An identity authentication method and system based on graph theory

Abstract

The application discloses an identity authentication method and system based on graph theory, wherein the method comprises the following steps: firstly, a user and an authorized server pre-set two values m and n, then the authorized server generates a sequence composed of k non-repeated values based on the value n, and issues the sequence as a private key to the user; the authorized server generates an undirected graph G(E, V, k) based on the sequence composed of k values, and broadcasts the undirected graph; the user verifies whether the private key key owned by the user represents a k-maximum clique of the broadcasted undirected graph G(E, V, k); if not, the private key is regenerated; if yes, the user approves the validity of the authorization. The application is based on the NP-complete complexity of the graph theory problem, and it is difficult for an attacker to find the maximum clique in the graph without the private key, thereby effectively preventing illegal users from impersonating legal users to perform identity authentication; this makes the method of the application have higher security guarantee in identity authentication, and effectively resists various attack means.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cryptography, and particularly relates to an identity authentication method and system based on graph theory. BACKGROUND

[0002] Public key cryptography is the foundation of modern cryptography, which uses a pair of public and private keys to achieve information encryption and identity authentication. The public key can be publicly published, while the private key is kept secret by the user. The public key is used for encrypting information, and only the user with the private key can decrypt the information. Similarly, the private key can be used to generate a digital signature, and the public key can be used to verify the signature, thereby ensuring the authenticity and integrity of the information source.

[0003] The public key can be used to encrypt messages that can only be decrypted using the private key. Known public key encryption systems rely on cryptographic algorithms based on mathematical problems, for example, the RSA public key encryption system relies on the difficulty of integer factorization, and the public key encryption based on elliptic curves relies on the difficulty of discrete logarithms, but with the development of quantum technology, the most widely used public key cryptography systems, RSA and elliptic curve cryptography (ECC), will be cracked by general quantum computers, and they will no longer be secure.

[0004] Cryptographic systems based on NP problem solutions are one of the research hotspots, which use the difficulty of NP problems to construct secure identity authentication mechanisms. NP problems refer to problems that can be verified in polynomial time on a nondeterministic Turing machine, but finding solutions may require exponential time. The solution to the NP problem is used as the user's private key, and the problem itself is used as the public key. The user can prove his identity by providing his private key, while the attacker is very difficult to find the solution to the problem without the private key.

[0005] Graph theory problems have unique advantages in cryptographic systems based on NP problem solutions, as they can provide a wide variety of structures and characteristics, thereby constructing more secure and flexible identity authentication protocols. Compared with other NP problems, graph theory problems have the following advantages in identity authentication: graph theory problems can describe various complex relationships, such as social networks, transportation networks, communication networks, etc., providing a rich structural basis for constructing flexible identity authentication protocols; graph theory problems can control the difficulty of the problem by adjusting the structural parameters of the graph, such as the number of nodes, the number of edges, and the edge weight, thereby meeting different security requirements; high attack resistance, some problems in graph theory, such as the maximum clique problem, have high complexity, even in the case of known solutions, it is difficult for attackers to find other solutions, thereby improving the security of identity authentication.

[0006] It can be seen that the graph theory problem has potential application value in the field of cryptography; however, there is no method for generating private key and public key by using the graph theory problem and further performing identity authentication, which makes it difficult to be popularized and developed in practical application. SUMMARY

[0007] The present application aims to solve the problems in the background art, and provides a graph theory-based identity authentication method and system, which utilizes the complexity and controllability of the graph theory problem to provide users with safer and more reliable identity authentication services, solves the problem that the public key and private key of the current cryptography system are easy to be cracked by quantum computers, and has the characteristics of flexibility and easy use, so that it can be easily integrated into the existing identity authentication system, thereby improving the security of identity authentication and expanding the application range.

[0008] TECHNICAL SOLUTION The present application provides a graph theory-based identity authentication method, which comprises the following steps:

[0009] (1) Generating a private key: first, a user and an authorized server pre-set two values m and n, and then the authorized server generates a sequence composed of k non-repeated values based on the value n, and then issues the generated sequence as a private key to the user, denoted as key; wherein the maximum value of the sequence does not exceed n;

[0010] (2) Generating a public key: the authorized server generates an undirected graph G(E, V, k) based on the sequence composed of k values, wherein E represents a set of edges, and there are m edges in total; V represents a set of nodes, and there are n nodes in total; k represents that the maximum clique of the undirected graph has k nodes; then, the authorized server broadcasts the generated undirected graph G(E, V, k);

[0011] (3) Private key verification: the user verifies whether the private key key owned by the user represents a k-maximum clique of the broadcasted undirected graph G(E, V, k), if not, returns to step (1) to regenerate the private key; if yes, the user approves the validity of the authorization;

[0012] (4) Identity authentication: when the user needs to perform identity authentication to an authentication server, the private key key is sent to the authentication server, the authentication server obtains the corresponding undirected graph G(E, V, k) from the broadcast, verifies whether the obtained private key key represents a k-maximum clique in the undirected graph G(E, V, k), if yes, the identity authentication is passed, if not, the identity authentication is rejected.

[0013] Further, the specific process steps for the authorized server to generate the undirected graph G(E, V, k) based on the sequence composed of k values are as follows:

[0014] 1) Firstly, the authorization server generates an n*n adjacency matrix, and assigns all matrix elements in the adjacency matrix except diagonal elements as 1, and assigns the matrix elements of the diagonal elements as 0;

[0015] 2) The authorization server randomly generates two unequal and both not greater than n values p, q (p≠q and p, q≤n); then, the authorization server judges the two numbers p and q, if both the two numbers p and q belong to the private key key, the authorization server does not operate; if the two numbers p and q do not belong to the private key key, the authorization server changes the assignment of the pth row and qth column matrix element (p, q) of the adjacency matrix and the qth row and pth column matrix element (q, p) of the matrix to 0;

[0016] 3) The authorization server repeats step 2) until the generated n*n adjacency matrix has only 2m matrix elements with the assignment of 1, and then takes this matrix as the adjacency matrix representing an undirected graph G(E, V, k), and outputs as the public key.

[0017] Further, the step 1) further comprises: counting the matrix elements with the assignment of 1 in the n*n adjacency matrix, and taking the count value as i, the initial value of i is i(0)=n*n-n;

[0018] The step 2) further comprises: in response to the authorization server changing the assignment of the pth row and qth column matrix element (p, q) of the adjacency matrix and the qth row and pth column matrix element (q, p) of the matrix to 0 for the a-th time, the count value i is updated as i(a)=i(a-1)-2=n*n-n-2a.

[0019] Further, the specific process of the authorization server generating a sequence composed of k non-repeating values based on the value n is:

[0020] 1) The authorization server converts the value n into a binary data format, and obtains the data length x of the binary data format of the value n;

[0021] 2) The authorization server generates k true random numbers with the length not greater than x, and then converts the generated k true random numbers into k values consistent with the base of the value n; then, the authorization server judges the k values, if there is a value greater than n or there are two or more repeated values, the corresponding values are discarded, and the authorization server re-generates the corresponding number of true random numbers with the length not greater than x according to the number of discarded values, and then converts the values and judges; repeat the above operation until k values less than or equal to n and not repeated are generated;

[0022] 3) The authorization server combines the generated k values to form a sequence.

[0023] Further, the specific process of generating a sequence of k non-repeating values by the authorization server based on the value n is:

[0024] a) the authorization server converts the value n into a binary data format, and obtains the data length x of the binary data format of the value n;

[0025] b) the authorization server generates a true random number with a length not greater than x, and then converts the generated true random number into a value consistent with the base of the value n, and judges the converted value, if the value is greater than n or has been obtained by converting the true random number before, the true random number is discarded and regenerated;

[0026] c) repeat step b) multiple times until k values less than or equal to n and not repeating are obtained;

[0027] d) the authorization server combines the generated k values to form a sequence.

[0028] Further, the combination of the generated k values to form a sequence refers to: according to the order of generating the k values, the k values are sequentially arranged and combined to form a sequence; or, after the authorization server generates the k values, the k values are randomly arranged, and then combined to form a sequence.

[0029] The application also includes a system of an identity authentication method based on graph theory, which includes users, an authentication server and an authorization server connected to each other;

[0030] The user is used for receiving the private key issued by the authorization server, and proving the legitimacy of the identity to the authentication server through the private key;

[0031] The authorization server is used for generating a private key and a public key, and issuing the generated private key to the user and broadcasting the generated public key;

[0032] The authentication server is used for verifying the legitimacy of the identity of the user according to the private key of the user.

[0033] Further, the authorization server includes an input unit, a data format conversion unit, a true random number generator, a sequence generation unit, a key issuance unit and a transmission unit connected in sequence, the sequence generation unit is further connected with an undirected graph generation unit, and the undirected graph generation unit is connected with the key issuance unit;

[0034] The input unit is used for inputting two values m and n;

[0035] The data format conversion unit is used for converting the value n into a binary data format, and obtaining the data length x of the binary data format of the value n;

[0036] The true random number generator is used to generate a true random number;

[0037] The sequence generating unit is used to convert the generated true random number into a numerical value consistent with the base of the numerical value n and make a judgment until k numerical values less than or equal to n and not repeated are obtained, and combine the generated k numerical values to form a sequence;

[0038] The undirected graph generating unit is used to generate an undirected graph according to the generated sequence;

[0039] The key issuing unit is used to transmit the received private key and public key to the transmission unit;

[0040] The transmission unit is used to issue the private key to the user and broadcast the public key.

[0041] The beneficial effects of the present application are:

[0042] (1) Based on the NP-complete complexity of the graph theory problem, it is difficult for an attacker to find the maximum clique in the graph without the private key, thereby effectively preventing illegal users from impersonating legitimate users for identity authentication; this makes the method of the present application have higher security assurance in identity authentication, effectively resisting various attack means;

[0043] (2) By controlling the structural parameters of the graph, such as the number of nodes and the number of edges, the difficulty of identity authentication can be adjusted to meet different security requirements. For example, for high sensitivity systems, the difficulty of identity authentication can be increased by increasing the complexity of the graph. This controllability enables the method of the present application to flexibly adjust parameters according to actual application scenarios to achieve optimal security. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 The present application is a graph theory-based identity authentication method;

[0045] Figure 2 The present application is a graph theory-based identity authentication system;

[0046] Figure 3 The present application is an authorized server structure. DETAILED DESCRIPTION

[0047] The present application will be further described below in conjunction with the drawings and examples:

[0048] The present application is a graph theory-based identity authentication method, and the method flow description is as shown in Figure 1 The present application utilizes the characteristics of graph theory problems to provide a password that is difficult to break for users, thereby constructing an identity authentication scheme with security advantages, which specifically includes the following steps:

[0049] (1) Generating a private key: first, the user and the authorization server pre-set two values m and n, and then the authorization server generates a sequence of k non-repeating values based on the value n, and then issues the generated sequence as a private key to the user, denoted as key; wherein the maximum value of the sequence does not exceed n;

[0050] The authorization server generates the sequence as the generator, and then issues the generated sequence as a private key to the user. Specifically, the specific process of generating a sequence of k non-repeating values based on the value n is as follows:

[0051] 1) The authorization server is provided with a data format conversion unit for converting the value into a binary data format. First, the value n is converted into a binary data format, and the data length of the binary data format of the value n is obtained as x;

[0052] 2) The authorization server is provided with a true random number generator for generating k true random numbers with a length not greater than x, and then converting the generated k true random numbers into k values consistent with the base of the value n. Then, the k values are judged. If there is a value greater than n or two or more repeated values, the corresponding values are discarded. The authorization server re-generates the corresponding number of true random numbers with a length not greater than x according to the number of discarded values, and then converts the values and judges. Repeat the above operation until k non-repeating values less than or equal to n are generated;

[0053] 3) The authorization server combines the generated k values to form a sequence.

[0054] Or the specific process of generating a sequence of k non-repeating values based on the value n by the authorization server is as follows:

[0055] a) The authorization server converts the value n into a binary data format, and obtains the data length of the binary data format of the value n as x;

[0056] b) The authorization server generates a true random number with a length not greater than x, and then converts the generated true random number into a value consistent with the base of the value n. Then, the converted value is judged. If the value is greater than n or has been obtained through the conversion of the true random number before, it is discarded, and a true random number is re-generated;

[0057] c) Repeat step b) multiple times until k non-repeating values less than or equal to n are obtained;

[0058] d) The authorization server combines the generated k values to form a sequence.

[0059] Combining the generated k values to form a sequence refers to: arranging the k values in sequence to form a sequence according to the order in which the k values are generated; or, after the authorization server generates the k values, arranging the k values in disorder, and then combining to form a sequence.

[0060] (2) Generating a public key: the authorization server regards the sequence composed of the k values as a representation of a k-maximal clique in an undirected graph, generates an undirected graph G(E, V, k), where E represents a set of edges, a total of m edges; V represents a set of nodes, a total of n nodes, n>k; k represents that the maximum clique of the undirected graph has k nodes; then, the authorization server broadcasts the generated undirected graph G(E, V, k);

[0061] The specific process steps of generating the undirected graph G(E, V, k) are as follows:

[0062] 1) First, the authorization server generates an n*n adjacency matrix, and assigns all matrix elements in the adjacency matrix except the diagonal elements to 1, and assigns the diagonal elements to 0;

[0063] The n*n matrix is an adjacency matrix, and the i-th row and j-th column matrix element (i, j) in the adjacency matrix represents the connection relationship between node i and node j (i≠j). If there is an edge between node i and node j, the value of the matrix element (i, j) is 1; if there is no edge between node i and node j, the value of the matrix element (i, j) is 0; the value of the diagonal element is 0; of course, the matrix elements with a value of 1 in the n*n adjacency matrix can be counted, and the count value is denoted as i, and the initial value of i is i(0)=n*n-n;

[0064] 2) The authorization server randomly generates two unequal and not greater than n values p and q (p≠q and p,q≤n) using a true random number generator; then, the authorization server judges the two numbers p and q, if both of them belong to the private key key, the authorization server does not operate; if both of them do not belong to the private key key, the authorization server changes the values of the p-th row and q-th column matrix element (p, q) of the adjacency matrix and the q-th row and p-th column matrix element (q, p) of the matrix to 0; that is, in response to the authorization server changing the values of the p-th row and q-th column matrix element (p, q) of the adjacency matrix and the q-th row and p-th column matrix element (q, p) to 0 for the a-th time, the count value i is updated to i(a)=i(a-1)-2a=n*n-n-2a.

[0065] 3) The authorization server repeats step 2) until only 2m matrix elements in the generated n x n adjacency matrix have a value of 1, or it can also be seen as comparing the size of i(a) with 2m, repeating step 2) until i(a) is equal to 2m, and then taking this matrix as the adjacency matrix representing an undirected graph G(E, V, k), and outputting as the public key.

[0066] (3) Private key verification: The user verifies whether the private key key owned by himself represents a k-maximum clique of the broadcasted undirected graph G(E, V, k), if not, go back to step (1) to generate a new private key; if yes, the user acknowledges the validity of the authorization;

[0067] The maximum clique problem refers to finding the largest clique in an undirected graph. The definition of a clique is a subset of the nodes V of an undirected graph, and each node in the subset has an edge connected to any node in the subset; k-maximum clique means that the largest clique in the undirected graph has k nodes. The maximum clique problem is an NP-complete problem, and its solution, that is, a k-maximum clique, is represented in this patent as the set of node numbers involved in the maximum clique.

[0068] The method for the user to verify whether the private key key owned by himself represents a k-maximum clique of the broadcasted undirected graph G(E, V, k) can be realized through the Bron-Kerbosch algorithm or backtracking method.

[0069] (4) Identity authentication: When the user needs to perform identity authentication to the authentication server, the private key key is sent to the authentication server, the authentication server obtains the corresponding undirected graph G(E, V, k) from the broadcast, and verifies whether the obtained private key key represents a k-maximum clique in the undirected graph G(E, V, k), if yes, the identity authentication is passed, if not, the identity authentication is rejected.

[0070] As can be seen, the identity authentication method based on graph theory proposed by the present application is based on the NP-complete complexity of graph theory problems, and it is difficult for an attacker to find the maximum clique in the graph without a private key, thereby effectively preventing illegal users from impersonating legitimate users to perform identity authentication; this makes the method of the present application have higher security guarantee in identity authentication, effectively resisting various attack means. The present application can also adjust the difficulty of identity authentication by controlling the structural parameters of the graph, such as the number of nodes and the number of edges, to meet different security requirements. For example, for high-sensitivity systems, the difficulty of identity authentication can be increased by increasing the complexity of the graph. This controllability enables the method of the present application to flexibly adjust parameters according to actual application scenarios to achieve optimal security.

[0071] The present application also proposes a system based on the above-mentioned graph theory-based identity authentication method, such as Figure 2As shown, the system comprises user 1, authentication server 2 and authorization server 3 connected in pairs; user 1 is the owner of a private key, used to receive the private key issued by authorization server 3 and prove the legitimacy of its identity to authentication server 2 through the private key; authorization server 3 is the generating and issuing agency of the private key and the public key, used to generate the private key and the public key, and issue the generated private key to user 1 and broadcast the generated public key; authentication server 2 is the proving agency of the identity legitimacy, used to verify the legitimacy of the identity of user 1 according to the private key of the user, and the user 1 passing the authentication process is the legitimate user.

[0072] As shown in the figure, Figure 3 As shown, authorization server 3 comprises input unit 31, data format conversion unit 32, true random number generator 33, sequence generating unit 34, key issuing unit 35 and transmission unit 36 connected in sequence, sequence generating unit 34 is also connected with undirected graph generating unit 37, and undirected graph generating unit 37 is connected with key issuing unit 35;

[0073] Input unit 31 is used to input two preset values m and n;

[0074] Data format conversion unit 32 is used to convert value n into binary data format, and obtain the data length x of the binary data format of value n;

[0075] True random number generator 33 is used to generate a true random number;

[0076] Sequence generating unit 34 is used to convert the generated true random number into a value consistent with the base of value n and make a judgment until k values less than or equal to n and not repeated are obtained; and combine the generated k values to form a sequence;

[0077] Undirected graph generating unit 37 is used to generate an undirected graph according to the generated sequence;

[0078] Key issuing unit 35 is used to transmit the received private key and public key to transmission unit 36;

[0079] Transmission unit 36 is used to issue the private key to user 1, and broadcast the public key.

[0080] The application has the characteristics of flexibility and easy use, can be conveniently integrated into the existing identity authentication system, thereby improving the security of identity authentication and expanding the application range.

Claims

1. A graph-based identity authentication method, characterized in that, The method comprises the following steps: (1) generating a private key: first, the user and the authorization server pre-set two values m and n, and then the authorization server generates a sequence of k non-repeating values based on the value n, and then issues the generated sequence as a private key to the user, denoted as key; wherein the maximum value of the sequence does not exceed n; (2) generating a public key: the authorization server generates an undirected graph G(E, V, k) based on the sequence of k values, wherein E represents the set of edges, a total of m edges; V represents the set of nodes, a total of n nodes; k represents that the maximum clique of the undirected graph has k nodes; then, the authorization server broadcasts the generated undirected graph G(E, V, k); (3) private key verification: the user verifies whether the private key key owned by the user represents a k-maximum clique of the broadcasted undirected graph G(E, V, k), if not, return to step (1) to regenerate the private key; if yes, the user approves the validity of the authorization; (4) identity authentication: when the user needs to perform identity authentication on the authentication server, the private key key is sent to the authentication server, and the authentication server obtains the corresponding undirected graph G(E, V, k) from the broadcast, and verifies whether the obtained private key key represents a k-maximum clique in the undirected graph G(E, V, k), if yes, the identity authentication is passed, if not, the identity authentication is rejected; Wherein, the specific process steps of the authorization server generating an undirected graph G(E, V, k) based on the sequence of k values are: 1) First, the authorization server generates an n*n adjacency matrix, and assigns all matrix elements in the adjacency matrix except the diagonal elements to 1, and assigns the diagonal elements to 0; 2) The authorization server randomly generates two unequal and not greater than n values p and q; then, the two numbers p and q are judged, if both of the two numbers p and q belong to the private key key, the authorization server does not operate; if the two numbers p and q do not belong to the private key key, the authorization server changes the assignment of the pth row and qth column matrix element (p, q) of the adjacency matrix and the qth row and pth column matrix element (q, p) of the matrix to 0; 3) The authorization server repeats step 2) until there are only 2m matrix elements with an assignment of 1 in the generated n*n adjacency matrix, and then takes this matrix as an adjacency matrix representing an undirected graph G(E, V, k), and outputs as a public key; The step 1) further comprises: counting the matrix elements with an assignment of 1 in the n*n adjacency matrix, and taking the count value as i, the initial value of i is i(0)=n*n-n; Step 2) further comprises: in response to the authorization server changing the assignment of the pth row and qth column matrix element (p, q) of the adjacency matrix and the qth row and pth column matrix element (q, p) of the matrix to 0 for the a-th time, the count value i is updated to i(a)=i(a-1)-2=n*n-n-2a.

2. The identity authentication method based on graph theory according to claim 1, characterized in that, The specific process of the authorization server generating a sequence of k non-repeating values based on the value n is: 1) The authorization server converts the value n into a binary data format, and obtains the data length x of the binary data format of the value n; 2) the authorization server generates k true random numbers with length not greater than x, and then converts the k true random numbers into k values consistent with the base of the number n; then the k values are judged, if there is a value greater than n or there are two or more repeated values, the corresponding values are discarded, the authorization server re-generates the corresponding number of true random numbers with length not greater than x according to the number of discarded values, and then converts the values and judges; the above operation is repeated until k values less than or equal to n and not repeated are generated; 3) the authorization server combines the generated k values to form a sequence.

3. The identity authentication method based on graph theory according to claim 1, characterized in that, The specific process of the authorization server generating a sequence composed of k non-repeated values based on the number n is: a) the authorization server converts the number n into a binary data format, and obtains the data length x of the binary data format of the number n; b) the authorization server generates a true random number with length not greater than x, and then converts the generated true random number into a value consistent with the base of the number n, and judges the converted value, if the value is greater than n or has been obtained through the conversion of the true random number before, it is discarded, and a true random number is re-generated; c) step b) is repeated multiple times until k values less than or equal to n and not repeated are obtained; d) the authorization server combines the generated k values to form a sequence.

4. The identity authentication method based on graph theory according to claim 2 or 3, characterized in that, The combination of the generated k values to form a sequence refers to: according to the order of the generation of the k values, the k values are sequentially arranged and combined to form a sequence; or, after the authorization server generates the k values, the k values are randomly arranged, and then combined to form a sequence.

5. A system based on the identity authentication method based on graph theory according to any one of claims 1 to 4, characterized in that: The system includes a user, an authentication server and an authorization server connected with each other; The user is used to receive the private key issued by the authorization server, and prove the legitimacy of the identity to the authentication server through the private key; The authorization server is used to generate a private key and a public key, and issue the generated private key to the user, and broadcast the generated public key; The authentication server is used to verify the legitimacy of the identity of the user according to the private key of the user.

6. The system of claim 5, wherein, The authorization server includes an input unit, a data format conversion unit, a true random number generator, a sequence generation unit, a key issuance unit and a transmission unit connected in turn, the sequence generation unit is further connected with an undirected graph generation unit, and the undirected graph generation unit is connected with the key issuance unit; The input unit is used to input two preset numbers m and n; The data format conversion unit is used to convert the number n into a binary data format, and obtain the data length x of the binary data format of the number n; The true random number generator is used to generate a true random number; The sequence generation unit is used to convert the generated true random number into a value consistent with the base of the number n and judge, until k values less than or equal to n and not repeated are obtained; and combine the generated k values to form a sequence; The undirected graph generation unit is used to generate an undirected graph according to the generated sequence; The key issuance unit is used to transmit the received private key and public key to the transmission unit; The transmission unit is used to issue the private key to the user, and broadcast the public key.

Images