Identity authentication method and system based on public key randomization mechanism

Abstract

The invention relates to an identity authentication method and system based on a public key randomization mechanism, belongs to the technical field of computer technology and information security, and solves the problem that an application side tracks a user track according to fixed information related to an identity in the prior art. The method comprises the steps of generating different randomized public keys for different application parties on a user public key randomization platform or a user terminal by utilizing a public key randomization mechanism based on a user public key; signing the randomized public key and the application identifier of the user through a user public key randomization platform private key to form a binding relationship, and sending the binding relationship to the user; the user signs the authentication message by using the user private key, and sends the binding relationship and the authentication message with the signature to the application party; and the application side verifies the legality of the binding relationship by using the public key of the user public key randomization platform, and then verifies the authenticity of the signature of the authentication message by the user by using the corresponding randomized public key, thereby completing the user identity authentication and realizing the user identity supervision.

Description

Technical Field

[0001] The present invention relates to the fields of computer technology, information security and distributed technology, and in particular to an identity authentication method and system based on a public key randomization mechanism. Background Art

[0002] Application services should follow the principle of not disclosing user information and behavior tracks. When verifying user identity, applications mainly authenticate the user's know-what, own-what, and be-what (biometrics). Common methods include: (1) requiring users to use third-party application authorization account information to log in for mutual recognition; (2) requiring the public key randomization platform to sign the user's principal elements, and the application party to authenticate the signature, etc.

[0003] The current identity authentication method has the following defects: (1) Using a third-party application to authorize login allows user identity information to be linked between different applications, increasing the risk of user identity information leakage. (2) The identity management party's public key is used to randomize the platform's private key to sign the identity tag, and the application party uses the public key of the public key randomization platform to identify the identity. It is impossible to verify that the identity tag belongs to the user, resulting in the identity tag being maliciously replaced. In summary, the current identity authentication method cannot achieve true identity non-linkability and high security and controllability at the same time.

[0004] In order to meet the security requirements of parallel authentication and supervision of cyberspace identity and the inability to link identities of different applications, an effective identity authentication method is needed to ensure that user identity information cannot be linked between different applications. At the same time, cyberspace user identity authentication is implemented to ensure that user identities are not misused. Summary of the invention

[0005] In view of the above analysis, the present invention aims to provide an identity authentication method and system based on a public key randomization mechanism, which solves the problem in the prior art that the application party can obtain the user's valid information through illegal links and there is a risk of user identity being impersonated.

[0006] The purpose of the present invention is mainly achieved through the following technical solutions:

[0007] On the one hand, the present invention discloses an identity authentication method based on a public key randomization mechanism, comprising:

[0008] For different application parties of user devices, different user randomized public keys are calculated using the public key randomization mechanism based on the user public key and the user public key randomization platform public key;

[0009] The user's randomized public key and the user's application identifier are signed by the platform private key using the user's public key to form a binding relationship; and the binding relationship and identity authentication data are signed using the user's private key to obtain the signed identity authentication data;

[0010] The application party verifies the authenticity of the user's signature based on the signed identity authentication data and completes the user identity authentication.

[0011] Furthermore, the user public key is randomized by a user public key randomization platform, or the user public key is randomized by a user device to obtain the user randomized public keys corresponding to different application parties.

[0012] Furthermore, the user public key randomization platform randomizes the user public key, including: the user device signs the user public key and the user's application identifier using the user's private key, and sends the signed information to the user public key randomization platform; the user public key randomization platform verifies the received signature information, and if the signature verification passes, uses the public key randomization mechanism to generate a user randomized public key for a specific application;

[0013] The user public key randomization platform signs the randomized public key and the user's application identification with its own private key to form a binding relationship.

[0014] Furthermore, the user's public key is randomized by the user device, including:

[0015] The user device generates a user randomized public key using the user public key and the user public key randomization platform public key through a public key randomization mechanism;

[0016] The randomized public key, the user public key, and the user's application identifier are signed using the user's private key, and sent to the user public key randomization platform; the correctness of the user's randomized public key is verified by the user public key randomization platform;

[0017] The user public key randomization platform signs the user randomized public key and the user's application identification with its own private key to form a binding relationship.

[0018] Furthermore, the application party verifies the authenticity of the user's signature based on the signed identity authentication data and completes the user identity authentication, including:

[0019] Based on the signed identity authentication data, the application party uses the user public key to randomize the platform public key to verify the legitimacy of the binding relationship, and uses the corresponding user randomized public key to verify the authenticity of the user signature to complete the user identity authentication.

[0020] Furthermore, it also includes retrospective supervision of user identities, including:

[0021] The application party sends the user randomized public key to the user public key randomization platform;

[0022] The user public key randomization platform opens the user randomized public key, traces back to the user public key information and user identity, and thus supervises the user identity.

[0023] On the other hand, an identity authentication system based on a public key randomization mechanism is also provided, comprising: a user device, a user public key randomization platform and an application party;

[0024] The user device is used to manage the user identity key and sign the identity authentication data;

[0025] The user public key randomization platform is used to verify the real identity of the user, generate random public keys, issue binding relationships and trace the real identity of the user;

[0026] The application is used to verify the legitimacy of the randomized public key and the correctness of the user's signature to perform user identity authentication.

[0027] Further, the user equipment includes a user key management module;

[0028] The user key management module is used to generate and store user public-private key pairs, generate user randomized public keys using a public key randomization mechanism, and securely transmit randomized public key generation information and identity authentication data issuance information.

[0029] Furthermore, the user public key randomization platform includes a randomized public key generation module, a binding relationship issuance module, a platform key generation and storage module, and a randomized public key opening module;

[0030] The randomized public key generation module is used to generate a user randomized public key using a public key randomization mechanism based on the user public key, the user's application identifier, the user public key randomization platform's own public key and random number information;

[0031] The binding relationship issuing module uses the user public key randomization platform private key to sign the user randomized public key and the user's application identifier to form a binding relationship;

[0032] The platform key generation and storage module is used to generate and store user public key randomization platform public and private key pairs;

[0033] The randomized public key opening module is used to open the randomized public key to obtain the user public key; by searching the user's real identity list, the user identity is traced back, thereby supervising the user identity.

[0034] Furthermore, the application side includes a randomized public key signature verification module;

[0035] The randomized public key signature verification module verifies the legitimacy of the binding relationship through the user public key randomization platform public key; after the verification is passed, the randomized public key matching the user is found according to the binding relationship issued by the user public key randomization platform, and the authenticity of the user's signature is verified by using the randomized public key, thereby realizing the authentication of the user's identity.

[0036] The beneficial effects of the present invention are as follows:

[0037] The present invention combines cryptography and identity authentication related technologies, and proposes an identity authentication method based on a public key randomization mechanism. The method provides a universal identity authentication model based on a randomized public key, generates randomized public keys for different applications based on the user's public key, can ensure the user's unlinkability between different applications, and solve the problem of the application party illegally linking to obtain the user's valid information. The binding relationship between the user's randomized public key and the user's application identifier signed by the public key randomization platform private key is embedded in the identity authentication model. The application party verifies the correctness of the binding relationship and the user's signature through the public key randomization platform public key and the randomized public key, proving that the binding relationship between the user's randomized public key and the user's application identifier is issued by the public key randomization platform, and that the user's signature comes from the user identity in the binding relationship, thereby solving the risk of the user's identity being misused. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings are only for the purpose of illustrating particular embodiments and are not to be considered limiting of the present invention. Like reference symbols denote like components throughout the drawings.

[0039] Figure 1 is a flow chart of an identity authentication method based on a public key randomization mechanism in an embodiment of the present invention;

[0040] Figure 2 This is a schematic diagram of an identity authentication process in which a user public key randomization platform randomizes a user public key in an embodiment of the present invention;

[0041] Figure 3 Schematic diagram of the identity authentication process of randomizing the user public key by the user equipment in an embodiment of the present invention

[0042] Figure 4 Schematic diagram of the structure of an identity authentication system based on a public key randomization mechanism in an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used to illustrate the principles of the present invention together with the embodiments of the present invention.

[0044] Embodiment 1

[0045] This embodiment discloses an identity authentication method based on a public key randomization mechanism, such as Figure 1 As shown, the following steps are included:

[0046] Step S1: for different application parties of the user device, based on the user public key and the user public key randomization platform public key, different user randomized public keys are calculated using the public key randomization mechanism;

[0047] Specifically, when performing user registration, a public-private key pair representing the user's identity is first generated through the user identity key management module of the user device and securely stored in the module; then the user's public key and the user's real identity information are sent to the user public key randomization platform to verify the user's real identity; the user's real identity information is verified through the public key randomization platform, and a corresponding list of the user's real identity information and the user's public key is stored for user identity tracing, thereby completing user registration.

[0048] The public key randomization mechanism generates a randomized public key based on information such as the user public key, the public key randomization platform public key and a random number. This embodiment provides two public key randomization generation mechanisms, including: randomizing the user public key by the user public key randomization platform; or randomizing the user public key by the user device.

[0049] Among them, the user public key randomization platform randomizes the user public key, such as Figure 2 As shown, it includes: the user device uses the user private key to sign the user public key and the user's application identifier, and sends the signed information to the user public key randomization platform; the user public key randomization platform verifies the received signature information, and if the signature verification passes, the public key randomization mechanism is used to generate a user randomized public key for a specific application; the user public key randomization platform signs the randomized public key and the user's application identifier with its own private key to form a binding relationship.

[0050] The user's public key is randomized by the user himself, such as Figure 3 As shown, it includes: the user device generates a user randomized public key by using the user public key and the user public key randomization platform public key through the public key randomization mechanism; uses the user private key to sign the randomized public key, the user public key, and the user's application identifier, and sends them to the user public key randomization platform; verifies the correctness of the user randomized public key through the user public key randomization platform, and if the verification is correct, saves the randomized public key information; and uses the user public key randomization platform to sign the user randomized public key and the user's application identifier through its own private key to form a binding relationship.

[0051] Specifically, a public key randomization mechanism is used to generate a randomized public key using a user public key and a platform public key. This embodiment does not limit the specific algorithm implementation of the public key randomization mechanism. In specific use, the user public key, the user public key randomization platform public key, and a random number and other information are input, and an existing public key randomization method is used to obtain multiple randomized public keys corresponding to the user public key.

[0052] By utilizing the public key randomization mechanism, different user randomized public keys are generated for different application parties, so that one user private key corresponds to multiple randomized public keys that match the application parties. Different application parties correspond to different user application identifiers, thereby achieving the unlinkability of user identities between different applications.

[0053] In the public key randomization mechanism, a user's private key can correspond to multiple randomized public keys, and each randomized public key corresponds to a different application. By making multiple randomized public keys unlinkable, it ensures that the user's identity cannot be linked between different applications, effectively preventing the problem of multiple applications colluding to track user behavior trajectories.

[0054] Step S2: using the user public key to randomize the platform private key, the user randomized public key and the user's application identifier are signed to form a binding relationship; and using the user private key to sign the binding relationship and identity authentication data to obtain the signed identity authentication data;

[0055] Specifically, in this embodiment, the public key randomization platform uses its own private key to sign the randomized public key and the user's application identification to form a binding relationship, indicating that the binding relationship between the randomized public key and the user's application identification is issued by the public key randomization platform. The binding relationship is sent to the user through the public key randomization platform, and the user's application identification, binding relationship and other identity authentication data are signed by the user's private key through the user device, and the signed identity authentication data is sent to the application party for identity authentication to access the specific application of the application party.

[0056] In this embodiment, the public key randomization platform private key is used to sign the randomized public key and the user's application identification to form a binding relationship, and the user's private key is further used to sign the user's application identification, binding relationship and other identity authentication data, so that the application party can authenticate the user's identity based on the randomized public key, realizing a truly unlinkable and highly secure identity authentication method.

[0057] Step S3: The application party verifies the authenticity of the user's signature based on the signed identity authentication data to complete the user identity authentication.

[0058] Specifically, the application party uses the user public key to randomize the platform public key to verify the legitimacy of the binding relationship based on the signed identity authentication data, and uses the corresponding user randomized public key to verify the authenticity of the user signature to complete the user identity authentication;

[0059] The application party uses the public key of the public key randomization platform to verify that the binding relationship between the randomized public key and the user's application identity is issued by the public key randomization platform, that is, the legitimacy of the binding relationship signature is verified.

[0060] In addition, the user uses the user's private key to sign the user's application identification, binding relationship and other identity authentication data, so that the application party can find the randomized public key that matches the user according to the binding relationship issued by the public key randomization platform and verify the identity authentication data signature. If the signature verification passes, it proves that the signature comes from the user identity in the binding relationship.

[0061] Furthermore, the identity authentication method of this embodiment can also realize traceability supervision of user identity, including:

[0062] The application sends the randomized public key to the user public key randomization platform;

[0063] The user public key randomization platform opens the randomized public key to obtain the user public key;

[0064] By looking up the corresponding list of the user's real identity information and the user's public key obtained during user registration, the user's identity can be traced back and supervised.

[0065] Specifically, in this embodiment, the public key randomization platform randomizes and stores the user's public key, or the user himself randomizes the user's public key, which needs to be verified and stored by the public key randomization platform. Only the public key randomization platform can open the randomized public key, trace the user's real identity information, and realize effective tracking of the user's identity.

[0066] When there is a need for supervision of user identity, the public key randomization platform uses the randomized public key and the public key randomization platform private key to use an opening mechanism to decrypt the user's public key, search the real identity list, determine the user's identity, and achieve real identity tracking.

[0067] In summary, this embodiment combines cryptography and identity authentication related technologies to propose an identity authentication method based on a public key randomization mechanism. This method uses the user's public key to generate different user randomized public keys according to the public key randomization mechanism, and distributes them to different application parties, and uses the public key randomization platform private key to sign the user's randomized public key and the user's application identifier to form a binding relationship. The application party verifies the correctness of the binding relationship and the user's signature through the public key randomization platform public key and the randomized public key. This embodiment is based on a universal identity authentication model of randomized public keys, and generates randomized public keys for different applications based on the user's public key, which can ensure that users cannot be linked between different applications, and solve the problem of illegal links by the application party to obtain valid user information. The binding relationship between the user's randomized public key and the user's application identity is embedded in the identity authentication model. The application party verifies the correctness of the binding relationship and the user's signature through the public key randomization platform public key and the randomized public key, proving that the binding relationship between the randomized public key and the user's application identity is issued by the public key randomization platform and that the user's signature comes from the user identity in the binding relationship, thereby eliminating the risk of user identity being misused.

[0068] Embodiment 2

[0069] This embodiment discloses an identity authentication system based on a public key randomization mechanism, such as Figure 4 Shown, including

[0070] User devices, user public key randomization platforms and applications;

[0071] The user device is used to manage the user identity key and sign the identity authentication data;

[0072] The user public key randomization platform is used to verify the user's true identity, generate random public keys, issue binding relationships, and trace and supervise the user's true identity;

[0073] The application is used to verify the legitimacy of the randomized public key and the correctness of the user's signature to authenticate the user.

[0074] The user device includes a user key management module; the user key management module is used to generate and store user public and private key pairs, generate randomized public keys using a public key randomization mechanism, and securely transmit randomized public key generation information and identity authentication data issuance information.

[0075] Specifically, the user device is responsible for the user identity key management throughout the entire life cycle, including the generation and storage of the user's public and private key pairs. In the randomized public key generation mechanism, after the identity is verified by the public key randomization platform, it is responsible for generating a randomized public key based on the user's public key using the public key randomization mechanism, and ensuring that the randomized public key generation information and identity authentication data issuance information are transmitted within a secure channel.

[0076] During the user authentication stage, the user's device interacts with the application party, uses the user's private key to sign the user's application identification, binding relationship and other authentication data, and sends the signed authentication data to the application party for authentication in order to access the application party's services.

[0077] Furthermore, the public key randomization platform includes a randomized public key generation module, a binding relationship issuance module, a platform key generation and storage module, and a randomized public key opening module;

[0078] The randomized public key generation module is used to generate a user randomized public key based on the user public key, the user's application identifier, the user public key randomization platform's own public key and random number information, using the public key randomization mechanism to generate a user randomized public key;

[0079] The binding relationship issuance module uses the user public key randomization platform private key to sign the user randomized public key and the user's application identifier to form a binding relationship;

[0080] The platform key generation and storage module is used to generate and store the user public key randomization platform public and private key pairs;

[0081] The randomized public key opening module is used to open the randomized public key to obtain the user public key; by searching the user's real identity list, the user identity is traced back, thereby supervising the user identity.

[0082] Specifically, the public key randomization platform is used to verify the authenticity of the user's identity. If the verification is successful, the random public key generation module uses the public key randomization mechanism to generate the user's random public key. The random public key generation module uses the user's public key corresponding to the user's private key, the public key of the public key randomization platform itself, random numbers and other information as input, generates the user's random public key using the public key randomization mechanism, and distributes the random public key to different applications. The unlinkability between multiple random public keys ensures that the user identity is unlinkable between different applications.

[0083] During the binding relationship issuance phase, the public key randomization platform uses its own private key to sign the generated user randomized public key and the user's application identifier to form a binding relationship.

[0084] Furthermore, the application party includes a randomized public key verification module; it is used to verify the legitimacy of the binding relationship through the user public key randomization platform public key; after the verification is passed, the randomized public key matching the user is found according to the binding relationship issued by the user public key randomization platform, and the authenticity of the user's signature is verified by using the randomized public key, thereby realizing the authentication of the user's identity.

[0085] Specifically, the application is used to verify the legitimacy of the randomized public key and the correctness of the user's signature, and to provide services to the user. The legitimacy of the binding relationship is verified by using the public key of the public key randomization platform, and the randomized public key matching the user is found according to the binding relationship issued by the public key randomization platform. The authenticity of the user's signature is verified by using the randomized public key, thereby achieving user identity authentication.

[0086] In addition, it also includes regulators. When it is necessary to trace and supervise the user's identity, the public key randomization platform uses the opening mechanism based on the randomized public key sent by the application to obtain the user's public key, trace the user's real identity, and thus realize the supervision of the user's identity.

[0087] Compared with the prior art, the beneficial effects of this embodiment are the same as those of the first embodiment, and are not described in detail here.

Claims

1. An identity authentication method based on a public key randomization mechanism, characterized in that: include: For different application parties of user devices, different user randomized public keys are calculated using the public key randomization mechanism based on the user public key and the user public key randomization platform public key; The user's randomized public key and the user's application identifier are signed by the platform private key using the user's public key to form a binding relationship; and the binding relationship and identity authentication data are signed using the user's private key to obtain the signed identity authentication data; The application party verifies the authenticity of the user's signature based on the signed identity authentication data and completes the user identity authentication.

2. The identity authentication method based on public key randomization mechanism according to claim 1, characterized in that: The user public key is randomized by a user public key randomization platform, or by a user device, to obtain the user randomized public keys corresponding to different application parties.

3. The identity authentication method based on public key randomization mechanism according to claim 2 is characterized in that: The user public key randomization platform randomizes the user public key, including: the user device signs the user public key and the user's application identifier using the user's private key, and sends the signed information to the user public key randomization platform; the user public key randomization platform verifies the received signature information, and if the signature verification passes, uses the public key randomization mechanism to generate a user randomized public key for a specific application; The user public key randomization platform signs the randomized public key and the user's application identification with its own private key to form a binding relationship.

4. The identity authentication method based on public key randomization mechanism according to claim 2 is characterized in that: The user's public key is randomized by the user's device, including: The user device generates a user randomized public key using the user public key and the user public key randomization platform public key through a public key randomization mechanism; The randomized public key, the user public key, and the user's application identifier are signed using the user's private key, and sent to the user public key randomization platform; the correctness of the user's randomized public key is verified by the user public key randomization platform; The user public key randomization platform signs the user randomized public key and the user's application identification with its own private key to form a binding relationship.

5. The identity authentication method based on public key randomization mechanism according to claim 1, characterized in that: The application party verifies the authenticity of the user's signature based on the signed identity authentication data and completes the user identity authentication, including: Based on the signed identity authentication data, the application party uses the user public key to randomize the platform public key to verify the legitimacy of the binding relationship, and uses the corresponding user randomized public key to verify the authenticity of the user signature to complete the user identity authentication.

6. The identity authentication method based on public key randomization mechanism according to claim 1, characterized in that: It also includes retroactive supervision of user identities, including: The application party sends the user randomized public key to the user public key randomization platform; The user public key randomization platform opens the user randomized public key, traces back to the user public key information and user identity, and thus supervises the user identity.

7. An identity authentication system based on a public key randomization mechanism, characterized in that: include: User devices, user public key randomization platform and application party; The user device is used to manage the user identity key and sign the identity authentication data; The user public key randomization platform is used to verify the real identity of the user, generate random public keys, issue binding relationships and trace the real identity of the user; The application is used to verify the legitimacy of the randomized public key and the correctness of the user's signature to perform user identity authentication.

8. The identity authentication system based on public key randomization mechanism according to claim 7, characterized in that: The user equipment comprises a user key management module; The user key management module is used to generate and store user public-private key pairs, generate user randomized public keys using a public key randomization mechanism, and securely transmit randomized public key generation information and identity authentication data issuance information.

9. The identity authentication system based on public key randomization mechanism according to claim 7, characterized in that: The user public key randomization platform includes a randomized public key generation module, a binding relationship issuance module, a platform key generation and storage module, and a randomized public key opening module; The randomized public key generation module is used to generate a user randomized public key using a public key randomization mechanism based on the user public key, the user's application identifier, the user public key randomization platform's own public key and random number information; The binding relationship issuing module uses the user public key randomization platform private key to sign the user randomized public key and the user's application identifier to form a binding relationship; The platform key generation and storage module is used to generate and store user public key randomization platform public and private key pairs; The randomized public key opening module is used to open the randomized public key to obtain a user public key; By looking up the user's real identity list, the user's identity can be traced back and supervised.

10. The identity authentication system based on public key randomization mechanism according to claim 7, characterized in that: The application side includes a randomized public key signature verification module; The randomized public key signature verification module verifies the legitimacy of the binding relationship through the user public key randomization platform public key; after the verification is passed, the randomized public key matching the user is found according to the binding relationship issued by the user public key randomization platform, and the authenticity of the user's signature is verified by using the randomized public key, thereby realizing the authentication of the user's identity.

Images