Consistency verification method and device

Abstract

The invention discloses a consistency verification method and device, and the method comprises the steps: n first devices receive n ciphertexts, the n ciphertexts are in one-to-one correspondence with the n first devices, each first device corresponds to a secret key, each ciphertext is determined by carrying out the first encryption of a plaintext according to the secret key of the corresponding first device, and n is a positive integer; the second device obtains the first challenge value and plaintexts corresponding to the n ciphertexts; the second device sends n first response values to a third device, the n first response values are in one-to-one correspondence with the n ciphertexts, each first response value is determined according to a first random value, a first challenge value and a plaintext, and the first random value belongs to a preset random value set; and the third device verifies whether the n plaintexts corresponding to the n ciphertexts are consistent or not according to the n first response values. According to the scheme of the invention, on the premise that the plaintext is not leaked, the consistency of the ciphertext received by multiple devices is efficiently verified, and the verification overhead and the potential safety hazard are reduced.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a consistency verification method and device. Background Art

[0002] With the development of smart hardware development technology and wireless communication technology, more and more smart devices have entered daily life, bringing many conveniences to the public. The development department of the device manufacturer needs to regularly push firmware updates to the sold devices to fix security vulnerabilities or improve device performance. The quality assurance department of the device manufacturer needs to collect feedback from device users about the use of new firmware updates and analyze these feedbacks in order to improve future update files. The quality assurance department needs to first verify whether all devices have received and installed the latest firmware of the same version to ensure the reliability of the feedback data.

[0003] However, due to the technical confidentiality and code privacy of the firmware design and development department, the development department cannot directly provide the firmware file to the quality assurance department. For privacy and security reasons, the device owner is also unable to directly provide the firmware plaintext. Therefore, how to verify the consistency of the firmware without leaking the firmware plaintext is an urgent problem to be solved. Summary of the invention

[0004] The present application provides a consistency verification method and device, which verify the consistency of the firmware update of the device based on additive homomorphic encryption technology and zero-knowledge proof. Under the premise of protecting the privacy of the firmware update, the verification overhead and security risks are reduced, and the verification reliability of the firmware consistency is improved.

[0005] In a first aspect, a consistency verification method is provided, the method comprising: n first devices receiving n ciphertexts, the n ciphertexts corresponding one-to-one to the n first devices, each first device corresponding to a key, each ciphertext being determined by first encrypting a plaintext according to the key of the corresponding first device, and n being a positive integer; a second device obtaining a first challenge value and plaintexts corresponding to the n ciphertexts; the second device sending n first response values ​​to a third device, the n first response values ​​corresponding one-to-one to the n ciphertexts, each first response value being determined according to a first random value, a first challenge value and plaintext, and the first random value belonging to a preset random value set; the third device verifying whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n first response values.

[0006] It should be noted that each device corresponds to a key. The key of the device can be understood as the key corresponding to the node, or the key owned by the device. In the following text, the key of the ciphertext can be understood as the key corresponding to the node used to encrypt the plaintext to obtain the ciphertext. The subsequent expressions can be understood in this way and will not be repeated.

[0007] According to the solution of the present application, through the method of zero-knowledge proof, it is possible to efficiently verify whether multiple devices have installed consistent firmware updates without leaking update files, thereby reducing verification overhead and security risks, and locating specific devices with inconsistent updates.

[0008] In combination with the first aspect, in certain implementations of the first aspect, the second device obtains the keys corresponding to n first devices; the second device sends n first commitment values ​​to the third device, the n first commitment values ​​correspond one-to-one to the n ciphertexts, each first commitment value is determined by performing a second encryption on a first random value according to the key of the corresponding ciphertext, and the second encryption and the first encryption use the same algorithm; the third device verifies whether the i-th ciphertext is obtained from the plaintext based on the i-th first commitment value, the first challenge value and the i-th first response value, i∈{1,2,…,n}.

[0009] In combination with the first aspect, in some implementations of the first aspect, when the first response value Res i , the first commitment value Com i , the first challenge value c and the ciphertext C i The third device determines that the i-th ciphertext is obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the third encryption and the first encryption use the same algorithm.

[0010] In combination with the first aspect, in certain implementations of the first aspect, the first device obtains a second challenge value; the first device sends a second response value and a second commitment value to a third device, the second response value is determined based on a second random value, a second challenge value and a plaintext, the second random value belongs to a random value set, and the second commitment value is determined by performing a fourth encryption on the second random value based on the key of the first device, and the fourth encryption uses the same algorithm as the first encryption; the third device verifies whether the jth first device has the plaintext corresponding to the jth ciphertext based on the jth second response value, the jth second challenge value and the jth second commitment value, j∈{1,2,…,n}.

[0011] In combination with the first aspect, in some implementations of the first aspect, when the second response value Res j , the second commitment value Com j , the second challenge value c j and ciphertext C j The jth first device has the plaintext corresponding to the jth n ciphertext when the following conditions are met: in, It represents a value determined by fifthly encrypting the j-th second response value according to the key of the first device corresponding to the j-th second response value, and the fifth encryption uses the same algorithm as the first encryption.

[0012] In combination with the first aspect, in some implementations of the first aspect, algorithms used for the first encryption, the second encryption, the third encryption, the fourth encryption, and the fifth encryption include an additive homomorphic encryption algorithm.

[0013] According to the solution of the present application, an additively homomorphic asymmetric encryption algorithm is used to replace a general asymmetric encryption algorithm to meet the consistency verification equation designed subsequently and ensure the confidentiality of the plaintext during transmission.

[0014] In combination with the first aspect, in some implementations of the first aspect, the additive homomorphic encryption algorithm includes a Paillier encryption algorithm.

[0015] In combination with the first aspect, in some implementations of the first aspect, the first response value Res i , the first random value r, the first challenge value c and the plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0016] In combination with the first aspect, in some implementations of the first aspect, the second response value Res j , the second random value r j , the second challenge value c j and plaintext M j , satisfying the following conditions: Res j =r j +c j ·M j , j∈{1,2,…,n}.

[0017] In combination with the first aspect, in certain implementations of the first aspect, the second device receives a first challenge value sent by the third device, and the first challenge value belongs to a random value set; the first device receives a second challenge value sent by the third device, and the second challenge value belongs to a random value set.

[0018] In combination with the first aspect, in some implementations of the first aspect, the second device determines the first challenge value based on the first commitment value; and the first device determines the second challenge value based on the second commitment value and the ciphertext.

[0019] According to the solution of the present application, through a non-interactive consistency proof method, proof parameters are generated once and sent to a third device for verification, avoiding the need for the device and the verifier to interact online in real time at the same time during the verification process, thereby reducing communication overhead.

[0020] In a second aspect, a consistency verification method is provided, the method comprising: obtaining a first challenge value and plaintexts corresponding to n ciphertexts, the n ciphertexts corresponding one-to-one to n first devices, each first device corresponding to a key, and each ciphertext being determined after a first encryption of the plaintext according to the key of the corresponding first device; sending n first response values, the n first response values ​​corresponding one-to-one to the n ciphertexts, each first response value being determined based on a first random value, a first challenge value and the plaintext, the first random value belonging to a preset random value set, and the n first response values ​​being used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent.

[0021] In combination with the second aspect, in certain implementations of the second aspect, keys corresponding to n first devices are obtained; n first commitment values ​​are sent, the n first commitment values ​​correspond one-to-one to n ciphertexts, each first commitment value is determined by performing a second encryption on a first random value based on the key of the corresponding ciphertext, the second encryption and the first encryption use the same algorithm, the i-th first commitment value is used to verify with the first challenge value and the i-th first response value whether the i-th ciphertext is obtained from the plaintext, i∈{1,2,…,n}.

[0022] In conjunction with the second aspect, in certain implementations of the second aspect, when the first response value Res i , the first commitment value Com i , the first challenge value c and the ciphertext C i The ith ciphertext is obtained from the ith plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the third encryption and the first encryption use the same algorithm.

[0023] In conjunction with the second aspect, in certain implementations of the second aspect, the first response value Res i , the first random value r, the first challenge value c and the plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0024] In combination with the second aspect, in some implementations of the second aspect, a first challenge value sent by a third device is received, and the first challenge value belongs to a random value set.

[0025] In combination with the second aspect, in some implementations of the second aspect, the first challenge value is determined according to the first commitment value.

[0026] In combination with the second aspect, in some implementations of the second aspect, the algorithms used for the first encryption, the second encryption, and the third encryption include an additive homomorphic encryption algorithm.

[0027] In combination with the second aspect, in some implementations of the second aspect, the additive homomorphic encryption algorithm includes the Paillier encryption algorithm.

[0028] According to a third aspect, a consistency verification method is provided, the method comprising: obtaining a first challenge value; receiving n first response values, the n first response values ​​corresponding one-to-one to n ciphertexts, the n ciphertexts corresponding one-to-one to n first devices, each first device corresponding to a key, each ciphertext being determined after a first encryption of a plaintext according to the key of the corresponding first device, each first response value being determined according to a first random value, a first challenge value and a plaintext, the first random value belonging to a preset set of random values; verifying whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n first response values.

[0029] In combination with the third aspect, in certain implementations of the third aspect, n first commitment values ​​are received, the n first commitment values ​​correspond one-to-one to n ciphertexts, each first commitment value is determined after a second encryption of a first random value based on a key of the corresponding ciphertext, and the second encryption and the first encryption use the same algorithm; based on the i-th first commitment value, the first challenge value and the i-th first response value, it is verified whether the i-th ciphertext is obtained from the plaintext, i∈{1,2,…,n}.

[0030] In conjunction with the third aspect, in certain implementations of the third aspect, when the first response value Res i , the first commitment value Com i , the first challenge value c and the ciphertext C i The i-th ciphertext is determined to be obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the third encryption and the first encryption use the same algorithm.

[0031] In combination with the third aspect, in certain implementations of the third aspect, a second challenge value is obtained; a second response value and a second commitment value are received, the second response value is determined based on a second random value, a second challenge value and a plaintext, the second random value belongs to a random value set, and the second commitment value is determined after performing a fourth encryption on the second random value based on a key of the first device, and the fourth encryption uses the same algorithm as the first encryption; and based on the jth second response value, the jth second challenge value and the jth second commitment value, it is verified whether the jth first device has the plaintext corresponding to the jth ciphertext, j∈{1,2,…,n}.

[0032] In combination with the third aspect, in certain implementations of the third aspect, when the second response value Res j , the second commitment value Comj , the second challenge value c j and ciphertext C j The jth first device has the plaintext corresponding to the jth n ciphertext when the following conditions are met: in, It represents a value determined by performing a fifth encryption on the j-th second response value according to the key of the first device corresponding to the j-th second response value, and the fifth encryption and the first encryption use the same algorithm.

[0033] In conjunction with the third aspect, in certain implementations of the third aspect, the first response value Res i , the first random value r, the first challenge value c and the plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0034] In conjunction with the third aspect, in certain implementations of the third aspect, the second response value Res j , the second random value r j , the second challenge value c j and plaintext M j , satisfying the following conditions: Res j =r j +c j ·M j , j∈{1,2,…,n}.

[0035] In combination with the third aspect, in certain implementations of the third aspect, the first challenge value is determined based on the first commitment value; and the second challenge value is determined based on the second commitment value and the ciphertext.

[0036] In combination with the third aspect, in some implementations of the third aspect, the algorithms used for the first encryption, the second encryption, the third encryption, the fourth encryption, and the fifth encryption include an additive homomorphic encryption algorithm.

[0037] In combination with the third aspect, in some implementations of the third aspect, the additive homomorphic encryption algorithm includes the Paillier encryption algorithm.

[0038] In a fourth aspect, a consistency verification method is provided, the method comprising: obtaining a ciphertext and a second challenge value, the ciphertext being determined by a first encryption of a plaintext according to a key, and n being a positive integer; sending a second response value and a second commitment value, the second response value being determined based on a second random value, a second challenge value and a plaintext, the second random value belonging to a preset set of random values, and the second commitment value being determined by a third encryption of the second random value according to the key, and the third encryption and the first encryption use the same algorithm; the second response value, the second challenge value and the second commitment value are used to verify whether the plaintext corresponding to the ciphertext is possessed.

[0039] In conjunction with the fourth aspect, in certain implementations of the fourth aspect, when the second response value Res j , the second commitment value Com j , the second challenge value c j and ciphertext C j When the following conditions are met, it is determined that the plaintext corresponding to the ciphertext is possessed: in, Indicates a value determined by performing a fifth encryption on the second response value according to the key.

[0040] In conjunction with the fourth aspect, in certain implementations of the fourth aspect, the second response value Res j , the second random value r j , the second challenge value c j and plaintext M j , satisfying the following conditions: Res j =r j +c j ·M j , j∈{1,2,…,n}.

[0041] In combination with the fourth aspect, in certain implementations of the fourth aspect, the second challenge value is determined based on the second commitment value and the ciphertext.

[0042] In a fifth aspect, a consistency verification device is provided, which includes: a transceiver unit, used to obtain a first challenge value and plaintexts corresponding to n ciphertexts, the n ciphertexts corresponding one-to-one to n first devices, each first device corresponding to a key, and each ciphertext is determined after a first encryption of the plaintext according to the key of the corresponding first device; and also used to send n first response values, the n first response values ​​corresponding one-to-one to the n ciphertexts, each first response value is determined based on a first random value, a first challenge value and plaintext, the first random value belongs to a preset random value set, and the n first response values ​​are used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent.

[0043] In combination with the fifth aspect, in certain implementations of the fifth aspect, the transceiver unit is further used to obtain the keys corresponding to n first devices; and is also used to send n first commitment values, the n first commitment values ​​corresponding one-to-one to the n ciphertexts, each first commitment value being determined by performing a second encryption on the first random value based on the key of the corresponding ciphertext, the second encryption and the first encryption use the same algorithm, the i-th first commitment value is used to verify with the first challenge value and the i-th first response value whether the i-th ciphertext is obtained from the plaintext, i∈{1,2,…,n}.

[0044] In conjunction with the fifth aspect, in certain implementations of the fifth aspect, when the first response value Res i , the first commitment value Com i, the first challenge value c and the ciphertext C i The ith ciphertext is obtained from the ith plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the third encryption and the first encryption use the same algorithm.

[0045] In conjunction with the fifth aspect, in certain implementations of the fifth aspect, the first response value Res i , the first random value r, the first challenge value c and the plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0046] In combination with the fifth aspect, in some implementations of the fifth aspect, the transceiver unit is specifically used to receive a first challenge value sent by a third device, and the first challenge value belongs to a random value set.

[0047] In combination with the fifth aspect, in some implementations of the fifth aspect, the device also includes a processing unit, configured to determine a first challenge value based on the first commitment value.

[0048] In combination with the fifth aspect, in certain implementations of the fifth aspect, the algorithms used for the first encryption, the second encryption, and the third encryption include an additive homomorphic encryption algorithm.

[0049] In combination with the fifth aspect, in certain implementations of the fifth aspect, the additive homomorphic encryption algorithm includes a Paillier encryption algorithm.

[0050] In a sixth aspect, a consistency verification device is provided, the device comprising: a transceiver unit, configured to obtain a first challenge value; and further configured to receive n first response values, the n first response values ​​corresponding one-to-one to n ciphertexts, the n ciphertexts corresponding one-to-one to n first devices, each first device corresponding to a key, each ciphertext being determined after first encrypting a plaintext according to the key of the corresponding first device, each first response value being determined according to a first random value, a first challenge value and a plaintext, and the first random value belonging to a preset random value set;

[0051] The processing unit is used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n first response values.

[0052] In conjunction with the sixth aspect, in some implementations of the sixth aspect, the transceiver unit is used to receive n first commitment values, the n first commitment values ​​correspond one-to-one to the n ciphertexts, each first commitment value is determined after performing a second encryption on the first random value according to a key of the corresponding ciphertext, and the second encryption and the first encryption use the same algorithm;

[0053] A processing unit is used to verify whether the i-th ciphertext is obtained from the plaintext according to the i-th first commitment value, the first challenge value and the i-th first response value, i∈{1,2,…,n}.

[0054] In conjunction with the sixth aspect, in certain implementations of the sixth aspect, when the first response value Res i , the first commitment value Com i , the first challenge value c and the ciphertext C i The i-th ciphertext is determined to be obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the third encryption and the first encryption use the same algorithm.

[0055] In combination with the sixth aspect, in some implementations of the sixth aspect, the transceiver unit is further used to obtain a second challenge value; and is further used to receive a second response value and a second commitment value, the second response value is determined according to the second random value, the second challenge value, and the plain text, the second random value belongs to the random value set, and the second commitment value is determined after performing a fourth encryption on the second random value according to the key of the first device, and the fourth encryption and the first encryption use the same algorithm;

[0056] The processing unit is further used to verify whether the jth first device has the plaintext corresponding to the jth ciphertext according to the jth second response value, the jth second challenge value and the jth second commitment value, j∈{1,2,…,n}.

[0057] In combination with the sixth aspect, in certain implementations of the sixth aspect, when the second response value Res j , the second commitment value Com j , the second challenge value c j and ciphertext C j The jth first device has the plaintext corresponding to the jth n ciphertext when the following conditions are met: in, It represents a value determined by performing a fifth encryption on the j-th second response value according to the key of the first device corresponding to the j-th second response value, and the fifth encryption and the first encryption use the same algorithm.

[0058] In conjunction with the sixth aspect, in certain implementations of the sixth aspect, the first response value Res i , the first random value r, the first challenge value c and the plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0059] In conjunction with the sixth aspect, in certain implementations of the sixth aspect, the second response value Res j , the second random value r j , the second challenge value c j and plaintext M j , satisfying the following conditions: Res j =r j +c j ·M j , j∈{1,2,…,n}.

[0060] In combination with the sixth aspect, in certain implementations of the sixth aspect, the processing unit is used to determine the first challenge value based on the first commitment value; and is also used to determine the second challenge value based on the second commitment value and the ciphertext.

[0061] In combination with the sixth aspect, in certain implementations of the sixth aspect, the algorithms used for the first encryption, the second encryption, the third encryption, the fourth encryption, and the fifth encryption include an additive homomorphic encryption algorithm.

[0062] In combination with the sixth aspect, in some implementations of the sixth aspect, the additive homomorphic encryption algorithm includes the Paillier encryption algorithm.

[0063] In the seventh aspect, a consistency verification device is provided, which includes: a transceiver unit, used to obtain a ciphertext and a second challenge value, the ciphertext is determined by a first encryption of a plaintext according to a key, and n is a positive integer; it is also used to send a second response value and a second commitment value, the second response value is determined based on a second random value, a second challenge value and a plaintext, the second random value belongs to a preset set of random values, and the second commitment value is determined by a third encryption of the second random value according to the key, and the third encryption and the first encryption use the same algorithm; the second response value, the second challenge value and the second commitment value are used to verify whether the plaintext corresponding to the ciphertext is possessed.

[0064] In conjunction with the seventh aspect, in certain implementations of the seventh aspect, when the second response value Res j , the second commitment value Com j , the second challenge value c j and ciphertext C j When the following conditions are met, it is determined that the plaintext corresponding to the ciphertext is possessed: in, Indicates a value determined by performing a fifth encryption on the second response value according to the key.

[0065] In conjunction with the seventh aspect, in certain implementations of the seventh aspect, the second response value Res j , the second random value r j , the second challenge value c j and plaintext Mj , satisfying the following conditions: Res j =r j +c j ·M j , j∈{1,2,…,n}.

[0066] In combination with the seventh aspect, in certain implementations of the seventh aspect, the device also includes a processing unit for determining a second challenge value based on the second commitment value and the ciphertext.

[0067] In combination with the seventh aspect, in certain implementations of the seventh aspect, the algorithms used for the first encryption, the third encryption, and the fifth encryption include an additive homomorphic encryption algorithm.

[0068] In combination with the seventh aspect, in some implementations of the seventh aspect, the additive homomorphic encryption algorithm includes a Paillier encryption algorithm.

[0069] In an eighth aspect, a consistency verification system is provided, the communication system comprising the consistency verification device provided in the fifth aspect, the consistency verification device provided in the sixth aspect, and the consistency verification device provided in the seventh aspect. The communication system can complete the consistency verification method provided in any possible implementation of the first to fourth aspects or the first to fourth aspects.

[0070] In the ninth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program runs on a computer, the computer executes instructions of the method of any possible implementation of the first to fourth aspects or the first to fourth aspects.

[0071] In a tenth aspect, a chip is provided, comprising: a processor, wherein the processor or the processing unit can execute instructions so that the method of any possible implementation of the first to fourth aspects or the first to fourth aspects is executed.

[0072] Among them, the processor mentioned above can be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the consistency verification method of the first to fourth aspects mentioned above.

[0073] In an eleventh aspect, a computer program product is provided, which includes a computer program code, and when the computer program code is executed, instructions for executing the method of any possible implementation of the first to fourth aspects or the first to fourth aspects are executed.

[0074] In the twelfth aspect, a chip system is provided, including a memory and a processor, wherein the memory is used to store instructions, and the processor is used to call and execute the instructions from the memory, so that the methods in the above-mentioned first to fourth aspects and possible implementation methods are executed.

[0075] Among them, the chip system may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.

[0076] Specifically, the beneficial effects of other aspects can refer to the beneficial effects described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0078] Figure 2 It is a schematic diagram of a consistency verification method provided by an embodiment of the present application;

[0079] Figure 3 is a schematic diagram of another consistency verification method provided in an embodiment of the present application;

[0080] Figure 4 is a schematic block diagram of a consistency verification device provided in an embodiment of the present application;

[0081] Figure 5 It is a schematic block diagram of another consistency verification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0082] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0083] The method provided in the present application can be applied to a distributed device, which may be a terminal device or a network device.

[0084] The terminal device in the embodiments of the present application may refer to user equipment (UE), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. The terminal device may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a 5G network or a terminal device in an evolved public land mobile network (PLMN), etc., and the embodiments of the present application are not limited to this. For example, the terminal device can be an on-board device, a complete vehicle device, an on-board module, a vehicle, an on-board unit (OBU), a roadside unit (RSU), a telematics box (T-box), a chip or a system on chip (SOC), etc. The above chip or SOC can be installed in a vehicle, OBU, RSU or T-box.

[0085] The terminal devices involved in the embodiments of the present application also include augmented reality AR / virtual reality VR / extended reality XR devices, wearable devices, smart home appliance terminals, terminal devices and communication modules of terminal devices, mobile phones and communication modules in mobile phones, vehicles and communication modules in vehicles, information processing devices, display devices, network devices, base stations, TRPs, customer premise equipment (CPE), routers, network access devices, etc. Considering Uu (UTRAN-to-terminal equipment) air interface transmission, both parties of wireless communication include network devices and user communication equipment; considering SL air interface transmission, the transceiver and transmitter of wireless communication are both user communication equipment. The network device can be a traditional macro base station eNB in ​​a traditional UMTS / LTE wireless communication system, a micro base station eNB in ​​a heterogeneous network (HetNet) scenario, a baseband processing unit (base band unit, BBU) and a remote radio unit (remote radio unit, RRU) in a distributed base station scenario, a baseband pool BBU pool and a radio unit RRU in a CRAN scenario, and a gNB in ​​a wireless communication system.

[0086] The network device in the embodiment of the present application can be any device with wireless transceiver function. The device includes but is not limited to: evolved Node B (eNB), radio network controller (RNC), Node B (NB), base station controller (BSC), base transceiver station (BTS), home base station (e.g., home evolved NodeB, or homeNode B, HNB), baseband unit (BBU), access point (AP) in wireless fidelity (WiFi) system, wireless relay node, wireless backhaul node, transmission point (TP) or transmission and reception point (TRP), etc., and can also be a gNB in ​​5G, such as NR, system, or a transmission point (TRP or TP), one or a group of (including multiple antenna panels) antenna panels of a base station in a 5G system, or a network node constituting a gNB or a transmission point, such as a baseband unit (BBU), or a distributed unit (DU), etc.

[0087] In some deployments, the gNB may include a centralized unit (CU) and a DU. The gNB may also include an active antenna unit (AAU). The CU implements some functions of the gNB, and the DU implements some functions of the gNB, for example, the CU is responsible for processing non-real-time protocols and services, and implementing the functions of the radio resource control (RRC) and packet data convergence protocol (PDCP) layers. The DU is responsible for processing physical layer protocols and real-time services, and implementing the functions of the radio link control (RLC) layer, the medium access control (MAC) layer, and the physical (PHY) layer. The AAU implements some physical layer processing functions, radio frequency processing, and related functions of active antennas. Since the information of the RRC layer will eventually become the information of the PHY layer, or be converted from the information of the PHY layer, therefore, under this architecture, high-level signaling, such as RRC layer signaling, can also be considered to be sent by the DU, or, sent by the DU+AAU. It can be understood that the network device can be a device including one or more of a CU node, a DU node, and an AAU node. In addition, the CU may be classified as a network device in an access network (radio access network, RAN), or the CU may be classified as a network device in a core network (core network, CN), which is not limited in the present application.

[0088] In an embodiment of the present application, a terminal device or a network device includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. The hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and a memory (also referred to as main memory). The operating system may be any one or more computer operating systems that implement business processing through a process, such as a Linux operating system, a Unix operating system, an Android operating system, an iOS operating system, or a Windows operating system. The application layer includes applications such as a browser, an address book, a word processing software, and an instant messaging software. In addition, the present application does not specifically limit the specific structure of the execution subject of the method provided by the present application, as long as it can communicate according to the method provided by the embodiment of the present application by running a program having a code of the method provided by the present application, for example, the execution subject of the method provided by the embodiment of the present application may be a terminal device or a network device, or a functional module in a terminal device or a network device that can call a program and execute the program.

[0089] In addition, various aspects or features of the present application can be implemented as methods, devices or products using standard programming and / or engineering techniques. The term "product" used in this application covers computer programs that can be accessed from any computer-readable device, carrier or medium. For example, computer-readable storage media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks or tapes, etc.), optical disks (e.g., compact discs (CDs), digital versatile discs (DVDs), etc.), smart cards and flash memory devices (e.g., erasable programmable read-only memories (EPROMs), cards, sticks or key drives, etc.). In addition, the various storage media described herein may represent one or more devices and / or other machine-readable media for storing information. The term "machine-readable medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing and / or carrying instructions and / or data.

[0090] It should be understood that in this application, "sending information to...(terminal)" can be understood as the destination of the information being the terminal. It can include sending information to the terminal directly or indirectly. "Receiving information from...(terminal)" can be understood as the source of the information being the terminal, which can include receiving information from the terminal directly or indirectly. The information may be processed as necessary between the source and destination of the information, such as format changes, etc., but the destination can understand the valid information from the source. Similar expressions in this application can be understood similarly and will not be repeated here.

[0091] In order to facilitate understanding of the embodiments of the present application, first, a brief introduction is given to the concepts and technologies involved in the embodiments of the application.

[0092] It should be understood that the related terms and explanations in the following text are common to all embodiments throughout the text, and different embodiments can be used independently or in combination based on certain internal or external connections, and different implementation methods in the embodiments can be used independently or in combination.

[0093] 1. Hash function

[0094] Hash function, also known as hash algorithm or hash function, is a method of creating a small digital "fingerprint" from any kind of data. Hash function compresses a message or data into a summary, making the data smaller and fixing the format of the data. The function shuffles and mixes the data to recreate a fingerprint called a hash value or hash value. Hash values ​​are usually represented by a short string of random letters and numbers.

[0095] 2. Firmware Update

[0096] Device firmware update scenarios such as Figure 1 As shown. The specific process includes three steps: First, the device manufacturer uses the public key of each device based on asymmetric encryption technology to encrypt the update file and generate a unique ciphertext; then, the manufacturer pushes the ciphertext to the corresponding device; finally, each device uses the private key to decrypt the update file locally and install the latest firmware update. The quality assurance department of the device manufacturer needs to collect feedback from device users on the use of the new version of the firmware update and analyze these feedbacks to improve future update files. The quality assurance department needs to first verify whether all devices have received and installed the same version of the latest firmware to ensure the reliability of the feedback data. However, due to the technical confidentiality and code privacy of the firmware design and development department, the development department cannot directly provide the firmware file to the quality assurance department. For privacy and security reasons, the device owner is also unable to directly provide the firmware plaintext. Therefore, all device owners (or the device itself) need to prove to the quality assurance department that they have successfully received and installed the same version of the firmware update pushed by the development department without leaking the firmware plaintext.

[0097] In a possible implementation, the consistency of the firmware update file may be verified by the version number. The verifier determines whether the same version of the firmware update is installed on each device by checking whether the version numbers in the firmware update file are consistent.

[0098] It should be understood that in the above implementation, firstly, the version number of the firmware update file received by the device may not match the firmware update file; secondly, the device may provide the verifier with a version number that is inconsistent with the firmware update installed by it. The above reasons will cause the verifier to fail to verify the consistency of the version number.

[0099] In another possible implementation, the consistency of the firmware update file can be verified by a hash algorithm. The hash verification is based on the anti-collision property of the hash algorithm. The verifier uses a hash function to perform a hash operation on the firmware update file, and then compares the hash value with the hash value of the firmware update received by all devices. If they are consistent, it indicates the integrity and consistency of the firmware update file. Otherwise, it indicates that the firmware update file installed on the device is inconsistent.

[0100] It should be understood that in the above implementation, if hash verification is used to verify the consistency of the firmware update file, the verifier needs to know the plain text information of the firmware update file to calculate the correct hash value, and then compare it with the hash value of the local update file of each device to verify the consistency of the update file version. This process discloses the privacy of the firmware update to the verifier. Therefore, the hash verification-based solution cannot realize the verification of the consistency of the firmware update while protecting the privacy of the file.

[0101] Based on the above problems, the present application provides a consistency verification method.

[0102] In the method of the present application, the first device may refer to a distributed network device or terminal device (Devices), and the third device may be the quality assurance department (Verifier) ​​of the device manufacturer. It is assumed that the third device will honestly follow the protocol to perform operations, but will attempt to reveal the privacy information of the firmware update file based on the obtained data, so any useful information related to the firmware update plaintext cannot be leaked during the proof process. The third device can be a verifier or multiple verifiers; the first device can also be other distributed devices that need to verify the consistency of distributed information, which is not limited in this application.

[0103] The present application provides a consistency verification method 100, such as Figure 2 As shown, the method 100 includes at least the following steps:

[0104] S110, the first device receives n ciphertexts.

[0105] The n first devices receive n ciphertexts, the n ciphertexts correspond to the n first devices one by one, each first device corresponds to a key, and each ciphertext is determined by first encrypting the plaintext according to the key of the corresponding first device.

[0106] In one possible implementation, the first encryption includes an additively homomorphic encryption algorithm.

[0107] Additively homomorphic asymmetric encryption systems include the Paillier encryption algorithm.

[0108] Additively homomorphic asymmetric encryption systems also include Gentry algorithm, BGV / BFV scheme, GSW scheme and CKKS algorithm, etc. The asymmetric encryption system only needs to satisfy additively homomorphic, and this application does not limit the specific algorithm used.

[0109] For example, there are n distributed devices in the system, and the distributed devices can be terminal devices and / or network devices. Each device has a pair of public and private keys {PK i ,SK i}, i∈{1,2,…,n}; the development department uses an additively homomorphic asymmetric encryption system, such as the Paillier encryption algorithm, to encrypt the firmware update using the public key of each device, expressed as Where M represents the update file, C i Indicates the ciphertext of the update file encrypted with the public key of device i.

[0110] The first device receives the ciphertext, which may be the ciphertext directly received and sent from the system, or downloaded from other devices.

[0111] In one possible implementation, the development department will C i , i∈{1,2,…,n} is sent to the corresponding device i, and C i Stored in a transparent, tamper-proof database, such as the Ethereum blockchain network, for device owners and quality assurance departments to query and download.

[0112] It should also be understood that device i uses the private key SK i Decryption C i Get the update file, install the update locally, and the public key PK of each device i , i∈{1,2,…,n} is also public in the system, for example, also stored in the blockchain network.

[0113] S120: The third device determines a first challenge value.

[0114] S121, the third device sends a first challenge value, and correspondingly, S122, the second device obtains the first challenge value.

[0115] The second device may be one of the n first devices, or may be other distributed devices, which is not limited in this application.

[0116] Exemplarily, the verifier may select one device from all first devices as a master prover (MP), ie, the second device.

[0117] The third device determines a first challenge value, and the first challenge value belongs to a preset random value set.

[0118] The random value set in this application can be preset by the system, for example, selecting an integer set A value space used as a random value for all devices.

[0119] For example, the verifier randomly selects a challenge value And send it to the master prover MP.

[0120] The second device also obtains the plaintexts corresponding to the n ciphertexts.

[0121] S130: The second device determines n first response values.

[0122] S131, the second device sends n first response values, and correspondingly, the third device receives the first response values.

[0123] The first response value corresponds to the ciphertext one by one, each first response value is determined according to the first random value, the first challenge value and the plaintext, and the first random value belongs to a preset random value set.

[0124] In one possible implementation, a random number is selected The first response value Res i , the first random value r, the first challenge value c and the plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0125] The master prover calculates n first response values ​​and sends all responses to the verifier.

[0126] S170: The third device performs verification.

[0127] The third device verifies whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n first response values.

[0128] The verifier checks whether Res1=Res2=…=Res n ; If the equality holds, it means that the plaintext contained in the n responses received by the verifier is the same.

[0129] In a possible implementation, method 100 may further include the following steps:

[0130] S150: The second device determines n first commitment values.

[0131] S151, the second device sends n first commitment values, and correspondingly, the third device receives n first commitment values

[0132] The n first commitment values ​​correspond one-to-one to the n ciphertexts, and each first commitment value is determined after performing a second encryption on the first random value according to the key of the corresponding ciphertext, and the first encryption and the second encryption use the same algorithm.

[0133] The second device will obtain the keys corresponding to the n first devices.

[0134] In one possible implementation, the second encryption includes an additively homomorphic asymmetric encryption system, and the additively homomorphic asymmetric encryption system includes a Paillier encryption algorithm.

[0135] Specifically, the master prover calculates n first commitment values ​​according to the first random value

[0136] S170: The third device performs verification.

[0137] The third device verifies whether the i-th ciphertext is obtained from the plaintext according to the i-th first commitment value, the first challenge value and the i-th first response value, i∈{1,2,…,n}.

[0138] In a possible implementation, when the first response value Res i , the first commitment value Com i , the first challenge value c and the ciphertext C i The third device determines that the i-th ciphertext is obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the third encryption and the first encryption use the same algorithm.

[0139] If the mth equation does not hold, that is, Then it can be determined which specific device's ciphertext and plaintext are inconsistent, thereby verifying which device caused the inconsistency.

[0140] S140: The third device determines a second challenge value.

[0141] S141, the third device sends a second challenge value, and correspondingly, S142, the first device obtains the second challenge value.

[0142] The third device randomly selects n-1 second challenge values And P j ≠MP, and send it to the corresponding first device.

[0143] S160, the second device determines a second response value and a second commitment value.

[0144] S161, the second device sends a second response value and a second commitment value, and correspondingly, the third device receives the second response value and the second commitment value.

[0145] The second commitment value is determined after performing a fourth encryption on the second random value according to the key of the first device, and the fourth encryption and the first encryption use the same algorithm.

[0146] The first device calculates the second response value Res j =r j +c j ·M j , j∈{1,2,…,n} and P j ≠MP, and sent to the verifier;

[0147] In a possible implementation, when the second response value Res j , the second commitment value Com j , the second challenge value c j and ciphertext C j The jth first device has the plaintext corresponding to the jth n ciphertext when the following conditions are met: in, It represents a value determined by performing a fifth encryption on the j-th second response value according to the key of the first device corresponding to the j-th second response value, and the fifth encryption and the first encryption use the same algorithm.

[0148] For example, after receiving all the response values, the verifier checks whether And P j ≠MP. If satisfied, it means the first device P j Indeed, it has C j The corresponding firmware update plaintext.

[0149] In one possible implementation, after receiving all responses, the verifier performs the following three checks:

[0150] (1) Whether Res1=Res2=…=Res n , if satisfied, it means that the firmware update included in the MP's response is the same.

[0151] (2) Whether If satisfied, it means ciphertext C i It is indeed composed of the corresponding i Generated by a firmware update.

[0152] (3) Whether And P j ≠MP.

[0153] If all three verification conditions are passed, it means that the firmware updates of all devices are consistent, otherwise the verification fails.

[0154] This application provides another consistency verification method 200, such as Figure 3 As shown, the method 200 includes:

[0155] S210, the first device receives the ciphertext.

[0156] S230: The second device determines n first response values.

[0157] S231, the second device sends n first response values, and correspondingly, the third device receives n first response values.

[0158] S240: The second device determines n first commitment values.

[0159] S241, the second device sends n first commitment values, and correspondingly, the third device receives n first commitment values.

[0160] S260, the first device determines a second response value and a second commitment value.

[0161] S261, the first device sends a second response value and a second commitment value, and correspondingly, the third device receives the second response value and the second commitment value.

[0162] The above steps are similar to the corresponding steps in method 100 and will not be repeated here. For specific descriptions, please refer to the descriptions of the corresponding steps in method 100.

[0163] The following describes the steps that are different from those in method 100:

[0164] S220: The second device obtains a first challenge value.

[0165] S250: The first device obtains a second challenge value.

[0166] S270: The third device obtains the first challenge value and the second challenge value.

[0167] In this implementation, the first challenge value is determined according to the first commitment value, and the second challenge value is determined according to the second commitment value and the ciphertext.

[0168] It should be understood that during the verification process, each random number challenge behavior of the verifier can be replaced by the prover executing a random oracle, and the input of the random oracle should contain all previous context information. The random oracle can be regarded as an idealized hash function that can transform the input into a result with true randomness (satisfying consistent distribution).

[0169] Exemplarily, a commonly used cryptographic hash algorithm may be used for implementation, such as a SHA-256 algorithm, a Keccak algorithm, and an SM3 algorithm, etc., which is not limited in this application.

[0170] In this implementation, the commitment value is information that the first device, the second device, and the third device all acquire, and the challenge value can be determined based on the commitment value.

[0171] For example, the second challenge value c j =Hash(Com j ,C j ),j∈{1,2,…,n} and P j ≠MP, that is, the second challenge value is determined according to the second commitment value and the ciphertext.

[0172] For example, the first challenge value c=Hash(Com1, Com2, ..., Com n ), that is, the challenge value can be determined based on n commitment values.

[0173] As another example, the first challenge value c=Hash(Com1, Com2, ..., Com n-1 ), that is, the challenge value can be determined based on the partial commitment value.

[0174] S250, the third device performs verification.

[0175] In a possible implementation, after receiving all the response values ​​and commitment values, the verifier calculates the first challenge value c = Hash (Com1, Com2, ..., Com n ) and the second challenge value c j =Hash(Com j ,C j ), check whether the following conditions are met:

[0176] (1) Whether Res1=Res2=…=Res n , if satisfied, it means that the firmware update included in the MP's response is the same.

[0177] (2) Whether If satisfied, it means ciphertext C i It is indeed composed of the corresponding i Generated by a firmware update.

[0178] (3) Whether And P j ≠MP, if satisfied, it means device P j Indeed, it has C j The corresponding firmware update plaintext.

[0179] If all three verification conditions are passed, it means that the firmware updates of all devices are consistent, otherwise the verification fails.

[0180] This application provides a non-interactive consistency proof method for scenarios where the device owner and the quality assurance department of the device manufacturer are not online at the same time. It supports the device to generate a proof once and send it to the verification device for verification, without the need for real-time interaction and waiting, reducing communication overhead and complexity and expanding applicable scenarios.

[0181] It should be understood that in various embodiments of the present application, the size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. For example, S231, sending n commitment values, can be executed at the same time as S241, sending n response values, or at different times, and the present application does not limit this. For another example, for S130, determining n response values, and S140, determining n commitment values, their execution order can be exchanged, and the present application does not limit this. Any sequential arrangement that can realize the function of each step should be within the scope of protection of the present application.

[0182] According to the above method, Figure 4 A schematic diagram of a consistency verification device 300 provided in an embodiment of the present application.

[0183] like Figure 5 As shown, the device 300 may include a module or unit corresponding to the method / operation / step / action described in the method 100 or the method 200, and the module or unit may be a hardware circuit, or software, or a combination of a hardware circuit and software. In a possible implementation, the device may include a transceiver unit 310 and a processing unit 320.

[0184] In a possible design, the device 300 may correspond to the second device in the above method 100 and method 200 embodiments.

[0185] The transceiver unit 310 in the communication device 300 is used to obtain the first challenge value and the plaintext corresponding to the n ciphertexts, the n ciphertexts correspond one-to-one to the n first devices, each first device corresponds to a key, and each ciphertext is determined after the plaintext is first encrypted according to the key of the corresponding first device; it is also used to send n first response values, the n first response values ​​correspond one-to-one to the n ciphertexts, each first response value is determined according to the first random value, the first challenge value and the plaintext, the first random value belongs to the random value set, and the n first response values ​​are used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent.

[0186] In a possible implementation, the transceiver unit 310 is further used to obtain the keys corresponding to the n first devices; and is further used to send n first commitment values, the n first commitment values ​​corresponding one-to-one to the n ciphertexts, each first commitment value being determined by performing a second encryption on the first random value according to the key of the corresponding ciphertext, the second encryption and the first encryption use the same algorithm, the i-th first commitment value is used to verify with the first challenge value and the i-th first response value whether the i-th ciphertext is obtained from the plaintext, i∈{1,2,…,n}.

[0187] In a possible implementation, when the first response value Res i , the first commitment value Com i , the first challenge value c and the ciphertext C i The ith ciphertext is obtained from the ith plaintext when the following conditions are met: in, represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the third encryption uses the same algorithm as the first encryption. In one possible implementation, the algorithms used for the first encryption, the second encryption, and the third encryption include an additive homomorphic encryption algorithm.

[0188] In a possible implementation manner, the first response value Res i , the first random value r, the first challenge value c and the plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0189] In a possible implementation manner, the transceiver unit 310 is specifically configured to receive a first challenge value sent by a third device, where the first challenge value belongs to a random value set.

[0190] In a possible implementation, the processing unit 320 is configured to determine the first challenge value according to the first commitment value.

[0191] In a possible implementation, algorithms used in the first encryption, the second encryption, and the third encryption include an additive homomorphic encryption algorithm.

[0192] In one possible implementation, the additive homomorphic encryption algorithm includes the Paillier encryption algorithm.

[0193] The transceiver unit 310 in the communication device 300 performs the receiving and sending operations performed by the second device in the above-mentioned method embodiments, and the processing unit 320 performs operations other than the receiving and sending operations.

[0194] In another possible design, the device 300 may correspond to the third device in the above method 100 and method 200 embodiments.

[0195] The transceiver unit 310 in the communication device 300 is used to obtain a first challenge value; and is also used to receive n first response values, the n first response values ​​correspond one-to-one to n ciphertexts, the n ciphertexts correspond one-to-one to n first devices, each first device corresponds to a key, each ciphertext is determined by first encrypting a plaintext according to the key of the corresponding first device, each first response value is determined according to the first random value, the first challenge value and the plaintext, and the first random value belongs to the random value set;

[0196] The processing unit 320 in the communication device 300 is used to verify whether the i-th ciphertext is obtained from the plaintext according to the i-th first commitment value, the first challenge value and the i-th first response value, i∈{1,2,…,n}.

[0197] In a possible implementation, the transceiver unit 310 is further configured to receive n first commitment values, the n first commitment values ​​correspond one-to-one to the n ciphertexts, each first commitment value is determined by performing a second encryption on the first random value according to a key of the corresponding ciphertext, and the second encryption and the first encryption use the same algorithm;

[0198] The processing unit 320 is further used to verify whether the i-th ciphertext is obtained from the i-th plaintext according to the i-th commitment value, the challenge value and the i-th response value, i∈{1,2,…,n}.

[0199] In a possible implementation, when the first response value Res i , the first commitment value Com i , the first challenge value c and the ciphertext C i The i-th ciphertext is determined to be obtained from the i-th plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the third encryption and the first encryption use the same algorithm.

[0200] In a possible implementation manner, the transceiver unit 310 is further used to obtain a second challenge value; and is further used to receive a second response value and a second commitment value, where the second response value is determined according to the second random value, the second challenge value, and the plain text, the second random value belongs to a random value set, and the second commitment value is determined after performing a fourth encryption on the second random value according to a key of the first device, and the fourth encryption and the first encryption use the same algorithm;

[0201] The processing unit 320 is further used to verify whether the jth first device has the plaintext corresponding to the jth ciphertext according to the jth second response value, the jth second challenge value and the jth second commitment value, j∈{1,2,…,n}.

[0202] In a possible implementation manner, when the second response value Res j , the second commitment value Com j , the second challenge value c j and ciphertext C j The jth first device has the plaintext corresponding to the jth n ciphertext when the following conditions are met: in, It represents a value determined by performing a fifth encryption on the j-th second response value according to the key of the first device corresponding to the j-th second response value, and the fifth encryption and the first encryption use the same algorithm.

[0203] In a possible implementation manner, the first response value Res i , the first random value r, the first challenge value c and the plaintext M i , satisfying the following conditions: Res i =r+c·M i , i∈{1,2,…,n}.

[0204] In a possible implementation manner, the second response value Res j , the second random value r j , the second challenge value c j and plaintext M j , satisfying the following conditions: Res j =r j +c j ·M j , j∈{1,2,…,n}.

[0205] In a possible implementation, the processing unit 320 is configured to determine the first challenge value according to the first commitment value; and is further configured to determine the second challenge value according to the second commitment value and the ciphertext.

[0206] In a possible implementation, algorithms used by the first encryption, the second encryption, the third encryption, the fourth encryption, and the fifth encryption include an additive homomorphic encryption algorithm.

[0207] In one possible implementation, the additive homomorphic encryption algorithm includes the Paillier encryption algorithm.

[0208] The transceiver unit 310 in the communication device 300 performs the receiving and sending operations performed by the third device in the above-mentioned method embodiments, and the processing unit 320 performs operations other than the receiving and sending operations.

[0209] In another possible design, the device 300 may correspond to the first device in the above method 100 and method 200 embodiments.

[0210] The transceiver unit 310 in the communication device 300 is used to obtain the ciphertext and the second challenge value, the ciphertext is determined by performing a first encryption on the plaintext according to the key, and n is a positive integer; it is also used to send a second response value and a second commitment value, the second response value is determined according to the second random value, the second challenge value and the plaintext, the second random value belongs to a random value set, and the second commitment value is determined by performing a third encryption on the second random value according to the key, and the algorithm used for the third encryption is the same as that used for the first encryption; the second response value, the second challenge value and the second commitment value are used to verify whether the plaintext corresponding to the ciphertext is possessed.

[0211] In a possible implementation manner, when the second response value Res j , the second commitment value Com j , the second challenge value c j and ciphertext C j When the following conditions are met, it is determined that the plaintext corresponding to the ciphertext is possessed: in, Indicates a value determined by performing a fifth encryption on the second response value according to the key.

[0212] In a possible implementation manner, the second response value Res j , the second random value r j , the second challenge value c j and plaintext M j , satisfying the following conditions: Res j =r j +c j ·M j , j∈{1,2,…,n}.

[0213] In a possible implementation, the processing unit 320 is configured to determine a second challenge value according to the second commitment value and the ciphertext.

[0214] In a possible implementation, the algorithms used by the first encryption, the third encryption, and the fifth encryption include an additive homomorphic encryption algorithm.

[0215] The transceiver unit 310 in the communication device 300 performs the receiving and sending operations performed by the first device in the above-mentioned method embodiments, and the processing unit 320 performs operations other than the receiving and sending operations.

[0216] According to the above method, Figure 5 Schematic diagram of a verification device 400 provided in an embodiment of the present application. Figure 5 As shown, the device 400 can be a certification device or a verification device.

[0217] The device 400 may include a processor 410 (i.e., an example of a processing unit). In a possible implementation, the device 400 also includes a memory 420. The memory 420 is used to store instructions, and the processor 410 is used to execute the instructions stored in the memory 420, so that the device 400 implements the steps performed by the first device or the second device in the method 100 or the method 200.

[0218] Furthermore, the device 400 may also include an interface 430 (i.e., an example of a transceiver unit module). Furthermore, the processor 410, the memory 420, and the interface 430 may communicate with each other through an internal connection path to transmit control and / or data signals. The memory 420 is used to store a computer program, and the processor 410 may be used to call and run the computer program from the memory 420 to control the interface 430 to receive a signal or send a signal to complete the steps of the first device or the second device in the above method. The memory 420 may be integrated in the processor 410, or may be provided separately from the processor 410.

[0219] In a possible implementation, if the verification device 400 is a communication device, the interface 430 is a receiver or a transmitter. The receiver and the transmitter may be the same or different physical entities. When they are the same physical entity, they may be collectively referred to as a transceiver.

[0220] In a possible implementation manner, if the verification device 400 is a chip or a circuit, the interface 430 is an input interface or the interface 430 is an output interface.

[0221] As an implementation, the function of the interface 430 may be implemented by a transceiver circuit or a dedicated transceiver chip. The processor 410 may be implemented by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.

[0222] As another implementation, it is possible to use a general-purpose computer to implement the verification device provided in the embodiment of the present application. That is, the program code that implements the functions of the processor 410 and the interface 430 is stored in the memory 420, and the general-purpose processor implements the functions of the processor 410 and the interface 430 by executing the code in the memory 420.

[0223] For the concepts, explanations, detailed descriptions and other steps involved in the device 400 and related to the technical solution provided in the embodiment of the present application, please refer to the description of these contents in the aforementioned method or other embodiments, which will not be repeated here.

[0224] An embodiment of the present application also provides a computer-readable storage medium on which computer instructions for implementing the method executed by the first device, the second device, or the third device in the above method embodiment are stored.

[0225] For example, when the computer program is executed by a computer, the computer can implement the method performed by the first device, the second device, or the third device in the above method embodiment.

[0226] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to implement the method executed by the first device, or the method executed by the second device, or the method executed by the third device in the above method embodiment.

[0227] An embodiment of the present application also provides a consistency verification system, which communication system includes the first device, the second device and the third device in the above embodiment.

[0228] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0229] It should be understood that in the embodiments of the present application, the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0230] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0231] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0232] It should be understood that the term "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0233] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0234] It will be appreciated by those skilled in the art that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or in combination with computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. It will be clearly understood by those skilled in the art that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. In several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, which may be electrical, mechanical or other forms.

[0235] The unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or it may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, the functional units in each embodiment of the present application may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions for a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory, a random access memory, a disk or an optical disk.

[0236] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A consistency verification method, characterized in that: include: n first devices receive n ciphertexts, the n ciphertexts correspond to the n first devices one by one, each first device corresponds to a key, each ciphertext is determined by first encrypting a plaintext according to the key of the corresponding first device, and n is a positive integer; The second device obtains the first challenge value and the plaintext corresponding to the n ciphertexts; The second device sends n first response values ​​to the third device, the n first response values ​​correspond one-to-one to the n ciphertexts, each of the first response values ​​is determined according to a first random value, the first challenge value and the plaintext, and the first random value belongs to a preset random value set; The third device verifies whether the n plaintexts corresponding to the n ciphertexts are consistent according to the n first response values.

2. The method according to claim 1, characterized in that The method further comprises: The second device obtains keys corresponding to the n first devices; The second device sends n first commitment values ​​to the third device, the n first commitment values ​​correspond one-to-one to the n ciphertexts, each first commitment value is determined by performing a second encryption on the first random value according to a key of the corresponding ciphertext, and the second encryption and the first encryption use the same algorithm; The third device verifies whether the i-th ciphertext is obtained from the plaintext according to the i-th first commitment value, the first challenge value and the i-th first response value, i∈{1,2,…,n}.

3. The method according to claim 2, characterized in that When the first response value Res i , the first commitment value Com i , the first challenge value c and the ciphertext C i When the following conditions are met, the third device determines that the i-th ciphertext is obtained from the i-th plaintext: in, It represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the algorithm used for the third encryption is the same as that used for the first encryption.

4. The method according to claim 2 or 3, characterized in that: The method further comprises: The first device obtains a second challenge value; The first device sends a second response value and a second commitment value to the third device, where the second response value is determined according to a second random value, the second challenge value, and the plain text, the second random value belongs to the random value set, and the second commitment value is determined by performing a fourth encryption on the second random value according to the key of the first device, and the fourth encryption uses the same algorithm as the first encryption; The third device verifies whether the jth first device possesses the plaintext corresponding to the jth ciphertext based on the jth second response value, the jth second challenge value and the jth second commitment value, j∈{1,2,…,n}.

5. The method according to claim 4, characterized in that When the second response value Res j The second commitment value Com j The second challenge value c j and the ciphertext C j The j-th first device has the plaintext corresponding to the j-th n ciphertext when the following conditions are met: in, It represents a value determined by performing a fifth encryption on the j-th second response value according to the key of the first device corresponding to the j-th second response value, and the algorithm used for the fifth encryption is the same as that used for the first encryption.

6. The method according to claim 5, characterized in that Algorithms used by the first encryption, the second encryption, the third encryption, the fourth encryption, and the fifth encryption include an additive homomorphic encryption algorithm.

7. The method according to claim 6, characterized in that The additive homomorphic encryption algorithm includes the Paillier encryption algorithm.

8. The method according to any one of claims 1 to 7, characterized in that The first response value Res i , the first random value r, the first challenge value c and the plaintext M i , the following conditions are met: Res i =r+c·M i ,i∈{1,2,…,n}。 9. The method according to any one of claims 3 to 7, characterized in that The second response value Res j The second random value r j The second challenge value c j and the plaintext M j , the following conditions are met: Res j =r j +c j ·M j ,j∈{1,2,…,n}。 10. The method according to any one of claims 4 to 9, characterized in that The second device obtains a first challenge value, including: the second device receives the first challenge value sent by the third device, the first challenge value belongs to the random value set; The first device obtains a second challenge value, including: The first device receives a second challenge value sent by the third device, where the second challenge value belongs to the random value set.

11. The method according to any one of claims 4 to 9, characterized in that: The second device acquires the first challenge value, including: the second device determines the first challenge value according to the first commitment value; The first device obtains a second challenge value, including: The first device determines the second challenge value according to the second commitment value and the ciphertext.

12. A consistency verification method, characterized in that: include: Obtaining a first challenge value and plain texts corresponding to n ciphertexts, wherein the n ciphertexts correspond one-to-one to the n first devices, each first device corresponds to a key, and each ciphertext is determined by first encrypting the plain text according to the key of the corresponding first device; Send n first response values, the n first response values ​​correspond one-to-one to the n ciphertexts, each of the first response values ​​is determined based on a first random value, the first challenge value and the plaintext, the first random value belongs to a preset random value set, and the n first response values ​​are used to verify whether the n plaintexts corresponding to the n ciphertexts are consistent.

13. The method according to claim 12, characterized in that The method further comprises: Obtaining keys corresponding to n first devices; Sending n first commitment values, wherein the n first commitment values ​​correspond one-to-one to the n ciphertexts, each first commitment value is determined by performing a second encryption on the first random value according to a key of the corresponding ciphertext, and the second encryption uses the same algorithm as the first encryption, The i-th first commitment value is used to verify with the first challenge value and the i-th first response value whether the i-th ciphertext is obtained from the plaintext, i∈{1,2,…,n}.

14. The method according to claim 13, characterized in that When the first response value Res i , the first commitment value Com i , the first challenge value c and the ciphertext C i The ith ciphertext is obtained from the ith plaintext when the following conditions are met: in, It represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the algorithm used for the third encryption is the same as that used for the first encryption.

15. The method according to any one of claims 10 to 14, characterized in that The first response value Res i , the first random value r, the first challenge value c and the plaintext M i , the following conditions are met: Res i =r+c·M i ,i∈{1,2,…,n}。 16. The method according to any one of claims 12 to 15, characterized in that Obtaining a first challenge value includes: receiving a first challenge value sent by a third device, where the first challenge value belongs to the random value set.

17. The method according to any one of claims 13 to 15, characterized in that Obtaining a first challenge value includes: determining the first challenge value according to the first commitment value.

18. A consistency verification method, characterized in that: include: Get the first challenge value; receiving n first response values, the n first response values ​​corresponding one-to-one to the n ciphertexts, the n ciphertexts corresponding one-to-one to the n first devices, each of the first devices corresponding to a key, each ciphertext being determined by first encrypting a plaintext according to the key of the corresponding first device, each first response value being determined according to a first random value, the first challenge value and the plaintext, and the first random value belonging to a preset random value set; Whether the n plaintexts corresponding to the n ciphertexts are consistent is verified according to the n first response values.

19. The method according to claim 18, characterized in that The method further comprises: receiving n first commitment values, the n first commitment values ​​corresponding one-to-one to the n ciphertexts, each first commitment value being determined by performing a second encryption on the first random value according to a key of the corresponding ciphertext, the second encryption using the same algorithm as the first encryption; Verify whether the i-th ciphertext is obtained from the plaintext according to the i-th first commitment value, the first challenge value and the i-th first response value, i∈{1,2,…,n}.

20. The method according to claim 19, characterized in that When the first response value Res i , the first commitment value Com i , the first challenge value c and the ciphertext C i When the following conditions are met, it is determined that the i-th ciphertext is obtained from the i-th plaintext: in, It represents a value determined by performing a third encryption on the i-th first response value according to the key of the i-th ciphertext corresponding to the i-th first response value, and the algorithm used for the third encryption is the same as that used for the first encryption.

21. The method according to any one of claims 18 to 20, characterized in that The method further comprises: Obtaining a second challenge value; receiving a second response value and a second commitment value, wherein the second response value is determined according to a second random value, the second challenge value, and the plain text, the second random value belongs to a random value set, and the second commitment value is determined after performing a fourth encryption on the second random value according to a key of the first device, and the fourth encryption uses the same algorithm as the first encryption; Verify whether the jth first device possesses the plaintext corresponding to the jth ciphertext according to the jth second response value, the jth second challenge value and the jth second commitment value, j∈{1,2,…,n}.

22. The method according to claim 21, characterized in that When the second response value Res j The second commitment value Com j The second challenge value c j and the ciphertext C j The j-th first device has the plaintext corresponding to the j-th n ciphertext when the following conditions are met: in, It represents a value determined by performing a fifth encryption on the j-th second response value according to the key of the first device corresponding to the j-th second response value, and the algorithm used for the fifth encryption is the same as that used for the first encryption.

23. The method according to any one of claims 18 to 22, characterized in that The first response value Res i , the first random value r, the first challenge value c and the plaintext M i , the following conditions are met: Res i =r+c·M i ,i∈{1,2,…,n}。 24. The method according to any one of claims 20 to 22, characterized in that The second response value Res j The second random value r j The second challenge value c j and the plaintext M j , the following conditions are met: Res j =r j +c j ·M j ,j∈{1,2,…,n}。 25. The method according to any one of claims 21 to 24, characterized in that: Acquiring a first challenge value includes: determining the first challenge value according to the first commitment value; Obtain the second challenge value, including: The second challenge value is determined according to the second commitment value and the ciphertext.

26. A distributed zero-knowledge consistency verification method, characterized in that: include: Obtaining a ciphertext and a second challenge value, wherein the ciphertext is determined by first encrypting the plaintext according to the key, and n is a positive integer; Sending a second response value and a second commitment value, where the second response value is determined according to a second random value, the second challenge value, and the plaintext, where the second random value belongs to a preset random value set, and the second commitment value is determined by performing a third encryption on the second random value according to the key, where the third encryption uses the same algorithm as the first encryption; The second response value, the second challenge value and the second commitment value are used to verify whether the plaintext corresponding to the ciphertext is possessed.

27. The method according to claim 26, characterized in that When the second response value Res j The second commitment value Com j The second challenge value c j and the ciphertext C j When the following conditions are met, it is determined that the plaintext corresponding to the ciphertext is possessed: in, Indicates a value determined by performing a fifth encryption on the second response value according to the key.

28. The method according to claim 26 or 27, characterized in that The second response value Res j The second random value r j The second challenge value c j and the plaintext M j , the following conditions are met: Res j =r j +c j ·M j ,j∈{1,2,…,n}。 29. The method according to claim 26 or 27, characterized in that Obtaining a second challenge value includes: determining the second challenge value according to the second commitment value and the ciphertext.

30. A verification device, characterized in that: include: A processor, wherein the processor is used to execute a program or an instruction so that the device performs the method according to any one of claims 12 to 17, or the device performs the method according to any one of claims 18 to 25, or the device performs the method according to any one of claims 26 to 29.

Images