A key generation method, apparatus, device, and medium

Abstract

The application provides a key generation method, device, equipment and medium. In the method, an applicant generates a signature public key fragment based on an elliptic curve set in an SM2 algorithm, sends a key application type, the signature public key fragment and a user identifier to an auditor as application information, forwards the application information to a provider after the auditor completes identity verification of the applicant based on the user identifier, enables the provider to generate key information of the key application type based on the elliptic curve and the signature public key fragment and the user identifier, and enables the provider to deliver the key information to the auditor and forward the key information to the applicant; and the applicant generates a public-private key pair of the key application type based on the key information. The above process introduces an auditor for identity verification and encrypted information forwarding, so as to guarantee the traceability of encrypted information, reduce the risk of an attacker applying for a key by impersonating the applicant, and realize the generation of multiple types of public-private key pairs.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of data security, and specifically discloses a key generation method, device, equipment and medium. BACKGROUND

[0002] The "Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm" is an application standard of asymmetric cryptography issued by the State Cryptography Administration, and is widely used in terminal authentication scenarios and key distribution scenarios. For example, it is used to realize bidirectional authentication of various collection terminals (such as RTU and PLC) and remote control terminals in an industrial manufacturing scenario, and is used to realize fast authentication between vehicles and vehicles and between vehicles and traffic facilities in a vehicle networking scenario.

[0003] The mechanism mainly involves two roles: an applicant (also referred to as a user terminal) and a provider (also referred to as a key generation center, KGC). The applicant can generate a set of public key fragments based on the elliptic curve parameters set in the SM2 algorithm and hand them over to the provider. The provider can generate a declared public key and a private key fragment representing part of the user private key based on the public key fragments, and then distribute the declared public key and the private key fragment to the applicant. The applicant then processes the private key fragment into a complete user private key, and then completes the generation of a public-private key pair.

[0004] The above process mainly has the following problems: there is a lack of third-party supervision in the generation stage of the public-private key pair, which is not conducive to the traceability of encrypted information, which leads to the fact that the mechanism can currently only support the generation of a signature public-private key pair. Moreover, the provider in the mechanism lacks the ability to identify the applicant, and there is a risk that an attacker may impersonate the applicant to apply for a key. SUMMARY

[0005] The embodiments of the application provide a key generation method, device, equipment and medium, which introduce an auditing party for identity verification and encrypted information forwarding to ensure the traceability of encrypted information, reduce the risk of an attacker impersonating an applicant to apply for a key, and realize the generation of multiple types of public-private key pairs.

[0006] To achieve the above object, the technical scheme of the embodiments of the application is as follows:

[0007] In a first aspect, the embodiments of the application provide a key generation method, comprising:

[0008] The applicant generates a signature public key fragment; the signature public key fragment is obtained by operating a signature private key fragment based on a base point of an elliptic curve, and the elliptic curve is set in the SM2 algorithm;

[0009] send the key application type, the signature public key fragment and the user identification to an auditing party as application information, perform identity verification on the applicant based on the user identification at the auditing party, and after passing, forward the application information to a provider, so that the provider performs key generation operation on the signature public key fragment and the user identification based on the elliptic curve, obtains key information of the key application type, and delivers the key information to the auditing party and forwards it to the applicant; the key information includes a declaration public key and a target private key fragment;

[0010] The applicant generates a public-private key pair of the key application type based on the key information; the key application type includes part or all of a signature type and an encryption type.

[0011] In the embodiments of the application, the applicant generates a signature public key fragment based on an elliptic curve set in the SM2 algorithm, sends the key application type, the signature public key fragment and the user identification to an auditing party as application information, performs identity verification on the applicant based on the user identification at the auditing party, and after passing, forwards the application information to a provider, so that the provider performs key generation operation on the signature public key fragment and the user identification based on the elliptic curve, obtains key information of the key application type, and delivers the key information to the auditing party and forwards it to the applicant; the applicant generates a public-private key pair of the key application type based on the key information, wherein the key application type can include part or all of a signature type and an encryption type. The above process introduces an auditing party for identity verification and encrypted information forwarding, so as to guarantee the traceability of encrypted information, reduce the risk of attackers impersonating the applicant to apply for keys, and realize the generation of multiple types of public-private key pairs.

[0012] In some embodiments, the provider obtains the key information of the key application type in the following way:

[0013] determine a user hash value of the applicant based on the coordinates of the provider master public key on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identification;

[0014] generate a private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment;

[0015] generate a declaration public key of the key application type based on the private key intermediate fragment and the base point;

[0016] determine a target private key fragment of the key application type based on the declaration public key, the private key intermediate fragment, the provider master private key and the user hash value.

[0017] In the embodiments of the present application, the provider can generate a private key intermediate fragment of a corresponding type based on the key application type of the applicant, generate a declared public key of the key application type based on the private key intermediate fragment and the base point, and determine a target private key fragment of the key application type based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value. The applicant can obtain the user private key of the key application type by processing the target private key fragment, thereby realizing the generation of multiple types of public and private key pairs.

[0018] In some embodiments, the provider generates the private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment in the following manner:

[0019] performing a random number operation on the provider master private key, the user hash value, the signature public key fragment and the key application type based on a preset random number algorithm to obtain an intermediate random number of the key application type;

[0020] performing a modulo operation on the order of the base point on the elliptic curve using the intermediate random number of the key application type to obtain the private key intermediate fragment of the key application type.

[0021] In the embodiments of the present application, the private key intermediate fragment of the key application type is introduced based on the provider master private key, the user hash value and the signature public key fragment to cooperatively calculate the intermediate random number of the key application type, and then a modulo operation is performed on the order of the base point on the elliptic curve using the intermediate random number to obtain the private key intermediate fragment of the key application type. In this way, the generation of multiple types of private key intermediate fragments is realized, and the generation efficiency and security of the public and private key pairs are improved.

[0022] In some embodiments, the provider generates the declared public key of the key application type based on the private key intermediate fragment and the base point in the following manner:

[0023] adding the product of the private key intermediate fragment of the key application type and the base point to the reference public key fragment associated with the key application type to obtain the declared public key of the key application type;

[0024] The reference public key fragment associated with the signature type is the signature public key fragment; the reference public key fragment associated with the encryption type is an encryption public key fragment; the encryption public key fragment is determined based on the product of an encryption private key fragment and the base point, and the encryption private key fragment is obtained by performing a hash operation on the user identifier and key type information set based on the encryption type using a preset hash algorithm by the provider.

[0025] In the embodiments of the present application, the reference public key fragments corresponding to each key application type are associated, so that the provider can add the product of the private key intermediate fragment of the key application type and the base point to the reference public key fragment associated with the key application type to obtain the declared public key of the key application type. In the above process, the signature public key fragment generated by the applicant is used as the reference public key fragment of the signature type to participate in the operation, and the encryption public key fragment generated by the provider is used as the reference public key fragment of the encryption type to participate in the operation. Since the signature private key fragment for generating the signature public key fragment is calculated by the applicant, the security of the signature type of the company key pair can be ensured. Since the encryption private key fragment for generating the encryption public key fragment is calculated by the provider, the traceability of the encryption public key pair can be ensured.

[0026] In some embodiments, the provider determines the target private key fragment of the key application type based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value in the following manner:

[0027] Determining the public key coordinates of the declared public key of the key application type on the elliptic curve;

[0028] Performing a hash operation on the public key coordinates and the user hash value by using a preset hash algorithm to obtain the public key hash value of the key application type;

[0029] Generating the target private key fragment of the key application type based on the private key intermediate fragment of the key application type, the public key hash value and the provider master private key.

[0030] In the embodiments of the present application, the public key coordinates of the declared public key of the key application type on the elliptic curve and the user hash value are subjected to a hash operation to obtain the public key hash value of the key application type, and the target private key fragment of the key application type is generated based on the private key intermediate fragment of the key application type, the public key hash value and the provider master private key. The above process cooperatively calculates the target private key fragment of each key application type by introducing the key application type, so that the applicant can obtain the user private key of the key application type by processing the target private key fragment, and then generate the public-private key pair of multiple types.

[0031] In some embodiments, the applicant generates the public-private key pair of the key application type based on the key information, which includes:

[0032] Determining the candidate private key based on the target private key fragment of the key application type and the reference private key fragment associated with the key application type. The reference private key fragment associated with the signature type is the signature private key fragment, and the reference private key fragment associated with the encryption type is the encryption private key fragment.

[0033] determining a first comparison public key of the key application type based on the candidate private key and the base point;

[0034] determining a second comparison public key of the key application type based on a public key hash value of the key application type, the provider master public key and a declared public key of the key application type;

[0035] if the first comparison public key is identical to the second comparison public key, taking any one of the first comparison public key and the second comparison public key as a public key of the key application type and taking the candidate private key as a private key of the key application type.

[0036] In the embodiments of the present application, a reference private key fragment corresponding to each key application type is associated, so that the applicant generates a candidate private key of the key application type and a first comparison public key of the key application type based on the reference private key fragment. Thus, the applicant can determine a second comparison public key of the key application type based on a public key hash value of the key application type, the provider master public key and a declared public key of the key application type. If the first comparison public key is identical to the second comparison public key, it means that the current candidate private key can form a public-private key pair of the key application type with any one of the first comparison public key and the second comparison public key, thereby realizing the generation of multiple types of public-private key pairs.

[0037] In some embodiments, the application information further comprises: an authentication ciphertext; the authentication ciphertext is obtained by encrypting an authentication factor by an authentication public key of the applicant;

[0038] The authentication ciphertext is used for decrypting the authentication ciphertext by an authentication private key of the provider after the provider receives the application information forwarded by the auditor. If the authentication factor is obtained by decryption, the step of performing the key generation operation on the signature public key fragment and the user identifier based on the elliptic curve is executed. Otherwise, prompt information representing the failure of the applicant identity verification is sent to the auditor.

[0039] In the embodiments of the present application, the applicant can encrypt the authentication factor by an authentication public key to obtain an authentication ciphertext, and add the authentication ciphertext to the application information, so as to perform authentication encryption verification on the authentication ciphertext by an authentication private key after the provider obtains the application information. If the decryption fails, it means that the applicant's identity is usurped. If the decryption succeeds, the key information is generated based on the application information, thereby realizing the decryption verification of the applicant and improving the data security.

[0040] In a second aspect, the embodiments of the present application further provide a key generation device, comprising:

[0041] The fragment obtaining unit is configured to generate a signature public key fragment by the applicant; the signature public key fragment is obtained by operating a signature private key fragment based on a base point of an elliptic curve, and the elliptic curve is set in an SM2 algorithm;

[0042] The information processing unit is configured to send a key application type, the signature public key fragment and a user identifier as application information to an auditing party, perform identity verification on the applicant based on the user identifier by the auditing party, and forward the application information to a providing party after passing the verification, so that the providing party performs key generation operation on the signature public key fragment and the user identifier based on the elliptic curve to obtain key information of the key application type, and delivers the key information to the auditing party and forwards it to the applicant; the key information includes a declaration public key and a target private key fragment;

[0043] The key generation unit is configured to generate a public-private key pair of the key application type by the applicant based on the key information; the key application type includes part or all of a signature type and an encryption type.

[0044] In some embodiments, the providing party obtains the key information of the key application type in the following manner:

[0045] Determine a user hash value of the applicant based on the coordinates of the main public key of the providing party on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identifier;

[0046] Generate a private key intermediate fragment of the key application type based on the main private key of the providing party, the user hash value and the signature public key fragment;

[0047] Generate a declaration public key of the key application type based on the private key intermediate fragment and the base point;

[0048] Determine a target private key fragment of the key application type based on the declaration public key, the private key intermediate fragment, the main private key of the providing party and the user hash value.

[0049] In some embodiments, the providing party generates the private key intermediate fragment of the key application type based on the main private key of the providing party, the user hash value and the signature public key fragment in the following manner:

[0050] Perform random number operation on the main private key of the providing party, the user hash value, the signature public key fragment and the key application type based on a preset random number algorithm to obtain an intermediate random number of the key application type;

[0051] Perform modulo operation on the order of the base point on the elliptic curve using the intermediate random number of the key application type to obtain the private key intermediate fragment of the key application type.

[0052] In some embodiments, the provider generates the declared public key of the key application type based on the private key intermediate fragment and the base point in the following manner:

[0053] adding a product of the private key intermediate fragment of the key application type and the base point to a reference public key fragment associated with the key application type to obtain the declared public key of the key application type;

[0054] wherein the reference public key fragment associated with the signature type is the signature public key fragment; the reference public key fragment associated with the encryption type is the encryption public key fragment; the encryption public key fragment is determined based on a product of an encryption private key fragment and the base point, and the encryption private key fragment is obtained by the provider performing a hash operation on the user identifier and key type information set based on the encryption type using a preset hash algorithm.

[0055] In some embodiments, the provider determines the target private key fragment of the key application type based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value in the following manner:

[0056] determining a public key coordinate of the declared public key of the key application type on the elliptic curve;

[0057] performing a hash operation on the public key coordinate and the user hash value using a preset hash algorithm to obtain a public key hash value of the key application type;

[0058] generating the target private key fragment of the key application type based on the private key intermediate fragment of the key application type, the public key hash value and the provider master private key.

[0059] In some embodiments, the key generation unit is specifically configured to perform the following based on the key information:

[0060] determining a candidate private key based on the target private key fragment of the key application type and a reference private key fragment associated with the key application type; wherein the reference private key fragment associated with the signature type is the signature private key fragment; the reference private key fragment associated with the encryption type is the encryption private key fragment;

[0061] determining a first comparison public key of the key application type based on the candidate private key and the base point;

[0062] determining a second comparison public key of the key application type based on the public key hash value of the key application type, the provider master public key and the declared public key of the key application type;

[0063] If the first comparison public key and the second comparison public key are the same, then either of the first comparison public key and the second comparison public key is taken as the public key of the key application type, and the candidate private key is taken as the private key of the key application type.

[0064] In some embodiments, the application information further comprises: an authentication ciphertext; the authentication ciphertext is obtained by encrypting an authentication factor by an authentication public key of the providing party;

[0065] The authentication ciphertext is used for decrypting the authentication ciphertext by an authentication private key after the providing party receives the application information forwarded by the auditing party, and if the authentication factor is obtained by decryption, the step of performing the key generation operation on the signature public key fragment and the user identifier based on the elliptic curve is executed; otherwise, prompt information representing that the identity verification of the application party fails is sent to the auditing party.

[0066] In a third aspect, an embodiment of the present application provides an electronic device, comprising:

[0067] a memory configured to store program instructions;

[0068] a processor configured to invoke the program instructions stored in the memory, and perform the steps included in the method according to the obtained program instructions.

[0069] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program comprises program instructions, and the program instructions, when executed by a computer, cause the computer to execute the method according to any one of the first aspect.

[0070] In a fifth aspect, an embodiment of the present application provides a computer program product, which comprises computer program codes, and the computer program codes, when executed on a computer, cause the computer to execute the method according to any one of the first aspect.

[0071] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and attained by means of the instrumentalities particularly pointed out in the written description and claims hereof, and the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0072] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments description will be briefly introduced. Obviously, the drawings in the following description only represent some of the embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor.

[0073] Figure 1 The timing diagram of the certificateless and implicit certificate public key mechanism based on the SM2 algorithm provided for the embodiments of the present application;

[0074] Figure 2 The timing diagram of the key generated by the applicant, the reviewer and the provider in cooperation provided for the embodiments of the present application;

[0075] Figure 3 The timing diagram of the key generation method provided for the embodiments of the present application;

[0076] Figure 4 The structural schematic diagram of the key generation device provided for the embodiments of the present application;

[0077] Figure 5 The structural schematic diagram of the electronic device provided for the embodiments of the present application. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solutions and advantages of the present application more clear, the present application will be further described in detail below with the drawings. Obviously, the described embodiments only represent some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0079] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. The implementation described in the following exemplary embodiments does not represent all the implementations consistent with the present application. On the contrary, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0080] In order to facilitate the understanding of the technical solutions provided by the present application, the technical background of the present application will be described in detail as follows:

[0081] "Certificateless and Implicit Certificate Public Key Mechanisms Based on SM2 Algorithm" is an asymmetric cryptography application standard released by the State Cryptography Administration. It involves two roles: the applicant (also known as the user) and the provider (also known as the Key Generation Center, KGC). The KGC can collaborate with the user to generate public and private key pairs. Implementation details are as follows: Figure 1 As shown, it includes the following steps:

[0082] Step 101: The user terminal uses a random number generator to generate a random number d′. A ∈[1,n-1];

[0083] Where G is the base point of the elliptic curve defined in the SM2 algorithm, and n is the order of G on the elliptic curve.

[0084] Step 102: The user terminal calculates the public key fragment U A =[d′ A G;

[0085] Step 103: The client submits the identifier ID to KGC. A and U A ;

[0086] Step 104: KGC calculates the first hash value H A =H 256 (ENTL A ∥ID A ∥a∥b∥x G ∥y G ∥x Pub ∥y Pub );

[0087] Among them, ENTL A It is the number of bits in two bytes converted from the integer entlenA; a and b are the elliptic curve equation parameters specified in the SM2 algorithm; x G and y G Let x be the x and y coordinates of the base point G on the elliptic curve; Pub and y Pub For the system master public key P pub The horizontal and vertical coordinates on the elliptic curve.

[0088] Step 105: KGC uses a random number generator to generate random numbers w∈[1,n-1];

[0089] Step 106: KGC calculates the public key W declared. A =[w]G+U A ;

[0090] Step 107: KGC calculates the second hash value λ = H 256 (x WA ∥yWA ||H A ) mod n;

[0091] Step 108: KGC calculates the private key fragment t A = (w + λ * m s ) mod n; wherein m s is the system master private key of KGC;

[0092] Step 109: KGC issues t A and W A to the user end;

[0093] Step 110: the user end calculates the private key d A = (t A + d' A ) mod n;

[0094] Step 111: if 0 < dA < n-1, then d A is taken as the private key of the current application, and P A = [d A ]G is taken as the public key of the current application; otherwise, return to step 101 to reapply.

[0095] In the above process, the application and issuance of the public-private key pair are completed by interaction between the user end and KGC, lacking third-party supervision, which is not conducive to the traceability of encrypted information, which leads to the fact that the mechanism can only support the generation of signature public-private key pairs. For example, the generation of encryption type public-private key pairs requires that the encrypted data participating in key generation must have information traceability, and the mechanism cannot meet the generation of such public-private key pairs. Moreover, the KGC in the mechanism cannot identify the identity of the user end, and there is a risk that an attacker may impersonate the identity of the user end to apply for a key.

[0096] To solve the above problems, the inventive concept of the present application is: the applicant generates a signature public key fragment based on the elliptic curve set in the SM2 algorithm, sends the key application type, the signature public key fragment and the user identification to the reviewer as application information, after the reviewer completes the identity verification of the applicant based on the user identification, forwards the application information to the provider, so that the provider performs key generation operation on the signature public key fragment and the user identification based on the elliptic curve to obtain the key information of the key application type, and transfers the key information to the reviewer and forwards it to the applicant; the applicant generates a public-private key pair of the key application type based on the key information, and the key application type can include part or all of the signature type and the encryption type. The above process introduces a reviewer for identity verification and encrypted information forwarding to ensure the traceability of encrypted information, reduce the risk of an attacker impersonating the identity of the applicant to apply for a key, and at the same time realize the generation of multiple types of public-private key pairs.

[0097] In the key generation method provided in this application, a new role of the auditing party is introduced, based on the user terminal and KGC in the aforementioned "Certificateless and Implicit Certificate Public Key Mechanism Based on SM2 Algorithm". In some embodiments, the Registration Authority (RA) can be used as the auditing party. The auditing party is mainly used to authenticate the user terminal in the key generation process, and to forward and store the application information submitted by the user terminal and the key information issued by the KGC.

[0098] Figure 2 The example illustrates the steps involved in the collaborative execution of a key generation process by the applicant (user), the approver (RA), and the provider (KGC), such as... Figure 2 As shown, the following steps may be included:

[0099] Step 201: The user submits the key application information to the RA;

[0100] Step 202: The RA verifies the user's identity and forwards the application information to the KGC after the verification is successful;

[0101] Step 203: KGC generates key information based on the application information and sends it to RA;

[0102] Step 204: The RA verifies the key information and forwards it to the user terminal after successful verification.

[0103] Step 205: The user terminal generates the public-private key pair for this application based on the key information.

[0104] To facilitate understanding, the following will be combined with Figure 3 The specific implementation process of steps 201 to 205 is explained below:

[0105] Figure 2 Step 201 shown: The user submits key application information to the RA, which can correspond to... Figure 3 Steps 301 to 302 are shown below;

[0106] Step 301: The user generates a public key fragment for signing;

[0107] In some embodiments, the user terminal can connect the base point G of the elliptic curve set in the SM2 algorithm with the signature private key fragment d. S The product of * is used as the signature public key fragment P. S *=[d S *]G;

[0108] In some embodiments, the private key fragment d is signed. S* is a random number generated by the user terminal in the interval [1, n-1]; wherein, n is the order of the base point G on the elliptic curve.

[0109] Step 302: The user terminal sends the key application type, user identification, personal registration information, authentication ciphertext and signature public key fragment to the RA as application information.

[0110] The key application type can include part or all of the signature type T S and the encryption type T E , and the user identification ID can represent the identification desired to be registered by the user terminal.

[0111] In some embodiments, the user terminal can agree with the RA in advance on the registration information required for identity verification, which should include the user identification ID, and on this basis, some personal registration information Inf of the user terminal based on actual needs can be added, such as a user name, a network address, etc.

[0112] Figure 2 Step 202: The RA performs identity verification on the user terminal, and after the verification is passed, the application information is forwarded to the KGC, which can correspond to Figure 3 Steps 303-305.

[0113] Step 303: The RA performs identity verification on the user terminal through the user identification and personal registration information.

[0114] Step 304: If the verification fails, the RA sends prompt information representing the identity verification failure to the user terminal.

[0115] Step 305: If the verification is successful, the RA forwards the application information to the KGC.

[0116] In implementation, the RA can perform identity verification on the user identification ID and personal registration information Inf of the user terminal, and after the verification is passed, the application information uploaded by the user terminal is forwarded to the KGC. Considering that the personal registration information Inf does not need to participate in subsequent key generation, the remaining information in the application information except the personal registration information Inf can be forwarded to the KGC after the verification is passed.

[0117] In some embodiments, the RA can also add validity verification information in step 304, which is used to set the validity of the application information. When the KGC receives the application information, the validity verification information can be verified. If the verification fails, it means that the application information is invalid, at which time the RA can be informed that the validity of the application information is invalid, and the subsequent key generation process is stopped.

[0118] Figure 2 Step 203: The KGC generates key information based on the application information and sends it to the RA, which can correspond to Figure 3Steps 306-312 are shown;

[0119] Step 306: The KGC decrypts the authentication ciphertext using the authentication private key;

[0120] Step 307: If the decryption fails, a prompt message indicating the decryption failure is sent to the RA;

[0121] Corresponding to the authentication ciphertext carried by the application information in the aforementioned step 302, the user end can encrypt the authentication factor r using the authentication public key of the KGC to obtain authentication ciphertext r*, which is used for the KGC to perform authentication encryption verification on the application information of the user end. The specific plaintext content of the authentication factor r can be agreed by the user end and the KGC in advance, or can be set by the user end itself, and the present application does not limit this.

[0122] Step 308: If the decryption is successful, the user hash value is determined based on the coordinates of the provider master public key on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identifier;

[0123] In implementation, the KGC can calculate the user hash value h = H 256 (ENTL||ID||a||b||x G ||y G ||x Pub ||y Pub );

[0124] Wherein, H 256 is a hash function with an output hash value of 256 bits, for example, an SM3 hash function; a and b are elliptic curve equation parameters set in the SM2 algorithm; x G and y G are the horizontal and vertical axis coordinates of the base point G on the elliptic curve; x Pub and y Pub are the horizontal and vertical axis coordinates of the provider master public key P Pub on the elliptic curve, which can be converted into a bit string form and then substituted into the calculation in the manner given in sections 4.2.5 and 4.2.6 of the national standard GB / T 32918.1-2016; ENTL is two bytes converted from the bit length entl of the user identifier ID using the big-endian representation, which can be converted in the manner of section 5.4 of the national standard GM / T0130-2023.

[0125] Step 309: Based on the provider master private key, the user hash value, and the signature public key fragment, generate the private key intermediate fragment of the key application type;

[0126] As mentioned earlier, the key generation algorithm of the embodiments of the present application supports the generation of multiple types of keys, and the key application type can specifically include the signature type T s and the encryption type TE Part or all of it.

[0127] During implementation, KGC can use a preset random number algorithm to generate a random number for the provider's master private key m. S User hash value h, signature public key fragment P S * Perform random number operations on the key request type to obtain an intermediate random number for that key request type; then, use the intermediate random number of the key request type to perform a modulo operation on the order n of the base point G on the elliptic curve to obtain an intermediate fragment of the private key for the key request type.

[0128] To facilitate understanding, the following sections will explain how to solve for the signature type T using the above process. s and encryption type T E Explanation of the fragments of each private key:

[0129] For signature type T S Private key fragment w S : Calculate w S =DRBG(m S ,h,P S *||T S bitlen WS )mod n;

[0130] DRBG is a deterministic random number generator that runs a preset random number algorithm; m S The provider's master private key; h is the user's hash value; P S * represents the signature public key fragment; n is the order of the base point G on the elliptic curve; bitlen WS For w S The bit length is n; mod is the modulo operation; DRBG(m S ,h,P S *||T S bitlen WS For T s An intermediate random number of type.

[0131] For encryption type T E Private key fragment w E : Calculate w E =DRBG(m S ,h,P S *||T E bitlen WE )mod n;

[0132] Among them, bitlen WE For w E The bit length, taking the value n; DRBG(m S ,h,PS ||T E bitlen WE ) is the intermediate random number of type T E .

[0133] Step 310: generating a declared public key of the key application type based on the private key intermediate fragment and the base point;

[0134] In implementation, the KGC can add the product of the private key intermediate fragment of the key application type and the base point to the reference public key fragment associated with the key application type to obtain the declared public key of the key application type; wherein the reference public key fragment associated with the signature type is the signature public key fragment; the reference public key fragment associated with the encryption type is the encryption public key fragment; the encryption public key fragment is determined based on the product of the encryption private key fragment and the base point, and the encryption private key fragment is obtained by the provider performing a hash operation on the user identifier and the key type information set based on the encryption type by using a preset hash algorithm.

[0135] For the convenience of understanding, the following explains how to solve the private declared public key of the signature type T s and the encryption type T E respectively by using the above-mentioned flow:

[0136] For the declared public key Ws of the signature type T S : calculate W S =[w S ]G+P S *; wherein the signature public key fragment P S * is the reference public key fragment of type T s .

[0137] For the declared public key W E of the encryption type T E : perform a hash operation on the user identifier ID and the key type information set based on the encryption type by using a preset hash algorithm to obtain the encryption private key fragment d E * = H 256 (ID||Ext) mod n; wherein Ext is the key type information set based on the encryption type, for example, information containing the public-private key pair of the key type applied by the user end. Then determine the encryption public key fragment P E * = [d E *]G based on the product of the encryption private key fragment and the base point, P E * is the reference public key fragment of type T E . Finally, calculate the declared public key W E =[w E ]G+P E *.

[0138] Step 311: Based on the declared public key, private key intermediate fragment, provider's master private key, and user hash value, determine the target private key fragment for this key request type;

[0139] During implementation, the public key coordinates of the declared public key of the key request type on the elliptic curve are determined; then, a preset hash algorithm is used to perform a hash operation on the public key coordinates and the user hash value to obtain the public key hash value of the key request type; then, based on the private key intermediate fragment of the key request type, the public key hash value, and the provider's master private key, the target private key fragment of the key request type is generated.

[0140] To facilitate understanding, the following sections will explain how to solve for the signature type T using the above process. S and encryption type T E Explanation of each private key fragment for their respective private target:

[0141] For signature type T S Target private key fragment t S Calculate T S The public key hash value λ corresponding to the type S =H 256 (x WS ||y WS ||h)mod n, then calculate t S =(w S +λ S ·m S )mod n;

[0142] Where, x WS and y WS T represents respectively S The public key W of the type declaration S The horizontal and vertical coordinates on the elliptic curve can be converted into bit strings using the methods given in sections 4.2.5 and 4.2.6 of the national cryptographic standard GB / T 32918.1-2016, and then substituted into the calculation.

[0143] For encryption type T E Target private key fragment t E Calculate T E The public key hash value λ corresponding to the type E =H 256 (x WE ||y WE ||h)mod n, then calculate t E =(w E +λ E ·m S )mod n;

[0144] Where, x WE and y WET E the declaration public key W E The horizontal and vertical axis coordinates on the elliptic curve can be converted into a bit string and then substituted into the calculation, for example, in the manner given in Sections 4.2.5 and 4.2.6 of the national standard GB / T 32918.1-2016.

[0145] Step 312: The declaration public key of the key application type and the target private key fragment are sent to the RA as key information.

[0146] To improve data security, the target private key fragment can be set with a corresponding private key fragment validity period during implementation.

[0147] If the key application type is the signature type T S , the T S type declaration public key W S , the target private key fragment t S , and the corresponding private key fragment validity period V S are taken as the key information.

[0148] If the key application type is the signature type T E , the T E type declaration public key W E , the target private key fragment t E , and the corresponding private key fragment validity period V E are taken as the key information.

[0149] If the key application type contains both the above two types, the key information of the T S type and the T E type can be generated through the above process, and then sent to the RA together.

[0150] Figure 2 Step 204: The RA verifies the signature of the key information, and forwards the key information to the user end after the verification is passed. The corresponding steps 313-315 can be performed. Figure 3

[0151] Step 313: The RA verifies the signature of the key information using the verification public key.

[0152] Step 314: If the verification fails, the RA sends prompt information to the KGC indicating that the key information verification has failed.

[0153] Step 315: If the verification is successful, the RA sends the key information to the user end.

[0154] ​In some embodiments, the RA and KGC may pre-agree on a signature verification process. The KGC can sign the data that needs to be forwarded by the RA, and then the RA can verify the signature. If the signature verification is successful, the data is forwarded to the user terminal, thereby improving data security.

[0155] Figure 2 Step 205: The user terminal generates the public-private key pair for this application based on the key information, which can correspond to... Figure 3 Steps 316 to 319 are shown;

[0156] Step 316: The client determines the candidate private key based on the target private key fragment and the reference private key fragment associated with the key application type;

[0157] Step 317: The user terminal determines the first comparison public key for this key application type based on the candidate private key and the base point;

[0158] Step 318: The user terminal determines the second comparison public key for the key request type based on the public key hash value of the key request type, the provider's master public key, and the declaration public key of the key request type;

[0159] Step 319: If the first comparison public key is the same as the second comparison public key, then use either the first comparison public key or the second comparison public key as the public key of the key request type, and use the candidate private key as the private key of the key request type.

[0160] As mentioned earlier, the key generation algorithm in this application supports the generation of multiple key types. Specifically, the key request type may include signature type Ts and encryption type T. E This refers to part or all of the information provided. To facilitate understanding of how the user client generates the public-private key pair for this application based on the key information, subsequent steps 316-319 explain how the user client generates two types of public-private key pairs:

[0161] If the key request type is signature type T S The user client can use the signature private key fragment d mentioned in step 301 above. S *This serves as a reference private key fragment associated with this type.

[0162] Then, obtain the target private key fragment t from the key information issued by KGC. S * and based on the target private key fragment t S * and reference private key fragment d S * Calculate the candidate private key d WS =(t S +d S *)mod n. To improve data security, KGC can use the authentication public key pair as the target private key fragment t. S* Encryption is performed, and the user terminal extracts the target private key fragment t from the key information. S *At this time, decryption using the authentication private key is required beforehand. If decryption fails, it indicates an error in the authentication encryption verification, signifying a failure in key generation and ending the key generation process. Furthermore, if the private key fragment obtained by the user from the key information has a validity period of V... S Failure indicates that the key generation process has failed and ends.

[0163] Next, based on the candidate private key d WS Calculate T with base point G S The first comparison of the public key P of type P WS =[d WS ]G.

[0164] Then use the T mentioned in step 311 above. s Type corresponds to public key hash value λ S The calculation method for λ S =H 256 (x WS ||y WS ||h)mod n.

[0165] Based on T s public key hash value λ of type S Provider's public key P pub And T S The public key W of the type declaration S Calculate T S The second comparison public key P of type P WS *=W S +[λ S ]P pub .

[0166] If P WS =P WS If they are the same, then P will be... WS or P WE *Use this as the public key for the signature type of this application, and d WS The private key is used as the signature type for this application. Otherwise, the public-private key pair representing this application is unavailable and a new application can be submitted.

[0167] If the key request type is signature type T E The user client can use the KGC's encrypted private key fragment d mentioned in step 310 above. E *This serves as a reference private key fragment associated with this type.

[0168] Then, obtain the target private key fragment t from the key information issued by KGC. E * and based on the target private key fragment t Eand the reference private key fragment d E *is calculated WE = (t E + d E ) mod n. To improve data security, the KGC should use the authentication public key pair to encrypt the target private key fragment t E *for the user to decrypt using the authentication private key when extracting the target private key fragment t E *from the key information. If the decryption fails, it indicates that the authentication encryption verification is incorrect, and the key generation process for this time is ended. In addition, if the validity period V E of the private key fragment obtained by the user from the key information is invalid, it also indicates that the key generation for this time fails and the key generation process for this time is ended.

[0169] Next, based on the candidate private key d WE and the base point G, the first comparison public key P E of type T WE = [d WE ]G is calculated.

[0170] Then, the calculation method of the public key hash value λ E of type T E mentioned in step 311 is used to calculate λ E = H 256 (x WE || y WE || h) mod n.

[0171] Then, based on the public key hash value λ E of type T E , the provider master public key P pub and the declared public key W E of type T E , the second comparison public key P E *of type T WE = W E + [λ E ]P pub is calculated.

[0172] If P WE = P WE *, then P WE or P WE *is used as the public key of the encryption type for this application, and d WE is used as the private key of the encryption type for this application. Otherwise, it indicates that the public and private key pair for this application is not available, and can be re-applied.

[0173] Further, for the aforementioned determination of the deterministic random number generator DRBG for generating the private key intermediate fragments at step 309, the internal state can include: V: a byte type with a length of seedlen bits = 440 bits; C: a byte type with a length of seedlen bits = 440 bits of state data.

[0174] In some embodiments, the DRBG can generate a random number by executing the following function: requested_bits = DRBG(sk_input, personalization_string, additional_input, requested_number_of_bits); which functions as a deterministic random number generator based on a HASH algorithm.

[0175] In particular implementation, working_state = Hash_DRBG_Instantiate_algorithm(sk_input, NULL, personalization_string) can be executed, and then returned_bits = Hash_DRBG_Generate_algorithm(working_state, requested_number_of_bits, additional_input) can be executed, thereby returning the generated random number returned_bits.

[0176] Wherein, sk_input represents the input key information; personalization_string represents a preset personalized string; additional_input represents an optional parameter, additional information; requested_number_of_bits represents the requested number of bits; returned_bits represents the return data of the above function, i.e., the generated random number.

[0177] In some embodiments, the DRBG can be initialized by executing the following function: initial_working_state = Hash_DRBG_Instantiate_algorithm(sk_input, nonce, personalization_string), which functions as a Hash DRBG instantiation function.

[0178] In implementation, the entropy_input, nonce and personalization_string can be spliced to obtain seed material data seed_material = entropy_input || nonce || personalization_string; seed data seed = Hash_df(seed_material, seedlen) is calculated; V = seed and C = Hash_df((0x00 || V), seedlen) are further calculated, and thus working state information composed of (V, C) is returned. The nonce represents one-time input data; the initial_working_state represents the return data of the above function, and is working state information recording the V and C parameters.

[0179] In some embodiments, the generation function of the DRBG returned_bits = Hash_DRBG_Generate_algorithm(working_state, requested_number_of_bits, additional_input) has the function of generating random bits based on the Hash DRBG;

[0180] In implementation, if the additional_input is a non-empty string, a hash value w = Hash(0x02 || V || additional_input) is calculated, Hash represents the SM3 algorithm, then V = (V + w) mod 2seedlen is updated, and seedlen can be 440. Then, returned_bits = Hashgen(requested_number_of_bits, V) is calculated and returned. The working_state represents the input working state; the returned_bits represents the return data of the above function, that is, the number of generated random bits.

[0181] In some embodiments, the Hash_df function of the DRBG (status, requested_bits) = Hash_df(input_string, no_of_bits_to_return) has the function of a derivation function based on the HASH algorithm.

[0182] In implementation, the temporary data string is first initialized as NULL, i.e., temp = NULL, then the number of groups where outlen represents the output bit length of the Hash function, and here SM3 algorithm is used with an output length of 256 bits. Then an 8-bit integer counter is initialized as counter = 0x01.

[0183] The hash value is iteratively calculated and the temporary data string temp = temp || Hash(counter || no_of_bits_to_return || input_string) is updated, where counter and no_of_bits_to_return are strings represented in big-endian with 8 and 32 bits, respectively. Then the counter is updated as counter = counter + 1, and the bit string data returned requested_bits = leftmost(temp, no_of_bits_to_return) is obtained by intercepting the high bits. Here, leftmost(s, n) represents intercepting the high bits (left side) of the bit string s with n bits, and returns requested_bits. Here, input_string represents the input data to be hashed, and no_of_bits_to_return represents the expected length of the returned data.

[0184] In some embodiments, the Hashgen function of the DRBG returned_bits = Hashgen(requested_no_of_bits, V) is a derivative function of the Hash DRBG data.

[0185] In specific implementation, the number of groups is first calculated as outlen is the output bit length of the HASH function, and here SM3 algorithm is used with an output length of 256 bits. Then a seedlen-bit (i.e., 440-bit) byte-type data = V is initialized, and a temporary data string W = NULL is initialized. Then returned_bits is returned by the following way: w = Hash(data) is calculated, W = W || w is updated, and data = (data + 1) mod 2seedlen. The bit string data returned returned_bits = leftmost(W, requested_no_of_bits) is obtained by intercepting the high bits. Here, leftmost(s, n) represents intercepting the high bits (left side) of the bit string s with n bits, requested_no_of_bits represents the input requested number of bits, V represents the V information in the Hash DRBG working state, and returned_bits represents the returned data of the above function, i.e., the generated random bit quantity.

[0186] Through the above setting, the execution efficiency is improved when the embodiment of the application generates random numbers by using the deterministic random number generator DRBG, the key-related information is convenient for later backtracking, and the storage amount of the decryption private key is reduced. From the perspective of operation, compared with using the nondeterministic random number generator to participate in key generation, a set of data can be stored.

[0187] Based on the same inventive concept, the embodiment of the application also provides a key generation device, the structure of which can be as shown in Figure 4

[0188] The fragment obtaining unit 401 is configured to generate a signature public key fragment by the applicant; the signature public key fragment is obtained by operating a signature private key fragment based on a base point of an elliptic curve, and the elliptic curve is set in an SM2 algorithm;

[0189] The information processing unit 402 is configured to send the key application type, the signature public key fragment, and the user identifier to the auditing party as application information, perform identity verification on the applicant based on the user identifier at the auditing party, and after passing, forward the application information to the provider, so that the provider performs key generation operation on the signature public key fragment and the user identifier based on the elliptic curve to obtain key information of the key application type, and delivers the key information to the auditing party and forwards it to the applicant; the key information includes a declaration public key and a target private key fragment;

[0190] The key generation unit 403 is configured to generate a public-private key pair of the key application type by the applicant based on the key information; the key application type includes part or all of the signature type and the encryption type.

[0191] In some embodiments, the provider obtains the key information of the key application type in the following way:

[0192] Based on the coordinates of the provider's master public key on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identifier, determine the user hash value of the applicant;

[0193] Based on the provider's master private key, the user hash value, and the signature public key fragment, generate a private key intermediate fragment of the key application type;

[0194] Based on the private key intermediate fragment and the base point, generate a declaration public key of the key application type;

[0195] Based on the declaration public key, the private key intermediate fragment, the provider's master private key, and the user hash value, determine a target private key fragment of the key application type.

[0196] ​In some embodiments, the provider generates the private key intermediate fragment of the key application type based on the provider master private key, the user hash value and the signature public key fragment in the following manner:

[0197] performing a random number operation on the provider master private key, the user hash value, the signature public key fragment and the key application type based on a preset random number algorithm to obtain an intermediate random number of the key application type;

[0198] performing a modulo operation on the order of the base point on the elliptic curve using the intermediate random number of the key application type to obtain the private key intermediate fragment of the key application type.

[0199] In some embodiments, the provider generates the declared public key of the key application type based on the private key intermediate fragment and the base point in the following manner:

[0200] adding the product of the private key intermediate fragment of the key application type and the base point to the reference public key fragment associated with the key application type to obtain the declared public key of the key application type;

[0201] wherein the signature type-associated reference public key fragment is the signature public key fragment; the encryption type-associated reference public key fragment is an encryption public key fragment; the encryption public key fragment is determined based on the product of an encryption private key fragment and the base point, and the encryption private key fragment is obtained by the provider performing a hash operation on the user identifier and key type information set based on the encryption type using a preset hash algorithm.

[0202] In some embodiments, the provider determines the target private key fragment of the key application type based on the declared public key, the private key intermediate fragment, the provider master private key and the user hash value in the following manner:

[0203] determining the public key coordinates of the declared public key of the key application type on the elliptic curve;

[0204] performing a hash operation on the public key coordinates and the user hash value using a preset hash algorithm to obtain a public key hash value of the key application type;

[0205] generating the target private key fragment of the key application type based on the private key intermediate fragment, the public key hash value and the provider master private key.

[0206] In some embodiments, the key generation unit 403 is specifically configured to perform the following operations:

[0207] determine a candidate private key based on the target private key shard of the key application type and a reference private key shard associated with the key application type, wherein the reference private key shard associated with the signature type is the signature private key shard, and the reference private key shard associated with the encryption type is the encryption private key shard;

[0208] determine a first comparison public key of the key application type based on the candidate private key and the base point;

[0209] determine a second comparison public key of the key application type based on a public key hash value of the key application type, the provider master public key, and a declared public key of the key application type;

[0210] if the first comparison public key is identical to the second comparison public key, take any one of the first comparison public key and the second comparison public key as the public key of the key application type, and take the candidate private key as the private key of the key application type.

[0211] In some embodiments, the application information further includes an authentication ciphertext, and the authentication ciphertext is obtained by encrypting an authentication factor by the authentication public key of the provider;

[0212] The authentication ciphertext is used for decrypting the authentication ciphertext by the authentication private key of the provider after the provider receives the application information forwarded by the auditor, and if the authentication factor is obtained by decryption, the step of performing the key generation operation on the signature public key shard and the user identifier based on the elliptic curve is executed; otherwise, sending prompt information representing the identity verification failure of the applicant to the auditor.

[0213] Based on the same inventive concept, the embodiments of the present application further provide an electronic device 530 for executing the key generation method described above. The structure can be as shown in Figure 5 It should be understood that, Figure 5 The electronic device 530 shown in

[0214] As shown in Figure 5 The electronic device 530 is in the form of a general electronic device. The components of the electronic device 530 can include but are not limited to the at least one processor 531 described above, the at least one memory 532 described above, and the bus 533 connecting different system components including the memory 532 and the processor 531.

[0215] The bus 533 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor or a local bus using any of a variety of bus structures.

[0216] The memory 532 can include a readable medium in the form of volatile memory, such as random access memory (RAM) 5321 and / or cache memory 5322, and can further include read only memory (ROM) 5323.

[0217] The memory 532 can also include a program / utility 5325 having a set of programs / modules 5324, including an operating system, one or more application programs, other program modules, and program data, each of which or a combination thereof, can include implementation of a network environment as in each of these examples or some combination thereof.

[0218] The electronic device 530 can also communicate with one or more external devices 534 such as a keyboard or a pointing device, and can communicate with one or more devices that enable a user to interact with the electronic device 530. Additionally, the electronic device 530 can communicate with one or more devices that enable the electronic device 530 to communicate with one or more other electronic devices. Such communication can be via an input / output (I / O) interface 535. Further, the electronic device 530 can communicate with one or more networks such as a local area network (LAN), a wide area network (WAN), and / or the Internet through a network adapter 536. As depicted, the network adapter 536 is in communication with the other components of the electronic device 530 through the bus 533. It should be appreciated that other hardware and / or software modules can be used in conjunction with the electronic device 530, such as microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.

[0219] In some embodiments, a computer readable storage medium is also provided, including the memory 532 including instructions, which can be executed by the processor 531 of the above-mentioned device to complete the above-mentioned method. Alternatively, the computer readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0220] In some embodiments, a computer program product is also provided, including computer programs / instructions, which are executed by the processor 531 to implement any one of the key generation methods provided in the present application.

[0221] In some embodiments, each aspect of the key generation method provided in the present application can also be implemented in the form of a program product, which includes program codes, when the program product is run on a computer device, the program codes are used to make the computer device execute the steps of the key generation method according to various exemplary embodiments of the present application described above in the specification.

[0222] The program product for key generation of the embodiments of the present application can employ any combination of one or more computer readable media. The computer readable media can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium can, for example, be— but is not limited to— an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0223] The program product for key generation of the embodiments of the present application can employ a portable compact disc read-only memory (CD-ROM) and include a program code, and can be run on an electronic device. However, the program product of the present application is not limited thereto, and in the present document, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0224] The computer readable signal medium can include a computer readable program code in a baseband or propagated as a carrier wave in a propagation medium. Such a propagated computer readable signal medium can take a variety of forms, including— but not limited to— electro-magnetic, optical, or any suitable combination thereof. The computer readable signal medium can also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0225] The program code contained on the computer readable medium can be transmitted using any suitable medium, including— but not limited to— wireless, wired, optical fiber, RF, etc., or any suitable combination of the foregoing.

[0226] The program code may, through the use of program components, be implemented in any of various ways, including procedure-based execution, object-oriented execution, and / or virtual machine-based execution. A program component or other component may, for example, be implemented in hardware or software in combination with off-the-shelf components, or custom components. Additionally or alternatively, the program code may be implemented in transitory or non-transitory forms.

[0227] It should be noted that, although the above detailed description refers to several units or sub-units of the apparatus, such a division is merely illustrative and not mandatory. Indeed, according to an embodiment of the application, features and functions of two or more units described above can be embodied in one unit. Conversely, features and functions of one unit described above can be split into several units.

[0228] Moreover, while operations of the methods of the present application are described in a particular order in the figures, this is not required or implied in any particular order for performing the operations to achieve the desired results. Additionally or alternatively, certain steps can be omitted, combined into fewer steps, and / or split into multiple steps.

[0229] Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, and the like) embodying computer readable program code.

[0230] The computer program instructions can also be loaded onto a computer or other programmable image processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0231] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable image processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0232] The computer program instructions can also be loaded onto a computer or other programmable image processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks Figure 1 one or more flow or blocks

[0233] While the preferred embodiments of the application have been described, additional variations and modifications can be made to the embodiments described and shown, and it is therefore intended that the application cover any and all variations of the preferred embodiments which fall within the scope of the application. Accordingly, the appended claims are intended to cover all such modifications and variations as falling within the scope of the application.

[0234] It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the scope or spirit of the application. Thus, it is intended that the present application cover the modifications and variations of this application provided they come within the scope of the appended claims and their equivalents.

Claims

1. A key generation method, characterized in that, The method includes: The applicant generates a signature public key fragment; the signature public key fragment is obtained by operating on the signature private key fragment based on the base points of an elliptic curve, and the elliptic curve is defined in the SM2 algorithm; The key request type, the signature public key fragment, and the user identifier are sent as application information to the reviewer. The reviewer verifies the applicant's identity based on the user identifier and, upon successful verification, forwards the application information to the provider, enabling the provider to obtain the key information of the key request type. The key information is then given to the reviewer and forwarded to the applicant. The key information includes: a declared public key and a target private key fragment. The applicant generates a public-private key pair for the key application type based on the key information; the key application type includes some or all of the signature type and encryption type. The provider obtains the key information for the key request type in the following manner: Based on the coordinates of the provider's master public key on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identifier, the user hash value of the applicant is determined; Based on the provider's master private key, the user's hash value, and the signature public key fragment, generate the private key intermediate fragment for the key request type; The product of the intermediate private key fragment of the key request type and the base point is added to the reference public key fragment associated with the key request type to obtain the declaration public key of the key request type; wherein, the reference public key fragment associated with the signature type is the signature public key fragment; the reference public key fragment associated with the encryption type is the encryption public key fragment; the encryption public key fragment is determined based on the product of the encryption private key fragment and the base point, and the encryption private key fragment is obtained by the provider using a preset hash algorithm to perform a hash operation on the user identifier and the key type information set based on the encryption type; Based on the declared public key, the intermediate private key fragment, the provider's master private key, and the user's hash value, the target private key fragment for the key request type is determined.

2. The method according to claim 1, characterized in that, The provider generates the intermediate private key fragment for the key request type based on the provider's master private key, the user hash value, and the signature public key fragment, in the following manner: Based on a preset random number algorithm, random number operations are performed on the provider's master private key, the user hash value, the signature public key fragment, and the key request type to obtain an intermediate random number for the key request type. Using the intermediate random number of the key request type, perform a modulo operation on the order of the base point on the elliptic curve to obtain the intermediate fragment of the private key of the key request type.

3. The method according to claim 1, characterized in that, The provider determines the target private key fragment for the key request type based on the declared public key, the intermediate private key fragment, the provider's master private key, and the user hash value in the following manner: Determine the public key coordinates of the declared public key of the key request type on the elliptic curve; A preset hash algorithm is used to perform a hash operation on the public key coordinates and the user hash value to obtain the public key hash value of the key request type; Based on the private key intermediate fragment of the key request type, the public key hash value, and the provider's master private key, generate the target private key fragment of the key request type.

4. The method according to claim 3, characterized in that, The applicant generates a public-private key pair for the key application type based on the key information, including: Based on the target private key fragment of the key request type and the reference private key fragment associated with the key request type, a candidate private key is determined; wherein, the reference private key fragment associated with the signature type is the signature private key fragment; and the reference private key fragment associated with the encryption type is the encryption private key fragment. Based on the candidate private key and the base point, determine the first comparison public key for the key request type; Based on the public key hash value of the key request type, the provider's master public key, and the declaration public key of the key request type, determine the second comparison public key of the key request type; If the first comparison public key is the same as the second comparison public key, then either the first comparison public key or the second comparison public key is used as the public key of the key application type, and the candidate private key is used as the private key of the key application type.

5. The method according to any one of claims 1-4, characterized in that, The application information also includes: authentication ciphertext; the authentication ciphertext is obtained by the applicant encrypting the authentication factor using the provider's authentication public key; The authentication ciphertext is used by the provider to decrypt the authentication ciphertext using the authentication private key after receiving the application information forwarded by the reviewer. If the authentication factor is obtained after decryption, the step of performing key generation operation on the signature public key fragment and the user identifier based on the elliptic curve is executed; otherwise, a prompt message indicating that the applicant's identity verification has failed is sent to the reviewer.

6. A key generation device, characterized in that, include: The fragment acquisition unit is configured as follows: the applicant generates a signature public key fragment; The signature public key fragment is obtained by operating on the signature private key fragment based on the base points of an elliptic curve, and the elliptic curve is set in the SM2 algorithm; The information processing unit is configured to: send the key application type, the signature public key fragment, and the user identifier as application information to the reviewer; verify the applicant's identity based on the user identifier and, upon successful verification, forward the application information to the provider so that the provider obtains the key information of the key application type; and deliver the key information to the reviewer and forward it to the applicant. The key information includes: a declared public key and a target private key fragment; The key generation unit is configured to: generate a public-private key pair of the key application type based on the key information; the key application type includes some or all of a signature type and an encryption type; The provider obtains the key information for the key request type in the following manner: Based on the coordinates of the provider's master public key on the elliptic curve, the coordinates of the base point on the elliptic curve, and the user identifier, the user hash value of the applicant is determined; Based on the provider's master private key, the user's hash value, and the signature public key fragment, generate the private key intermediate fragment for the key request type; The product of the intermediate private key fragment of the key request type and the base point is added to the reference public key fragment associated with the key request type to obtain the declaration public key of the key request type; wherein, the reference public key fragment associated with the signature type is the signature public key fragment; the reference public key fragment associated with the encryption type is the encryption public key fragment; the encryption public key fragment is determined based on the product of the encryption private key fragment and the base point, and the encryption private key fragment is obtained by the provider using a preset hash algorithm to perform a hash operation on the user identifier and the key type information set based on the encryption type; Based on the declared public key, the intermediate private key fragment, the provider's master private key, and the user's hash value, the target private key fragment for the key request type is determined.

7. The apparatus according to claim 6, characterized in that, The provider generates the intermediate private key fragment for the key request type based on the provider's master private key, the user hash value, and the signature public key fragment, in the following manner: Based on a preset random number algorithm, random number operations are performed on the provider's master private key, the user hash value, the signature public key fragment, and the key request type to obtain an intermediate random number for the key request type. Using the intermediate random number of the key request type, perform a modulo operation on the order of the base point on the elliptic curve to obtain the intermediate fragment of the private key of the key request type.

8. The apparatus according to claim 6, characterized in that, The provider determines the target private key fragment for the key request type based on the declared public key, the intermediate private key fragment, the provider's master private key, and the user hash value in the following manner: Determine the public key coordinates of the declared public key of the key request type on the elliptic curve; A preset hash algorithm is used to perform a hash operation on the public key coordinates and the user hash value to obtain the public key hash value of the key request type; Based on the private key intermediate fragment of the key request type, the public key hash value, and the provider's master private key, generate the target private key fragment of the key request type.

9. The apparatus according to claim 8, characterized in that, The requester generates a public-private key pair for the key request type based on the key information. Specifically, the key generation unit is configured as follows: Based on the target private key fragment of the key request type and the reference private key fragment associated with the key request type, a candidate private key is determined; wherein, the reference private key fragment associated with the signature type is the signature private key fragment; and the reference private key fragment associated with the encryption type is the encryption private key fragment. Based on the candidate private key and the base point, determine the first comparison public key for the key request type; Based on the public key hash value of the key request type, the provider's master public key, and the declaration public key of the key request type, determine the second comparison public key of the key request type; If the first comparison public key is the same as the second comparison public key, then either the first comparison public key or the second comparison public key is used as the public key of the key application type, and the candidate private key is used as the private key of the key application type.

10. The apparatus according to any one of claims 6-9, characterized in that, The application information also includes: authentication ciphertext; the authentication ciphertext is obtained by the applicant encrypting the authentication factor using the provider's authentication public key; The authentication ciphertext is used by the provider to decrypt the authentication ciphertext using the authentication private key after receiving the application information forwarded by the reviewer. If the authentication factor is obtained after decryption, the step of performing key generation operation on the signature public key fragment and the user identifier based on the elliptic curve is executed; otherwise, a prompt message indicating that the applicant's identity verification has failed is sent to the reviewer.

11. An electronic device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method according to any one of claims 1-5.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a computer, cause the computer to perform the method as described in any one of claims 1-5.

Images