Network communication privacy protection method and system based on multi-level pseudonym mechanism

Abstract

The present invention provides a network communication privacy protection method and system based on a multi-level pseudonym mechanism, which protects the privacy of the sender of a datagram at the network layer, enables the receiver to authenticate the datagram based on the SM9 identification password and pseudonym mechanism, and allows the user to obtain a multi-level pseudonym before obtaining the private key, thereby allowing the regulatory agency to trace the true identity of the anonymous user while preventing the agency from having excessive power; the user communication private key components are generated in a distributed manner, so that the KGC is not clear about which communication anonymous identifier the private key is generated for.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a network communication privacy protection method based on multi-level pseudonyms and distributed keys. Background Art

[0002] Today, we are in an era of rapid Internet development. The Internet has achieved enormous coverage, and its security has received increasing attention. Because some network protocols used by the Internet were not designed with future security needs in mind, many protocols have security issues. Summary of the Invention

[0003] The present invention aims to provide a network layer communication privacy protection method and system based on a multi-level pseudonym mechanism and distributed private key generation, which overcomes the above problems or at least partially solves the above problems.

[0004] To achieve the above object, the technical solution of the present invention is specifically implemented as follows:

[0005] One aspect of the present invention provides a method for protecting network communication privacy based on a multi-level pseudonym mechanism, comprising:

[0006] V KGCs sequentially generate V pseudonym groups based on the request of the requesting party, and generate a corresponding private key group for each pseudonym group to form a pseudonym chain; where V ≥ 2 and is an integer preset value;

[0007] The Vth KGC generates a communication anonymous identification ID for the requesting party B And private key generation material m2;

[0008] The requesting party uses the Vth pseudonym group and the corresponding Vth private key group to request CKGC to generate the communication anonymous identification ID for the requesting party in a distributed manner B The corresponding private key ds B ;

[0009] The datagram sender adds a partial chain node value to the IP header of the datagram to be sent, and sends the datagram to be sent, wherein the datagram to be sent includes: the pseudonym of the datagram sender, the partial chain node value and the signature flag;

[0010] The proxy receives the datagram and determines the source of the datagram. If the datagram is from the sender to the receiver, the proxy modifies the source IP address to its own IP address and forwards the datagram. If the datagram is from the receiver to the sender, the proxy modifies the destination IP address to the sender's IP address and forwards the datagram.

[0011] The datagram receiver receives the datagram to be received, and verifies the correctness of the datagram to be received based on the pseudonym, partial chain node value and signature identifier of the sender in the datagram to be received.

[0012] Optionally, the V KGCs generate V pseudonym groups based on the user's real identity ID, and generate a corresponding private key group for each pseudonym group. Forming a pseudonym chain includes:

[0013] The requesting party sends a first request message to the first KGC, where the first request message is used to request allocation of a first pseudonym and a first private key, including a real user identity ID;

[0014] The first KGC authenticates the requester according to the first request information, and generates a first pseudonym group eidx={eid x1 ,eid x2 ,…,eid xn} and the first private key group s corresponding to each first pseudonym x ={s x1 ,s x2 ,…,s xn}, the first pseudonym group eidx and the first private key group s are sent to the server through a first preset security method. x Send to the requester and store the first corresponding relationship (ID:eidx:s x ), announcing the validity of the first pseudonym group eidx;

[0015] The requesting party sends a second request message to the second KGC, where the second request message is used to request allocation of a second pseudonym and a second private key, including the first pseudonym group eidx;

[0016] The second KGC authenticates the requester according to the second request information and generates a second pseudonym group eidy={eid y1 ,eid y2 ,…,eid yn} and the second private key group s corresponding to each second pseudonym y ={s y1 ,s y2 ,…,s yn}, the second pseudonym group eidy and the second private key group s are sent to the server through a second preset security method. y Send to the requester and store the second corresponding relationship (eidx:eidy:s y), announce the validity of the second pseudonym group eidy; wherein, if V>2, the requesting party continues to request the allocation of pseudonyms and private keys until the Vth KGC generates the Vth pseudonym group and the Vth private key group, sends the Vth pseudonym group and the Vth private key group to the requesting party through the Vth preset security method, stores the Vth corresponding relationship, and announces the validity of the Vth pseudonym group.

[0017] Optionally, the Vth KGC generates a communication anonymous identification ID for the requesting party B And the private key generation material m2 includes:

[0018] The Vth KGC generates a communication anonymous identification ID for the requesting party B ;

[0019] The Vth KGC calculates m1=H1(ID B ||hid,N)+ks, and calculate m2=[m1] -1 P1, where: H1 is a hash function, hid is a signature private key generation function identifier, N is the order of the cyclic group in the elliptic curve, ks is the private key of the Vth KGC, and P1 is a generator on the group in the elliptic curve;

[0020] The Vth KGC will use the communication anonymous identification ID B and the private key generation material m2 are sent to the requesting party.

[0021] Optionally, the requesting party uses the Vth pseudonym group and the corresponding Vth private key group to request CKGC to generate the communication anonymous identification ID for the requesting party in a distributed manner B The corresponding private key ds B include:

[0022] The requester selects a secret random number s2∈[1,N-1] and uses the pseudonym ID generated by the Vth KGC a and private key ds A Sign the secret random number s2 and send the identity verification validity information to CKGC;

[0023] The requester calculates m2s2=s2·[m1] -1 P1, and sends m2s2 to the CKGC;

[0024] Each CKGC calculates the private key component kc after verifying the identity validity information. i m2s2=kc i ·s2·[m1] -1 P1 and sent to the requesting party, where kc iis the private key of CKGC, and i is the number of each CKGC;

[0025] The requester will kc i m2s2=kc i ·s2·[m1] -1 P1 multiplied by s2 -1 Get the communication private key component ds Bi =kc i ·[m1] -1 P1, obtains the complete communication private key ds by aggregating the communication private key components B .

[0026] Optionally, the datagram sender adds a partial chain node value to the IP header of the datagram to be sent and sends the datagram to be sent, wherein the datagram to be sent includes: the pseudonym of the datagram sender, the partial chain node value and the signature flag including:

[0027] The datagram sender determines whether the datagram to be sent is the first datagram in the communication;

[0028] If the datagram to be sent is the first datagram in the communication, a message chain is generated, and the value of the chain head node is set to HC0; the signature counter is set to 0;

[0029] If the datagram to be sent is not the first datagram in the communication, query the tail node of the message chain to obtain HC x , calculate the latest chain node value HC x+1 =hash(HC x ,input), add 1 to the signature counter;

[0030] The datagram sender determines whether the signature interval has been reached, and if so, calculates the signature S=sign(eid,HC x+1 , parameters), send the signed datagram, and send the datagram with the pseudonym eid and part of the chain node value HC x+1 value and signature flag, reset the signature counter to 0; if the signature interval is not reached, send a datagram carrying the pseudonym eid, part of the chain node value HC x+1 value and signature flags the datagram.

[0031] Optionally, the datagram receiver receives the datagram to be received, and verifies the correctness of the datagram to be received according to the pseudonym, partial chain node value and signature identifier of the sender in the datagram to be received, including:

[0032] The datagram receiver receives the to-be-received datagram, and determines whether the received to-be-received datagram is the first datagram in the communication;

[0033] If the received datagram to be received is the first datagram in the communication, a message chain is generated when the pseudonym eid in the datagram to be received is legal, the chain head node value is set to HC0, and the signature counter is set to 0;

[0034] If the received datagram to be received is not the first datagram in the communication, the pseudonym eid and the partial chain node value HC of the sender in the datagram to be received are obtained. x+1 |part and signature mark information;

[0035] Determine whether a signature datagram is included;

[0036] If the signature datagram is included, obtain the identification password public key corresponding to the pseudonym eid of the sender, query the relevant parameters to verify the correctness of the signature V=verify(sign,eid,HC x+1 ,parameters), if the verification is wrong, an error message will be prompted and the communication will end; if the verification is correct, the communication will end;

[0037] If the signature datagram is not included, obtaining the corresponding message chain and signature counter in combination with the sender's pseudonym eid;

[0038] Determine whether the maximum signature interval has been reached. If so, an error message will be prompted and the communication will be terminated. Otherwise, the locally saved chain tail node value HC will be used. x ' and the relevant information of the datagram to be received to calculate the latest chain node value HC x+1 ′=hash(HC x ,input);

[0039] Determine HC x+1 ′|part=HC x+1 |part, if HC x+1 ′|part=HC x+1 |part, then end this communication; if HC x+1 ′|part≠HC x+1 |part, an error message will be prompted and the communication will be terminated.

[0040] Optionally, the method further includes: querying the user's real identity ID step by step through the pseudonym.

[0041] Optionally, querying the user's real identity ID step by step using a pseudonym includes:

[0042] If a problem occurs with the datagram, error information is saved, wherein the error information includes the pseudonym in the datagram;

[0043] submitting said pseudonym to KGC;

[0044] The Vth KGC to the first KGC sequentially query the local corresponding relationship, and obtain the previous pseudonym through the latter pseudonym, until the first KGC queries the real identity ID of the user.

[0045] Another aspect of the present invention provides a network communication privacy protection system based on a multi-level pseudonym mechanism, which uses the network layer communication privacy protection method based on the multi-level pseudonym mechanism and distributed private key generation as described above for data transmission.

[0046] It can be seen that the network layer communication privacy protection method and system based on the multi-level pseudonym mechanism and distributed private key generation provided by the present invention can protect the privacy of the sender of the datagram at the network layer, and the receiver can authenticate the datagram based on the SM9 identification password and pseudonym mechanism. The user obtains a multi-level pseudonym before obtaining the private key, which allows the regulatory agency to trace the true identity of the anonymous user while preventing the agency from having excessive power; the user communication private key component is generated in a distributed manner, so that the KGC is not clear about which communication anonymous identifier the private key is generated for. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0048] Figure 1 A schematic diagram of a communication process provided by an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of the chain node generation process provided by an embodiment of the present invention;

[0050] Figure 3 A flowchart of a method for protecting network layer communication privacy based on a multi-level pseudonym mechanism and distributed private key generation provided by an embodiment of the present invention;

[0051] Figure 4 Flowchart of EID and private key generation provided by the embodiment of the present invention;

[0052] Figure 5 A datagram sending flow chart provided in an embodiment of the present invention;

[0053] Figure 6 Proxy forwarding flow chart provided by an embodiment of the present invention;

[0054] Figure 7 A datagram receiving flow chart provided in an embodiment of the present invention;

[0055] Figure 8 This is a flowchart of user identity supervision provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0057] like Figure 1 As shown in the figure, during the communication process, the identity identifier and location identifier of the datagram are decoupled, and the source IP address is modified by using a proxy to forward the datagram to make the sender's location identifier invisible to the receiver. At the same time, the anonymous user identity is authenticated based on the SM9 identification password and pseudonym mechanism. Before generating a communication anonymous identifier, the user first obtains a multi-level pseudonym, and the user's private key is distributed by multiple KGCs. When sending a datagram, the sender adds additional information to the IP header, including its own anonymous identity identifier EID, the datagram integrity chain verification field, and the signature flag. The receiver verifies the additional information in the IP header to confirm the validity of the sender's anonymous identity. The communication process is as follows Figure 1 As shown in the figure, the data flows from the sender to the receiver.

[0058] in:

[0059] Datagram sender: hides the source address and sends datagrams with anonymous identity identification, namely pseudonym, node value, message signature and other verification information.

[0060] Datagram receiver: Receives and verifies anonymous datagrams.

[0061] Proxy: forwards datagrams from senders and receivers.

[0062] KGC: Generates user anonymous identity and private key.

[0063] Message chain: The chain head node N0 is set to the shared initial value HC0, corresponding to the chain node N x ,x≠0, its value is HC x =hash(HC x-1 ,input), where input represents the latest input, and input is the datagram related information. By adding only a part of the chain node value in the datagram IP header, the receiver completes the verification of the message. At the same time, since only the sender and the receiver have the complete message chain, the sender's non-repudiation of the datagram is achieved. The chain node generation process is as follows Figure 2 .

[0064] Datagram Signature: Datagrams must be signed at intervals equal to sign_interval. The signature algorithm takes as input the eid, HC, and parameters related to the identification password, and outputs the signature. The signature verification algorithm takes as input the signature, eid, HC, and parameters related to the identification password, and outputs the signature verification result.

[0065] Distributed private key generation process and principle: The last level KGC generates a pseudonym for the user and also generates a communication anonymous ID for the user B And private key generation materials. KGC calculates m1=H1(ID B ||hid,N)+ks, then generates m2=[m1] -1 P1 and send it to the user. Use ID B And the subsequent distributed generated communication private key ds B Sign.

[0066] The user chooses a secret random number s2∈[1,N-1] and uses the pseudonymous ID obtained from the last level KGC a and private key ds A Verify the identity validity with CKGC. Then send m2s2=s2·[m1] to CKGC. -1 P1, each CKGC calculates the private key component kc i m2s2=kc i ·s2·[m1] -1 P1 is sent to the user, who multiplies it by s2 -1 Get the communication private key component ds Bu =kc u ·[m1] -1 P1. Obtain the complete communication private key by aggregating the communication private key components. In this process, CKGC only knows ID a The effectiveness of the communication anonymous identity is not clear for which private key is generated, reducing the risk of CKGC collusion.

[0067] The core of the present invention is:

[0068] (1) Designed a network layer communication privacy protection method

[0069] This approach decouples the host identity in the network layer IP address from the location identifier in the network topology. By modifying and forwarding datagrams through a proxy, the sender's source IP address is hidden. Using an identification password and pseudonym mechanism, the receiver can authenticate the sender's identity without having to consider the source IP address. KGC also assigns anonymous identities, protecting privacy while providing a degree of oversight.

[0070] (2) Multi-level identity generation and supervision

[0071] The process of generating the anonymous identity identifier (eid) is participated in by multiple KGCs, so a single KGC cannot directly confirm the user's true identity through the eid used in communication. It must cooperate with other KGCs at the same time to avoid excessive power of a single point.

[0072] (3) Using a distributed approach to generate private keys reduces key escrow risks

[0073] The private keys corresponding to users' anonymous communication identities are generated by CKGC in a distributed manner and ultimately aggregated by the users. This ensures that, on the one hand, a single CKGC only holds a portion of a user's private key; on the other hand, CKGC is unaware of which anonymous communication identity the private key is being generated for. This minimizes the risks of CKGC collusion and key escrow.

[0074] Figure 3 A flowchart of a method for protecting network layer communication privacy based on a multi-level pseudonym mechanism and distributed private key generation according to an embodiment of the present invention is shown. Figure 3 The embodiment of the present invention provides a method for protecting privacy in network layer communications based on a multi-level pseudonym mechanism and distributed private key generation, including:

[0075] S1, V KGCs generate V pseudonym groups in turn according to the request of the requesting party, and generate a corresponding private key group for each pseudonym group to form a pseudonym chain; where V ≥ 2 and is an integer preset value.

[0076] Specifically, this step is a multi-level pseudonym generation step.

[0077] As an optional implementation of the embodiment of the present invention, V KGCs generate V pseudonym groups based on the user's real identity ID, and generate a corresponding private key group for each pseudonym group. Forming a pseudonym chain includes:

[0078] The requesting party sends a first request message to the first KGC, where the first request message is used to request allocation of a first pseudonym and a first private key, including a real user identity ID;

[0079] The first KGC authenticates the requester according to the first request information, and generates a first pseudonym group eidx={eid x1 ,eid x2 ,…,eid xn} and the first private key group s corresponding to each first pseudonym x ={s x1 ,s x2 ,…,s xn}, the first pseudonym group eidx and the first private key group s are sent to the server through the first preset security method. xSend to the requester and store the first corresponding relationship (ID:eidx:s x ), announce the validity of the first pseudonym group eidx;

[0080] The requesting party sends a second request message to the second KGC, where the second request message is used to request allocation of a second pseudonym and a second private key, including the first pseudonym group eidx;

[0081] The second KGC authenticates the requester according to the second request information and generates a second pseudonym group eidy={eid y1 ,eid y2 ,…,eid yn} and the second private key group s corresponding to each second pseudonym y ={s y1 ,s y2 ,…,s yn}, the second pseudonym group eidy and the second private key group s are sent to the server through the second preset security method. y Send to the requester and store the second corresponding relationship (eidx:eidy:s y ), announce the validity of the second pseudonym group eidy; wherein, if V>2, the requesting party continues to request the allocation of pseudonyms and private keys until the Vth KGC generates the Vth pseudonym group and the Vth private key group, sends the Vth pseudonym group and the Vth private key group to the requesting party through the Vth preset security method, stores the Vth corresponding relationship, and announces the validity of the Vth pseudonym group.

[0082] Specifically, KGC generates multiple pseudonyms for the user based on their real ID, and then uses the identification password to generate the corresponding private key for the pseudonym for subsequent signing or encryption. Figure 4 The present invention takes the pseudonym level of 2 as an example for explanation. The pseudonym and private key generation process is as follows:

[0083] Step 1: The sender (requester) requests KGC1 to assign a pseudonym and private key.

[0084] Step 2 KGC1 obtains the master key and related generation parameters after authenticating the sender.

[0085] Step 3 KGC1 generates a pseudonym group eidx={eid x1 ,eid x2 ,…,eid xn} and the corresponding private key group s x ={s x1 ,s x2 ,…,s xn}, and then pass it to the sender in a secure way. KGC1 stores the corresponding relationship (ID:eidx:s x ), and inform KGC2 of the validity of eidx.

[0086] Step 4 The sender uses eidx and private key s x Authenticate to KGC2.

[0087] Step 5 KGC2 performs similar steps as KGC1 to generate eidy={eid y1 ,eid y2 ,…,eid yn} and s y ={s y1 ,s y2 ,…,s yn}, KGC2 stores the corresponding relationship (eidx:eidy:s y This process can be repeated by adding more participating KGCs according to security parameters, generating a pseudonymous chain consisting of EIDs, which reduces the risk of KGC collusion to an arbitrarily small value.

[0088] Step 6 The sender uses eidy and s y to communicate.

[0089] S2, the Vth KGC generates a communication anonymous identification ID for the requester B And private key generation material m2;

[0090] S3: The requester uses the Vth pseudonym group and the corresponding Vth private key group to request CKGC to generate a distributed communication anonymous identification ID for the requester. B The corresponding private key ds B .

[0091] This step is the step of generating distributed private keys.

[0092] As an optional implementation of the embodiment of the present invention, the Vth KGC generates a communication anonymous identification ID for the requesting party. B And the private key generation material m2 includes:

[0093] The V KGC generates a communication anonymous identification ID for the requester B ;

[0094] The Vth KGC calculates m1=H1(ID B ||hid,N)+ks, and calculate m2=[m1] -1P1, where: H1 is the hash function, hid is the signature private key generation function identifier, N is the order of the cyclic group in the elliptic curve, ks is the private key of the Vth KGC, and P1 is the generator on the group in the elliptic curve;

[0095] No. V KGC will use the anonymous ID of the communication B The private key generation material m2 is sent to the requester.

[0096] As an optional implementation of the embodiment of the present invention, the requesting party uses the Vth pseudonym group and the corresponding Vth private key group to request CKGC to generate a distributed communication anonymous identification ID for the requesting party. B The corresponding private key ds B include:

[0097] The requester selects a secret random number s2∈[1,N-1] and uses the pseudonym ID generated by the Vth KGC a and private key ds A Sign the secret random number s2 and send the identity verification information to CKGC;

[0098] The requester calculates m2s2 = s2 · [m1] -1 P1 and sends m2s2 to CKGC;

[0099] Each CKGC calculates the private key component kc after verifying the identity validity information i m2s2=kc i ·s2·[m1] -1 P1 and sent to the requester, where kc i is the private key of CKGC, and i is the number of each CKGC;

[0100] The requester will kc i m2s2=kc i ·s2·[m1] -1 P1 multiplied by s2 -1 Get the communication private key component ds Bi =kc i ·[m1] -1 P1, obtains the complete communication private key ds by aggregating the communication private key components B .

[0101] Specifically, the present invention generates a KGC for the last level pseudonym for the user and generates a communication anonymous identifier for the user. The user uses the last level pseudonym and the corresponding private key for authentication and requests the CKGC to generate a distributed private key corresponding to the communication anonymous identifier. The distributed private key is generated as follows:

[0102] Step 1 VKGC generates a pseudonymous ID for the user band key generation material m2.

[0103] Step 2 To verify the validity of the identity to CKGC, the user uses ID a and ds A Sign a fixed bit string message.

[0104] Step 3 CKGC combines the user's pseudonym and VKGC's public (ID a , P pub-a ) to authenticate the message.

[0105] After Step 4 authentication is passed, CKGC calculates the private key components and sends them to the user.

[0106] Step 5: The user aggregates the private key components to obtain the complete private key.

[0107] S4, the datagram sender adds a partial chain node value to the IP header of the datagram to be sent, and sends the datagram to be sent. The datagram to be sent includes: the pseudonym of the datagram sender, the partial chain node value and the signature flag.

[0108] Specifically, this step is a datagram sending process step.

[0109] As an optional implementation of the embodiment of the present invention, the datagram sender adds a partial chain node value to the IP header of the datagram to be sent and sends the datagram to be sent. The datagram to be sent includes: the pseudonym of the datagram sender, the partial chain node value and the signature flag including:

[0110] The datagram sender determines whether the datagram to be sent is the first datagram in the communication;

[0111] If the datagram to be sent is the first datagram in the communication, a message chain is generated, and the value of the chain head node is set to HC0; the signature counter is set to 0;

[0112] If the datagram to be sent is not the first datagram in the communication, query the tail node of the message chain to obtain HC x , calculate the latest chain node value HC x+1 =hash(HC x ,input), add 1 to the signature counter;

[0113] The datagram sender determines whether the signature interval has been reached. If so, the signature S=sign(eid,HC x+1 , parameters), send the signed datagram, and send the datagram with the pseudonym eid and part of the chain node value HC x+1The datagram with the value and signature flag resets the signature counter to 0; if the signature interval is not reached, the datagram carrying the pseudonym eid and the partial chain node value HC is sent. x+1 value and signature flags the datagram.

[0114] Specifically, if Figure 5 As shown, the datagram sender adds additional information to the datagram IP header to verify the recipient's identity when the source IP address changes. Because HC0 is an agreed-upon value, only the communicating parties possess it. Furthermore, only a portion of the latest chain node information is sent each time, making it impossible for the sender to deny a datagram containing the chain node value. Using an identity signature algorithm and interval signatures, anonymous authentication and secondary confirmation of user identity are achieved, while also improving efficiency compared to packet-by-packet signatures. The specific process is as follows:

[0115] Step 1: If the datagram to be sent is the first datagram in the communication, the parameter initialization process is performed. A message chain is generated, and the chain head node value is set to HC0; the signature interval counter count is set to 0.

[0116] Step 2: Query the tail node of the message chain to obtain HC x , calculate and generate the latest node HC x+1 =hash(HC x ,inpit).

[0117] Step 3: The signature interval counter is incremented by 1.

[0118] Step 4 When the signature interval is reached, that is, countmodsign_interval=0, calculate the signature S=sign(eid,HC x+1 , parameters) and sends the signed datagram, resetting the counter to 0.

[0119] Step 5 Send the message carrying eid and part of HC x+1 value and signature flags the datagram.

[0120] S5, the proxy receives the datagram and determines the source of the datagram. If it is from the sender to the receiver, it modifies the source IP address to its own IP address and forwards the datagram. If it is from the receiver to the sender, it modifies the destination IP address to the sender's IP address and forwards the datagram.

[0121] Specifically, this step is the proxy forwarding datagram process step, see Figure 6 The proxy acts as a datagram relay, modifying the datagrams from the sender and receiver before forwarding them. The specific process is as follows:

[0122] Step 1 determines the source of the datagram. If the datagram flows from the sender to the receiver, it enters Step 2. If the receiver replies to the sender, it enters Step 3.

[0123] Step 2: The proxy modifies the source IP address of the datagram to its own IP address and forwards the datagram.

[0124] Step 3: The proxy modifies the destination IP address of the datagram to the sender's IP address and forwards the datagram.

[0125] S6, the datagram receiver receives the datagram to be received, and verifies the correctness of the datagram to be received based on the sender's pseudonym, partial chain node value and signature identifier in the datagram to be received.

[0126] Specifically, this step is a datagram receiving process step.

[0127] As an optional implementation manner of the embodiment of the present invention, the datagram receiver receives the datagram to be received, and verifies the correctness of the datagram to be received based on the pseudonym, partial chain node value and signature identifier of the sender in the datagram to be received, including:

[0128] The datagram receiver receives the to-be-received datagram and determines whether the received to-be-received datagram is the first datagram in the communication;

[0129] If the received datagram to be received is the first datagram in the communication, a message chain is generated when the pseudonym eid in the datagram to be received is legal, the chain head node value is set to HC0, and the signature counter is set to 0;

[0130] If the received datagram is not the first datagram in the communication, the sender's pseudonym eid and partial chain node value HC in the datagram are obtained. x+1 |part and signature mark information;

[0131] Determine whether a signature datagram is included;

[0132] If the signature datagram is included, obtain the public key of the identification code corresponding to the sender's pseudonym eid and query the relevant parameters to verify the correctness of the signature V=verify(sign,eid,HC x+1 ,parameters), if the verification is wrong, an error message will be prompted and the communication will end; if the verification is correct, the communication will end;

[0133] If the signed datagram is not included, the corresponding message chain and signature counter are obtained in combination with the sender's pseudonym eid;

[0134] Determine whether the maximum signature interval has been reached. If so, an error message will be prompted and the communication will be terminated. Otherwise, the locally saved chain tail node value HC will be used.x ' and the relevant information of the datagram to be received to calculate the latest chain node value HC x+1 ′=hash(HC x ,input);

[0135] Determine HC x+1 ′|part=HC x+1 |part, if HC x+1 ′|part=HC x+1 |part, then end this communication; if HC x+1 ′|part≠HC x+1 |part, an error message will be prompted and the communication will be terminated.

[0136] Specifically, see Figure 7 The receiver receives and verifies the correctness of the datagram based on the eid and the message chain. When the signature interval is reached, the receiver verifies the sender's identity based on the signature; when the signature interval is not reached, the receiver verifies the sender's identity based on the partial chain node value and the message chain. The specific process is as follows:

[0137] Step 1: If the received datagram is the first datagram in the communication, the parameter initialization process is performed. If the eid is valid, a message chain is generated, and the chain head node value is set to HC00; the signature interval counter count is set to 0.

[0138] Step 2 Get the eid and some node values ​​HC in the datagram x+1 |part and signature flag information, combined with eid to obtain the corresponding message chain and counter. If the maximum signature interval is reached, an error message is displayed and the communication ends.

[0139] Step 3 calculates the latest chain node value HC through the locally saved chain tail node and the relevant information of the received datagram x+1 ′=hash(HC x , input). If HC x+1 ′|part=HC x+1 |part, then continue; if HC x+1 ′|part≠HC x+1 |part, an error message will be prompted and the communication will be terminated.

[0140] Step 4: When the signature flag is 1, obtain the public key corresponding to the eid and query the relevant parameters to verify the correctness of the signature V = verify (sign, eid, HC x+1 , parameters). If the verification fails, an error message will be prompted and the communication will end.

[0141] As an optional implementation of the embodiment of the present invention, the network layer communication privacy protection method based on the multi-level pseudonym mechanism and distributed private key generation provided by the embodiment of the present invention further includes: querying the user's real identity ID level by level using the pseudonym. The querying the user's real identity ID level by level using the pseudonym includes:

[0142] If there is a problem with the datagram, the error information is saved, including the pseudonym in the datagram;

[0143] Submit the pseudonym to KGC;

[0144] The Vth KGC to the first KGC sequentially query the local corresponding relationship, and obtain the previous pseudonym through the latter pseudonym, until the first KGC queries the user's real identity ID.

[0145] Specifically, see Figure 8 The present invention uses the pseudonym level of 2 as an example to illustrate that when the real identity of the sender of the datagram needs to be clarified, the real identity of the user needs to be obtained through the EID, and the query method is a level-by-level query. The specific process is as follows:

[0146] Step 1: When a problem occurs in the datagram, save the error information including the eid part in the datagram.

[0147] Step 2: Submit the eid to KGC.

[0148] Step3 KGC2 queries the local corresponding relationship (eidx:eidy:s y ) and obtain the eidx information through eidy. Because the receiver verifies the legitimacy of the eid before establishing communication with the user represented by the eid, communication with an invalid eid will not be established, so the eid cannot be found. For eid chains with more levels, multiple KGCs will be combined to trace back step by step until the eidx is obtained.

[0149] Step4 KGC1 queries the local corresponding relationship (ID:eidx:s x ), obtain ID information through eidx.

[0150] Thus, the network-layer communication privacy protection method based on a multi-level pseudonym mechanism and distributed private key generation provided by the embodiments of the present invention protects the privacy of the datagram sender at the network layer, and enables the recipient to authenticate the datagram based on the SM9 identification password and pseudonym mechanism. The distributed generation of user communication private key components obscures the KGC from knowing for which anonymous communication identifier the private key is being generated. Users are assigned multi-level pseudonyms before obtaining their private keys, allowing regulators to trace the true identity of anonymous users while preventing excessive institutional power.

[0151] The present invention also provides a network communication privacy protection system based on a multi-level pseudonym mechanism, which uses the above-mentioned network layer communication privacy protection method based on a multi-level pseudonym mechanism and distributed private key generation for data transmission.

[0152] Thus, the network-layer communication privacy protection system based on a multi-level pseudonym mechanism and distributed private key generation provided by the embodiments of the present invention protects the privacy of the datagram sender at the network layer, and enables the recipient to authenticate the datagram based on the SM9 identification password and pseudonym mechanism. The distributed generation of user communication private key components obscures the KGC from knowing for which anonymous communication identifier the private key is being generated. Users are given multi-level pseudonyms before obtaining their private keys, allowing regulators to trace the true identity of anonymous users while preventing excessive institutional power.

[0153] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A network communication privacy protection method based on a multi-level pseudonym mechanism, characterized in that: include: V KGCs sequentially generate V pseudonym groups based on the request of the requesting party, and generate a corresponding private key group for each pseudonym group to form a pseudonym chain; where V ≥ 2 and is an integer preset value; The Vth KGC generates a communication anonymous identification ID for the requesting party B And private key generation material m2; The requesting party uses the Vth pseudonym group and the corresponding Vth private key group to request CKGC to generate the communication anonymous identification ID for the requesting party in a distributed manner B The corresponding private key ds B ; The datagram sender adds a partial chain node value to the IP header of the datagram to be sent, and sends the datagram to be sent, wherein the datagram to be sent includes: the pseudonym of the datagram sender, the partial chain node value and the signature flag; The proxy receives the datagram and determines the source of the datagram. If the datagram is from the sender to the receiver, the proxy modifies the source IP address to its own IP address and forwards the datagram. If the datagram is from the receiver to the sender, the proxy modifies the destination IP address to the sender's IP address and forwards the datagram. The datagram receiver receives the datagram to be received, and verifies the correctness of the datagram to be received based on the pseudonym, partial chain node value and signature identifier of the sender in the datagram to be received.

2. The method according to claim 1, characterized in that The V KGCs sequentially generate V pseudonym groups according to the request of the requesting party, and generate a corresponding private key group for each pseudonym group to form a pseudonym chain, including: The requesting party sends a first request message to the first KGC, where the first request message is used to request allocation of a first pseudonym and a first private key, including a real user identity ID; The first KGC authenticates the requester according to the first request information, and generates a first pseudonym group eidx={eid x1 ,eid x2 ,…,eid xn } and the first private key group s corresponding to each first pseudonym x ={s x1 ,s x2 ,…,s xn }, the first pseudonym group eidx and the first private key group s are sent to the server through a first preset security method. x Send to the requester and store the first corresponding relationship (ID:eidx:s x ), announcing the validity of the first pseudonym group eidx; The requesting party sends a second request message to the second KGC, where the second request message is used to request allocation of a second pseudonym and a second private key, including the first pseudonym group eidx; The second KGC authenticates the requester according to the second request information and generates a second pseudonym group eidy={eid y1 ,eid y2 ,…,eid yn } and the second private key group s corresponding to each second pseudonym y ={s y1 ,s y2 ,…,s yn }, the second pseudonym group eidy and the second private key group s are sent to the server through a second preset security method. y Send to the requester and store the second corresponding relationship (eidx:eidy:s y ), announce the validity of the second pseudonym group eidy; wherein, if V>2, the requesting party continues to request the allocation of pseudonyms and private keys until the Vth KGC generates the Vth pseudonym group and the Vth private key group, sends the Vth pseudonym group and the Vth private key group to the requesting party through the Vth preset security method, stores the Vth corresponding relationship, and announces the validity of the Vth pseudonym group.

3. The method according to claim 2, characterized in that The Vth KGC generates a communication anonymous identification ID for the requesting party B And the private key generation material m2 includes: The Vth KGC generates a communication anonymous identification ID for the requesting party B ; The Vth KGC calculates m1=H1(ID B ||hid,N)+ks, and calculate m2=[m1] -1 P1, where: H1 is a hash function, hid is a signature private key generation function identifier, N is the order of the cyclic group in the elliptic curve, ks is the private key of the VKGC, and P1 is a generator on the group in the elliptic curve; The Vth KGC will use the communication anonymous identification ID B and the private key generation material m2 are sent to the requesting party.

4. The method according to claim 3, characterized in that The requesting party uses the Vth pseudonym group and the corresponding Vth private key group to request CKGC to generate the communication anonymous identification ID for the requesting party in a distributed manner B The corresponding private key ds B include: The requester selects a secret random number s2∈[1,N-1] and uses the pseudonym ID generated by the Vth KGC a and private key ds A Sign the secret random number s2 and send the identity validation information to CKGC; The requester calculates m2s2=s2·[m1] -1 P1, and sends m2s2 to the CKGC; Each CKGC calculates the private key component kc after verifying the identity validity information. i m2s2=kc i ·s2·[m1] -1 P1 and sent to the requesting party, where kc i is the private key of CKGC, and i is the number of each CKGC; The requester will kc i m2s2=kc i ·s2·[m1] -1 P1 multiplied by s2 -1 Get the communication private key component ds Bi =kc i ·[m1] -1 P1, obtains the complete communication private key ds by aggregating the communication private key components B .

5. The method according to claim 1, wherein The datagram sender adds a partial chain node value to the IP header of the datagram to be sent and sends the datagram to be sent, including: The datagram sender determines whether the datagram to be sent is the first datagram in the communication; If the datagram to be sent is the first datagram in the communication, a message chain is generated, and the value of the chain head node is set to HC0; the signature counter is set to 0; If the datagram to be sent is not the first datagram in the communication, query the tail node of the message chain to obtain HC x , calculate the latest chain node value HC x+1 =hash(HC x ,input), add 1 to the signature counter; input represents the latest input, which is the datagram related information; The datagram sender determines whether the signature interval has been reached, and if so, calculates the signature S=sign(eid,HC x+1 , parameters), send the signed datagram, and send the datagram with the pseudonym eid and part of the chain node value HC x+1 | part and signature flag datagram, reset the signature counter to 0; if the signature interval is not reached, send the datagram with the pseudonym eid and part of the chain node value HC x+1 |part and signature flags for the datagram.

6. The method according to claim 1, characterized in that The datagram receiver receives the datagram to be received, and verifies the correctness of the datagram to be received according to the pseudonym, partial chain node value and signature identifier of the sender in the datagram to be received, including: The datagram receiver receives the to-be-received datagram, and determines whether the received to-be-received datagram is the first datagram in the communication; If the received datagram to be received is the first datagram in the communication, a message chain is generated when the pseudonym eid in the datagram to be received is legal, the chain head node value is set to HC0, and the signature counter is set to 0; If the received datagram to be received is not the first datagram in the communication, the pseudonym eid and the partial chain node value HC of the sender in the datagram to be received are obtained. x+1 |part and signature mark information; Determine whether a signature datagram is included; If the signature datagram is included, obtain the identification password public key corresponding to the pseudonym eid of the sender, query the relevant parameters to verify the correctness of the signature V=verify(sign,eid,HC x+1 ,parameters), if the verification is wrong, an error message will be prompted and the communication will end; if the verification is correct, the communication will end; If the signature datagram is not included, obtaining the corresponding message chain and signature counter in combination with the sender's pseudonym eid; Determine whether the maximum signature interval has been reached. If so, an error message will be prompted and the communication will be terminated. Otherwise, the locally saved chain tail node value HC will be used. x ' and the relevant information of the datagram to be received to calculate the latest chain node value HC x+1 ′=hash(HC x ,input); where input represents the latest input, which is the relevant information of the datagram; Determine HC x+1 Is ′|part equal to HC? x+1 |part, if HC x+1 ′|part=HC x+1 |part, then end this communication; if HC x+1 ′|part≠HC x+1 |part, an error message will be prompted and the communication will be terminated.

7. The method according to claim 2, characterized in that Also includes: The user's real identity ID is queried step by step through the pseudonym.

8. The method according to claim 7, characterized in that The step-by-step query of the user's real identity ID using a pseudonym includes: If a problem occurs with the datagram, error information is saved, wherein the error information includes the pseudonym in the datagram; submitting said pseudonym to KGC; The Vth KGC to the first KGC sequentially query the local corresponding relationship, and obtain the previous pseudonym through the latter pseudonym, until the first KGC queries the real identity ID of the user.

9. A network communication privacy protection system based on a multi-level pseudonym mechanism, comprising a requester, a datagram sender, a proxy, a datagram receiver, and V KGCs, characterized in that: The network communication privacy protection method based on the multi-level pseudonym mechanism as described in any one of claims 1 to 8 is used for data transmission.

Images