key according to the first target shared factor, the second key, and the first ciphertext corresponding to the coefficients of the first polynomial respectively; The second message to be sent is encrypted according to the third key and then sent to the second device, or the third message sent by the second device is decrypted according to the third key.

2. The method according to claim 1, characterized in that The determining the third key according to the first target shared factor, the second key, and the first ciphertext respectively corresponding to the coefficients of the first polynomial includes: Compressing first target shared factors corresponding to coefficients of the first polynomial to obtain a plurality of first bits; splicing the multiple first bits to obtain a fourth message; Combining the sharing factors of the fourth message to obtain a second target sharing factor; wherein the fourth message is represented by the second target sharing factor; The third key is determined according to the second target shared factor, the second key and the first ciphertext.

3. The method according to claim 2, characterized in that The determining the third key according to the second target shared factor, the second key, and the first ciphertext includes: Hash the second target shared factor and the second key to obtain a second polynomial; Performing hash processing on the second polynomial and multiple values ​​to obtain multiple first byte groups respectively; wherein the multiple values ​​are randomly generated; By increasing the number of sharing factors of the first byte group, a third target sharing factor is obtained; wherein the first byte group is represented by the third target sharing factor; The third key is determined according to the third target shared factor, the second key and the first ciphertext.

4. The method according to claim 3, characterized in that The third target sharing factor includes: a plurality of groups of sub-target sharing factors; wherein the sub-target sharing factors are used to represent the bit values ​​in the first byte group; The determining the third key according to the third target shared factor, the second key and the first ciphertext includes: Sampling multiple groups of the sub-goal sharing factors in the third goal sharing factor multiple times to obtain multiple third polynomials; wherein i groups of the sub-goal sharing factors are sampled at a time; i is greater than or equal to 1; Combining the sharing factors of the coefficients of the third polynomial to obtain a fourth target sharing factor; wherein the coefficients of the third polynomial are represented by the fourth target sharing factor; Determine a third key according to the fourth target shared factor, the second key and the first ciphertext corresponding to the coefficients of the third polynomial respectively.

5. The method according to any one of claims 1 to 4, characterized in that: The step of obtaining a first target sharing factor by increasing the number of sharing factors of coefficients of the first polynomial comprises: Generate N sharing factors; wherein the formats of the generated N sharing factors are determined by the formats of the sharing factors of the coefficients of the first polynomial; the values ​​of the generated N sharing factors are first values; and N is greater than or equal to 1; Refresh the generated N sharing factors and the corresponding sharing factors of the coefficients of the first polynomial through a mask refresh function to obtain a first target sharing factor; Repeat the above steps until each coefficient of the first polynomial has been processed to obtain the first target sharing factors corresponding to the coefficients of the first polynomial.

6. The method according to any one of claims 2 to 4, characterized in that: The combining the sharing factors of the fourth messages to obtain a second target sharing factor includes: Selecting N+1 sharing factors from the sharing factors of the fourth message; Merging the N+1 shared factors to obtain a merged shared factor; The combined sharing factor and the unselected sharing factor are used as the second target sharing factor.

7. A communication device, comprising: A generating module configured to generate a first key and a second key, and send the second key to a second device; a receiving module, configured to receive a first ciphertext sent by the second device; The first ciphertext is generated by the second device encrypting the first message according to the second key; A first obtaining module, configured to obtain a first polynomial according to the first key and the first ciphertext; A second obtaining module is configured to obtain a first target sharing factor by increasing the number of sharing factors of the coefficients of the first polynomial; wherein the coefficients of the first polynomial are represented by the first target sharing factor; a determination module configured to determine a third key according to a first target shared factor, the second key, and the first ciphertext corresponding to coefficients of the first polynomial respectively; A sending module, configured to encrypt the second message to be sent according to the third key and then send the encrypted message to the second device; A decryption module is configured to decrypt the third message sent by the second device according to the third key.

8. A first device, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images