Terminal authorization authentication system and method based on proxy signature

Abstract

The invention relates to a terminal authorization authentication system and method based on a proxy signature. The system comprises an authorization service platform, terminal equipment and an application party, the authorization service platform is used for generating an assigner public and private key pair; proxy signature private key negotiation with the terminal equipment is carried out based on the assigner public and private keys, and proxy signature authority is given to the terminal equipment; the terminal equipment is used for performing operation to obtain a proxy signature private key containing a permission message range based on the proxy signature private key negotiation result, and signing user assertion information by using the proxy signature private key to obtain authentication data; and the application party is used for performing signature verification on the proxy signature information of the authentication data based on the assigner public key, and providing corresponding application service if the signature verification is passed. According to the method and the device, the problem that information sources such as assertion are not credible is solved, meanwhile, signatures exceeding a permission message range are effectively avoided, the credibility of a verification result output by the terminal equipment is enhanced, and authorization admission of the terminal equipment is verifiable.

Description

Technical Field

[0001] The present invention belongs to the technical field of privacy data processing, and in particular relates to a terminal authorization authentication system and method based on proxy signature. Background Art

[0002] As user-centric application models such as Web 3.0 and Metaverse are gradually promoted, local real-name identity authentication services for terminal devices centered on users will become the main technical means for autonomous identity management and legal identity supervision, and will also become the core driving force for the development of distributed digital identity authentication technology. According to the real-name management requirements put forward by government authorities for various industries and fields, users need to perform real-name identity authentication when accessing certain application services of the application party. For the distributed digital identity authentication process centered on terminal devices, the application party needs to trust the assertions and other information generated by the terminal device to confirm whether the user can access the corresponding application service.

[0003] The above-mentioned application methods have the following defects: (1) For services that use terminal devices to locally verify user identities, the security credibility of the terminal device environment held by users varies greatly. If the terminal device involved in the authentication does not obtain a trusted access permit, the assertions and other information it generates will be difficult to be trusted, causing many application parties to be unable to bear the legal risks brought about by local identity authentication services; (2) There is a lack of an effective security mechanism to confirm the trust of the terminal device, making it difficult to ensure that the assertions and other information are authentic and reliable.

[0004] To this end, an effective terminal device access authorization and authentication method is needed to effectively avoid message signatures that exceed the permitted scope, solve the problem of unreliable information sources such as assertions, and effectively enhance the credibility of the verification results output by the terminal device, so as to achieve verifiable access to the terminal device. Summary of the invention

[0005] In view of the above analysis, the present invention aims to disclose a terminal authorization authentication system and method based on proxy signature, which effectively avoids message signatures exceeding the permitted scope, solves the problem of unreliable information sources such as assertions, enhances the credibility of the verification results output by the terminal device, and realizes the verifiable access of the terminal device.

[0006] The purpose of the present invention is mainly achieved through the following technical solutions:

[0007] On the one hand, the present invention discloses a terminal authorization authentication system based on proxy signature, comprising:

[0008] Authorized service platforms, terminal devices and application parties;

[0009] The authorization service platform is used to generate a public-private key pair of the designator; and based on the public-private key pair of the designator, negotiate a proxy signature private key with the terminal device to grant the terminal device a proxy signature authority;

[0010] The terminal device acts as a proxy, and is used to calculate and obtain a proxy signature private key based on the proxy signature private key negotiation result, and use the proxy signature private key to sign the user assertion information to obtain authentication data;

[0011] The application party is used to verify the proxy signature information of the authentication data based on the designator's public key, and if the verification is successful, provide the corresponding application service to the terminal device.

[0012] Further, the authorization service platform includes a terminal authorization module;

[0013] The terminal authorization module is used to generate and store the assignor's public and private key pair; and negotiate the proxy signature private key with the terminal device based on the proxy assignment protocol to generate a proxy signature private key on the terminal device side, so that the terminal device has proxy signature authority.

[0014] Further, the designator public-private key pair includes a designator public key and a designator private key;

[0015] The terminal authorization module signs the interactive information in the proxy signature private key negotiation using the designator private key, and sends the signed interactive information to the terminal device for calculation to generate the proxy signature private key;

[0016] The designator's public key is used as input for generating the proxy signature private key; and is used by the application party to verify the proxy signature information.

[0017] Furthermore, granting the terminal device with proxy signing authority includes:

[0018] Generate a public-private key pair of the assignor and a public-private key pair of the agent through the authorization service platform and the terminal device respectively;

[0019] The authorization service platform performs a two-way proxy signature private key negotiation with the terminal device based on the designator's public-private key pair and the agent designation protocol, and shares public parameters including the designator's public key with the terminal device;

[0020] The terminal device uses the public parameters and the agent public key generated by itself to perform calculations, generate a proxy signature private key, and obtain proxy signature authority.

[0021] Further, granting proxy signing authority to the terminal device also includes specifying a permission message space for the terminal device;

[0022] The permission message space includes message fields, message types, or validity periods of proxy signatures.

[0023] Further, the terminal device includes a proxy signature module;

[0024] The proxy signature module is used to generate and store the public-private key pair of the agent; and based on the public-private key pair, negotiate with the authorization service platform to obtain the proxy signature private key; and sign the user assertion information to generate authentication data.

[0025] Furthermore, the application side includes a proxy signature verification module, which is used to verify the proxy signature information of the authentication data using the designator's public key to confirm the authenticity of the assertion information and its source terminal device.

[0026] On the other hand, a terminal authorization authentication method based on proxy signature is also provided, including:

[0027] Negotiate the proxy signature private key with the terminal device through the authorization service platform, generate the proxy signature private key on the terminal device side, and specify the permission message space;

[0028] Performing identity authentication on the user through the terminal device to generate assertion information; and using the proxy signature private key to sign the assertion information on the permission message space to obtain authentication data;

[0029] The application party uses the designator public key pre-generated by the authorization service platform to verify the proxy signature information. If the verification is successful, the authentication result is returned to the terminal device and the corresponding application service is provided.

[0030] Furthermore, the proxy signature private key negotiation is performed between the authorization service platform and the terminal device, and the proxy signature private key is generated by calculation on the terminal device side, including:

[0031] The authorization service platform and the terminal device generate a public-private key pair of the assignor and a public-private key pair of the agent respectively;

[0032] Based on the public and private key pair of the designator, the authorization service platform conducts two-way proxy signature private key negotiation with the terminal device through the proxy designation protocol, and shares public parameters including the designator's public key with the terminal device;

[0033] The terminal device uses the public parameters and the agent public key generated by itself to perform calculations to generate a proxy signature private key.

[0034] Furthermore, the permission message space includes message fields, message types or validity periods of proxy signatures.

[0035] The present invention can achieve at least one of the following beneficial effects:

[0036] 1. The present invention solves the security problem of unreliable information such as user assertions and their source devices through proxy signature methods such as authorization service platform for terminal devices, proxy signing of assertions by terminal devices, and public verification of signature information by third-party applications. The terminal access authorization and authentication mechanism based on terminal trusted authorization and third-party trusted authentication enhances the credibility of the terminal device itself and its output verification results.

[0037] 2. The present invention sets the authorization service platform as the designator role, and ensures the security and reliability of the terminal device through the authorization from the authorization service platform; sets the terminal device as the agent role, and implements password protection for information such as assertions through the agent signature mechanism, ensuring that information such as assertions are authentic and reliable; sets the application party as the authenticator role, and verifies that information such as assertions comes from a trusted access terminal device through the agent signature verification mechanism.

[0038] 3. Compared with the conventional certificate authentication system, the proxy signature authentication mechanism adopted by the present invention enables the agent to sign the specified message space, and the signature verification directly uses the designator's public key for verification, thereby proving that the signature is signed by a trusted device with access by the authorized party. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components;

[0040] Figure 1 It is a block diagram of a terminal authorization and authentication system based on proxy signature in an embodiment of the present invention;

[0041] Figure 2 The present invention is a flowchart of a terminal authorization and authentication method based on proxy signature in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used to illustrate the principles of the present invention together with the embodiments of the present invention.

[0043] Embodiment 1:

[0044] The proxy signature cryptography technology framework usually includes roles such as designator, agent, and authenticator. The designator has the right to delegate the agent to perform certain operations, and the authenticator can verify the agency relationship between the designator and the agent. The terminal device access authorization and authentication framework proposed in this embodiment is mainly composed of an authorization service platform, a terminal device, and an application party, which correspond to the roles of designator, agent, and authenticator respectively. The parties are connected and interacted through the Internet, and the authorization and authentication of terminal trusted access are realized based on the proxy signature mechanism.

[0045] The embodiment of the present invention discloses a terminal authorization authentication system based on proxy signature, such as Figure 1 As shown, it includes: authorization service platform, terminal equipment and application party;

[0046] The authorization service platform includes a terminal authorization module; used to generate a public-private key pair of the designator; and based on the public-private key pair of the designator, perform proxy signature private key negotiation with the terminal device to grant the terminal device proxy signature authority;

[0047] The terminal authorization module is used to generate and store the designator's public-private key pair, and negotiate the proxy signature private key with the terminal device based on the proxy designation protocol to generate a proxy signature private key on the terminal device side, so that the terminal device has the proxy signature authority. The designator's public-private key pair can be generated by the conventional signature private key and signature verification public key generation method in the digital signature algorithm based on the elliptic curve. The designator's public-private key pair includes the designator's public key and the designator's private key; wherein the designator's private key is generated based on a random number, and the designator's public key is generated based on the designator's private key and public parameters (such as initialization parameters such as base points).

[0048] In particular, the terminal authorization module acts as the designator and the terminal device acts as the agent. The agent signature private key negotiation is a secure interaction protocol between the two parties, which complies with the basic method of secure two-party operation. During the interaction process, the two parties share parameters, including: the designator's public key, the agent's public key, the designator's private key, the agent's identity identifier, the message space that the designator entrusts the agent to sign, etc. The above parameters are used as the input of the interaction protocol, and the terminal device undergoes secure two-party operation to generate the agent signature private key.

[0049] The authorization service platform uses the private key of the designator to sign the interactive information in the proxy signature private key negotiation, and sends the signed interactive information to the terminal device for the terminal device to perform calculations and generate the proxy signature private key; in particular, during the interaction between the two parties, the terminal authorization module uses the private key of the designator to sign the interactive information to be sent to the terminal device (including the public key of the designator, the designated message space, the agent ID, the agent public key and other agent identity information) and the terminal device verifies the interactive information containing the signature after receiving it. After the verification is passed, it performs calculations based on the received interactive information and its own information to generate the proxy signature private key. The input parameters for the proxy signature private key generation calculation include the public key of the designator, the public key of the agent, the agent identity, the designated permission message space, etc. The specific calculation process and the private key generation algorithm are not limited, and any private key generation algorithm can be used.

[0050] The designator's public key is used as input for the generation of the proxy signature private key; and is shared with the application party for verifying the proxy signature information. The proxy signature private key is generated by the proxy signature module on the terminal device side. Based on parameters such as the designator's public key, the agent's public key, the agent's identity identifier, and the specified permission message space, the proxy signature private key generation operation (such as modulus operation, hash operation, etc.) is performed in the proxy signature module on the terminal device side to generate the proxy signature private key.

[0051] Furthermore, the aforementioned granting of proxy signing authority to the terminal device includes:

[0052] Generate the public and private key pair of the assignor and the public and private key pair of the agent through the authorization service platform and the terminal device respectively;

[0053] Based on the public and private key pair of the designator, the authorization service platform conducts two-way proxy signature private key negotiation with the terminal device through the proxy designation protocol, and shares public parameters including the designator's public key with the terminal device;

[0054] The terminal device uses the public parameters and the agent public key generated by itself to perform calculations, generate the agent signature private key, and obtain the agent signature authority.

[0055] Granting proxy signing authority to the terminal device also includes specifying a permission message space for the terminal device;

[0056] The permission message space includes fields of the message, the type of message, or the validity period of the proxy signature.

[0057] It should be noted that the authorization service platform assumes the role of designator in the entire authorization and authentication system and has certain privileges. It can delegate its recognized agents (terminal devices) to perform identity authentication, proxy signature and other operations.

[0058] Specifically, the authorization service platform is mainly responsible for authorizing the terminal equipment at the factory stage, so that it generates a proxy signature private key and has a secure and reliable signing environment. The platform includes a terminal authorization module, which is the key core module of the authorization service platform to grant authorization to the terminal equipment. It is mainly responsible for the generation and storage of the public and private key pairs of the assignor, and the key management of the entire life cycle and the negotiation of the proxy signature private key. This module promotes the agent (terminal equipment) to have the authority of the proxy signature by means of the proxy signature private key negotiation, and delimits the scope of the delegation, that is, to specify the message space that can be signed for the terminal equipment, which plays the role of downward delegation and designation.

[0059] During the initialization phase when the authorization service platform grants authorization to the terminal device, the authorization service platform generates the basic key for proxy signature private key negotiation, namely, the designator's public-private key pair. The designator's private key is mainly used to sign the negotiated interaction information between the designator and the agent. In addition to participating in the generation of the proxy signature private key, the designator's public key is also used by the application party to verify the proxy signature information.

[0060] Furthermore, the terminal device includes a proxy signature module; which is used to calculate and obtain a proxy signature private key based on the proxy signature private key negotiation result, and use the proxy signature private key to sign the user assertion information to obtain authentication data;

[0061] Specifically, the proxy signature module is used to generate and store the public-private key pair of the agent; and negotiate with the authorization service platform based on the public-private key pair to obtain the proxy signature private key; and sign the user assertion information to generate authentication data; and authenticate the user to obtain the user assertion information.

[0062] Specifically, during the initialization phase when the authorization service platform grants authorization to the terminal device, the terminal device generates the basic key for proxy signature private key negotiation, namely the agent public-private key pair. The agent public-private key is mainly used as the key parameter for the proxy signature private key generation operation. The terminal device assumes the role of agent in the entire authorization and authentication system and needs to perform identity authentication, proxy signature and other operations on behalf of the assignor (authorization service platform) within the scope of its proxy authority.

[0063] Specifically, the terminal device is mainly responsible for receiving authorization, identity authentication, proxy signature, and output of assertions after signing. After carrying the authorization of the authorization service platform, the terminal device ensures that the assertion information and its source device are safe and reliable through the proxy signature mechanism. The terminal device includes a proxy signature module; the proxy signature module is responsible for the generation and storage of the agent's public and private key pairs and other key management throughout the life cycle, proxy signature private key negotiation and proxy signature generation; and is responsible for authenticating the user and outputting assertions and other information, where identity authentication can be verification methods such as dynamic and static passwords, biometrics, and third-party Internet account authorization.

[0064] Furthermore, the application party includes a proxy signature verification module; it is used to verify the proxy signature information of the authentication data based on the designator's public key to confirm the authenticity of the assertion information and its source terminal device. If the verification passes, the authentication result is returned to the terminal device and the corresponding application service is provided.

[0065] Specifically, the application party assumes the role of the authenticator in the entire authorization and authentication system. The authenticator will verify the authentication data submitted by the agent (terminal device) when the user accesses its application service. The application party usually refers to Internet application service providers, telecom operators, etc., and is mainly responsible for licensing access to compliant terminals. The application party includes a proxy signature verification module, which is used to verify the proxy signature information in the authentication data submitted by the terminal device using the designator's public key during the authentication stage of the application party's authorization of the terminal device. After the verification is passed, the assertion and other information in the authentication data are accepted and the corresponding application service is provided to the user.

[0066] Embodiment 2:

[0067] A method for application authorization based on terminal access identity is also provided, such as Figure 2 As shown, the following steps are included:

[0068] Step S1: Negotiate the proxy signature private key with the terminal device through the authorization service platform, generate the proxy signature private key on the terminal device side, and specify the permission message space;

[0069] Specifically, first, the authorization service platform and the terminal device generate a public-private key pair of the assignor and a public-private key pair of the agent respectively;

[0070] Then, the authorization service platform conducts a two-way proxy signature private key negotiation with the terminal device through the proxy assignment protocol based on the public and private key pair of the designator, and shares the public parameters including the public key of the designator with the terminal device;

[0071] The terminal device uses the public parameters and the agent public key generated by itself to perform calculations to generate the agent signature private key.

[0072] The permission message space includes fields of the message, the type of message, or the validity period of the proxy signature.

[0073] It should be noted that the authorization service platform acts as the original signer and the terminal device acts as the proxy signer. Both parties negotiate the proxy signature private key through the proxy assignment protocol based on the basic key generated by each initialization. During the negotiation process, the terminal device performs calculations based on the public parameters obtained and the proxy key generated by itself to generate the proxy signature private key and execute the proxy signature. The generation of the proxy signature private key indicates that the authorization service platform has completed the trusted authorization of the terminal device. Only when the authorized terminal device signs the information on the license message space specified by the assignor, it has the credibility recognized by the authorization service platform.

[0074] Step S2: Authenticate the user through the terminal device to generate assertion information; and use the proxy signature private key to sign the assertion information on the permission message space to obtain authentication data, including proxy signature information, assertion information, etc.;

[0075] Based on the proxy signature private key, the terminal device uses the proxy signature algorithm to sign and protect the assertion and other information in the license message space, generate proxy signature information, and prove the authenticity of the information and its source device.

[0076] The terminal device acts as a proxy signer and uses the proxy signature private key to sign the assertions and other information generated by itself in the message space specified by the authorization service platform. After signing, authentication data containing the proxy signature, assertions and other information is formed. The authentication data generated on the terminal device side is submitted to the application for authentication.

[0077] The proxy signature private key is authorized by the authorized service platform, and the message space is specified by the authorized service platform. Therefore, the signature verification result of the authentication data submitted by the terminal device by the application party is authorized and credible.

[0078] Step S3: The application party verifies the proxy signature information using the designator public key pre-generated by the authorization service platform. If the verification passes, the authentication result is returned to the terminal device and the corresponding application service is provided.

[0079] The application party uses the public key of the designator of the authorization service platform to authenticate the proxy signature information, and adopts assertions and other information based on the authentication results to ensure that the source of the information is credible and the content is authentic.

[0080] In this embodiment, based on the authentication data submitted by the terminal device, i.e., the assertion and other information after signing, the application uses the public key of the assignor to authenticate the proxy signature information in the authentication data submitted by the terminal device. After the authentication is passed, the application can believe that the signature information comes from an authorized and trusted terminal device. The above authentication method can effectively avoid the signing of messages beyond the scope of permission and solve the problem of unreliable sources of information such as assertions.

[0081] In summary, the present invention solves the security problem of user assertions and other information and their source devices being untrustworthy through the proxy signature method such as authorization of the terminal device by the authorization service platform, proxy signing of assertions and other information by the terminal device, and public verification of signature information by a third-party application. The terminal access authorization and authentication mechanism based on terminal trusted authorization and third-party trusted authentication enhances the credibility of the terminal device itself and its output verification results. The authorization service platform is set as the designator role, and the security and credibility of the terminal device are guaranteed through the authorization from the authorization service platform; the terminal device is set as the agent role, and the password protection of assertions and other information is realized through the proxy signature mechanism to ensure that the assertions and other information are authentic and credible; the application party is set as the authenticator role, and the assertions and other information are verified from the trusted access terminal device through the proxy signature verification mechanism. Compared with the conventional certificate authentication system, the proxy signature authentication mechanism adopted by the present invention realizes that the agent signs the specified message space, and the signature verification directly uses the designator's public key for verification, thereby proving that the signature is signed by the trusted device accessed by the authorized party.

[0082] Those skilled in the art will appreciate that all or part of the process of the method in the above embodiment can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0083] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A terminal authorization and authentication system based on proxy signature, characterized in that: include: Authorized service platforms, terminal devices and application parties; The authorization service platform is used to generate a public and private key pair of the assignor; and negotiate a proxy signature private key with the terminal device based on the public and private key pair of the designator, thereby granting the terminal device a proxy signature authority; The terminal device acts as a proxy, and is used to calculate and obtain a proxy signature private key based on the proxy signature private key negotiation result, and use the proxy signature private key to sign the user assertion information to obtain authentication data; The application party is used to verify the proxy signature information of the authentication data based on the designator's public key, and if the verification is successful, provide the corresponding application service to the terminal device.

2. The terminal authorization and authentication system based on proxy signature according to claim 1 is characterized in that: The authorization service platform includes a terminal authorization module; The terminal authorization module is used to generate and store the assignor's public and private key pair; and negotiate the proxy signature private key with the terminal device based on the proxy assignment protocol to generate a proxy signature private key on the terminal device side, so that the terminal device has proxy signature authority.

3. The terminal authorization and authentication system based on proxy signature according to claim 2 is characterized in that: The designator public-private key pair includes a designator public key and a designator private key; The terminal authorization module signs the interactive information in the proxy signature private key negotiation using the designator private key, and sends the signed interactive information to the terminal device for calculation to generate the proxy signature private key; The designator's public key is used as input for generating the proxy signature private key; and is used by the application party to verify the proxy signature information.

4. The terminal authorization and authentication system based on proxy signature according to claim 1 is characterized in that: The granting of proxy signing authority to the terminal device includes: Generate a public-private key pair of the assignor and a public-private key pair of the agent through the authorization service platform and the terminal device respectively; The authorization service platform performs a two-way proxy signature private key negotiation with the terminal device based on the designator's public-private key pair and the agent designation protocol, and shares public parameters including the designator's public key with the terminal device; The terminal device uses the public parameters and the agent public key generated by itself to perform calculations, generate a proxy signature private key, and obtain proxy signature authority.

5. The terminal authorization and authentication system based on proxy signature according to claim 4 is characterized in that: Granting proxy signing authority to the terminal device also includes specifying a permission message space for the terminal device; The permission message space includes message fields, message types, or validity periods of proxy signatures.

6. The terminal authorization and authentication system based on proxy signature according to claim 1 is characterized in that: The terminal device includes a proxy signature module; The proxy signature module is used to generate and store the public-private key pair of the agent; and based on the public-private key pair, negotiate with the authorization service platform to obtain the proxy signature private key; and sign the user assertion information to generate authentication data.

7. The terminal authorization and authentication system based on proxy signature according to claim 1 is characterized in that: The application side includes a proxy signature verification module, which is used to verify the proxy signature information of the authentication data using the designator's public key to confirm the authenticity of the assertion information and its source terminal device.

8. A terminal authorization authentication method based on proxy signature, characterized in that: include: Negotiate the proxy signature private key with the terminal device through the authorization service platform, generate the proxy signature private key on the terminal device side, and specify the permission message space; Performing identity authentication on the user through the terminal device to generate assertion information; and using the proxy signature private key to sign the assertion information on the permission message space to obtain authentication data; The application party uses the designator public key pre-generated by the authorization service platform to verify the proxy signature information. If the verification is successful, the authentication result is returned to the terminal device and the corresponding application service is provided.

9. The terminal authorization authentication method based on proxy signature according to claim 8, characterized in that: The proxy signature private key negotiation is performed between the authorization service platform and the terminal device, and the proxy signature private key is generated by calculation on the terminal device side, including: The authorization service platform and the terminal device generate a public-private key pair of the assignor and a public-private key pair of the agent respectively; Based on the public and private key pair of the designator, the authorization service platform conducts two-way proxy signature private key negotiation with the terminal device through the proxy designation protocol, and shares public parameters including the designator's public key with the terminal device; The terminal device uses the public parameters and the agent public key generated by itself to perform calculations to generate a proxy signature private key.

10. The terminal authorization authentication method based on proxy signature according to claim 8, characterized in that: The permission message space includes message fields, message types, or validity periods of proxy signatures.

Images