SM2 certificateless identity authentication method and system

Abstract

The present invention provides an identity authentication method and system based on SM2 certificateless, including: obtaining an identity data packet to be authenticated, decrypting the identity data packet based on the SM2 algorithm to obtain a main singular value sequence and a user public key; performing XOR decryption processing on the main singular value sequence and a private key corresponding to the user public key to obtain an original main singular value sequence; reconstructing the original main singular value sequence to obtain a reconstructed singular value matrix; performing inverse discrete wavelet transform based on the reconstructed singular value matrix to obtain reconstructed watermark data; matching the reconstructed watermark data with the original watermark data in a database, and obtaining an identity authentication result based on the matching result. In the present invention, by introducing the decryption mechanism of the SM2 algorithm, the identity authentication mechanism is deeply integrated with the characteristics of the watermark data, thereby overcoming the defect that the current identity authentication based on watermark data cannot be efficiently and accurately realized.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to an SM2 certificateless identity authentication method and system. Background Art

[0002] Traditional identity authentication methods, such as those based on simple passwords or symmetric encryption, have gradually exposed many security risks. Passwords may be stolen, cracked or forgotten, and the management of symmetric encryption keys also faces distribution and storage risks, making it difficult to meet the growing security needs.

[0003] Digital watermarking technology is widely used as an effective means of information hiding and copyright protection, but there are still many challenges in the field of combining identity authentication with watermark data authentication. On the one hand, watermark data is vulnerable to malicious attacks such as tampering and forgery during transmission and storage. How to ensure the integrity and authenticity of watermark data has become an urgent problem to be solved. On the other hand, the existing identity authentication mechanism is difficult to deeply integrate with the characteristics of watermark data, and it is impossible to efficiently and accurately realize identity authentication based on watermark data. Summary of the invention

[0004] The main purpose of the present invention is to provide an SM2-based certificateless identity authentication method and system, aiming to overcome the current defect that identity authentication based on watermark data cannot be realized efficiently and accurately.

[0005] To achieve the above object, the present invention provides an identity authentication method based on SM2 certificateless, comprising the following steps:

[0006] Obtain the identity data packet to be authenticated, decrypt the identity data packet based on the SM2 algorithm, and obtain the primary singular value sequence and the user public key;

[0007] Performing XOR decryption processing on the main singular value sequence and the private key corresponding to the user public key to obtain the original main singular value sequence;

[0008] Reconstructing the original main singular value sequence to obtain a reconstructed singular value matrix;

[0009] Performing inverse discrete wavelet transform based on the reconstructed singular value matrix to obtain reconstructed watermark data;

[0010] The reconstructed watermark data is matched with the original watermark data in the database, and an identity authentication result is obtained according to the matching result.

[0011] Furthermore, the decryption of the identity data packet based on the SM2 algorithm to obtain the main singular value sequence and the user public key includes:

[0012] Parsing the encryption key information in the identity data packet based on the key parsing function in the SM2 algorithm to obtain a session key;

[0013] Performing symmetric decryption processing on the encrypted data portion in the identity data packet based on the session key to obtain preliminary decrypted data;

[0014] According to a preset data structure identifier, the preliminary decrypted data is split to separate the main singular value sequence and the user public key from the preliminary decrypted data.

[0015] Further, the main singular value sequence is subjected to XOR decryption processing with a private key corresponding to the user public key to obtain an original main singular value sequence, including:

[0016] Extract the public key feature code from the user's public key, and locate the corresponding private key storage address according to a pre-established mapping relationship table between the public key feature code and the private key storage path;

[0017] Read a private key from the private key storage address and convert the private key into a binary private key sequence having the same length as the primary singular value sequence;

[0018] The main singular value sequence and the binary private key sequence are subjected to a bit-by-bit XOR operation to obtain an original main singular value sequence.

[0019] Furthermore, before obtaining the identity data packet to be authenticated, the method includes:

[0020] Perform SM2 certificateless key generation on the original watermark data submitted by the user to obtain the user's public key and the corresponding private key;

[0021] Performing discrete wavelet transform on the original watermark data to obtain sub-band data at different frequency levels;

[0022] Performing singular value decomposition processing on the subband data to obtain a singular value matrix, and extracting a main singular value sequence in the singular value matrix;

[0023] Performing XOR encryption on the main singular value sequence and the user's private key to obtain an encrypted main singular value sequence;

[0024] The encrypted primary singular value sequence and the user public key are encrypted and packaged based on the SM2 algorithm to obtain an identity data packet.

[0025] Further, the original main singular value sequence is reconstructed to obtain a reconstructed singular value matrix; based on the reconstructed singular value matrix, an inverse discrete wavelet transform is performed to obtain reconstructed watermark data, including:

[0026] Determining the dimension information of the reconstructed singular value matrix according to the length information of the original main singular value sequence and the preset singular value matrix structure rule;

[0027] Fill the elements in the original main singular value sequence into the corresponding matrix positions in sequence according to the dimension information to complete the construction of the reconstructed singular value matrix;

[0028] Based on the preset wavelet basis function and transformation parameters, performing inverse transformation calculation on each element in the reconstructed singular value matrix;

[0029] The results after the inverse transformation calculation are integrated and format converted to obtain reconstructed watermark data that is consistent with the original watermark data format.

[0030] Furthermore, after obtaining the identity authentication result, the following steps are performed:

[0031] Generate a corresponding mapping table for the identity data packet to be authenticated, the reconstructed watermark data and the identity authentication result;

[0032] A storage key is generated based on the mapping table and is used to encrypt and store the mapping table.

[0033] Further, generating a storage key based on the mapping table includes:

[0034] Converting the identity data packet to be authenticated in the mapping table into a first-dimensional vector, converting the reconstructed watermark data into a second-dimensional vector, and converting the identity authentication result into a third-dimensional vector;

[0035] Construct a hypercomplex space based on SM2 elliptic curve parameters, and map the first-dimensional vector, the second-dimensional vector, and the third-dimensional vector to the hypercomplex space; in the hypercomplex space, rotate and scale the mapped vectors to form a geometric figure with their trajectories in the hypercomplex space;

[0036] Extracting the coordinates of key feature points of the geometric figure, and encoding and compressing the coordinate values ​​of the key feature points;

[0037] The encoded and compressed data is grouped, and XOR and shift operations are performed alternately in each group to obtain the storage key.

[0038] The present invention also provides an SM2 certificateless identity authentication system, comprising:

[0039] An acquisition unit is used to acquire the identity data packet to be authenticated, decrypt the identity data packet based on the SM2 algorithm, and obtain a primary singular value sequence and a user public key;

[0040] A decryption unit, used for performing XOR decryption processing on the main singular value sequence and the private key corresponding to the user public key to obtain an original main singular value sequence;

[0041] A reconstruction unit, used for reconstructing the original main singular value sequence to obtain a reconstructed singular value matrix;

[0042] A transform unit, used for performing an inverse discrete wavelet transform based on the reconstructed singular value matrix to obtain reconstructed watermark data;

[0043] The authentication unit is used to match the reconstructed watermark data with the original watermark data in the database, and obtain an identity authentication result based on the matching result.

[0044] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above methods when executing the computer program.

[0045] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned methods are implemented.

[0046] The SM2-based certificateless identity authentication method and system provided by the present invention include: obtaining an identity data packet to be authenticated, decrypting the identity data packet based on the SM2 algorithm to obtain a main singular value sequence and a user public key; performing XOR decryption processing on the main singular value sequence and the private key corresponding to the user public key to obtain the original main singular value sequence; reconstructing the original main singular value sequence to obtain a reconstructed singular value matrix; performing inverse discrete wavelet transform based on the reconstructed singular value matrix to obtain reconstructed watermark data; matching the reconstructed watermark data with the original watermark data in a database, and obtaining an identity authentication result based on the matching result. In the present invention, by introducing the decryption mechanism of the SM2 algorithm, the required reconstructed watermark data is parsed from the identity data packet to be authenticated, and then matched and authenticated with the original watermark data in the database. The identity authentication mechanism is deeply integrated with the characteristics of the watermark data to overcome the current defect that identity authentication based on watermark data cannot be realized efficiently and accurately. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a schematic diagram of the steps of an identity authentication method based on SM2 without a certificate in one embodiment of the present invention;

[0048] Figure 2 This is a structural block diagram of an identity authentication system based on SM2 certificateless authentication in one embodiment of the present invention;

[0049] Figure 3 It is a schematic block diagram of the structure of a computer device according to an embodiment of the present invention.

[0050] The implementation, functional features and advantages of the present invention will be further described in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0052] Reference Figure 1 In one embodiment of the present invention, a certificateless identity authentication method based on SM2 is provided, comprising the following steps:

[0053] Step S1, obtaining an identity data packet to be authenticated, decrypting the identity data packet based on the SM2 algorithm, and obtaining a primary singular value sequence and a user public key;

[0054] Step S2, performing XOR decryption processing on the main singular value sequence and the private key corresponding to the user public key to obtain the original main singular value sequence;

[0055] Step S3, reconstructing the original main singular value sequence to obtain a reconstructed singular value matrix;

[0056] Step S4, performing inverse discrete wavelet transform based on the reconstructed singular value matrix to obtain reconstructed watermark data;

[0057] Step S5, matching the reconstructed watermark data with the original watermark data in the database, and obtaining an identity authentication result based on the matching result.

[0058] In this embodiment, as described in step S1 above, the identity data packet to be authenticated includes a data packet for key information for identity authentication, which is usually encrypted during transmission to ensure security. First, it is necessary to use the key management mechanism and encryption protocol specification in the SM2 algorithm to parse the encrypted header information or metadata part in the identity data packet, and extract decryption-related parameters, such as the index or identification information of the encryption key. According to the extracted parameters, the corresponding decryption key pair information (public key and private key related information) is obtained from a pre-configured or securely stored key library. The decryption function of the SM2 algorithm is used, which is based on the mathematical principles of elliptic curve cryptography, to decrypt the encrypted main data part in the identity data packet.

[0059] In the decrypted original data, the main singular value sequence and the user public key are separated according to the pre-set data structure and format agreement. The main singular value sequence is an important data basis for subsequent identity authentication processing, which carries the key feature information related to the original watermark data; while the user public key is used to cooperate with the private key to achieve further decryption and identity authentication operations.

[0060] As described in step S2 above, the private key corresponding to the user's public key is the key information uniquely bound to a specific user in the identity authentication system, and its security is guaranteed based on the key generation and management mechanism of the SM2 algorithm. XOR decryption processing is an effective way to recover encrypted data. Perform an XOR operation on each bit of data in the main singular value sequence and the data of the corresponding bit in the private key. Due to the characteristics of the XOR operation (0 for the same and 1 for different), when the correct private key is used to perform XOR with the encrypted main singular value sequence, the original main singular value sequence can be restored. The above method utilizes the confidentiality of the private key and the reversibility of the XOR operation to ensure that only users with legitimate private keys can successfully restore the original main singular value sequence, thereby providing a reliable data source for subsequent identity authentication.

[0061] As described in step S3 above, the original main singular value sequence has undergone data deformation or splitting in the previous encryption and transmission process for easy processing and transmission. The purpose of the reconstruction process is to restore it to a singular value matrix form with a specific mathematical structure and semantics.

[0062] Specifically, the dimensions and element arrangement of the reconstructed singular value matrix are determined according to the predefined singular value matrix construction rules and the length of the original main singular value sequence, data distribution characteristics and other information. For example, if it is known that the original singular value matrix is ​​an n×n square matrix, and the main singular value sequence is stored in a certain order (such as diagonal elements from the upper left corner to the lower right corner are prioritized), then the elements in the main singular value sequence are sequentially filled into the corresponding positions of the reconstructed singular value matrix in the above order. For the missing elements, they are reasonably supplemented or inferred according to the mathematical properties of the matrix (such as symmetry, positive definiteness, etc.), and finally a complete reconstructed singular value matrix is ​​obtained, so that it can correctly participate in the operation in the subsequent inverse discrete wavelet transform to restore the original watermark data characteristics.

[0063] As described in step S4 above, discrete wavelet transform is a commonly used signal processing and data compression technology, and is also widely used in watermark data processing. The original watermark data is processed by discrete wavelet transform, which decomposes it into sub-band data of different frequencies and scales. The features of these sub-band data are extracted and encoded into the main singular value sequence in some way.

[0064] Therefore, an inverse discrete wavelet transform is required here, which is to use the inverse transform algorithm of discrete wavelet transform to reconstruct the singular value matrix as input data. The inverse discrete wavelet transform algorithm performs step-by-step inverse transform calculations on the data in the reconstructed singular value matrix according to the pre-set wavelet basis function (such as Haar wavelet, Daubechies wavelet, etc.) and the relevant parameters recorded during the transformation process (such as the number of decomposition layers, sub-band coefficient scaling factors, etc.). By recombining and restoring the data in the reconstructed singular value matrix, the approximate representation of the original watermark data in the spatial domain or time domain is gradually restored, that is, the reconstructed watermark data. The above-mentioned reconstructed watermark data has a high correlation with the original embedded watermark data in terms of features and content, and is the key data for identity authentication comparison.

[0065] As described in step S5 above, the original watermark data stored in the database is standard watermark data extracted and saved at a previous trusted time point (such as user registration, data first generation, etc.), which represents the real identity feature identification of the user or data source. When matching the reconstructed watermark data with the original watermark data, a similarity measurement algorithm is usually used. For example, the Euclidean distance, cosine similarity or other similarity indicators designed specifically for watermark data can be calculated between the two. If the reconstructed watermark data is highly similar to the original watermark data in terms of features, that is, the similarity exceeds a preset threshold (the threshold is determined based on factors such as the security requirements of the system and the tolerance for false alarm rate), the identity authentication is considered to be successful, indicating that the user or data source corresponding to the current identity data packet to be authenticated is legal and credible; on the contrary, if the similarity is lower than the threshold, the identity authentication fails, and there are security risks such as data tampering and identity forgery. Corresponding security measures can be taken according to the specific application scenario, such as denying access and issuing an alarm.

[0066] In one embodiment, the decrypting of the identity data packet based on the SM2 algorithm to obtain the primary singular value sequence and the user public key includes:

[0067] Parsing the encryption key information in the identity data packet based on the key parsing function in the SM2 algorithm to obtain a session key;

[0068] Performing symmetric decryption processing on the encrypted data portion in the identity data packet based on the session key to obtain preliminary decrypted data;

[0069] According to a preset data structure identifier, the preliminary decrypted data is split to separate the main singular value sequence and the user public key from the preliminary decrypted data.

[0070] In this embodiment, decrypting the identity data packet is a key initial step. Obtaining the correct session key is a prerequisite for successfully decrypting the subsequent encrypted data. Since the data is encrypted for security reasons during transmission, the encryption key information is included in the identity data packet, and a parsing function is required to extract and restore the session key that can be used for decryption.

[0071] The SM2 algorithm is a public key cryptographic algorithm based on the elliptic curve cryptography system. Its key parsing function is designed according to the specifications and mathematical principles of the algorithm. It can identify the encryption key information part in a specific format and encoding method in the identity data packet. For example, the encryption key information may exist in the header or other specified locations of the data packet in a specific field structure and encoding format (such as hexadecimal encoding, etc.). The key parsing function will scan the data packet bit by bit, identify and extract the relevant key information fields according to these preset rules.

[0072] When the key parsing function accurately identifies and extracts the encryption key information, it will process the extracted encryption key information according to the mathematical operation rules for key generation and conversion in the SM2 algorithm, such as elliptic curve point multiplication, modular operation, etc., to convert it into a session key that can actually be used for decryption operations. The above session key is a temporary symmetric key related to this decryption operation, which will play a role in the subsequent symmetric decryption processing steps.

[0073] After obtaining the session key, in order to further restore the valuable information contained in the identity data packet (such as the primary singular value sequence and the user's public key, etc.), the encrypted data part needs to be decrypted. Since the symmetric encryption method (encryption using the session key) is used in the encryption process, the symmetric decryption processing based on the same session key is used here to restore the data.

[0074] Symmetric decryption is based on the principle of symmetric encryption in cryptography, that is, the same key is used for encryption and decryption (here, the session key obtained earlier). In specific operations, the encrypted data part in the identity data packet is subjected to specific mathematical operations with the session key bit by bit or block by block (depending on the specific encryption method and data organization form), such as XOR operations, decryption round function operations in block cipher algorithms, etc. Through these operations, the encrypted data is gradually restored to its original unencrypted form, thereby obtaining preliminary decrypted data. For example, if a certain block cipher algorithm (such as AES, etc.) is used for encryption, then when decrypting, it is necessary to follow the decryption process of the block cipher algorithm, use the session key to perform decryption operations on each group in turn, and finally combine the results of all group decryption to obtain preliminary decrypted data.

[0075] The above-mentioned preliminary decrypted data is an intermediate result obtained after symmetric decryption processing. It contains various information originally encrypted in the identity data packet, but the information at this time is still in a relatively original state without further processing and separation.

[0076] In order to facilitate the subsequent accurate processing of the decrypted data and extraction of key information, a data structure identifier is pre-set. The above data structure identifier can be in the form of a specific field length, data type mark, separator, etc. For example, the starting position and length range of the main singular value sequence in the preliminary decrypted data, as well as the corresponding position and format requirements of the user's public key, are specified. Through the above clear identification, the distribution of different types of information in the preliminary decrypted data can be clearly defined.

[0077] According to the preset data structure identifier, the preliminary decrypted data is scanned and analyzed bit by bit or block by block. When the part that matches the main singular value sequence data structure identifier is scanned, this part of the data is extracted as the main singular value sequence; similarly, when the part that matches the user public key data structure identifier is scanned, it is extracted as the user public key.

[0078] Through this data splitting operation, the main singular value sequence and the user's public key are successfully separated from the preliminary decrypted data. These two key information will play an important role in the subsequent identity authentication process. The main singular value sequence is an important basis for subsequent data reconstruction, inverse transformation and other operations to restore the original watermark data characteristics; the user's public key is used in conjunction with the corresponding private key in the subsequent steps for further decryption, verification and other operations, and is one of the key elements to ensure the accuracy and security of identity authentication.

[0079] In one embodiment, the main singular value sequence is subjected to XOR decryption processing with a private key corresponding to the user public key to obtain an original main singular value sequence, including:

[0080] Extract the public key feature code from the user's public key, and locate the corresponding private key storage address according to a pre-established mapping relationship table between the public key feature code and the private key storage path;

[0081] Read a private key from the private key storage address and convert the private key into a binary private key sequence having the same length as the primary singular value sequence;

[0082] The main singular value sequence and the binary private key sequence are subjected to a bit-by-bit XOR operation to obtain an original main singular value sequence.

[0083] In this embodiment, the public key is publicly available information, while the private key needs to be stored in strict confidentiality. In order to accurately and quickly find the private key corresponding to a specific public key, it is necessary to extract a representative feature code from the public key. The above public key feature code is like the "identity identifier" of the public key, through which the corresponding private key storage path information can be found in the pre-established mapping relationship table.

[0084] The public key usually exists in a specific format and encoding method, such as a mathematical representation based on the elliptic curve cryptography system (such as the coordinates of a point on an elliptic curve, etc.). When extracting the public key feature code, some key information in the public key will be selected as the feature code based on this specific structure of the public key and related algorithm specifications. For example, you can select a specific component of the point coordinates on the elliptic curve represented by the public key (such as some bits of the horizontal or vertical coordinates), or perform a hash operation on the public key and take its hash value of a specific length as the feature code. The above extraction methods are designed based on the mathematical characteristics and security requirements of the public key itself to ensure that the extracted feature code can not only accurately identify the public key, but also ensure security to a certain extent, and prevent the feature code from being easily forged or tampered with.

[0085] The pre-established mapping relationship table of public key feature codes and private key storage paths records the mapping relationship between the feature code of each legal public key and the private key storage address corresponding to the public key. After the public key feature code is extracted, a search operation can be performed in this mapping relationship table.

[0086] The private key storage address usually points to a secure storage area in the system, such as an encrypted storage device, a protected memory area, etc. When reading, the reading operation will be performed according to the original storage format and encoding method of the private key to obtain the complete private key data.

[0087] The main singular value sequence usually exists in binary form. In order to perform bitwise XOR operation with the main singular value sequence, the private key read needs to be converted into binary form. Moreover, in order to ensure the accuracy and consistency of the operation, the private key needs to be converted into a binary private key sequence with the same length as the main singular value sequence. The specific conversion process includes parsing the original encoding method of the private key, and then converting it into a binary sequence according to the mathematical representation of the private key (such as a digital representation based on the elliptic curve cryptography system). If the length of the private key is inconsistent with the length of the main singular value sequence, appropriate padding or truncation operations are required (the padding or truncation operations need to follow specific rules to ensure that they do not affect the validity and security of the private key), and finally a binary private key sequence with the same length as the main singular value sequence is obtained, so that accurate XOR operations can be performed later.

[0088] XOR is a basic logical operation that plays an important role in binary data processing. Its operation rule is: when two binary bits are the same, the XOR result is 0; when two binary bits are different, the XOR result is 1. In this technical solution, the main singular value sequence and the binary private key sequence are XORed bit by bit, and this characteristic of the XOR operation is used to restore the original main singular value sequence.

[0089] In this embodiment, each bit in the main singular value sequence is XORed with each corresponding bit in the binary private key sequence from left to right (or in a specific order). For example, the first bit of the main singular value sequence is XORed with the first bit of the binary private key sequence to obtain the first bit of the result; the second bit of the main singular value sequence is XORed with the second bit of the binary private key sequence to obtain the second bit of the result, and so on. After performing such XOR operations on all bits, the XOR results of all bits are combined in sequence to obtain the original main singular value sequence. The above-mentioned original main singular value sequence is the original data that has been changed after encryption or other processing. It will serve as the basic data for subsequent steps (such as reconstructing the singular value matrix, etc.), and plays an important role in the smooth progress of the entire identity authentication process.

[0090] In one embodiment, before obtaining the identity data packet to be authenticated, the process includes:

[0091] Perform SM2 certificateless key generation on the original watermark data submitted by the user to obtain the user's public key and the corresponding private key;

[0092] Performing discrete wavelet transform on the original watermark data to obtain sub-band data at different frequency levels;

[0093] Performing singular value decomposition processing on the subband data to obtain a singular value matrix, and extracting a main singular value sequence in the singular value matrix;

[0094] Performing XOR encryption on the main singular value sequence and the user's private key to obtain an encrypted main singular value sequence;

[0095] The encrypted primary singular value sequence and the user public key are encrypted and packaged based on the SM2 algorithm to obtain an identity data packet.

[0096] In this embodiment, SM2 is a public key cryptographic algorithm based on the elliptic curve cryptography (ECC). Its key generation process is based on the difficulty of the elliptic curve discrete logarithm problem (ECDLP) to ensure the security of the key. Specifically, the user's private key is first generated through specific mathematical operations based on pre-set elliptic curve parameters (such as curve equation, base point, etc.). The private key is usually a random number, and the value range is within the interval that meets the requirements of the elliptic curve cryptography system. Then, using the private key and parameters such as the base point of the elliptic curve, the corresponding user public key is generated by elliptic curve point multiplication operations and other methods. The public key is a point on the elliptic curve, and its coordinates are represented in a specific format, which can be used for subsequent encryption, verification and other operations.

[0097] Discrete wavelet transform (DWT) is a signal processing and data compression technology. When processing watermark data, its main purpose is to decompose the original watermark data into sub-band data at different frequency levels in order to better extract data features, perform subsequent encryption processing, and achieve effective data reconstruction in the subsequent authentication process.

[0098] Discrete wavelet transform performs multi-scale decomposition operations on the original watermark data by selecting appropriate wavelet basis functions (such as Haar wavelet, Daubechies wavelet, etc.). It regards the original data as a signal and splits it according to different frequency components. Specifically, the original watermark data will first be decomposed into two parts: low-frequency sub-band and high-frequency sub-band, and then the low-frequency sub-band can be further decomposed into lower-frequency and relatively high-frequency sub-bands, and so on. After multiple decompositions, sub-band data at different frequency levels are obtained. The above decomposition method is similar to splitting a complex sound signal according to different tones (frequencies), so that we can analyze and process sub-band data at different frequency levels separately.

[0099] In watermark data processing, sub-band data at different frequency levels carry different characteristic information of the original watermark data. For example, low-frequency sub-band data usually contains the main outline and overall characteristic information of the watermark data, while high-frequency sub-band data may contain some details and edge characteristic information. By performing subsequent singular value decomposition and other processing on these sub-band data, key characteristic data for identity authentication can be extracted more effectively, and it is also convenient to perform targeted operations according to the characteristics of different sub-bands in the subsequent encryption, transmission and reconstruction processes.

[0100] Singular value decomposition (SVD) is a matrix decomposition technology. When processing sub-band data obtained from discrete wavelet transform, its purpose is to further extract the key features of the data and convert the sub-band data into a form that is easier to analyze, process and encrypt, namely the singular value matrix, and obtain the main singular value sequence as the important basic data for subsequent encryption and other operations.

[0101] For a given subband data matrix (which can be a subband data matrix of any frequency level obtained from discrete wavelet transform), singular value decomposition will decompose it into the product form of three matrices: U, Σ and V. Among them, U and V are orthogonal matrices, Σ is a diagonal matrix, and the elements on its diagonal are singular values. The above singular values ​​are arranged in order from large to small, reflecting the main characteristic information of the subband data matrix. Through the singular value decomposition operation, a complete singular value matrix can be obtained, which contains the key characteristic information of the subband data, and is presented in a clearer and easier to process way.

[0102] After obtaining the singular value matrix, we usually pay attention to the main singular value sequence. The main singular value sequence generally refers to the sequence composed of several larger singular values ​​on the diagonal of the singular value matrix. The above main singular values ​​carry the main characteristic information of the subband data, and they will serve as an important data basis in the subsequent encryption processing. The method of extracting the main singular value sequence is to directly select several singular values ​​from the diagonal position of the singular value matrix in order from large to small (the specific number of selected values ​​can be determined according to the actual situation and the requirements of subsequent operations) to form the main singular value sequence.

[0103] The purpose of the XOR encryption process here is to encrypt the main singular value sequence using the user's private key to protect the key feature information in the main singular value sequence so that it cannot be easily obtained or tampered with during transmission and subsequent processing, thereby ensuring the security of the watermark data and the accuracy of identity authentication.

[0104] When the main singular value sequence is XOR-encrypted with the user's private key, each bit in the main singular value sequence is XOR-ed with the corresponding bit in the user's private key. Due to the reversibility of the XOR operation, only by knowing the correct private key can the original main singular value sequence be restored through the XOR operation, which ensures the security of encryption.

[0105] The encrypted main singular value sequence obtained is the encrypted main singular value sequence, which will be used as one of the important input data for subsequent encryption and packaging processing based on the SM2 algorithm. In the entire identity authentication and watermark data processing process, the encrypted main singular value sequence can resist a certain degree of external attack and illegal acquisition during transmission. Only with the correct private key can the original main singular value sequence be restored in the subsequent steps to complete subsequent identity authentication and other operations.

[0106] Through encryption packaging processing based on the SM2 algorithm, the encrypted master singular value sequence and the user's public key are integrated and encrypted to form a complete identity data packet, which is convenient for subsequent transmission, storage, and identity authentication at the receiving end. This identity data packet is the key data carrier in the transmission link of the entire identity authentication process, and it needs to ensure the security and integrity of the data.

[0107] First, according to the specifications and requirements of the SM2 algorithm, the appropriate encryption mode (such as SM2's encryption function, encryption parameters, etc.) is selected. Then, the encrypted main singular value sequence and the user's public key are arranged in a preset format and order (for example, the encrypted main singular value sequence is placed first, and then the user's public key, etc.) to form a data block to be encrypted. Finally, the SM2 algorithm is used to encrypt the data block to be encrypted, and a series of mathematical operations such as elliptic curve point multiplication and modular operations are used to convert the data block into an encrypted form to obtain an identity data packet.

[0108] The above identity data packet is a comprehensive data body after encryption, which contains key information such as the encrypted main singular value sequence and the user's public key. In the subsequent identity authentication process, when the receiving end obtains this identity data packet, it is necessary to first restore the encrypted main singular value sequence and the user's public key through a decryption operation based on the SM2 algorithm, and then perform identity authentication processing according to subsequent steps (such as XOR decryption, reconstruction of the singular value matrix, etc.) to determine the legitimacy of the identity and verify the authenticity of the watermark data.

[0109] In one embodiment, the original main singular value sequence is reconstructed to obtain a reconstructed singular value matrix; and an inverse discrete wavelet transform is performed based on the reconstructed singular value matrix to obtain reconstructed watermark data, including:

[0110] Determining the dimension information of the reconstructed singular value matrix according to the length information of the original main singular value sequence and the preset singular value matrix structure rule;

[0111] Fill the elements in the original main singular value sequence into the corresponding matrix positions in sequence according to the dimension information to complete the construction of the reconstructed singular value matrix;

[0112] Based on the preset wavelet basis function and transformation parameters, performing inverse transformation calculation on each element in the reconstructed singular value matrix;

[0113] The results after the inverse transformation calculation are integrated and format converted to obtain reconstructed watermark data that is consistent with the original watermark data format.

[0114] In this embodiment, the length of the original main singular value sequence is an important reference. It contains a certain number of elements, which are key eigenvalues ​​obtained from the previous processing of the original watermark data (such as singular value decomposition and other operations). By analyzing its length, it can be preliminarily inferred how these elements should be distributed in various positions of the matrix when constructing the reconstructed singular value matrix, and what dimensional scale the matrix needs to have to reasonably accommodate these elements so that it can fully reflect the relevant characteristics of the original watermark data.

[0115] The preset singular value matrix structure rules are formulated based on the mathematical principles and data characteristic laws in the process of processing the original watermark data. The above rules stipulate the standard structural form of the singular value matrix under normal circumstances (that is, before transmission, encryption, and other operations that may cause deformation), such as the shape of the matrix (square or rectangular), the order of elements (for example, row priority or column priority), the relationship between different dimensions (such as the correspondence between a certain dimension and a certain characteristic dimension of the original watermark data), etc. Combined with the length information of the original main singular value sequence, these rules can accurately determine the dimensional information of the reconstructed singular value matrix, such as determining the number of rows and columns of the matrix, so as to perform subsequent element filling operations.

[0116] Starting from the first element of the original main singular value sequence, the elements are placed in the corresponding positions of the reconstructed singular value matrix in accordance with the established filling rules (such as row-first filling, that is, filling one row first and then filling the next row; or column-first filling, etc.). If it is found during the filling process that the number of elements in the original main singular value sequence does not completely match the number of elements that the reconstructed singular value matrix can accommodate according to the established dimensions, it is necessary to perform appropriate processing according to the specific situation. For example, when the number of elements is insufficient, reasonable supplements are made according to the mathematical properties of the matrix (such as symmetry, positive definiteness, etc.) (such as supplementing specific default values, etc.); when the number of elements is too large, truncation is required, but it is necessary to ensure that the truncation operation does not lose key feature information to ensure that the reconstructed singular value matrix can accurately reflect the relevant features of the original watermark data.

[0117] Once the element filling operation is completed and the complete reconstructed singular value matrix is ​​constructed, it means that the original main singular value sequence is converted from a one-dimensional sequence form to a two-dimensional matrix form with a specific mathematical structure (it can also be other dimensional forms, depending on the determined dimensional information). The above matrix form is more in line with the requirements of the subsequent inverse discrete wavelet transform and the entire process of restoring the original watermark data. It can carry more characteristic information about the original watermark data, and provides the necessary conditions for further accurate recovery and reconstruction of the watermark data.

[0118] Based on the preset wavelet basis function and transformation parameters, each element in the reconstructed singular value matrix is ​​inversely transformed. The purpose is to gradually restore the state of the original watermark data before the discrete wavelet transform, so as to prepare for the final reconstructed watermark data.

[0119] The preset wavelet basis function is one of the core elements of discrete wavelet transform and inverse discrete wavelet transform. Different wavelet basis functions (such as Haar wavelet, Daubechies wavelet, etc.) have different characteristics, which determine the way to decompose and reconstruct the data. In the inverse transform calculation process, it is necessary to ensure that the data can be correctly restored based on the wavelet basis function selected when the original watermark data is subjected to discrete wavelet transform. Transformation parameters are some transformation-related parameters recorded during the discrete wavelet transform process, such as the number of decomposition layers, subband coefficient scaling factors, etc. These parameters are crucial for accurate inverse transform calculation. Together with the wavelet basis function, they standardize the specific methods and steps of inverse transform calculation, ensuring accurate inverse transform operations for each element in the reconstructed singular value matrix.

[0120] For each element in the reconstructed singular value matrix, the inverse discrete wavelet transform mathematical formula and algorithm are used to calculate the selected wavelet basis function and the corresponding transformation parameters. By performing such inverse transformation calculations on each element, the data in the reconstructed singular value matrix is ​​gradually converted to a state closer to the original watermark data before the discrete wavelet transform.

[0121] After the previous inverse transform calculation steps, although the data in the reconstructed singular value matrix has been restored to a certain extent to be closer to the state of the original watermark data before the discrete wavelet transform, the data at this time may still have some formal differences, such as the data arrangement and data type may be inconsistent with the original watermark data. The result after the inverse transform calculation is processed to make it consistent with the format of the original watermark data in all aspects, so as to finally obtain the reconstructed watermark data for subsequent identity authentication and other operations.

[0122] The result of the inverse transform calculation may be a scattered data block or element set arranged in a certain way. The data integration operation is to reorganize these scattered data according to the arrangement of the original watermark data. For example, if the original watermark data is arranged in the form of a two-dimensional matrix, then the result of the inverse transform calculation is also organized into a corresponding two-dimensional matrix to ensure that the data arrangement is consistent with the original watermark data. At the same time, appropriate processing is performed on possible duplicate data, missing data, etc. to ensure data integrity and accuracy.

[0123] In addition to adjusting the data arrangement, format conversion operations may also be required. This is because the data type may have changed during the previous processing (such as encryption, decryption, transformation, etc.), such as from integer type to floating point type, or from binary form to decimal form, etc. The format conversion operation is to convert the data type back to the same type as the original watermark data. For example, if the original watermark data is of integer type, and the result of the inverse transformation calculation is of floating point type, the floating point type data needs to be converted to integer type, and processed by rounding, rounding, etc. (depending on the requirements of the original watermark data) to ensure that the data format is consistent with the original watermark data.

[0124] Through data integration and format conversion operations, we finally get the reconstructed watermark data that is consistent with the original watermark data format. This reconstructed watermark data will be used as the key data for matching and comparing with the original watermark data in the subsequent identity authentication process, and plays a vital role in accurately judging the legitimacy of the identity and verifying the authenticity of the watermark data.

[0125] In one embodiment, after obtaining the identity authentication result, the following steps are included:

[0126] Generate a corresponding mapping table for the identity data packet to be authenticated, the reconstructed watermark data and the identity authentication result;

[0127] A storage key is generated based on the mapping table and is used to encrypt and store the mapping table.

[0128] In this embodiment, after completing the identity authentication process and obtaining the identity authentication result, a mapping table containing the identity data packet to be authenticated, the reconstructed watermark data, and the identity authentication result is generated. The purpose is to create a structured data storage form that centrally records the key information related to this identity authentication, which is convenient for subsequent query, tracing, analysis, and further data processing operations on the authentication process and results, and also provides a basic data structure for subsequent encrypted storage and other operations based on this mapping table.

[0129] After obtaining the above three key elements, it is necessary to determine the structure of the mapping table to organize these data reasonably. Usually, a mapping table can be constructed in the form of a table or a database record with a specific field structure. For example, different fields can be set to correspond to the identity data packet to be authenticated, the reconstructed watermark data, and the identity authentication result. Each field can be set with a suitable storage format according to the type and characteristics of the corresponding data. For example, the identity data packet is stored in binary format, the reconstructed watermark data is stored in the corresponding standard format according to its data type (such as numeric type, character type, etc.), and the identity authentication result is stored in Boolean type (success is true, failure is false).

[0130] According to the determined mapping table structure, the identity data packet to be authenticated, the reconstructed watermark data and the identity authentication result are filled into the corresponding fields or positions respectively, so as to generate a complete mapping table. In this way, the key information of the identity authentication process is clearly recorded in a unified mapping table structure, which is convenient for subsequent processing and query.

[0131] The main purpose of generating a storage key and using it to encrypt and store the mapping table is to ensure the security and confidentiality of the key information about identity authentication recorded in the mapping table. Since the mapping table contains sensitive information such as the identity data packet to be authenticated, the reconstructed watermark data, and the identity authentication result, once leaked, it may pose a serious threat to the security of the relevant system, the privacy of the user, and the integrity of the data. By generating a specific storage key to encrypt and store it, this information can be effectively prevented from being accessed, tampered with, or stolen without authorization.

[0132] In one embodiment, generating a storage key based on the mapping table includes:

[0133] Converting the identity data packet to be authenticated in the mapping table into a first-dimensional vector, converting the reconstructed watermark data into a second-dimensional vector, and converting the identity authentication result into a third-dimensional vector;

[0134] Construct a hypercomplex space based on SM2 elliptic curve parameters, and map the first-dimensional vector, the second-dimensional vector, and the third-dimensional vector to the hypercomplex space; in the hypercomplex space, rotate and scale the mapped vectors to form a geometric figure with their trajectories in the hypercomplex space;

[0135] Extracting the coordinates of key feature points of the geometric figure, and encoding and compressing the coordinate values ​​of the key feature points;

[0136] The encoded and compressed data is grouped, and XOR and shift operations are performed alternately in each group to obtain the storage key.

[0137] In this embodiment, the identity data packet to be authenticated usually contains a series of complex binary data or data in other formats, depending on its initial setting in the identity authentication process. When converting it into a first-dimensional vector, it is necessary to extract information from the data in the data packet bit by bit or in groups, and arrange it in sequence into a one-dimensional vector form. For example, each byte (or other suitable unit) of data can be converted into an element in the vector in turn according to the storage order of the data in the data packet, thereby forming a first-dimensional vector with a certain length.

[0138] The reconstructed watermark data also has its own data structure and characteristics, including numerical data, a certain representation form of image data after processing, etc. When converted to a second-dimensional vector, the data is extracted and arranged according to the corresponding rules. For example, if the reconstructed watermark data is numerical data in the form of a two-dimensional matrix, the elements in the matrix can be extracted and arranged into a one-dimensional vector in a row-first or column-first manner, and then this one-dimensional vector is used as the second-dimensional vector. Of course, the specific conversion method needs to be determined according to the actual situation of the reconstructed watermark data, with the aim of accurately converting it into a vector form that can be easily used for mathematical operations in subsequent steps.

[0139] The result of identity authentication is usually a relatively simple Boolean value (true for success, false for failure) or other simple identification forms. When converting it into a third-dimensional vector, a simple encoding method can be used, such as representing true as [1] and false as [0], forming a third-dimensional vector with a length of 1. In this way, through different conversion methods, the three different types of data in the mapping table are converted into first-dimensional, second-dimensional and third-dimensional vectors respectively, preparing for subsequent processing in the hypercomplex space.

[0140] The purpose of constructing a hypercomplex space based on SM2 elliptic curve parameters is to introduce a complex and unique mathematical environment to process the vector data obtained from the previous conversion. The SM2 elliptic curve parameters themselves have high security and mathematical properties. Using these parameters to construct a hypercomplex space can enable subsequent processing of vectors based on the relevant principles of elliptic curve cryptography, thereby adding additional security and uniqueness to the generation of storage keys. Compared with ordinary real space or complex space, the hypercomplex space has a richer mathematical structure and can provide more diverse mathematical operations and transformation methods, which helps to mine deeper feature information of the data.

[0141] Mapping the first-dimensional vector, the second-dimensional vector, and the third-dimensional vector to the hypercomplex space is to introduce these vectors originally represented in the ordinary data space into the specific coordinate representation system of the hypercomplex space according to the rules and transformation methods. The specific mapping method can be to perform corresponding mathematical transformations on each element in the vector according to the SM2 elliptic curve parameters and the definition of the hypercomplex space, so that it can find the corresponding coordinate position in the hypercomplex space. For example, it is necessary to perform operations such as elliptic curve point multiplication and modular operations on the vector elements, and accurately map them to the hypercomplex space in combination with the dimension and coordinate rules of the hypercomplex space, so that these vectors have a new representation in the hypercomplex space, which is convenient for subsequent processing.

[0142] The purpose of rotating and scaling the mapped vector in the hypercomplex space is to change the position and shape of the vector in the hypercomplex space through these mathematical operations so that its trajectory can form a geometric figure. The formation of the above geometric figure is of great significance. First, it is an intuitive and unique mathematical representation of the vector data after a series of complex mathematical operations. After such processing, different mapping table data (i.e., different identity data packets to be authenticated, reconstructed watermark data, and identity authentication results) will form different geometric figures in the hypercomplex space, which provides a basis for the subsequent extraction of unique key feature point coordinates. Secondly, the process of forming geometric figures through rotation and scaling transformation is actually a deep mining and transformation of the data, making the characteristics of the data more prominent and unique, which helps to generate storage keys with higher security and uniqueness.

[0143] The purpose of extracting the key feature point coordinates of the above geometric figures is to further capture and refine the core feature information of the data after a series of processing. The above key feature point coordinates can represent the main characteristics of the geometric figures, such as vertex coordinates, special point coordinates, etc. They are the key identifiers of the entire geometric figure in the hypercomplex space. By extracting these coordinates, the complex geometric figure information can be simplified into a set of representative values ​​for subsequent further processing and generation of storage keys.

[0144] The specific method of extracting the coordinates of key feature points may involve using corresponding mathematical algorithms and tools to determine the positions of key feature points and obtain their coordinate values ​​according to the type of geometric figures (such as triangles, polygons, curves, etc.) and the coordinate system of hypercomplex space. For example, for a polygonal geometric figure, the key feature points can be determined by calculating the coordinates of its vertices; for a curved geometric figure, the key feature points can be determined by finding the coordinates of special points such as its extreme points and inflection points. In short, through appropriate mathematical methods, the coordinates of the key feature points of geometric figures can be accurately extracted, and the complex geometric figure information can be converted into a set of quantifiable coordinate values.

[0145] The purpose of encoding and compressing the coordinate values ​​of key feature points is to reduce the amount of data and to hide and protect the data to a certain extent. The purpose of grouping the encoded and compressed data is to further subdivide and organize the data so that targeted mathematical operations can be performed within each group to generate storage keys with specific rules and security. Through grouping, the originally relatively uniform encoded and compressed data can be divided into several small groups according to certain rules. The data in each group will serve as the basis for subsequent XOR and shift alternating operations, which can make the generated storage key have a more complex structure and higher security.

[0146] Performing XOR and shift operations alternately in each group is an effective way to generate storage keys through specific mathematical operations. XOR and shift operations are both basic operations commonly used in the field of cryptography. XOR operations are reversible and have unique logical characteristics. By performing XOR operations on data in a group, the binary representation of the data can be changed, increasing the randomness and unpredictability of the data. Shift operations can move data on binary bits, further changing the structure and characteristics of the data. By performing these two operations alternately, the data can be continuously transformed in each group, so that the storage key finally generated has a complex structure and high security. For example, the data in the group is first XORed, then shifted, and then XORed... This is performed alternately. After multiple rounds of operations, the processed data in each group is combined to obtain the storage key. The storage key generated by the above-mentioned XOR and shift alternating operations not only meets certain security requirements, but also has a unique generation rule, which can effectively prevent the storage key from being easily cracked.

[0147] In one embodiment, generating a storage key based on the mapping table includes:

[0148] Performing a hash operation on the mapping table to obtain a corresponding hash value; extracting multi-dimensional character features of the hash value; wherein the multi-dimensional character features are all represented as numbers;

[0149] The mapping table is screened for characters according to a preset rule, and the screened characters are added one by one in order to each node of a preset multi-branch tree template to generate a character tree; wherein, in the multi-branch tree template, a plurality of child nodes are split downward from a root node, and the child nodes are split downward iteratively;

[0150] Assigning a sequence number to the character tree, and searching the character tree for a sequence number corresponding to the number of the dimensional character feature as a target sequence number;

[0151] Connecting nodes corresponding to adjacent target numbers to obtain multiple straight lines; filtering out target nodes according to the positional relationship between each node in the character tree and the multiple straight lines;

[0152] The characters on the target node are combined in sequence to obtain the storage key.

[0153] In this embodiment, the mapping table is first hashed to convert the complex data content in the mapping table into a fixed-length, unique hash value. The hash function has a one-way characteristic, that is, the hash value can be easily calculated through the mapping table, but it is difficult (computationally infeasible) to reversely derive the original mapping table content from the hash value. This ensures the confidentiality of the original mapping table data in the subsequent process of generating storage keys based on the hash value, and at the same time uses the uniqueness of the hash value to provide a relatively stable and unique basis for the generation of storage keys.

[0154] Hash functions (such as SHA-256, etc.) treat the data in the mapping table as a byte stream, and process each bit of the byte stream through a series of complex mathematical operations (such as bit operations, modulus operations, etc.), and finally generate a hash value of fixed length. For example, SHA-256 will generate a 256-bit hash value, which is a 64-bit string in hexadecimal.

[0155] The purpose of extracting the multi-dimensional character features of the hash value is to further explore the potential information contained in the hash value so that it can be used to generate the storage key in the subsequent steps. The multi-dimensional character features mentioned here can analyze and extract the hash value from different angles. For example, the characteristic values ​​of different groups can be extracted from the binary representation of the hash value according to certain grouping rules (such as every few bits in a group); or the frequency of occurrence, position relationship, etc. of each character can be analyzed from the hexadecimal representation of the hash value as the characteristic value. The extracted multi-dimensional character features are all represented as numbers to facilitate the subsequent unified mathematical processing in the entire storage key generation process. For example, the hexadecimal characters can be converted into corresponding decimal numbers through encoding rules, or specific mathematical operations can be performed according to the characteristic values ​​of the binary grouping to convert them into digital form. In this way, the hash value features that originally existed in character or binary form are converted into digital form, which is convenient for connecting with the data processing methods in other steps.

[0156] The purpose of filtering characters in the mapping table according to preset rules is to select a part of representative or specific characters from the complex data set of the mapping table for use in building a character tree. These filtered characters will play an important role in the subsequent generation of storage keys. The above preset rules can be determined according to specific needs and designs. For example, filtering can be performed based on the type of characters (such as numeric characters, alphabetic characters, etc.) to select only a certain type of specific characters; it can also be filtered based on the position relationship of the characters in the mapping table (such as selecting one every few characters, etc.). Through these preset rules, it is possible to obtain characters that meet the requirements from the mapping table in a targeted manner, providing suitable materials for building a character tree.

[0157] The above-mentioned multi-branch tree template is a tree data structure with a pre-set structure, which stipulates that multiple child nodes are split downward from the root node, and the child nodes will iteratively split downward. For example, the root node is set to split into 3 child nodes, each child node is split into 3 child nodes, and so on, forming a multi-level tree structure. When adding characters, the characters are added to each node in sequence starting from the root node in the order of the filtered characters. If the current node is already filled with characters, add characters to the child nodes of the next layer. In this way, all the filtered characters are gradually added to the multi-branch tree template, and finally a complete character tree is generated.

[0158] The purpose of assigning serial numbers to the character tree is to establish a unique identifier for each node in the character tree so that it can be easily searched and located in subsequent operations. By assigning a serial number to each node, the nodes in the character tree can be associated with specific digital identifiers, making it easier to find nodes corresponding to dimensional character features. For example, you can start from the root node and assign an increasing serial number to each node in a depth-first traversal manner. First, assign a serial number to the root node, and then traverse the child nodes of the root node in the order of left first and right later (or other preset traversal order) and assign serial numbers to them, and so on, until all nodes in the character tree are assigned serial numbers.

[0159] After assigning serial numbers to the character tree, the serial numbers of the nodes are compared with the numbers of the dimensional character features. If a node serial number is found to be equal to the number of one of the dimensional character features, then the serial number of this node is recorded as the target serial number. Since the multi-dimensional character features of the hash value include multiple numbers, this search process needs to be repeated until the target serial number corresponding to the numbers of all dimensional character features is found. The above target serial number will be used to determine the target node in the subsequent steps to generate the storage key.

[0160] The purpose of connecting the target numbers in sequence to obtain multiple straight lines is to represent the relationship between the target numbers in a visual way, and to provide a basis for the subsequent screening of target nodes based on this relationship. By connecting the target numbers to form straight lines, the order and connection between different target numbers can be more intuitively observed, which is very important for determining the positional relationship of related nodes in the character tree later. For example, if there are target numbers 1, 3, and 5, connecting them in sequence can obtain a straight line from node 1 through node 3, and a straight line from node 3 to node 5. This way of forming straight lines can help more accurately locate the nodes related to these target numbers in the character tree, thereby screening out the target nodes.

[0161] To filter the target nodes according to the positional relationship between each node and multiple straight lines in the character tree, you need to find those nodes in the character tree that have a specific positional relationship with the formed straight lines as target nodes. The specific positional relationship can be determined according to the needs. For example, you can set to filter out the nodes that are on the straight line as target nodes; or filter out the nodes that are closest to the straight line as target nodes; you can also filter the target nodes according to other conditions such as the positional relationship of the nodes above and below the straight line. By traversing the character tree, checking the positional relationship between each node and multiple straight lines, according to the preset filtering conditions, filter out the nodes that meet the conditions as target nodes.

[0162] The purpose of combining the characters on the target node in sequence to obtain the storage key is to generate a storage key with specific rules and security through a series of complex operations, starting from the mapping table, through hash operation, character screening, character tree construction, target sequence number search and target node screening. This storage key will be used to encrypt and store the mapping table to ensure the security and confidentiality of the key information about identity authentication contained in the mapping table. In this embodiment, different mapping table data will generate different target nodes after the above steps, thereby obtaining different storage keys, which ensures the uniqueness and security of the storage key, making it difficult for unauthorized personnel to obtain the correct storage key by guessing or other conventional means, thereby protecting the sensitive information in the mapping table.

[0163] Reference Figure 2 In one embodiment of the present invention, there is also provided an SM2 certificateless identity authentication system, comprising:

[0164] An acquisition unit is used to acquire the identity data packet to be authenticated, decrypt the identity data packet based on the SM2 algorithm, and obtain a primary singular value sequence and a user public key;

[0165] A decryption unit, used for performing XOR decryption processing on the main singular value sequence and the private key corresponding to the user public key to obtain an original main singular value sequence;

[0166] A reconstruction unit, used for reconstructing the original main singular value sequence to obtain a reconstructed singular value matrix;

[0167] A transform unit, used for performing an inverse discrete wavelet transform based on the reconstructed singular value matrix to obtain reconstructed watermark data;

[0168] The authentication unit is used to match the reconstructed watermark data with the original watermark data in the database, and obtain an identity authentication result based on the matching result.

[0169] In this embodiment, for the specific implementation of each unit in the above system embodiment, please refer to the above method embodiment, which will not be repeated here.

[0170] Reference Figure 3 In an embodiment of the present invention, a computer device is also provided. The computer device may be a server, and its internal structure may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, a display screen, an input device, a network interface and a database connected through a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the corresponding data in this embodiment. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the above method is implemented.

[0171] Those skilled in the art will understand that Figure 3 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied.

[0172] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above method is implemented. It can be understood that the computer-readable storage medium in this embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0173] In summary, the SM2-based certificateless identity authentication method and system provided in the embodiment of the present invention include: obtaining an identity data packet to be authenticated, decrypting the identity data packet based on the SM2 algorithm to obtain a main singular value sequence and a user public key; performing XOR decryption processing on the main singular value sequence and the private key corresponding to the user public key to obtain the original main singular value sequence; reconstructing the original main singular value sequence to obtain a reconstructed singular value matrix; performing an inverse discrete wavelet transform based on the reconstructed singular value matrix to obtain reconstructed watermark data; matching the reconstructed watermark data with the original watermark data in the database, and obtaining an identity authentication result based on the matching result. In the present invention, by introducing the decryption mechanism of the SM2 algorithm, the required reconstructed watermark data is parsed from the identity data packet to be authenticated, and then matched and authenticated with the original watermark data in the database. The identity authentication mechanism is deeply integrated with the characteristics of the watermark data to overcome the current defect that identity authentication based on watermark data cannot be efficiently and accurately realized.

[0174] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided by the present invention and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double-speed data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM.

[0175] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0176] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A certificateless identity authentication method based on SM2, characterized in that: The following steps are involved: Obtain the identity data packet to be authenticated, decrypt the identity data packet based on the SM2 algorithm, and obtain the primary singular value sequence and the user public key; Performing XOR decryption processing on the main singular value sequence and the private key corresponding to the user public key to obtain the original main singular value sequence; Reconstructing the original main singular value sequence to obtain a reconstructed singular value matrix; Performing inverse discrete wavelet transform based on the reconstructed singular value matrix to obtain reconstructed watermark data; The reconstructed watermark data is matched with the original watermark data in the database, and an identity authentication result is obtained according to the matching result.

2. The SM2 certificateless identity authentication method according to claim 1, characterized in that: The method of decrypting the identity data packet based on the SM2 algorithm to obtain the main singular value sequence and the user public key includes: Parsing the encryption key information in the identity data packet based on the key parsing function in the SM2 algorithm to obtain a session key; Performing symmetric decryption processing on the encrypted data portion in the identity data packet based on the session key to obtain preliminary decrypted data; According to a preset data structure identifier, the preliminary decrypted data is split to separate the main singular value sequence and the user public key from the preliminary decrypted data.

3. The SM2 certificateless identity authentication method according to claim 1, characterized in that: The main singular value sequence is subjected to XOR decryption processing with the private key corresponding to the user public key to obtain the original main singular value sequence, including: Extract the public key feature code from the user's public key, and locate the corresponding private key storage address according to a pre-established mapping relationship table between the public key feature code and the private key storage path; Read a private key from the private key storage address and convert the private key into a binary private key sequence having the same length as the primary singular value sequence; The main singular value sequence and the binary private key sequence are subjected to a bit-by-bit XOR operation to obtain an original main singular value sequence.

4. The SM2 certificateless identity authentication method according to claim 1, characterized in that: Before obtaining the identity data packet to be authenticated, the method includes: Perform SM2 certificateless key generation on the original watermark data submitted by the user to obtain the user's public key and the corresponding private key; Performing discrete wavelet transform on the original watermark data to obtain sub-band data at different frequency levels; Performing singular value decomposition processing on the subband data to obtain a singular value matrix, and extracting a main singular value sequence in the singular value matrix; Performing XOR encryption on the main singular value sequence and the user's private key to obtain an encrypted main singular value sequence; The encrypted primary singular value sequence and the user public key are encrypted and packaged based on the SM2 algorithm to obtain an identity data packet.

5. The SM2 certificateless identity authentication method according to claim 1, characterized in that: Reconstructing the original main singular value sequence to obtain a reconstructed singular value matrix; Performing an inverse discrete wavelet transform based on the reconstructed singular value matrix to obtain reconstructed watermark data includes: Determining the dimension information of the reconstructed singular value matrix according to the length information of the original main singular value sequence and the preset singular value matrix structure rule; Fill the elements in the original main singular value sequence into the corresponding matrix positions in sequence according to the dimension information to complete the construction of the reconstructed singular value matrix; Based on the preset wavelet basis function and transformation parameters, performing inverse transformation calculation on each element in the reconstructed singular value matrix; The results after the inverse transformation calculation are integrated and format converted to obtain reconstructed watermark data that is consistent with the original watermark data format.

6. The SM2 certificateless identity authentication method according to claim 1, characterized in that: After the identity authentication result is obtained, the following steps are included: Generate a corresponding mapping table for the identity data packet to be authenticated, the reconstructed watermark data and the identity authentication result; A storage key is generated based on the mapping table and is used to encrypt and store the mapping table.

7. The SM2 certificateless identity authentication method according to claim 6, characterized in that: Generating a storage key based on the mapping table includes: Converting the identity data packet to be authenticated in the mapping table into a first-dimensional vector, converting the reconstructed watermark data into a second-dimensional vector, and converting the identity authentication result into a third-dimensional vector; Construct a hypercomplex space based on SM2 elliptic curve parameters, and map the first-dimensional vector, the second-dimensional vector, and the third-dimensional vector to the hypercomplex space; in the hypercomplex space, rotate and scale the mapped vectors to form a geometric figure with their trajectories in the hypercomplex space; Extracting the coordinates of key feature points of the geometric figure, and encoding and compressing the coordinate values ​​of the key feature points; The encoded and compressed data is grouped, and XOR and shift operations are performed alternately in each group to obtain the storage key.

8. An SM2 certificateless identity authentication system, characterized in that: include: An acquisition unit is used to acquire the identity data packet to be authenticated, decrypt the identity data packet based on the SM2 algorithm, and obtain a primary singular value sequence and a user public key; A decryption unit, used for performing XOR decryption processing on the main singular value sequence and the private key corresponding to the user public key to obtain an original main singular value sequence; A reconstruction unit, used for reconstructing the original main singular value sequence to obtain a reconstructed singular value matrix; A transform unit, used for performing an inverse discrete wavelet transform based on the reconstructed singular value matrix to obtain reconstructed watermark data; The authentication unit is used to match the reconstructed watermark data with the original watermark data in the database, and obtain an identity authentication result based on the matching result.

9. A computer device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images