Key generation method and device, equipment and medium

Abstract

The invention provides a secret key generation method and device, equipment and a medium, and the method comprises the steps that an applicant generates a signature public key fragment based on an elliptic curve set in an SM2 algorithm, and sends a secret key application type, the signature public key fragment and a user identifier as application information to an auditing party; after the auditor completes identity verification of the applicant based on the user identifier, forwarding application information to the provider, so that the provider generates key information of the key application type for the signature public key fragment and the user identifier based on the elliptic curve, and submits the key information to the auditor and forwards the key information to the applicant; and the applicant generates a public and private key pair of the key application type based on the key information. According to the process, by introducing the auditor used for identity verification and encrypted information forwarding, the traceability of the encrypted information is guaranteed, the risk that an attacker illegally uses an identity application key of an applicant is reduced, and meanwhile generation of multiple types of public and private key pairs is achieved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and specifically discloses a key generation method, device, equipment and medium. Background Art

[0002] "Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm" is an application standard of asymmetric cryptography issued by the National Cryptography Administration. It is widely used in terminal authentication scenarios, key distribution and other scenarios. For example, in industrial manufacturing scenarios, it can realize two-way authentication between various acquisition terminals (such as RTU, PLC, etc.) and remote control terminals. For another example, in the Internet of Vehicles scenario, it can realize rapid authentication between vehicles and workshops, and vehicles and transportation facilities.

[0003] This mechanism mainly involves two roles: the applicant (also known as the user end) and the provider (also known as the key generation center, KGC). The applicant can generate a set of public key fragments based on the elliptic curve parameters set by the SM2 algorithm and hand it over to the provider. The provider can generate a declared public key and a private key fragment representing part of the user's private key based on the public key fragment, and then send the declared public key and private key fragments to the applicant, who will then process the private key fragments into a complete user private key, thereby completing the generation of the public-private key pair.

[0004] The above process has the following main problems: the lack of third-party supervision during the generation of public-private key pairs is not conducive to the traceability of encrypted information, which means that the mechanism can only support the generation of signature public-private key pairs. Moreover, the provider in the mechanism lacks the ability to identify the applicant, and there may be a risk that an attacker may impersonate the applicant to apply for a key. Summary of the invention

[0005] The embodiments of the present application provide a key generation method, apparatus, device and medium, which are used to ensure the traceability of encrypted information by introducing an auditor for identity authentication and forwarding of encrypted information, and reduce the risk of attackers applying for keys by impersonating the applicant, while realizing the generation of multiple types of public-private key pairs.

[0006] To achieve the above purpose, the technical solution of the embodiment of the present application is implemented as follows:

[0007] In a first aspect, an embodiment of the present application provides a key generation method, comprising:

[0008] The applicant generates a signature public key fragment; the signature public key fragment is obtained by calculating the signature private key fragment based on the base point of the elliptic curve, and the elliptic curve is set in the SM2 algorithm;

[0009] The key application type, the signature public key fragment and the user ID are sent as application information to the reviewer, the reviewer authenticates the applicant based on the user ID, and after passing the authentication, the reviewer forwards the application information to the provider, so that the provider performs a key generation operation on the signature public key fragment and the user ID based on the elliptic curve to obtain the key information of the key application type, and the key information is handed over to the reviewer and forwarded to the applicant; the key information includes: the declared public key and the target private key fragment;

[0010] The applicant generates a public-private key pair of the key application type based on the key information; the key application type includes part or all of the signature type and the encryption type.

[0011] In an embodiment of the present application, the applicant generates signature public key fragments based on the elliptic curve set in the SM2 algorithm, and sends the key application type, signature public key fragments and user identification as application information to the auditor. After the auditor completes the identity authentication of the applicant based on the user identification, the application information is forwarded to the provider, so that the provider performs a key generation operation on the signature public key fragments and the user identification based on the elliptic curve to obtain the key information of the key application type, and the key information is handed over to the auditor and forwarded to the applicant; the applicant generates a public-private key pair of the key application type based on the key information, wherein the key application type may include part or all of the signature type and encryption type. The above process introduces an auditor for identity authentication and encryption information forwarding to ensure the traceability of encrypted information, reduce the risk of attackers impersonating the applicant to apply for keys, and realize the generation of multiple types of public-private key pairs.

[0012] In some embodiments, the provider obtains the key information of the key application type in the following manner:

[0013] Determine a user hash value of the applicant based on the coordinates of the provider's master public key on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identifier;

[0014] Generate a private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment;

[0015] Based on the private key intermediate fragment and the base point, generating a declared public key of the key application type;

[0016] A target private key fragment of the key application type is determined based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value.

[0017] In an embodiment of the present application, the provider can generate a corresponding type of private key intermediate fragments based on the applicant's key application type, and generate a declared public key of the key application type based on the private key intermediate fragments and the base point, and then determine the target private key fragments of the key application type based on the declared public key, the private key intermediate fragments, the provider's master private key and the user hash value. The applicant can obtain the user private key of the key application type by processing the target private key fragments, thereby realizing the generation of multiple types of public-private key pairs.

[0018] In some embodiments, the provider generates the private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment in the following manner:

[0019] Based on a preset random number algorithm, a random number operation is performed on the provider master private key, the user hash value, the signature public key fragment, and the key application type to obtain an intermediate random number of the key application type;

[0020] Using the intermediate random number of the key application type, a modular operation is performed on the order of the base point on the elliptic curve to obtain the intermediate fragment of the private key of the key application type.

[0021] In the embodiment of the present application, the intermediate fragments of the private key of the key application type are introduced based on the provider's master private key, the user hash value, and the signature public key fragments to collaboratively calculate the intermediate random number of the key application type, and then the intermediate random number is used to perform a modular operation on the order of the base point on the elliptic curve to obtain the intermediate fragments of the private key of the key application type. In this way, the generation of multiple types of intermediate fragments of private keys is achieved, and the generation efficiency and security of public-private key pairs are improved.

[0022] In some embodiments, the provider generates a declared public key of the key application type based on the private key intermediate fragment and the base point in the following manner:

[0023] The product of the intermediate fragment of the private key of the key application type and the base point is added to the reference public key fragment associated with the key application type to obtain a declared public key of the key application type;

[0024] Among them, the reference public key fragment associated with the signature type is the signature public key fragment; the reference public key fragment associated with the encryption type is the encryption public key fragment; the encryption public key fragment is determined based on the product of the encryption private key fragment and the base point, and the encryption private key fragment is obtained by the provider using a preset hash algorithm to perform a hash operation on the user identifier and the key type information set based on the encryption type.

[0025] In the embodiment of the present application, by associating the corresponding reference public key fragments for each key application type, the provider can add the product of the intermediate fragments of the private key of the key application type and the base point to the reference public key fragments associated with the key application type to obtain the declared public key of the key application type. In the above process, the signature public key fragments generated by the applicant are used as the reference public key fragments of the signature type to participate in the calculation, and the encryption public key fragments generated by the provider are used as the reference public key fragments of the encryption type to participate in the calculation. Since the signature private key fragments used to generate the signature public key fragments are calculated by the applicant, the security of the signature type company key pair verification can be guaranteed. Since the encryption private key fragments used to generate the encryption public key fragments are calculated by the provider, the traceability of the encrypted public and private key pairs can be guaranteed.

[0026] In some embodiments, the provider determines the target private key fragment of the key application type based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value in the following manner:

[0027] Determine the public key coordinates of the declared public key of the key application type on the elliptic curve;

[0028] Using a preset hash algorithm to perform a hash operation on the public key coordinates and the user hash value to obtain a public key hash value of the key application type;

[0029] Based on the private key intermediate fragment of the key application type, the public key hash value and the provider master private key, a target private key fragment of the key application type is generated.

[0030] In the embodiment of the present application, the public key coordinates of the declared public key of the key application type on the elliptic curve and the user hash value are hashed to obtain the public key hash value of the key application type, and based on the private key intermediate fragments of the key application type, the public key hash value and the provider's master private key, the target private key fragments of the key application type are generated. The above process introduces the key application type to collaboratively calculate the target private key fragments of each key application type, so that the applicant can obtain the user private key of the key application type by processing the target private key fragments, and then realize the generation of multiple types of public-private key pairs.

[0031] In some embodiments, the applicant generates a public-private key pair of the key application type based on the key information, including:

[0032] Determine a private key to be selected based on the target private key fragment of the key application type and the reference private key fragment associated with the key application type; wherein the reference private key fragment associated with the signature type is the signature private key fragment; and the reference private key fragment associated with the encryption type is the encryption private key fragment;

[0033] Determine a first comparison public key of the key application type based on the selected private key and the base point;

[0034] Determine a second comparison public key of the key application type based on a public key hash value of the key application type, the provider master public key, and a declared public key of the key application type;

[0035] If the first comparison public key is the same as the second comparison public key, any one of the first comparison public key and the second comparison public key is used as the public key of the key application type, and the selected private key is used as the private key of the key application type.

[0036] In an embodiment of the present application, by associating corresponding reference private key fragments for each key application type, the applicant generates a candidate private key for the key application type and a first comparison public key for the key application type based on the reference private key fragments. The applicant can thereby determine the second comparison public key for the key application type based on the public key hash value of the key application type, the provider's master public key, and the declared public key of the key application type. If the first comparison public key is the same as the second comparison public key, it means that the current candidate private key can form a public-private key pair for the key application type with any one of the first comparison public key and the second comparison public key, thereby realizing the generation of multiple types of public-private key pairs.

[0037] In some embodiments, the application information further includes: an authentication ciphertext; the authentication ciphertext is obtained by encrypting the authentication factor by the applicant using the authentication public key of the provider;

[0038] Among them, the identification ciphertext is used for the provider to decrypt the identification ciphertext with the identification private key after receiving the application information forwarded by the auditor. If the identification factor is obtained by decryption, the step of performing a key generation operation on the signature public key fragment and the user identifier based on the elliptic curve is executed; otherwise, a prompt message indicating that the applicant's identity authentication has failed is sent to the auditor.

[0039] In an embodiment of the present application, the applicant may use an identification public key to encrypt an identification factor to obtain an identification ciphertext, and add an identification key to the application information, so that after the provider obtains the application information, the identification ciphertext can be encrypted and verified using an identification private key. If the decryption fails, it indicates that the identity of the applicant has been impersonated. If the decryption is successful, key information will be generated based on the application information, thereby achieving decryption verification of the applicant and improving data security.

[0040] In a second aspect, an embodiment of the present application further provides a key generation device, including:

[0041] The fragment acquisition unit is configured to: the applicant generates signature public key fragments; the signature public key fragments are obtained by calculating the signature private key fragments based on the base points of the elliptic curve, and the elliptic curve is set in the SM2 algorithm;

[0042] The information processing unit is configured to: send the key application type, the signature public key fragment and the user identification as application information to the reviewer, the reviewer authenticates the applicant based on the user identification, and forwards the application information to the provider after passing the authentication, so that the provider performs a key generation operation on the signature public key fragment and the user identification based on the elliptic curve to obtain the key information of the key application type, and hand over the key information to the reviewer and forward it to the applicant; the key information includes: a declared public key and a target private key fragment;

[0043] The key generation unit is configured to: the applicant generates a public-private key pair of the key application type based on the key information; the key application type includes part or all of the signature type and the encryption type.

[0044] In some embodiments, the provider obtains the key information of the key application type in the following manner:

[0045] Determine a user hash value of the applicant based on the coordinates of the provider's master public key on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identifier;

[0046] Generate a private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment;

[0047] Based on the private key intermediate fragment and the base point, generating a declared public key of the key application type;

[0048] A target private key fragment of the key application type is determined based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value.

[0049] In some embodiments, the provider generates the private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment in the following manner:

[0050] Based on a preset random number algorithm, a random number operation is performed on the provider master private key, the user hash value, the signature public key fragment, and the key application type to obtain an intermediate random number of the key application type;

[0051] Using the intermediate random number of the key application type, a modular operation is performed on the order of the base point on the elliptic curve to obtain the intermediate fragment of the private key of the key application type.

[0052] In some embodiments, the provider generates a declared public key of the key application type based on the private key intermediate fragment and the base point in the following manner:

[0053] The product of the intermediate fragment of the private key of the key application type and the base point is added to the reference public key fragment associated with the key application type to obtain a declared public key of the key application type;

[0054] Among them, the reference public key fragment associated with the signature type is the signature public key fragment; the reference public key fragment associated with the encryption type is the encryption public key fragment; the encryption public key fragment is determined based on the product of the encryption private key fragment and the base point, and the encryption private key fragment is obtained by the provider using a preset hash algorithm to perform a hash operation on the user identifier and the key type information set based on the encryption type.

[0055] In some embodiments, the provider determines the target private key fragment of the key application type based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value in the following manner:

[0056] Determine the public key coordinates of the declared public key of the key application type on the elliptic curve;

[0057] Using a preset hash algorithm to perform a hash operation on the public key coordinates and the user hash value to obtain a public key hash value of the key application type;

[0058] Based on the private key intermediate fragment of the key application type, the public key hash value and the provider master private key, a target private key fragment of the key application type is generated.

[0059] In some embodiments, the applicant generates a public-private key pair of the key application type based on the key information, and the key generation unit is specifically configured to:

[0060] Determine a private key to be selected based on the target private key fragment of the key application type and the reference private key fragment associated with the key application type; wherein the reference private key fragment associated with the signature type is the signature private key fragment; and the reference private key fragment associated with the encryption type is the encryption private key fragment;

[0061] Determine a first comparison public key of the key application type based on the selected private key and the base point;

[0062] Determine a second comparison public key of the key application type based on a public key hash value of the key application type, the provider master public key, and a declared public key of the key application type;

[0063] If the first comparison public key is the same as the second comparison public key, any one of the first comparison public key and the second comparison public key is used as the public key of the key application type, and the selected private key is used as the private key of the key application type.

[0064] In some embodiments, the application information further includes: an authentication ciphertext; the authentication ciphertext is obtained by encrypting the authentication factor by the applicant using the authentication public key of the provider;

[0065] Among them, the identification ciphertext is used for the provider to decrypt the identification ciphertext with the identification private key after receiving the application information forwarded by the auditor. If the identification factor is obtained by decryption, the step of performing a key generation operation on the signature public key fragment and the user identifier based on the elliptic curve is executed; otherwise, a prompt message indicating that the applicant's identity authentication has failed is sent to the auditor.

[0066] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0067] A memory for storing program instructions;

[0068] The processor is used to call the program instructions stored in the memory, and execute the steps included in any one of the methods in the first aspect according to the obtained program instructions.

[0069] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes any one of the methods described in the first aspect.

[0070] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods described in the first aspect.

[0071] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0073] Figure 1 A timing diagram of the "Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm" provided in the embodiment of the present application;

[0074] Figure 2 A timing diagram of the collaborative generation of keys by the applicant, the auditor, and the provider provided in the embodiment of the present application;

[0075] Figure 3 A timing diagram of a key generation method provided in an embodiment of the present application;

[0076] Figure 4 A schematic diagram of the structure of a key generation device provided in an embodiment of the present application;

[0077] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0079] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0080] To facilitate understanding of the technical solution provided by this application, the technical background of this application is described in detail below:

[0081] "Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm" is an application standard of asymmetric cryptography issued by the National Cryptography Administration. It involves two roles: the applicant (also known as the user end) and the provider (also known as the key generation center, KGC). KGC can work with the user end to jointly generate a public-private key pair. Figure 1 As shown, the following steps are included:

[0082] Step 101: The user terminal generates a random number d′ using a random number generator A ∈[1,n-1];

[0083] Among them, G is the base point of the elliptic curve defined in the SM2 algorithm, and n is the order of G on the elliptic curve.

[0084] Step 102: The user end calculates the public key fragment U A =[d′ A ]G;

[0085] Step 103: The user terminal submits the identification ID to KGC A and U A ;

[0086] Step 104: KGC calculates the first hash value H A =H 256 (ENTL A ∥ID A ∥a∥b∥x G ∥y G ∥x Pub ∥y Pub );

[0087] Among them, ENTL A is the number of bits of two bytes converted from the integer entlenA; a and b are the parameters of the elliptic curve equation specified in the SM2 algorithm; x G and G is the horizontal and vertical coordinates of the base point G on the elliptic curve; x Pub and Pub is the system master public key P pub The horizontal and vertical coordinates on the elliptic curve.

[0088] Step 105: KGC uses a random number generator to generate a random number w∈[1,n-1];

[0089] Step 106: KGC calculates the declared public key W A =[w]G+U A ;

[0090] Step 107: KGC calculates the second hash value λ=H 256 (x WA ∥yWA ∥H A ) mod n;

[0091] Step 108: The KGC calculates the private key fragment t A =(w + λ * m s ) mod n; where m s is the system master private key of the KGC;

[0092] Step 109: The KGC sends t A and W A to the user side;

[0093] Step 110: The user side calculates the private key d A =(t A + d' A ) mod n;

[0094] Step 111: If 0 < dA < n - 1, then use d A as the private key for this application, and use P A =[d A G as the public key for this application; otherwise, return to Step 101 to apply again.

[0095] In the above process, the application and distribution of the public and private key pairs are both completed through the interaction between the user side and the KGC. Lacking third-party supervision, it is not conducive to the traceability of encrypted information, which leads to the fact that this mechanism can only support the generation of signature public and private key pairs. For example, the generation requirements of the public and private key pairs of the encryption type stipulate that the encrypted data participating in the key generation must have information traceability, and this mechanism cannot meet the generation of such public and private key pairs. Moreover, the KGC in this mechanism cannot identify the identity of the user side, and there may be a risk that an attacker impersonates the identity of the user side to apply for the key.

[0096] To solve the above problems, the inventive concept of this application is: The applicant generates a signature public key fragment based on the elliptic curve set in the SM2 algorithm, and sends the key application type, the signature public key fragment, and the user identifier as application information to the auditor. After the auditor completes the identity verification of the applicant based on the user identifier, the application information is forwarded to the provider, so that the provider performs key generation operations on the signature public key fragment and the user identifier based on the elliptic curve to obtain the key information of the key application type, and hands the key information to the auditor and forwards it to the applicant; The applicant generates a public and private key pair of the key application type based on the key information, and the key application type may include some or all of the signature type and the encryption type. The above process introduces an auditor for identity verification and encrypted information forwarding to ensure the traceability of encrypted information, reduce the risk that an attacker impersonates the applicant's identity to apply for the key, and at the same time realizes the generation of multiple types of public and private key pairs.

[0097] In the key generation method provided in the embodiment of the present application, based on the user end and KGC in the aforementioned "Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm", a new role of the auditor is introduced. In some embodiments, the Registration Authority (RA) can be used as the auditor, and the auditor is mainly used to authenticate the identity of the user end in the key generation process, and to forward and store the application information submitted by the user end and the key information issued by the KGC.

[0098] Figure 2 The following example shows the steps of the key generation process performed by the applicant (user end), the auditor (RA) and the provider (KGC) in collaboration, as shown in FIG. Figure 2 As shown, the following steps may be included:

[0099] Step 201: The user terminal submits key application information to the RA;

[0100] Step 202: RA conducts identity verification on the user, and forwards the application information to KGC after passing the verification;

[0101] Step 203: KGC generates key information based on the application information and sends it to RA;

[0102] Step 204: RA verifies the signature of the key information and forwards the key information to the user end after the signature verification passes;

[0103] Step 205: The user terminal generates a public-private key pair for this application based on the key information.

[0104] For ease of understanding, the following Figure 3 The specific implementation process of steps 201 to 205 is explained as follows:

[0105] Figure 2 Step 201: The user terminal submits key application information to the RA, which can correspond to Figure 3 Steps 301 to 302 are shown;

[0106] Step 301: The user terminal generates signature public key fragments;

[0107] In some embodiments, the user end may compare the base point G of the elliptic curve set in the SM2 algorithm with the signature private key fragment d S * is used as the signature public key fragment P S *=[d S *]G;

[0108] In some embodiments, the signature private key fragment d S* is a random number generated by the user in the interval [1, n-1], where n is the order of the base point G on the elliptic curve.

[0109] Step 302: The user terminal sends the key application type, user ID, personal registration information, authentication ciphertext, and signature public key fragment as application information to the RA;

[0110] Among them, the key application type may include the signature type T S and encryption type T E Part or all of the user identification ID may represent the identification that the user terminal wishes to register.

[0111] In some embodiments, the user terminal may pre-agreed with the RA on the registration information required for identity verification. The registration information should include the user identification ID. On this basis, some personal registration information Inf of the user terminal set based on actual needs may also be added, such as user name, network address, etc.

[0112] Figure 2 Step 202: RA conducts identity verification on the user end, and forwards the application information to KGC after the verification is passed. Figure 3 Steps 303 to 305 are shown;

[0113] Step 303: RA conducts identity verification on the user terminal based on the user ID and personal registration information;

[0114] Step 304: If the verification fails, a prompt message indicating that the identity verification failed is sent to the user terminal;

[0115] Step 305: If the review is successful, the application information is forwarded to KGC;

[0116] During implementation, RA can conduct identity verification on the user ID and personal registration information Inf of the user terminal, and forward the application information uploaded by the user terminal to KGC after the verification is passed. Considering that personal registration information Inf does not need to participate in subsequent key generation, the remaining information in the application information except personal registration information Inf can be forwarded to KGC after the verification is passed.

[0117] In some embodiments, RA may also add validity verification information in step 304 to set the validity of the application information. When KGC receives the application information, it may verify the validity verification information. If the verification fails, it means that the application information is invalid. At this time, RA may be informed that the validity of the application information is invalid and the subsequent key generation process may be stopped.

[0118] Figure 2 Step 203: KGC generates key information based on the application information and sends it to RA, which can correspond to Figure 3Steps 306 to 312 are shown;

[0119] Step 306: KGC uses the authentication private key to decrypt the authentication ciphertext;

[0120] Step 307: If the decryption fails, a prompt message indicating the decryption failure is sent to the RA;

[0121] Corresponding to the authentication ciphertext carried by the application information in the aforementioned step 302, the user terminal can use the authentication public key of the KGC to encrypt the authentication factor r to obtain the authentication ciphertext r*, which is used by the KGC to perform authenticatable encryption verification on the application information of the user terminal. The specific plaintext content of the authentication factor r can be agreed upon in advance by the user terminal and the KGC, or can be set by the user terminal itself, and this application does not limit this.

[0122] Step 308: If the decryption is successful, the user hash value is determined based on the coordinates of the provider's master public key on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identifier;

[0123] During implementation, KGC can calculate the user hash value h = H 256 (ENTL||ID||a||b||x G ||y G ||x Pub ||y Pub );

[0124] Among them, H 256 is a hash function with an output hash value of 256 bits, such as an SM3 hash function; a and b are elliptic curve equation parameters set in the SM2 algorithm; x G and G is the horizontal and vertical coordinates of the base point G on the elliptic curve; x Pub and Pub The provider's master public key P Pub The horizontal and vertical axis coordinates on the elliptic curve can be converted into a bit string in the form of a bit string and then substituted into the calculation, for example, using the method given in Sections 4.2.5 and 4.2.6 of the national cryptographic standard GB / T 32918.1-2016; ENTL is two bytes obtained by converting the bit length entl of the user identification ID using the big-endian representation, for example, it can be converted in Section 5.4 of the national cryptographic standard GM / T0130-2023.

[0125] Step 309: Generate a private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment;

[0126] As mentioned above, the key generation algorithm in the embodiment of the present application supports the generation of multiple types of keys, and the key application type may specifically include the signature type T s and encryption type TE part or all of .

[0127] During implementation, KGC can use a preset random number algorithm to generate the provider's master private key m S , user hash value h, signature public key fragment P S * and the key application type to perform random number operation to obtain an intermediate random number of the key application type; then, using the intermediate random number of the key application type, perform a modular operation on the order n of the base point G on the elliptic curve to obtain an intermediate fragment of the private key of the key application type.

[0128] To facilitate understanding, let's look at how to solve the signature type T through the above process. s and encryption type T E The intermediate fragments of each private key are explained:

[0129] For a signed type T S The private key intermediate fragment w S : Calculate w S =DRBG(m S ,h,P S *||T S ,bitlen WS )mod n;

[0130] Wherein, DRBG is a deterministic random number generator that runs a preset random number algorithm; m S is the provider's master private key; h is the user's hash value; P S * is the signature public key fragment; n is the order of the base point G on the elliptic curve; bitlen WS w S The bit length is n; mod is the modulus operation; DRBG(m S ,h,P S *||T S ,bitlen WS T s The intermediate random number of type.

[0131] For encryption type T E The private key intermediate fragment w E : Calculate w E =DRBG(m S ,h,P S *||T E ,bitlen WE )mod n;

[0132] Among them, bitlen WE w E The bit length of DRBG(m S ,h,PS *||T E ,bitlen WE ) is T E The intermediate random number of type.

[0133] Step 310: Generate a declared public key of the key application type based on the private key intermediate fragment and the base point;

[0134] During implementation, KGC may add the product of the intermediate fragment of the private key of the key application type and the base point to the reference public key fragment associated with the key application type to obtain the declared public key of the key application type; wherein, the reference public key fragment associated with the signature type is the signature public key fragment; the reference public key fragment associated with the encryption type is the encryption public key fragment; the encryption public key fragment is determined based on the product of the encryption private key fragment and the base point, and the encryption private key fragment is obtained by the provider using a preset hash algorithm to perform a hash operation on the user identifier and the key type information set based on the encryption type.

[0135] To facilitate understanding, let's look at how to solve the signature type T through the above process. s and encryption type T E Each privately declared public key is explained:

[0136] For a signed type T S The declared public key Ws: Calculate W S =[w S ]G+P S *; where the signature public key fragment P S * is T s The reference public key shard of type.

[0137] For encryption type T E The declared public key W E :Use the preset hashing algorithm to perform a hashing operation on the user ID and the key type information set based on the encryption type to obtain the encrypted private key fragment d E *=H 256 (ID||Ext) mod n; where Ext is the key type information set based on the encryption type, for example, information containing the public-private key pair whose key type applied by the user end is encryption type. Then, the encrypted public key fragment P is determined based on the product of the encrypted private key fragment and the base point. E *=[d E *]G,P E * is T E Finally, the declared public key W is calculated. E =[w E ]G+P E *.

[0138] Step 311: Determine the target private key fragment of the key application type based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value;

[0139] During implementation, the public key coordinates of the declared public key of the key application type on the elliptic curve are determined; then a preset hashing algorithm is used to perform a hashing operation on the public key coordinates and the user hash value to obtain the public key hash value of the key application type; and then based on the private key intermediate fragments of the key application type, the public key hash value and the provider's master private key, the target private key fragments of the key application type are generated.

[0140] To facilitate understanding, let's look at how to solve the signature type T through the above process. S and encryption type T E The respective private key fragments are explained as follows:

[0141] For a signed type T S The target private key fragment t S : Calculate T S The public key hash value λ corresponding to the type S =H 256 (x WS ||y WS ||h)mod n, then calculate t S =(w S +λ S ·m S )mod n;

[0142] Among them, x WS and WS Respectively represent T S A declared public key of type W S The horizontal and vertical axis coordinates on the elliptic curve can be converted into a bit string in the form of a bit string and then substituted into the calculation, for example, using the method given in Sections 4.2.5 and 4.2.6 of the national cryptographic standard GB / T 32918.1-2016.

[0143] For encryption type T E The target private key fragment t E : Calculate T E The public key hash value λ corresponding to the type E =H 256 (x WE ||y WE ||h)mod n, then calculate t E =(w E +λ E ·m S )mod n;

[0144] Among them, x WE and WERespectively represent T E A declared public key of type W E The horizontal and vertical axis coordinates on the elliptic curve can be converted into a bit string in the form of a bit string and then substituted into the calculation, for example, using the method given in Sections 4.2.5 and 4.2.6 of the national cryptographic standard GB / T 32918.1-2016.

[0145] Step 312: The declared public key of the key application type and the target private key fragment are used as key information and sent to the RA;

[0146] To improve data security, a corresponding private key fragment validity period can be set for the target private key fragment during implementation;

[0147] If the key application type is signature type T S , then T S A declared public key of type W S 、Target private key fragment t S , and the corresponding private key fragment validity period V S , as key information.

[0148] If the key application type is signature type T E , then T E A declared public key of type W E 、Target private key fragment t E , and the corresponding private key fragment validity period V E , as key information.

[0149] If the key application type includes both of the above types, T can be generated through the above process S Type and T E The key information of each type is then sent to RA.

[0150] Figure 2 Step 204: RA verifies the signature of the key information and forwards the key information to the user end after the signature verification is passed. Figure 3 Steps 313 to 315 are shown;

[0151] Step 313: RA uses the signature verification public key to verify the signature of the key information;

[0152] Step 314: If the signature verification fails, a prompt message indicating that the key information signature verification fails is sent to the KGC;

[0153] Step 315: If the verification is successful, the key information is sent to the user end;

[0154] In some embodiments, the RA and KGC may pre-agree on a signature verification process. The KGC may sign the data that needs to be forwarded by the RA, and then the RA verifies the data. If the verification is successful, the data is forwarded to the user end, thereby improving data security.

[0155] Figure 2 Step 205: The user terminal generates a public-private key pair for this application based on the key information, which can correspond to Figure 3 Steps 316 to 319 are shown;

[0156] Step 316: The user terminal determines a private key to be selected based on the target private key fragment and the reference private key fragment associated with the key application type;

[0157] Step 317: The user terminal determines the first comparison public key of the key application type based on the selected private key and the base point;

[0158] Step 318: The user terminal determines the second comparison public key of the key application type based on the public key hash value of the key application type, the provider master public key and the declared public key of the key application type;

[0159] Step 319: If the first comparison public key is the same as the second comparison public key, any one of the first comparison public key and the second comparison public key is used as the public key of the key application type, and the selected private key is used as the private key of the key application type.

[0160] As mentioned above, the key generation algorithm in the embodiment of the present application supports the generation of multiple types of keys. The key application type may specifically include signature type Ts and encryption type T E To facilitate understanding of how the user terminal generates the public-private key pair for this application based on the key information, subsequent steps 316 to 319 explain how the user terminal generates two types of public-private key pairs:

[0161] If the key application type is signature type T S The client can use the signature private key fragment d mentioned in step 301 above S * A reference to the private key shard associated with this type.

[0162] Then, obtain the target private key fragment t from the key information issued by KGC S *, and based on the target private key fragment t S * and reference private key fragment d S *, calculate the selected private key d WS =(t S +d S *)mod n. To improve data security, KGC can use the authentication public key pair as the target private key fragment t S* Encryption, the client takes out the target private key fragment from the key information S *, it is necessary to use the authentication private key to decrypt in advance. If the decryption fails, it means that the authentication encryption verification is wrong. At this time, it indicates that the key generation has failed and the key generation process ends. In addition, if the private key fragment obtained by the user from the key information is valid for V S Invalidation also indicates that the key generation has failed and ends the key generation process.

[0163] Next, based on the selected private key d WS Calculate T from base point G S The first comparison public key of type P WS =[d WS ]G.

[0164] Then use the T mentioned in step 311 above s Type corresponds to the public key hash value λ S Calculate λ by S =H 256 (x WS ||y WS ||h)mod n.

[0165] Based on T s The public key hash value of type λ S , provider master public key P pub and T S A declared public key of type W S , calculate T S The second comparison public key of type P WS *=W S +[λ S ]P pub .

[0166] If P WS =P WS * are the same, then P WS or P WE * as the public key for the signature type of this application, and d WS As the private key of the signature type for this application. Otherwise, the public-private key pair representing this application is unavailable and can be re-applied.

[0167] If the key application type is signature type T E The user end can use the encrypted private key fragment d of KGC mentioned in the above step 310 E * A reference to the private key shard associated with this type.

[0168] Then, obtain the target private key fragment t from the key information issued by KGC E *, and based on the target private key fragment t E* and reference private key fragment d E *, calculate the selected private key d WE =(t E +d E *)mod n. To improve data security, KGC should use the authentication public key pair as the target private key fragment t E * Encryption, the client takes out the target private key fragment from the key information E *, it is necessary to use the authentication private key to decrypt in advance. If the decryption fails, it means that the authentication encryption verification is wrong. At this time, it indicates that the key generation has failed and the key generation process ends. In addition, if the private key fragment obtained by the user from the key information is valid for V E Invalidation also indicates that the key generation has failed and ends the key generation process.

[0169] Next, based on the selected private key d WE Calculate T from base point G E The first comparison public key of type P WE =[d WE ]G.

[0170] Then use the T mentioned in step 311 above E Type corresponds to the public key hash value λ E Calculate λ by E =H 256 (x WE ||y WE ||h)mod n.

[0171] Based on T E The public key hash value of type λ E , provider master public key P pub and T E A declared public key of type W E , calculate T E The second comparison public key of type P WE *=W E +[λ E ]P pub .

[0172] If P WE =P WE * are the same, then P WE or P WE * as the public key for the encryption type of this application, and d WE As the private key of the encryption type of this application. Otherwise, the public-private key pair representing this application is unavailable and can be re-applied.

[0173] In addition, for the deterministic random number generator DRBG used to generate private key intermediate fragments mentioned in the aforementioned step 309, its internal state may include: V: byte type with a length of seedlen bits = 440 bits; C: byte type status data with a length of seedlen bits = 440 bits.

[0174] In some embodiments, DRBG may generate a random number by executing the following function: requested_bits=DRBG(sk_input, personalization_string, additional_input, requested_number_of_bits); its function is a deterministic random number generator based on the HASH algorithm;

[0175] In specific implementation, working_state=Hash_DRBG_Instantiate_algorithm(sk_input,NULL,personalization_string) may be executed; then returned_bits=Hash_DRBG_Generate_algorithm(working_state,requested_number_of_bits,additional_input) may be executed, thereby returning the generated random number returned_bits;

[0176] Among them, sk_input represents the input key information; personalization_string represents the preset personalized string; additional_input represents optional parameters, additional information; requested_number_of_bits represents the requested number of bits; returned_bitss represents the return data of the above function, that is, the generated random number.

[0177] In some embodiments, the DRBG may be initialized by executing the following function: initial_working_state=Hash_DRBG_Instantiate_algorithm(sk_input, nonce, personalization_string), which is a Hash DRBG instantiation function;

[0178] In specific implementation, entropy_input, nonce, and personalization_string can be concatenated to obtain seed material data seed_material = entropy_input||nonce||personalization_string; calculate seed data seed = Hash_df(seed_material,seedlen); then calculate V = seed, C = Hash_df((0x00||V), seedlen), and thus return the working status information composed of (V, C). Among them, nonce represents the one-time temporary data input; initial_working_state represents the return data of the above function, which is the working status information recording the status of V and C parameters.

[0179] In some embodiments, the DRBG generation function returned_bits=Hash_DRBG_Generate_algorithm(working_state, requested_number_of_bits, additional_input) generates random bits based on Hash DRBG;

[0180] In specific implementation, if additional_input is a non-empty string, the hash value w=Hash(0x02||V||additional_input) is calculated, Hash represents the SM3 algorithm, and then the byte string V=(V+w)mod 2seedlen is updated, and the value of seedlen can be 440. Then, calculated and returned returned_bits=Hashgen(requested_number_of_bits,V). Among them, working_state represents the working state of the input; returned_bitss represents the return data of the above function, that is, the number of random bits generated.

[0181] In some embodiments, the Hash_df function (status, requested_bits) = Hash_df (input_string, no_of_bits_to_return) of DRBG is a derived function based on the HASH algorithm.

[0182] In the specific implementation, first initialize the temporary data string to an empty string, that is, temp = NULL, and then calculate the number of groups Where outlen represents the output bit length of the hash function. Here, the SM3 algorithm is used, and the output length is 256 bits. Then initialize the 8-bit integer counter counter = 0x01.

[0183] Iteratively calculate the hash value and update the temporary data string temp = temp||Hash(counter||no_of_bits_to_return||input_string), where counter and no_of_bits_to_return represent 8-bit and 32-bit big-endian strings respectively. Then update the counter counter = counter+1, and obtain the returned bit string data requested_bits = leftmost(temp,no_of_bits_to_return) by intercepting the high bits; where leftmost(s,n) means intercepting the high (left) n bits of the bit string s and returning requested_bits. Where input_string represents the input data to be HASHed, and no_of_bits_to_return represents the expected length of the returned data.

[0184] In some embodiments, the Hashgen function of DRBG returned_bits=Hashgen(requested_no_of_bits, V) is a derivative function of Hash DRBG data.

[0185] In specific implementation, first calculate the number of groups outlen is the output bit length of the HASH function. Here, the SM3 algorithm is used, and the output length is 256 bits. Then initialize the byte type data = V of seedlen bits (i.e. 440 bits), and initialize the temporary data string W = NULL. Then return returned_bits in the following way: calculate w = Hash (data), W = W||w, data = (data + 1) mod 2seedlen. Then intercept the high bit to get the returned bit string data returned_bits = leftmost (W, requested_no_of_bits); where leftmost (s, n) represents the high (left) n bits of the intercepted bit string s, requested_no_of_bits represents the number of requested bits input, V represents the V information in the Hash DRBG working state, and returned_bitss represents the return data of the above function, that is, the number of random bits generated.

[0186] The above setting can improve the execution efficiency when the deterministic random number generator DRBG is used to generate random numbers in the embodiment of the present application, facilitate the later tracing of key-related information, and reduce the storage amount of the decryption private key. From the operation point of view, compared with the use of an uncertain random number generator to participate in key generation, one less set of data can be stored.

[0187] Based on the same inventive concept, the present application also provides a key generation device, whose structure can be as follows: Figure 4 As shown, including:

[0188] The fragment acquisition unit 401 is configured to: the applicant generates signature public key fragments; the signature public key fragments are obtained by calculating the signature private key fragments based on the base points of the elliptic curve, and the elliptic curve is set in the SM2 algorithm;

[0189] The information processing unit 402 is configured to: send the key application type, the signature public key fragment and the user identifier as application information to the reviewer, the reviewer authenticates the applicant based on the user identifier, and after passing the authentication, forwards the application information to the provider, so that the provider performs a key generation operation on the signature public key fragment and the user identifier based on the elliptic curve to obtain key information of the key application type, and hand over the key information to the reviewer and forward it to the applicant; the key information includes: a declared public key and a target private key fragment;

[0190] The key generation unit 403 is configured to: the applicant generates a public-private key pair of the key application type based on the key information; the key application type includes part or all of the signature type and the encryption type.

[0191] In some embodiments, the provider obtains the key information of the key application type in the following manner:

[0192] Determine a user hash value of the applicant based on the coordinates of the provider's master public key on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identifier;

[0193] Generate a private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment;

[0194] Based on the private key intermediate fragment and the base point, generating a declared public key of the key application type;

[0195] A target private key fragment of the key application type is determined based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value.

[0196] In some embodiments, the provider generates the private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment in the following manner:

[0197] Based on a preset random number algorithm, a random number operation is performed on the provider master private key, the user hash value, the signature public key fragment, and the key application type to obtain an intermediate random number of the key application type;

[0198] Using the intermediate random number of the key application type, a modular operation is performed on the order of the base point on the elliptic curve to obtain the intermediate fragment of the private key of the key application type.

[0199] In some embodiments, the provider generates a declared public key of the key application type based on the private key intermediate fragment and the base point in the following manner:

[0200] The product of the intermediate fragment of the private key of the key application type and the base point is added to the reference public key fragment associated with the key application type to obtain a declared public key of the key application type;

[0201] Among them, the reference public key fragment associated with the signature type is the signature public key fragment; the reference public key fragment associated with the encryption type is the encryption public key fragment; the encryption public key fragment is determined based on the product of the encryption private key fragment and the base point, and the encryption private key fragment is obtained by the provider using a preset hash algorithm to perform a hash operation on the user identifier and the key type information set based on the encryption type.

[0202] In some embodiments, the provider determines the target private key fragment of the key application type based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value in the following manner:

[0203] Determine the public key coordinates of the declared public key of the key application type on the elliptic curve;

[0204] Using a preset hash algorithm to perform a hash operation on the public key coordinates and the user hash value to obtain a public key hash value of the key application type;

[0205] Based on the private key intermediate fragment of the key application type, the public key hash value and the provider master private key, a target private key fragment of the key application type is generated.

[0206] In some embodiments, the applicant generates a public-private key pair of the key application type based on the key information, and the key generation unit 403 is specifically configured to:

[0207] Determine a private key to be selected based on the target private key fragment of the key application type and the reference private key fragment associated with the key application type; wherein the reference private key fragment associated with the signature type is the signature private key fragment; and the reference private key fragment associated with the encryption type is the encryption private key fragment;

[0208] Determine a first comparison public key of the key application type based on the selected private key and the base point;

[0209] Determine a second comparison public key of the key application type based on a public key hash value of the key application type, the provider master public key, and a declared public key of the key application type;

[0210] If the first comparison public key is the same as the second comparison public key, any one of the first comparison public key and the second comparison public key is used as the public key of the key application type, and the selected private key is used as the private key of the key application type.

[0211] In some embodiments, the application information further includes: an authentication ciphertext; the authentication ciphertext is obtained by encrypting the authentication factor by the applicant using the authentication public key of the provider;

[0212] Among them, the identification ciphertext is used for the provider to decrypt the identification ciphertext with the identification private key after receiving the application information forwarded by the auditor. If the identification factor is obtained by decryption, the step of performing a key generation operation on the signature public key fragment and the user identifier based on the elliptic curve is executed; otherwise, a prompt message indicating that the applicant's identity authentication has failed is sent to the auditor.

[0213] Based on the same inventive concept, the present application embodiment also provides an electronic device 530 for executing the above-mentioned key generation method. Its structure can be as follows Figure 5 As shown, it should be understood that Figure 5 The electronic device 530 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0214] like Figure 5 As shown, the electronic device 530 is in the form of a general electronic device. The components of the electronic device 530 may include but are not limited to: the at least one processor 531, the at least one memory 532, and a bus 533 connecting different system components (including the memory 532 and the processor 531).

[0215] Bus 533 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0216] The memory 532 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 5321 and / or a cache memory 5322 , and may further include a read-only memory (ROM) 5323 .

[0217] Memory 532 may also include a program / utility 5325 having a set (at least one) of program modules 5324, such program modules 5324 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0218] The electronic device 530 may also communicate with one or more external devices 534 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 530, and / or communicate with any device that enables the electronic device 530 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 535. Furthermore, the electronic device 530 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 536. As shown, the network adapter 536 communicates with other modules for the electronic device 530 via a bus 533. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 530, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0219] In some embodiments, a computer-readable storage medium including instructions is also provided, such as a memory 532 including instructions, and the instructions can be executed by the processor 531 of the above device to complete the above method. Optionally, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0220] In some embodiments, a computer program product is also provided, including a computer program / instruction, which, when executed by the processor 531, implements any one of the key generation methods provided in the present application.

[0221] In some embodiments, various aspects of a key generation method provided by the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a key generation method according to various exemplary embodiments of the present application described above in this specification.

[0222] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0223] The program product for key generation of the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on an electronic device. However, the program product of the present application is not limited to this. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0224] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein readable program code is carried. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0225] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0226] The program code for performing the operation of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as language or similar programming languages. The program code can be executed entirely on the user electronic device, partially on the user device, as an independent software package, partially on the user electronic device and partially on the remote electronic device, or completely on the remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0227] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0228] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0229] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0230] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable image scaling device to produce a machine, so that the instructions executed by the processor of the computer or other programmable image scaling device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0231] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable image scaling device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, the instruction device being implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0232] These computer program instructions may also be loaded onto a computer or other programmable image scaling device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0233] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0234] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A key generation method, characterized in that: The method comprises: The applicant generates a signature public key fragment; the signature public key fragment is obtained by calculating the signature private key fragment based on the base point of the elliptic curve, and the elliptic curve is set in the SM2 algorithm; The key application type, the signature public key fragment and the user ID are sent as application information to the reviewer, the reviewer authenticates the applicant based on the user ID, and after passing the authentication, the reviewer forwards the application information to the provider, so that the provider performs a key generation operation on the signature public key fragment and the user ID based on the elliptic curve to obtain the key information of the key application type, and the key information is handed over to the reviewer and forwarded to the applicant; the key information includes: the declared public key and the target private key fragment; The applicant generates a public-private key pair of the key application type based on the key information; the key application type includes part or all of the signature type and the encryption type.

2. The method according to claim 1, characterized in that The provider obtains the key information of the key application type in the following manner: Determine a user hash value of the applicant based on the coordinates of the provider's master public key on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identifier; Generate a private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment; Based on the private key intermediate fragment and the base point, generating a declared public key of the key application type; A target private key fragment of the key application type is determined based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value.

3. The method according to claim 2, characterized in that The provider generates a private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment in the following manner: Based on a preset random number algorithm, a random number operation is performed on the provider master private key, the user hash value, the signature public key fragment, and the key application type to obtain an intermediate random number of the key application type; Using the intermediate random number of the key application type, a modular operation is performed on the order of the base point on the elliptic curve to obtain the intermediate fragment of the private key of the key application type.

4. The method according to claim 2, characterized in that: The provider generates a declared public key of the key application type based on the private key intermediate fragment and the base point in the following manner: The product of the intermediate fragment of the private key of the key application type and the base point is added to the reference public key fragment associated with the key application type to obtain a declared public key of the key application type; Among them, the reference public key fragment associated with the signature type is the signature public key fragment; the reference public key fragment associated with the encryption type is the encryption public key fragment; the encryption public key fragment is determined based on the product of the encryption private key fragment and the base point, and the encryption private key fragment is obtained by the provider using a preset hash algorithm to perform a hash operation on the user identifier and the key type information set based on the encryption type.

5. The method according to claim 2, characterized in that: The provider determines the target private key fragment of the key application type based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value in the following manner: Determine the public key coordinates of the declared public key of the key application type on the elliptic curve; Using a preset hash algorithm to perform a hash operation on the public key coordinates and the user hash value to obtain a public key hash value of the key application type; Based on the private key intermediate fragment of the key application type, the public key hash value and the provider master private key, a target private key fragment of the key application type is generated.

6. The method according to claim 5, characterized in that The applicant generates a public-private key pair of the key application type based on the key information, including: Determine a private key to be selected based on the target private key fragment of the key application type and the reference private key fragment associated with the key application type; wherein the reference private key fragment associated with the signature type is the signature private key fragment; and the reference private key fragment associated with the encryption type is the encryption private key fragment; Determine a first comparison public key of the key application type based on the selected private key and the base point; Determine a second comparison public key of the key application type based on a public key hash value of the key application type, the provider master public key, and a declared public key of the key application type; If the first comparison public key is the same as the second comparison public key, any one of the first comparison public key and the second comparison public key is used as the public key of the key application type, and the selected private key is used as the private key of the key application type.

7. The method according to any one of claims 1 to 6, characterized in that: The application information also includes: an authentication ciphertext; the authentication ciphertext is obtained by the applicant encrypting the authentication factor using the authentication public key of the provider; Among them, the identification ciphertext is used for the provider to decrypt the identification ciphertext with the identification private key after receiving the application information forwarded by the auditor. If the identification factor is obtained by decryption, the step of performing a key generation operation on the signature public key fragment and the user identifier based on the elliptic curve is executed; otherwise, a prompt message indicating that the applicant's identity authentication has failed is sent to the auditor.

8. A key generation device, characterized in that: include: The fragment acquisition unit is configured to: the applicant generates signature public key fragments; The signature public key fragments are obtained by calculating the signature private key fragments based on the base points of the elliptic curve, and the elliptic curve is set in the SM2 algorithm; The information processing unit is configured to: send the key application type, the signature public key fragment and the user identifier as application information to the reviewer, the reviewer authenticates the applicant based on the user identifier, and after passing the identity verification, forward the application information to the provider, so that the provider performs a key generation operation on the signature public key fragment and the user identifier based on the elliptic curve to obtain key information of the key application type, and hand over the key information to the reviewer and forward it to the applicant; The key information includes: a declared public key and target private key fragments; The key generation unit is configured to: the applicant generates a public-private key pair of the key application type based on the key information; the key application type includes part or all of the signature type and the encryption type.

9. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in any one of claims 1-7 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the computer executes the method according to any one of claims 1 to 7.

Images