Key verification method

Abstract

According to the secret key verification method implemented by applying the quantum state, only a cloud server and a user master own user secret keys, a verification party does not master the secret keys, even if the verification party knows answers of all questions, the verification party cannot obtain specific numerical values of bits corresponding to the secret keys and cannot reversely deduce the secret keys according to the questions, and therefore the verification efficiency is improved. Therefore, the security of the key is ensured. Therefore, in the secret key verification method, a notarist is not needed, a high-order entangled state does not need to be prepared either, even if an attacker has controlled the verification party, the shared user secret key cannot be obtained, and the good safety performance is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptography, and in particular to a key verification method implemented by means of quantum states. Background Art

[0002] In 1982, someone proposed the following problem (i.e., the millionaire problem): There are two millionaires, a million and b million, where a and b are both integers. The two want to compare the size of a and b, but do not want to disclose the amount of their own property. Later, someone proposed a quantum confidentiality comparison protocol using quantum states, and through the intervention of an honest notary, it can achieve the comparison of a and b in the problem, and even more extensive private data. This method of comparing private data using quantum states is later called the quantum privacy comparison (QPC) protocol.

[0003] Quantum privacy comparison can be applied to key verification to achieve high confidentiality comparison of keys. However, the existing QPC protocol requires a semi-honest notary, which limits the application of the QPC protocol in key verification, because in practical applications, adding a notary will introduce new risks. In addition, the existing QPC protocol requires the preparation of high-order entangled states. The preparation of high-order entangled states in practical applications and the prevention of decoherence of high-order entangled states are both thorny issues, which place high demands on devices. Summary of the invention

[0004] In view of the above problems in the prior art, the present invention proposes a key verification method implemented by using quantum states, in which only the cloud server and the user have their own user keys, and the verifier does not have the key. Even if the verifier knows the answer to each question, it cannot obtain the specific value of the bit corresponding to the key, and cannot infer the key based on the question, thereby ensuring the security of the key. Therefore, in this key verification method, there is no need for a notary, nor is there a need to prepare a high-order entangled state. Even if the attacker has controlled the verifier, the shared user key cannot be obtained, and it has good security performance. Obviously, this security of verification makes the key verification method well suitable for Internet projects to prevent key leakage during the verification process, because the verification method proposed by the present invention can effectively improve the security of verification. In the worst case, such as the verifier being invaded, hijacked and eavesdropped, this scheme can still prevent the intruder from obtaining the shared key, thereby achieving the security of verification.

[0005] Specifically, the present invention relates to a key verification method, which includes a key length acquisition step, a question setting step, a server feedback step, a user feedback step, a comparison step and a verification step;

[0006] The key length acquisition step is used for the verification party to obtain the length M of the user key from the server;

[0007] The question setting step is used to generate L questions by the verifier, where L is an integer satisfying [M / 3]≤L≤[M / 2]. The question includes comparing the size of an integer i and a number j consisting of 3 bits in the user key, where, corresponding to each question, an integer i is randomly selected from 2 to 6, and the positions of the 3 bits in the user key are randomly selected in sequence;

[0008] The server feedback step is used for the verifier to obtain answers to L questions from the server by means of the comparison step, wherein the verifier and the server are Alice and Bob in the comparison step respectively;

[0009] The user feedback step is used for the verification party to obtain answers to L questions from the user by means of the comparison step, wherein the verification party and the user are Alice and Bob in the comparison step respectively;

[0010] In the comparison step, Alice selects n=8 quantum bits to be encoded under a first basis vector and sends them to Bob in sequence, wherein the first basis vector is kept secret from Bob, and the first i quantum bits of the n quantum bits have a first value, and the last ni quantum bits have a second value; Bob sends n-1 quantum bits of the n quantum bits except the j+1th quantum bit to Alice in a changing order; Alice measures the received n-1 quantum bits in sequence under the first basis vector to obtain an answer, wherein when i-1 first values ​​are measured, the answer is recorded as a first result value, and when i first values ​​are measured, the answer is recorded as a second result value, otherwise an error is fed back;

[0011] The verification step is used by the verification party to compare the L answers obtained through the server feedback step with the L answers obtained through the user feedback step, and pass the verification when the comparison is consistent.

[0012] Furthermore, in the key length acquisition step, the user sends a login request to the authenticator, and the authenticator applies to the server for the length M of the user key in response to the login request; and the server searches for the user key and feeds back its length M to the authenticator in response to the application.

[0013] Furthermore, in the comparing step, the first basis vector is randomly selected.

[0014] Optionally, the first value is one of |0> or |1>, and the second value is the other of |0> or |1>; and / or, the first result value is one of 0 or 1, and the second result value is the other of 0 or 1.

[0015] Further, if an error is reported in the server feedback step or the user feedback step and the number of errors does not exceed a preset threshold, the question setting step is repeated so that the verification party regenerates L questions, and verification is performed based on the regenerated questions with the help of the server feedback step, the user feedback step and the verification step; and,

[0016] If an error is reported in the server feedback step or the user feedback step and the number of errors exceeds a preset threshold, the verification is terminated.

[0017] Preferably, the user key is formed by combining a K-bit random key P and a MK-bit hash function value Hash(P) about the key P. Before the server feedback step, the server also includes a step of verifying whether the last Mn bits in the user key are the hash function value of the first n bits; and / or before the user feedback step, the user also includes a step of verifying whether the last Mn bits in the user key are the hash function value of the first n bits. And, when verifying that the last Mn bits in the user key are the hash function value of the first n bits, the server feedback step and / or the user feedback step are executed.

[0018] Preferably, the server is a cloud server.

[0019] Preferably, the user key is implemented through a quantum key distribution process. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The specific implementation modes of the present invention are further described in detail below in conjunction with the accompanying drawings.

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. It is obvious that the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 A method for applying quantum states to solve the millionaire's problem according to the present invention is shown, wherein the first value is selected as |0> and the second value is selected as |1>;

[0023] Figure 2 A key verification method according to the present invention is shown. DETAILED DESCRIPTION

[0024] Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. The following embodiments are provided by way of example so as to fully convey the spirit of the present invention to those skilled in the art to which the present invention belongs. Therefore, the present invention is not limited to the embodiments disclosed herein.

[0025] Figure 1 The data comparison method using quantum states according to the present invention is shown, which allows the comparison of the (private) data sizes of both parties in a way that both parties are unaware of each other's data without introducing an honest notary and preparing a high-order entangled state, thereby solving the millionaire's problem.

[0026] Assume that the two parties who need to compare the data size are Alice and Bob, where Alice has data i and Bob has data j, i and j are integers and 0≤i, j<n, and Alice and Bob want to compare the size of i and j.

[0027] To achieve the above data size comparison, such as Figure 1 As shown, the data comparison method of the present invention may include the following steps.

[0028] Step S101 is used to prepare quantum bits: Alice selects a basis, such as a first basis vector, to encode and prepare n quantum bits under the first basis vector, wherein the selected first basis vector is kept secret from Bob, and the first i of the n quantum bits have a first value, such as encoded as |0>, and the last ni have a different second value, such as encoded as |1>.

[0029] Step S102 is used to send the prepared quantum bits: Alice sends the n quantum bits she prepared to Bob in sequence.

[0030] Step S103 is used for Bob's quantum bit feedback: after receiving the n quantum bits sent by Alice, Bob extracts the j+1th quantum bit, and then sends the remaining n-1 quantum bits to Alice in a random order.

[0031] Step S104 is used for Alice to measure the feedback quantum bits: after receiving the n-1 quantum bits fed back by Bob, Alice measures the received n-1 quantum bits in turn according to the basis selected in step S101, such as the first basis vector, and records the measurement results.

[0032] Step S105, which is used to analyze the measurement results to obtain the answer to the comparison question: if there are i-1 first values ​​(e.g. |0>) in the measurement results, it means that the j+1th quantum bit taken by Bob is the first value (|0>), which indicates that the answer to the comparison question is j<i, and accordingly the answer can be recorded as the first result value, e.g. 0;

[0033] If there are i first values ​​(|0>) in the measurement result, it means that the j+1th qubit taken by Bob is the second value (|1>), which means that the answer to the comparison problem is j≥i. Accordingly, the answer can be recorded as the second result value, for example, 1.

[0034] If the measurement result is other, an error is fed back and the comparison process is terminated.

[0035] It can be seen that, with the help of the above method, the size of data i and j can be compared without Alice and Bob publishing their respective data i and j. Among them, the use of quantum state information can greatly improve security, because on the one hand, if the information used in the method (protocol) is classical information, then Bob can check the number of 0 and 1 to obtain data i. However, when the method uses quantum information, because the basis selected by Alice is confidential, Bob cannot know the measurement basis, and thus cannot perform measurement without causing changes in quantum bits, and cannot know the number of |0> in n quantum bits, so it is impossible to know the size of data i. Further, Bob's measurement behavior will cause a change in the quantum state, which will be discovered by Alice in step S105. On the other hand, if classical information is used in the method, Alice uses encrypted numbers and Bob cannot decrypt them. If Alice changes the transmitted encrypted information from 0 / 1 to numbers from 0 to n, then Bob takes the jth encrypted information and returns the remaining encrypted information, and Alice can obtain j by decryption. However, in the present invention, there is only one quantum bit that carries the information 0 or 1. Since the order of the n-1 quantum bits that Bob feeds back to Alice is disrupted, distinguishing these n-1 quantum bits is equivalent to distinguishing the one quantum bit that Bob takes away. However, there are only two measurement results for a quantum bit, so when n≥3, a quantum bit with n possibilities cannot be completely distinguished. Therefore, no matter what quantum bits Alice prepares, the quantum bits taken away by Bob cannot be distinguished, so Alice cannot know the data j. It can be seen that with the data size comparison method of the present invention, the use of quantum information is superior to the use of classical information, and can effectively prevent the leakage of data i and j. Compared with the previous QPC protocol, no notary is required; no preparation and maintenance of multi-quantum entangled states are required; only Alice needs to prepare and measure quantum bits, and the requirements for equipment and environment are relatively low.

[0036] Due to the many advantages of the above data comparison method, the present invention further proposes a key verification method based on the data comparison method, which is used to realize key verification between a user and a server (such as a cloud server) with the help of any verification party.

[0037] Figure 2The key verification method according to the present invention is shown, which can, for example, be used in an application scenario where a user key is shared between a user and a (cloud) server, by verifying whether the user key provided by the user is consistent with the corresponding user key maintained in the server, thereby realizing functions related to key verification, such as login, query, etc.

[0038] like Figure 2 As shown, the key verification method of the present invention may include a key length acquisition step, a question setting step, a server feedback step, a user feedback step, a comparison step and a verification step.

[0039] According to the present invention, in order to implement key verification by means of the above data comparison method, it is first necessary to use a key length acquisition step, where the verification party obtains the length M of the user key from the server.

[0040] As an example, when a user sends a login request to the authenticator, the authenticator, in response to the login request, requests the cloud server to obtain the length M of the user key. After receiving the user key length request from the authenticator, the cloud server can find the corresponding (shared) user key according to, for example, the user name, and feed back its length M to the authenticator.

[0041] After obtaining the length M of the user key, it is necessary to use L specific size comparison questions to implement key verification between the user and the cloud server according to the answers to the size comparison questions, where L is an integer and [M / 3]≤L≤[M / 2]. Therefore, in the present invention, with the help of the problem setting step, the verification party generates L questions, which involve the size comparison problem of the integer i and the number j composed of 3 bits in the user key. Specifically, when generating each question, it is necessary to set the integers i and j (that is, the 3 bit positions in the user key) accordingly, where the integer i is randomly selected from 2 to 6 each time, and the 3 bit positions in the user key are also randomly selected sequentially each time. For example, corresponding to a certain question, i=2 is randomly selected from 2-6, and the bit composition j at the 1st, 3rd, and M-1 positions is randomly selected from the 1-M bit positions in the user key, while for another question, i=5 is randomly selected, and the bit composition j at the 4th, 8th, and M-3 positions in the M-bit user key is randomly selected. With this randomness, in these L questions, the randomly selected number i and the 3 bit positions on the user data will not be exactly the same.

[0042] Subsequently, the answers to the L questions can be obtained from the server and the user respectively by means of the server feedback step and the user feedback step, wherein the answer to each question needs to be obtained by means of the comparison step implemented by the above data comparison method.

[0043] Specifically, corresponding to the above data comparison method, in the comparison step of the present invention, Alice can choose to encode n=8 (corresponding to the range of 0-7 for a number composed of 3 bits) quantum bits under the first basis vector and send them to Bob sequentially, wherein the first basis vector is kept confidential to Bob, and the first i of the n quantum bits have a first value (for example, |0>), and the last ni have a second value (for example, |1>); Bob sends the n-1 quantum bits except the j+1th quantum bit among the n quantum bits to Alice in a changing order (i.e., disrupting the original order); Alice measures the received n-1 quantum bits in turn under the first basis vector to obtain an answer, wherein when i-1 first values ​​are measured, the answer is recorded as the first result value (for example, 0), and when i first values ​​are measured, the answer is recorded as the second result value (for example, 1), otherwise an error is fed back.

[0044] Therefore, in the server feedback step, the verifier and the server act as Alice and Bob in the comparison step, respectively, and the verifier obtains the answers to the L questions from the server by means of the comparison step. In the user feedback step, the verifier and the user act as Alice and Bob in the comparison step, respectively, and the verifier obtains the answers to the L questions from the user by means of the comparison step.

[0045] Further, it can be known that in the server feedback step, the verifier can obtain L answers with the help of the comparison step, which may include an answer with an incorrect result (i.e., feedback error). In order to ensure the efficiency and reliability of the verification method, a threshold value can be pre-set for the number of errors in the present invention. When the feedback error occurs and the number of errors does not exceed the preset threshold, the question setting step is repeated so that the verifier regenerates L questions, and then based on the regenerated questions, verification is performed again with the help of the server feedback step, the user feedback step and the verification step; and when the feedback error occurs and the number of errors exceeds the preset threshold, the current verification process can be terminated.

[0046] Similarly, in the user feedback step, the verifier can also obtain L answers with the help of the comparison step, which may include an answer with an incorrect result (i.e., feedback error). Therefore, with the help of a preset threshold, when the feedback is incorrect and the number of errors does not exceed the preset threshold, the question setting step can be repeated to allow the verifier to regenerate L questions, and then based on the regenerated questions, verification can be performed again with the help of the server feedback step, the user feedback step, and the verification step; and when the feedback is incorrect and the number of errors exceeds the preset threshold, the current verification process can be terminated.

[0047] After the verifier obtains the correct answers to L questions from the server and the user respectively with the help of the server feedback step and the user feedback step, the verifier can use the verification step to compare the L answers obtained through the server feedback step with the L answers obtained through the user feedback step, and pass the verification when the comparison is consistent, and feedback the verification failure to the user when the comparison is inconsistent.

[0048] Furthermore, the M-bit user key can preferably be formed by combining the K-bit random key P and the MK-bit hash function value Hash(P), that is, P+Hash(P), where the hash function value Hash(P) is a value generated by operating the key P using a hash function. The user and the cloud server can use the same hash function operation, thereby amplifying the difference in random keys.

[0049] At this time, in the key verification method of the present invention, before the server feedback step, the server can verify whether the last Mn bits in the user key are the hash function value of the first n bits; and before the user feedback step, the user can verify whether the last Mn bits in the user key are the hash function value of the first n bits. And when it is verified that the last Mn bits in the user key are the hash function value of the first n bits, the server feedback step and the user feedback step are performed.

[0050] Furthermore, the user keys can be securely distributed between the user and the cloud server via quantum key distribution (QKD) technology.

[0051] Based on the above content, it can be seen that in the key verification method of the present invention, only the cloud server and the user have the key, the verifier does not have the key, and even if the verifier knows the answer to each question, it cannot obtain the specific value of the key corresponding to the bit, so it is impossible to infer the key based on the question, thereby ensuring the security of the key. Therefore, in this key verification method, there is no need for a notary, nor is there a need to prepare a high-order entangled state. Even if the attacker has controlled the verifier, the shared user key cannot be obtained, and it has good security performance. Obviously, this verification security makes the key verification method well suited for Internet projects to prevent key leakage during the verification process, because the verification method proposed by the present invention can effectively improve the security of verification. In the worst case, such as the verifier being invaded, hijacked and eavesdropped, this solution can still prevent the intruder from obtaining the shared key, thereby achieving the security of verification.

[0052] Although the present invention has been described above through specific embodiments in conjunction with the accompanying drawings, those skilled in the art will readily recognize that the above embodiments are merely exemplary and are used to illustrate the principles of the present invention, and do not limit the scope of the present invention. Those skilled in the art may make various combinations, modifications and equivalent substitutions to the above embodiments without departing from the spirit and scope of the present invention.

Claims

1. A key verification method, comprising a key length obtaining step, a question setting step, a server feedback step, a user feedback step, a comparison step and a verification step; The key length acquisition step is used for the verification party to obtain the length M of the user key from the server; The problem setting step is used to generate L questions by the verifier, where L is an integer and [M / 3]≤L≤[M / 2], and the question includes comparing the size of the integer i with the number j consisting of 3 bits in the user key, wherein, For each question, randomly select an integer i from 2 to 6, and randomly select the positions of the 3 bits in the user key in sequence; The server feedback step is used for the verifier to obtain answers to L questions from the server by means of the comparison step, wherein the verifier and the server are Alice and Bob in the comparison step respectively; The user feedback step is used for the verification party to obtain answers to L questions from the user by means of the comparison step, wherein the verification party and the user are Alice and Bob in the comparison step respectively; In the comparison step, Alice selects n=8 quantum bits to be encoded under a first basis vector and sends them to Bob in sequence, wherein the first basis vector is kept secret from Bob, and the first i quantum bits of the n quantum bits have a first value, and the last ni quantum bits have a second value; Bob sends n-1 quantum bits of the n quantum bits except the j+1th quantum bit to Alice in a changing order; Alice measures the received n-1 quantum bits in sequence under the first basis vector to obtain an answer, wherein when i-1 first values ​​are measured, the answer is recorded as a first result value, and when i first values ​​are measured, the answer is recorded as a second result value, otherwise an error is fed back; The verification step is used by the verification party to compare the L answers obtained through the server feedback step with the L answers obtained through the user feedback step, and pass the verification when the comparison is consistent.

2. The key verification method according to claim 1, wherein: In the key length acquisition step, the user sends a login request to the verification party, and the verification party applies to the server to obtain the length M of the user key in response to the login request; And, in response to the application, the server searches for the user key and feeds back its length M to the verifier.

3. The key verification method according to claim 1, wherein: In the comparing step, the first basis vector is randomly selected.

4. The key verification method according to claim 1, wherein: The first value is one of |0> or |1>, and the second value is the other of |0> or |1>; and / or, the first result value is one of 0 or 1, and the second result value is the other of 0 or 1.

5. The key verification method according to claim 1, wherein: If an error is reported in the server feedback step or the user feedback step and the number of errors does not exceed a preset threshold, repeat the question setting step so that the verification party regenerates L questions, and performs verification based on the regenerated questions with the help of the server feedback step, the user feedback step and the verification step; and, If an error is reported in the server feedback step or the user feedback step and the number of errors exceeds a preset threshold, the verification is terminated.

6. The key verification method according to claim 1, wherein: The user key is formed by combining a K-bit random key P and an MK-bit hash function value Hash(P) about the key P.

7. The key verification method according to claim 6, wherein: Before the server feedback step, the method further includes a step in which the server verifies whether the last Mn bits in the user key are the hash function value of the first n bits; and / or, before the user feedback step, the method further includes a step in which the user verifies whether the last Mn bits in the user key are the hash function value of the first n bits.

8. The key verification method as claimed in claim 7, wherein: When verifying that the last Mn bits in the user key are the hash function value of the first n bits, a server feedback step and / or a user feedback step is performed.

9. The key verification method according to any one of claims 1 to 8, wherein: The server is a cloud server.

10. The key verification method according to any one of claims 1 to 8, wherein: The user key is implemented through a quantum key distribution process.

Images