Key verification method, key acquisition method and equipment

Abstract

The embodiment of the invention provides a key verification method, a key acquisition method and equipment, and verification equipment can verify whether a private key of supervision equipment can decrypt ciphertext information or not based on zero-knowledge proof information, and verify whether a key obtained by decryption in the ciphertext information is a communication key determined by negotiation between a first terminal and a second terminal or not, so that the key verification efficiency is improved. According to the embodiment of the invention, the monitoring equipment can be ensured to decrypt to obtain the communication key determined by negotiation between the first terminal and the second terminal after acquiring the ciphertext information, so that the monitoring equipment can monitor sidewalk communication between the first terminal and the second terminal.

Description

Key verification method, key acquisition method and device Technical Field

[0001] The embodiments of the present application relate to the field of communications, and more specifically, to a key verification method, a key acquisition method, and a device. Background Art

[0002] Regulatory equipment can monitor 3rd Generation Partnership Project (3GPP) communication scenarios, but it does not cover UE-to-UE relay (UE-to-UE Relay) scenarios. Industry trends suggest that regulation of UE-to-UE relay scenarios is inevitable in the future. How to regulate UE-to-UE relay scenarios remains a challenge.

[0003] Summary of the Invention

[0004] The embodiments of the present application provide a key verification method, a key acquisition method, and a device. A supervisory device can obtain the communication key required for monitoring in a UE to UE Relay scenario through zero-knowledge proof, thereby realizing monitoring of the UE to UE Relay scenario.

[0005] In a first aspect, a key verification method is provided, which is applied to a verification device, and the method includes:

[0006] The verification device receives first information;

[0007] Among them, the first information includes the key negotiation parameters, ciphertext information and zero-knowledge proof information of the first terminal, the ciphertext information is derived based on the public key of the supervisory device, the communication key determined by negotiation between the first terminal and the second terminal, and the first random number generated by the first terminal, the zero-knowledge proof information includes first proof information and / or second proof information, the first proof information is determined based on the ciphertext information, the second proof information is determined based on the ciphertext information and the key negotiation parameters of the first terminal, the first proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and the second proof information is used to verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, and the first terminal and the second terminal communicate sideways through the relay terminal.

[0008] In a second aspect, a key verification method is provided, which is applied to a first terminal, wherein the first terminal and a second terminal perform sideline communication via a relay terminal, the method comprising:

[0009] The first terminal sends first information;

[0010] Among them, the first information includes the key negotiation parameters, ciphertext information and zero-knowledge proof information of the first terminal, the ciphertext information is derived based on the public key of the supervisory device, the communication key determined by negotiation between the first terminal and the second terminal, and the first random number generated by the first terminal, the zero-knowledge proof information includes first proof information and / or second proof information, the first proof information is determined based on the ciphertext information, the second proof information is determined based on the ciphertext information and the key negotiation parameters of the first terminal, the first proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and the second proof information is used to verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

[0011] In a third aspect, a key acquisition method is provided, which is applied to a supervisory device, and the method includes:

[0012] The supervisory device receives ciphertext information, wherein the ciphertext information is derived based on a public key of the supervisory device, a communication key determined by negotiation between a first terminal and a second terminal, and a first random number generated by the first terminal, and the first terminal and the second terminal perform sideways communication via a relay terminal.

[0013] The supervisory device decrypts the ciphertext information according to the private key of the supervisory device to obtain the communication key determined by negotiation between the first terminal and the second terminal.

[0014] In a fourth aspect, a verification device is provided for executing the method in the first aspect.

[0015] Specifically, the verification device includes a functional module for executing the method in the above-mentioned first aspect.

[0016] In a fifth aspect, a terminal device is provided for executing the method in the second aspect.

[0017] Specifically, the terminal device includes a functional module for executing the method in the above-mentioned second aspect.

[0018] In a sixth aspect, a supervision device is provided for executing the method in the third aspect.

[0019] Specifically, the supervision device includes a functional module for executing the method in the third aspect above.

[0020] In the seventh aspect, a verification device is provided, comprising a processor and a memory; the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory, so that the verification device executes the method in the above-mentioned first aspect.

[0021] In an eighth aspect, a terminal device is provided, comprising a processor and a memory; the memory is used to store computer programs, and the processor is used to call and run the computer programs stored in the memory, so that the terminal device executes the method in the above-mentioned second aspect.

[0022] In the ninth aspect, a supervisory device is provided, comprising a processor and a memory; the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory, so that the supervisory device executes the method in the third aspect above.

[0023] In a tenth aspect, a device is provided for implementing the method in any one of the first to third aspects above.

[0024] Specifically, the apparatus includes: a processor, configured to call and run a computer program from a memory, so that a device equipped with the apparatus executes the method in any one of the first to third aspects described above.

[0025] In an eleventh aspect, a computer-readable storage medium is provided for storing a computer program, wherein the computer program enables a computer to execute the method in any one of the first to third aspects above.

[0026] In a twelfth aspect, a computer program product is provided, comprising computer program instructions, wherein the computer program instructions enable a computer to execute the method in any one of the above-mentioned first to third aspects.

[0027] In a thirteenth aspect, a computer program is provided, which, when executed on a computer, enables the computer to execute the method in any one of the first to third aspects above.

[0028] Through the above technical solution, the verification device can verify whether the private key of the supervisory device can decrypt the ciphertext information based on zero-knowledge proof information, and verify whether the key decrypted from the ciphertext information is the communication key negotiated and determined by the first terminal and the second terminal. Thus, it can be ensured that the supervisory device can decrypt and obtain the communication key negotiated and determined by the first terminal and the second terminal after obtaining the ciphertext information, and further, the supervisory device can monitor the side communication between the first terminal and the second terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] FIG1 is a schematic diagram of a communication system architecture applied in an embodiment of the present application.

[0030] FIG2 is a schematic flowchart of a key verification method provided according to an embodiment of the present application.

[0031] FIG3 is a schematic flowchart of a first terminal and a second terminal negotiating and determining a communication key according to an embodiment of the present application.

[0032] FIG4 is a schematic flowchart of a key acquisition method provided according to an embodiment of the present application.

[0033] FIG5 is a schematic block diagram of a verification device provided according to an embodiment of the present application.

[0034] FIG6 is a schematic block diagram of a terminal device provided according to an embodiment of the present application.

[0035] FIG7 is a schematic block diagram of a monitoring device provided according to an embodiment of the present application.

[0036] FIG8 is a schematic block diagram of a communication device provided according to an embodiment of the present application.

[0037] FIG9 is a schematic block diagram of a device provided according to an embodiment of the present application.

[0038] FIG10 is a schematic block diagram of a communication system provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0039] The following will describe the technical solutions in the embodiments of this application in conjunction with the drawings in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of the embodiments. With respect to the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0040] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: Global System of Mobile communication (GSM) system, Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, Advanced Long Term Evolution (LTE-A) system, New Radio (NR) system, NR system evolution system, LTE-based access to unlicensed spectrum (LTE-U) system on unlicensed spectrum, NR-based access to unlicensed spectrum (NR-U) system on unlicensed spectrum, Non-Terrestrial Networks (NTN) system, Universal Mobile Telecommunication System (UMTS), Wireless Local Area Networks (WLAN), Internet of Things (IoT), Wireless Fidelity (WFI) system. Fidelity, WiFi), fifth-generation communication (5th-Generation, 5G) system, sixth-generation communication (6G) system or other communication systems.

[0041] Generally speaking, traditional communication systems support a limited number of connections and are easy to implement. However, with the development of communication technology, mobile communication systems will not only support traditional communications, but will also support, for example, device-to-device (D2D) communication, machine-to-machine (M2M) communication, machine type communication (MTC), vehicle-to-vehicle (V2V) communication, sidelink (SL) communication, vehicle-to-everything (V2X) communication, etc. The embodiments of the present application can also be applied to these communication systems.

[0042] In some embodiments, the communication system in the embodiments of the present application can be applied to a carrier aggregation (CA) scenario, a dual connectivity (DC) scenario, an independent (SA) networking scenario, or a non-standalone (NSA) networking scenario.

[0043] In some embodiments, the communication system in the embodiments of the present application can be applied to an unlicensed spectrum, where the unlicensed spectrum can also be considered as a shared spectrum; or, the communication system in the embodiments of the present application can also be applied to an authorized spectrum, where the authorized spectrum can also be considered as an unshared spectrum.

[0044] In some embodiments, the communication system in the embodiments of the present application can be applied to the FR1 frequency band (corresponding to the frequency band range of 410MHz to 7.125GHz), can also be applied to the FR2 frequency band (corresponding to the frequency band range of 24.25GHz to 52.6GHz), and can also be applied to new frequency bands such as high-frequency bands corresponding to the frequency band range of 52.6GHz to 71GHz or the frequency band range of 71GHz to 114.25GHz.

[0045] The embodiments of the present application describe various embodiments in conjunction with terminal devices (such as a first terminal, a second terminal, and a relay terminal), wherein the terminal device may also be referred to as user equipment (UE), an access terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent, or a user device, etc.

[0046] The terminal device can be a station (ST) in a WLAN, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a next-generation communication system such as an NR network, or a terminal device in a future evolved Public Land Mobile Network (PLMN) network, etc.

[0047] In an embodiment of the present application, the terminal device can be deployed on land, including indoors or outdoors, handheld, wearable or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.).

[0048] In an embodiment of the present application, the terminal device may be a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city or a wireless terminal device in a smart home, an in-vehicle communication device, a wireless communication chip / application specific integrated circuit (ASIC) / system on chip (SoC), etc.

[0049] As an example and not a limitation, in the embodiment of the present application, the terminal device may also be a wearable device. Wearable devices may also be called wearable smart devices, which are a general term for wearable devices that are intelligently designed and developed using wearable technology for daily wear, such as glasses, gloves, watches, clothing, and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include those that are fully functional, large in size, and can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various smart bracelets and smart jewelry for vital sign monitoring.

[0050] In an embodiment of the present application, the network device may be a device for communicating with a mobile device. The network device may be an access point (AP) in WLAN, a base station (BTS) in GSM or CDMA, a base station (NodeB, NB) in WCDMA, an evolved base station (eNB or eNodeB) in LTE, or a relay station or access point, or a network device or base station (gNB) or a transmission reception point (TRP) in a vehicle-mounted device, a wearable device, and an NR network, or a network device in a future evolved PLMN network or a network device in an NTN network, etc.

[0051] As an example and not a limitation, in an embodiment of the present application, the network device may have a mobile feature, for example, the network device may be a mobile device. In some embodiments, the network device may be a satellite or a balloon station. For example, the satellite may be a low earth orbit (LEO) satellite, a medium earth orbit (MEO) satellite, a geostationary earth orbit (GEO) satellite, a high elliptical orbit (HEO) satellite, etc. In some embodiments, the network device may also be a base station set up in a location such as land or water.

[0052] In an embodiment of the present application, the network device can provide services for a cell, and the terminal device communicates with the network device through the transmission resources used by the cell (for example, frequency domain resources, or spectrum resources). The cell can be a cell corresponding to the network device (for example, a base station). The cell can belong to a macro base station or a base station corresponding to a small cell. The small cells here may include: metro cells, micro cells, pico cells, femto cells, etc. These small cells have the characteristics of small coverage and low transmission power, and are suitable for providing high-speed data transmission services.

[0053] For example, a communication system 100 used in an embodiment of the present application may be shown in FIG1 . The communication system 100 may include a first terminal 110, a relay terminal 120, and a second terminal 130. The first terminal 110 and the second terminal 130 perform sideways communication via the relay terminal 120. The relay terminal 120 may provide communication coverage for a specific geographic area and may communicate with terminal devices within the coverage area.

[0054] In some embodiments, the communication system 100 may also include other network entities such as access network equipment, a network controller, a mobility management entity, etc., which is not limited in the embodiments of the present application.

[0055] It should be understood that in the embodiments of the present application, a device having a communication function in a network / system may be referred to as a communication device. Taking the communication system 100 shown in FIG1 as an example, the communication device may include a first terminal 110, a relay terminal 120, and a second terminal 130 having a communication function. The first terminal 110, the relay terminal 120, and the second terminal 130 may be the specific devices described above and will not be described in detail here. The communication device may also include other devices in the communication system 100, such as a network controller, a mobility management entity, and other network entities, which are not limited in the embodiments of the present application.

[0056] It should be understood that the terms "system" and "network" are often used interchangeably herein. The term "and / or" is simply a description of an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " generally indicates that the related objects are in an "or" relationship.

[0057] It should be understood that this document relates to a first communication device and a second communication device. The first communication device can be a terminal device, such as a mobile phone, a machine facility, a customer premises equipment (CPE), industrial equipment, a vehicle, etc.; the second communication device can be a peer communication device of the first communication device, such as a terminal device, a mobile phone, industrial equipment, a vehicle, etc. In the embodiment of the present application, the first communication device can be a first terminal, and the second communication device can be a second terminal (i.e., side communication).

[0058] The terms used in the embodiments of this application are intended only to explain the specific embodiments of this application and are not intended to limit this application. The terms "first," "second," "third," and "fourth," etc. in the specification and claims of this application and the accompanying drawings are used to distinguish different objects, not to describe a specific order. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions.

[0059] It should be understood that the "indication" mentioned in the embodiments of this application can be a direct indication, an indirect indication, or an indication of an association. For example, "A indicates B" can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that there is an association between A and B.

[0060] In the description of the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between the two, or an association relationship between the two, or a relationship between indication and being indicated, configuration and being configured, etc.

[0061] In the embodiments of the present application, "pre-definition" or "pre-configuration" may be implemented by pre-storing corresponding codes, tables, or other methods that can be used to indicate relevant information in a device (e.g., a terminal device and a network device). The present application does not limit the specific implementation method. For example, pre-definition may refer to information defined in a protocol.

[0062] In the embodiments of the present application, the “protocol” may refer to a standard protocol in the communications field, for example, it may be an evolution of an existing LTE protocol, NR protocol, Wi-Fi protocol, or a protocol related to other communication systems. The present application does not limit the protocol type.

[0063] To facilitate understanding of the technical solutions of the embodiments of the present application, the technical solutions of the present application are described in detail below through specific embodiments. The following related technologies can be combined with the technical solutions of the embodiments of the present application as optional solutions, and they all fall within the scope of protection of the embodiments of the present application. The embodiments of the present application include at least part of the following contents.

[0064] While surveillance devices can monitor 3GPP (3rd Generation Partnership Project) communication scenarios, they do not cover UE-to-UE relay (UE-to-UE Relay) scenarios. Industry trends suggest that regulation of UE-to-UE relay scenarios is inevitable in the future. Without access to communication keys, such as encryption keys, surveillance devices will be unable to conduct eavesdropping.

[0065] The Diffie-Hellman (DH) key exchange protocol / algorithm is a common technique for end-to-end key negotiation within 3GPP. It can also be used for key negotiation between two UEs in UE-to-UE relay scenarios to determine the communication key. However, current UE-to-UE relay scenarios do not involve interception. If the communication key is negotiated directly between two UEs, the relay terminal and other devices cannot obtain the communication key, nor can they provide the communication key to the supervisory device.

[0066] The Diffie-Hellman (DH) key exchange protocol / algorithm, proposed by Whitefield and Martin Hellman in 1976, is a method for ensuring the secure transmission of shared keys across insecure networks. The ingenuity of the DH (Diffie-Hellman) key exchange protocol / algorithm lies in the fact that two parties seeking secure communication can establish a shared key over an insecure channel without any prior knowledge of the other party. This method can be used to determine a symmetric key, which can then be used for encryption and decryption. However, it is important to note that the DH (Diffie-Hellman) key exchange protocol / algorithm can only be used for key exchange, not for message encryption or decryption. After the communicating parties determine the key to be used, they must use other symmetric key operations and encryption algorithms to encrypt and decrypt messages.

[0067] The Elgamal algorithm is a public key cryptography algorithm that can be used in the DH key exchange protocol / algorithm to establish a shared key between two parties.

[0068] In order to facilitate a better understanding of the embodiments of the present application, the problems solved by the present application are explained.

[0069] Currently, in 3GPP, if a key is negotiated directly between two devices using the DH key exchange protocol / algorithm, such as a UE to UE Relay scenario in 3GPP, no monitoring solution is involved.

[0070] If the DH key exchange protocol / algorithm does not have an appropriate algorithm to assist in key calculation, the following problems are likely to occur:

[0071] 1. No information about the identities of the two parties was provided;

[0072] 2. The DH key exchange protocol / algorithm is computationally intensive and therefore vulnerable to blocking attacks, where the adversary requests a large number of keys and the victim spends a relatively large amount of computing resources solving useless power coefficients instead of doing real work;

[0073] 3. There is no way to prevent replay attacks;

[0074] 4. Vulnerable to man-in-the-middle attacks.

[0075] For example, device A and device B communicate sideways through device C. Device C acts as device B when communicating with device A, and acts as device A when communicating with device B. Both device A and device B negotiate a key with device C, which then allows device C to monitor and pass traffic. A man-in-the-middle attack works as follows:

[0076] (1) Device B sends its public key in a message to device A.

[0077] (2) Device C intercepts and parses the message. Device C saves Device B's public key and sends a message to Device A. This message has Device B's user identity (ID) but uses Device C's public key YC, still appearing to come from Device B. After receiving the message from Device C, Device A stores YC and Device B's user ID together. Similarly, Device C uses YC to send a message to Device B that appears to come from Device A.

[0078] (3) Device B calculates secret key K1 based on private keys XB and YC. Device A calculates secret key K2 based on private keys XA and YC. Device C calculates K1 using private keys XC and YB, and calculates K2 using XC and YA.

[0079] (4) From now on, device C can forward messages from device A to device B or forward messages from device B to device A, modifying their ciphertexts as needed along the way, so that neither device A nor device B knows that they are sharing communications with device C.

[0080] Based on the above problems, this application proposes a solution for a supervisory device to obtain the communication key required for monitoring in a UE to UE Relay scenario. The supervisory device can obtain the communication key required for monitoring in a UE to UE Relay scenario through zero-knowledge proof, thereby realizing monitoring of the UE to UE Relay scenario.

[0081] The technical solution of this application is described in detail below through specific embodiments.

[0082] FIG2 is a schematic flow chart of a key verification method 200 according to an embodiment of the present application. Specifically, in the key verification method 200, a first terminal and a second terminal perform side communication via a relay terminal. As shown in FIG2, the key verification method 200 may include at least part of the following contents:

[0083] S210, the first terminal sends first information; wherein the first information includes a key negotiation parameter, ciphertext information, and zero-knowledge proof information of the first terminal, the ciphertext information is derived based on a public key of a supervisory device, a communication key determined by negotiation between the first terminal and the second terminal, and a first random number generated by the first terminal, the zero-knowledge proof information includes first proof information and / or second proof information, the first proof information is determined based on the ciphertext information, and the second proof information is determined based on the ciphertext information and the key negotiation parameter of the first terminal, the first proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and the second proof information is used to verify whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal;

[0084] S220: The verification device receives the first information.

[0085] In an embodiment of the present application, the verification device can verify whether the private key of the supervisory device can decrypt the ciphertext information based on zero-knowledge proof information, and verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal. Thus, it can be ensured that the supervisory device can decrypt the ciphertext information to obtain the communication key determined by negotiation between the first terminal and the second terminal after obtaining the ciphertext information, and further, the supervisory device can monitor the side communication between the first terminal and the second terminal.

[0086] In some embodiments, the verification device is the relay terminal, or the verification device is a third-party network device. Optionally, in this case, the zero-knowledge proof information includes the first proof information and the second proof information.

[0087] For example, the verification device is the relay terminal, that is, the relay terminal receives the first information sent by the first terminal, and the relay terminal stores all the information contained in the first information. After the verification is passed, the relay terminal uploads part or all of the information contained in the first information to the blockchain so that the supervisory device can obtain the relevant information required for monitoring. The first information is carried by one of the following: Sidelink Control Information (SCI) and PC5-Radio Resource Control (RRC).

[0088] For example, the verification device is a third-party network device, that is, the third-party network device receives the first information sent by the first terminal, and the third-party network device stores all information contained in the first information. After the verification is passed, the third-party network device uploads part or all of the information contained in the first information to the blockchain so that the supervisory device can obtain the relevant information required for monitoring. The information transmission method between the third-party network device and the first terminal can be wireless communication, wired communication, or other media, which is not limited in the embodiments of the present application.

[0089] For example, the verification device is a third-party network device, that is, the first terminal sends the first information to the relay terminal, and the third-party network device receives the first information sent by the relay terminal, and the third-party network device stores all the information contained in the first information, and after the verification is passed, the third-party network device uploads part or all of the information contained in the first information to the blockchain so that the supervisory device can obtain the relevant information required for monitoring. The information transmission method between the third-party network device and the relay terminal can be wireless communication, wired communication, or other media, and the embodiments of the present application are not limited to this.

[0090] In some embodiments, the verification device is the supervisory device. Optionally, in this case, the zero-knowledge proof information includes the second proof information.

[0091] For example, the first terminal sends the first information to the relay terminal, and the supervisory device receives the first information sent by the relay terminal, or the supervisory device obtains the first information through the blockchain. The information transmission method between the supervisory device and the relay terminal may be wireless communication, wired communication, or other media, and is not limited in this embodiment of the present application.

[0092] In some embodiments, the supervisory device may be a device that has obtained monitoring authorization. For example, the supervisory device may be a terminal device, an access network device or a base station, a core network device, a third-party network device, or other devices. The embodiments of the present application do not limit this.

[0093] In some embodiments, the first terminal and the second terminal may determine a communication key through negotiation based on a DH key exchange protocol / algorithm.

[0094] In some embodiments, the embodiments of the present application may be applied not only to sideline communication between a first terminal and a second terminal via a relay terminal, that is, a UE to UE Relay scenario, but also to other scenarios.

[0095] For example, the embodiments of the present application can also be applied to scenarios where UE (such as a first terminal) and UE (such as a second terminal) directly communicate with each other. In this scenario, the verification device can be a third-party network device or a supervision device, that is, the verification device can obtain the first information from the first terminal or the second terminal. After the verification is passed, the supervision device can obtain the communication key between the first terminal and the second terminal, and the first terminal and the second terminal do not need to know the behavior of the supervision device.

[0096] For another example, the embodiments of the present application can also be applied to scenarios where a UE (such as a first terminal) and a zero-power device (such as a second terminal) directly communicate with each other. In this scenario, the verification device can be a third-party network device or a supervisory device, that is, the verification device can obtain the first information from the first terminal or the second terminal. After the verification is passed, the supervisory device can obtain the communication key between the first terminal and the second terminal, and the first terminal and the second terminal do not need to know the behavior of the supervisory device.

[0097] For another example, the embodiments of the present application can also be applied to scenarios where a UE (such as a first terminal) and a vehicle-mounted wireless device (such as a second terminal) directly communicate with each other. In this scenario, the verification device can be a third-party network device or a supervisory device, that is, the verification device can obtain the first information from the first terminal or the second terminal. After the verification is passed, the supervisory device can obtain the communication key between the first terminal and the second terminal, and the first terminal and the second terminal do not need to know the behavior of the supervisory device.

[0098] For another example, the embodiments of the present application can also be applied to scenarios where a UE (such as a first terminal) and a perception device (such as a second terminal) directly communicate. In this scenario, the verification device can be a third-party network device or a supervision device, that is, the verification device can obtain the first information from the first terminal or the second terminal. After the verification is passed, the supervision device can obtain the communication key between the first terminal and the second terminal, and the first terminal and the second terminal do not need to know the behavior of the supervision device.

[0099] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is determined based on a second random number generated by the first terminal and a key negotiation parameter of the second terminal. For example, the second terminal may send the key negotiation parameter of the second terminal to the first terminal, after which the first terminal generates a second random number, and the first terminal determines the communication key between the first terminal and the second terminal based on the second random number and the key negotiation parameter of the second terminal.

[0100] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is determined based on a third random number generated by the second terminal and a key negotiation parameter of the first terminal. For example, the first terminal may send the key negotiation parameter of the first terminal to the second terminal, after which the second terminal generates a third random number, and the second terminal determines the communication key between the first terminal and the second terminal based on the third random number and the key negotiation parameter of the first terminal.

[0101] In some embodiments, the key negotiation parameter of the first terminal may be determined based on a second random number generated by the first terminal. Optionally, the second random number generated by the first terminal is a, and the key negotiation parameter of the first terminal is g0 a mod p, where a∈Z*, Z* is a positive integer domain, g0 is a generator, p is a random prime number, and mod represents a modulo operation.

[0102] In some embodiments, the key negotiation parameter of the second terminal may be determined based on a third random number generated by the second terminal. Optionally, the third random number generated by the second terminal is b, and the key negotiation parameter of the second terminal is g. b mod p, where b∈Z*, Z* is a positive integer domain, g0 is a generator, p is a random prime number, and mod represents a modulo operation.

[0103] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is g0 ab mod p;

[0104] Among them, the key negotiation parameter of the first terminal is g0 a mod p, the key negotiation parameter of the second terminal is g0 b mod p, a is the second random number generated by the first terminal, b is the third random number generated by the second terminal, p is a random prime number, and mod represents a modulo operation.

[0105] In some embodiments, the ciphertext information is encrypted based on the Elgamal algorithm.

[0106] In some embodiments, the ciphertext information is ((g0 ab mod p)h r ,g1 r );

[0107] Among them, the first part of the ciphertext information is (g0 ab mod p)h r , the second part of the ciphertext information is g1 r ;

[0108] Wherein, g0 and g1 are both generators, a is the second random number generated by the first terminal, b is the third random number generated by the second terminal, p is a random prime number, and h=g1 x , r is a first random number generated by the first terminal, g1 and h are both public keys of the supervisory device, x is a private key of the supervisory device, and mod represents a modulo operation.

[0109] For example, g1 is a generator of G, and G is the q-order cyclic group of g1.

[0110] In some embodiments, g0 can be equal to g1. For example, g0 is a generator of G.

[0111] In some embodiments, x∈[1,q-1].

[0112] It should be noted that the private key of the supervisory device is stored by the supervisory device, that is, x is stored by the supervisory device.

[0113] It should be noted that g0 and p are public information of the DH key exchange protocol / algorithm. G, q, g1, and h are the public keys encrypted by the Elgamal algorithm.

[0114] In some embodiments, the first terminal generates the ciphertext information. Specifically, the first terminal generates a first random number r, r∈[1,q-1], and the first terminal calculates c1=(g0 ab mod p)h r , the first terminal calculates c2=g1 r , (c1,c2) ​​is the ciphertext information.

[0115] In some embodiments, the supervisory device can decrypt the ciphertext information. Specifically, the supervisory device calculates s=c2 x , then calculate m = c1 × s -1 , m is the decrypted information, that is, m = g0 ab mod p, where c1=(g0 ab mod p)h r , c2=g1 r , x is the private key of the supervisory device.

[0116] In some embodiments, the process of negotiating and determining the communication key between the first terminal and the second terminal may be as shown in FIG. 3 , and may specifically include part or all of S11 to S18 .

[0117] S11, the first terminal generates a random number a, and calculates the key negotiation parameter g0 of the first terminal based on the random number a a mod p;

[0118] S12, the first terminal sends g0 to the relay terminala mod p;

[0119] S13, the relay terminal sends g0 to the second terminal a mod p;

[0120] S14, the second terminal generates a random number b, and calculates the key negotiation parameter g0 of the second terminal based on the random number b b mod p, based on random numbers b and g0 a mod p calculates the communication key g0 between the first terminal and the second terminal ab mod p;

[0121] S15, the second terminal sends g0 to the relay terminal b mod p and g0 ab mod p;

[0122] S16, the relay terminal saves g0 b mod p and g0 ab mod p;

[0123] S17, the relay terminal sends g0 to the first terminal b mod p;

[0124] S18, the first terminal uses the random numbers a and g0 b mod p calculates the communication key g0 between the first terminal and the second terminal ab mod p.

[0125] In some embodiments, the verification device verifies whether the private key of the supervisory device can decrypt the ciphertext information based on the first proof information; when the verification result corresponding to the first proof information indicates that the private key of the supervisory device can decrypt the ciphertext information, the verification device verifies whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal based on the second proof information; when the verification result corresponding to the second proof information indicates that the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, the verification device sends the ciphertext information to the supervisory device.

[0126] Optionally, the verification device may send the encrypted information to the supervisory device via the blockchain. Of course, the verification device may also send the encrypted information to the supervisory device via other means, which is not limited in this embodiment of the present application.

[0127] In some implementations, the verification device is the relay terminal, or a third-party network device. Specifically, the verification device can verify, based on the first proof information, whether the supervisory device's private key can decrypt the ciphertext information, and, based on the second proof information, verify whether the key decrypted from the ciphertext information is the communication key agreed upon between the first and second terminals. If the verification is successful, the verification device sends the ciphertext information to the supervisory device, which can then decrypt the ciphertext information using its private key and obtain the communication key agreed upon between the first and second terminals.

[0128] In some implementations, the verification device performs zero-knowledge verification based on the first proof information, and when the verification result is that the first random number in the first part of the ciphertext information and the first random number in the second part of the ciphertext information are the same, the verification result corresponding to the first proof information indicates that the private key of the supervisory device can decrypt the ciphertext information. For example, the ciphertext information is (c1, c2), that is, the first part of the ciphertext information is c1, the second part of the ciphertext information is c2, where c1=(g0 ab mod p)h r , c2=g1 r Specifically, the verification device performs zero-knowledge verification based on the first proof information, and when the verification result shows that the random numbers r in c1 and c2 are the same, it can indicate that the private key of the supervisory device can decrypt the ciphertext information.

[0129] In some implementations, the verification device performs zero-knowledge verification based on the second proof information, and if the verification result is that the second random number in the key obtained by decrypting the ciphertext information is the same as the value of the second random number in the key negotiation parameter of the first terminal, the verification result corresponding to the second proof information indicates that the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal. For example, the key obtained by decrypting the ciphertext information is g0 ab mod p, the key negotiation parameter of the first terminal is g0 a mod p, specifically, the verification device performs zero-knowledge verification based on the second proof information, and when the verification result is g0 ab mod p and g0 a If the random number a in mod p is the same, it can indicate that the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

[0130] In some embodiments, the verification device decrypts the ciphertext information according to the private key of the supervisory device; the verification device verifies whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal based on the second proof information; when the verification result corresponding to the second proof information indicates that the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, the verification device decrypts the ciphertext information according to the private key of the supervisory device to obtain the communication key determined by negotiation between the first terminal and the second terminal.

[0131] Optionally, the verification device receives the first information sent by the relay device. Of course, the verification device can also obtain the first information through other devices, which is not limited in this embodiment of the present application.

[0132] In some implementations, the verification device is the supervisory device. That is, the supervisory device decrypts the ciphertext information using the supervisory device's private key; and the supervisory device verifies, based on the second certification information, whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal; if the verification result corresponding to the second certification information indicates that the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, the supervisory device decrypts the ciphertext information using the supervisory device's private key to obtain the communication key determined by negotiation between the first terminal and the second terminal.

[0133] In some implementations, the verification device performs zero-knowledge verification based on the second proof information, and if the verification result is that the second random number in the key obtained by decrypting the ciphertext information is the same as the value of the second random number in the key negotiation parameter of the first terminal, the verification result corresponding to the second proof information indicates that the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal. For example, the key obtained by decrypting the ciphertext information is g0 ab mod p, the key negotiation parameter of the first terminal is g0 a mod p, specifically, the verification device performs zero-knowledge verification based on the second proof information, and when the verification result is g0 ab mod p and g0 a If the random number a in mod p is the same, it can indicate that the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

[0134] In some embodiments, the zero-knowledge proof used in the embodiments of the present application is a linear equality proof, where the linear equality proof can be shown as Formula 1.

[0135]

[0136] Among them, in the linear equality proof algorithm, c,a1,…,a l To make the value public, the prover does not reveal x1,L,x l In this case, the verifier is convinced that he has x1,L,x l and satisfy

[0137] Specifically, the prover proves to the verifier that the element y is (x1,L,x l ) with g1, L, g l ∈G is the discrete logarithm value with the base, and satisfies the linear equality Among them, c and a i For example, the prover may be the first terminal, and the verifier may be the verification device.

[0138] In some embodiments, it is proved that the random numbers r in c1 and c2 in the ciphertext information (c1, c2) are equal, where c1=(g0 ab mod p)h r , c2=g1 r Specifically, the equation is constructed as follows: Let g0 in c1 a Mod p is g, b is m, h is y, r is r1, and let g1 be h and r be r2 in c2, that is, Construct the equation x=c1×c2, thereby proving that 0·m+1·r1+(-1)·r2=0 (i.e., proving that r1=r2).

[0139] Proof: From Z * Select random numbers v1, v2, v3; calculate commitment Satisfy 0·v1+1·v2+(-1)·v3=0; calculate challenge c=H(g,y,h,t,x); calculate response s1=v1-cm ， s2=v2-cr 1， s3=v3-cr2, construct the proof information (s1, s2, s3, t), that is, the first proof information is (s1, s2, s3, t), and send the proof information (s1, s2, s3, t) to the verifier.

[0140] Verifier: Check equality Is it true (if and only if x=c1×c2); Check whether the equation 0·s1+1·s2+(-1)·s3=0 is true (if and only if r1=r2). That is, if and only if x=c1×c2, the equation It holds, and 0·s1+1·s2+(-1)·s3=0 holds if and only if r1=r2. In other words, when 0·s1+1·s2+(-1)·s3=0 holds, the verification result is that the random numbers r in c1 and c2 are the same, which indicates that the private key of the supervisory device can decrypt the ciphertext information.

[0141] In some embodiments, the ciphertext information is (c1, c2), where c1=(g0 ab mod p)h r , c2=g1 r , prove that (g0 ab mod p)h r and g0 a The random number a in mod p is equal. Specifically, the equation is constructed: Let (g0 ab mod p)h r In the equation, h is g, r is m, and g0 b Let y be y, a be r1, and let g0 a In mod p, g0 is h and a is r2, that is, Construct the equation x=c1×c2, and prove that 0·m+1·r1+(-1)·r2=0 (that is, prove r 1 =r2).

[0142] Proof: From Z * Select random numbers v1, v2, v3; calculate commitment 0·v1+1·v2+(-1)·v3=0 ； Calculate the challenge c = H(g, y, h, t, x); calculate the responses s1 = v1-cm, s2 = v2-cr1, s3 = v3-cr2, construct the proof information (s1, s2, s3, t), that is, the second proof information is (s1, s2, s3, t), and send the proof information (s1, s2, s3, t) to the verifier.

[0143] Verifier: Check equality Is it true (if and only if x=c1×c2); Check whether the equation 0·s1+1·s2+(-1)·s3=0 is true (if and only if r1=r2). That is, if and only if x=c1×c2, the equation holds, and 0·s1+1·s2+(-1)·s3=0 holds if and only if r1=r2. In other words, when 0·s1+1·s2+(-1)·s3=0 holds, the verification result is (g0 ab mod p)h r and g0 aThe random number a in mod p is equal, which can indicate that the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

[0144] Therefore, in an embodiment of the present application, the verification device can verify whether the private key of the supervisory device can decrypt the ciphertext information based on the zero-knowledge proof information, and verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal. Thus, it can be ensured that the supervisory device can decrypt the communication key determined by negotiation between the first terminal and the second terminal after obtaining the ciphertext information, and further, the supervisory device can monitor the side communication between the first terminal and the second terminal.

[0145] The above, in combination with Figures 2 to 3, describes in detail the verification device side embodiment of the present application. The following, in combination with Figure 4, describes in detail the supervision device side embodiment of the present application. It should be understood that the supervision device side embodiment and the verification device side embodiment correspond to each other, and similar descriptions can refer to the verification device side embodiment.

[0146] FIG4 is a schematic flow chart of a key acquisition method 300 according to an embodiment of the present application. Specifically, as shown in FIG4 , the key acquisition method 300 may include at least part of the following contents:

[0147] S310: The supervisory device receives ciphertext information; wherein the ciphertext information is derived based on a public key of the supervisory device, a communication key determined by negotiation between a first terminal and a second terminal, and a first random number generated by the first terminal; the first terminal and the second terminal perform sideways communication via a relay terminal;

[0148] S320: The supervisory device decrypts the ciphertext information according to the private key of the supervisory device to obtain a communication key determined by negotiation between the first terminal and the second terminal.

[0149] In some embodiments, the supervisory device receives confirmation information indicating that the zero-knowledge proof information has been verified. Specifically, as described in the key verification method 200 above, the verification device verifies, based on the zero-knowledge proof information, whether the supervisory device's private key can decrypt the ciphertext information, and whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal. After the verification is successful, the verification device may send a confirmation information indicating that the verification is successful.

[0150] In some embodiments, the supervisory device decrypts the ciphertext information after verifying that the confirmation information is valid. That is, the above S320 is performed after the supervisory device verifies that the confirmation information is valid.

[0151] In some embodiments, the supervisory device receives the encrypted information and / or the confirmation information via the blockchain. Of course, the supervisory device may also obtain the encrypted information through other means. Alternatively, the encrypted information and / or the confirmation information may be provided by a verification device.

[0152] In an embodiment of the present application, the verification device can verify whether the private key of the supervisory device can decrypt the ciphertext information based on zero-knowledge proof information, and verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal. Thus, it can be ensured that the supervisory device can decrypt the ciphertext information to obtain the communication key determined by negotiation between the first terminal and the second terminal after obtaining the ciphertext information, and further, the supervisory device can monitor the side communication between the first terminal and the second terminal.

[0153] Optionally, the verification device may generate confirmation information after the verification is successful, and send the confirmation information of the successful verification to the supervisory device, or upload the confirmation information of the successful verification to the blockchain so that the supervisory device can obtain the confirmation information through the blockchain.

[0154] In some embodiments, the verification device is the relay terminal, or the verification device is a third-party network device.

[0155] For example, the verification device is the relay terminal, that is, the relay terminal receives the first information sent by the first terminal, and the relay terminal stores all the information contained in the first information, and after the verification is passed, the relay terminal uploads the ciphertext information to the blockchain so that the supervisory device can obtain the ciphertext information. Optionally, the information transmission method between the relay device and the supervisory device can be wireless communication transmission, wired communication transmission, or transmission through other media, which is not limited in the embodiment of the present application.

[0156] The first information includes the key negotiation parameters, ciphertext information, and zero-knowledge proof information of the first terminal. The ciphertext information is derived based on the public key of the supervisory device, the communication key determined by negotiation between the first terminal and the second terminal, and the first random number generated by the first terminal. The zero-knowledge proof information includes first proof information and / or second proof information. The first proof information is determined based on the ciphertext information, and the second proof information is determined based on the ciphertext information and the key negotiation parameters of the first terminal. The first proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and the second proof information is used to verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal. The first information is carried via one of the following: SCI, PC5-RRC.

[0157] For example, the verification device is a third-party network device, that is, the third-party network device receives the first information sent by the first terminal, and the third-party network device stores all information contained in the first information. After the verification is passed, the third-party network device uploads the ciphertext information contained in the first information to the blockchain so that the supervisory device can obtain the ciphertext information. The information transmission method between the third-party network device and the first terminal can be wireless communication, wired communication, or other media, which is not limited in the embodiments of the present application.

[0158] For example, the verification device is a third-party network device, that is, the first terminal sends the first information to the relay terminal, and the third-party network device receives the first information sent by the relay terminal, and the third-party network device stores all the information contained in the first information, and after the verification is passed, the third-party network device uploads the ciphertext information contained in the first information to the blockchain so that the supervisory device can obtain the ciphertext information. The information transmission method between the third-party network device and the relay terminal can be wireless communication, wired communication, or other media, and the embodiments of the present application are not limited to this.

[0159] In some embodiments, the supervisory device may be a device that has obtained monitoring authorization. The supervisory device may be a terminal device, an access network device, a core network device, or other devices, which is not limited in the embodiments of the present application.

[0160] In some embodiments, the first terminal and the second terminal may determine a communication key through negotiation based on a DH key exchange protocol / algorithm.

[0161] In some embodiments, the embodiments of the present application may be applied not only to sideline communication between a first terminal and a second terminal via a relay terminal, that is, a UE to UE Relay scenario, but also to other scenarios.

[0162] For example, the embodiments of the present application can also be applied to scenarios where UE (such as a first terminal) and UE (such as a second terminal) directly communicate with each other. In this scenario, the verification device can be a third-party network device or a supervision device, that is, the verification device can obtain the first information from the first terminal or the second terminal. After the verification is passed, the supervision device can obtain the communication key between the first terminal and the second terminal, and the first terminal and the second terminal do not need to know the behavior of the supervision device.

[0163] For another example, the embodiments of the present application can also be applied to scenarios where a UE (such as a first terminal) and a zero-power device (such as a second terminal) directly communicate with each other. In this scenario, the verification device can be a third-party network device or a supervisory device, that is, the verification device can obtain the first information from the first terminal or the second terminal. After the verification is passed, the supervisory device can obtain the communication key between the first terminal and the second terminal, and the first terminal and the second terminal do not need to know the behavior of the supervisory device.

[0164] For another example, the embodiments of the present application can also be applied to scenarios where a UE (such as a first terminal) and a vehicle-mounted wireless device (such as a second terminal) directly communicate with each other. In this scenario, the verification device can be a third-party network device or a supervisory device, that is, the verification device can obtain the first information from the first terminal or the second terminal. After the verification is passed, the supervisory device can obtain the communication key between the first terminal and the second terminal, and the first terminal and the second terminal do not need to know the behavior of the supervisory device.

[0165] For another example, the embodiments of the present application can also be applied to scenarios where a UE (such as a first terminal) and a perception device (such as a second terminal) directly communicate. In this scenario, the verification device can be a third-party network device or a supervision device, that is, the verification device can obtain the first information from the first terminal or the second terminal. After the verification is passed, the supervision device can obtain the communication key between the first terminal and the second terminal, and the first terminal and the second terminal do not need to know the behavior of the supervision device.

[0166] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is determined based on a second random number generated by the first terminal and a key negotiation parameter of the second terminal. For example, the second terminal may send the key negotiation parameter of the second terminal to the first terminal, after which the first terminal generates a second random number, and the first terminal determines the communication key between the first terminal and the second terminal based on the second random number and the key negotiation parameter of the second terminal.

[0167] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is determined based on a third random number generated by the second terminal and a key negotiation parameter of the first terminal. For example, the first terminal may send the key negotiation parameter of the first terminal to the second terminal, after which the second terminal generates a third random number, and the second terminal determines the communication key between the first terminal and the second terminal based on the third random number and the key negotiation parameter of the first terminal.

[0168] In some embodiments, the key negotiation parameter of the first terminal may be determined based on a second random number generated by the first terminal. Optionally, the second random number generated by the first terminal is a, and the key negotiation parameter of the first terminal is g0 amod p, where a∈Z*, Z* is a positive integer domain, g0 is a generator, p is a random prime number, and mod represents a modulo operation.

[0169] In some embodiments, the key negotiation parameter of the second terminal may be determined based on a third random number generated by the second terminal. Optionally, the third random number generated by the second terminal is b, and the key negotiation parameter of the second terminal is g. b mod p, where b∈Z*, Z* is a positive integer domain, g0 is a generator, p is a random prime number, and mod represents a modulo operation.

[0170] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is g0 ab mod p;

[0171] Among them, the key negotiation parameter of the first terminal is g0 a mod p, the key negotiation parameter of the second terminal is g0 b mod p, a is the second random number generated by the first terminal, b is the third random number generated by the second terminal, p is a random prime number, and mod represents a modulo operation.

[0172] In some embodiments, the ciphertext information is encrypted based on the Elgamal algorithm.

[0173] In some embodiments, the ciphertext information is ((g0 ab mod p)h r ,g1 r );

[0174] Among them, the first part of the ciphertext information is (g0 ab mod p)h r , the second part of the ciphertext information is g1 r ;

[0175] Wherein, g0 and g1 are both generators, a is the second random number generated by the first terminal, b is the third random number generated by the second terminal, p is a random prime number, and h=g1 x , r is a first random number generated by the first terminal, g1 and h are both public keys of the supervisory device, x is a private key of the supervisory device, and mod represents a modulo operation.

[0176] For example, g1 is a generator of G, and G is the q-order cyclic group of g1.

[0177] In some embodiments, g0 can be equal to g1. For example, g0 is a generator of G.

[0178] In some embodiments, x∈[1,q-1].

[0179] It should be noted that the private key of the supervisory device is stored by the supervisory device, that is, x is stored by the supervisory device.

[0180] It should be noted that g0 and p are public information of the DH key exchange protocol / algorithm. G, q, g1, and h are the public keys encrypted by the Elgamal algorithm.

[0181] In some embodiments, the first terminal generates the ciphertext information. Specifically, the first terminal generates a first random number r, r∈[1,q-1], and the first terminal calculates c1=(g0 ab mod p)h r , the first terminal calculates c2=g1 r , (c1,c2) ​​is the ciphertext information.

[0182] In some embodiments, the supervisory device can decrypt the ciphertext information. Specifically, the supervisory device calculates s=c2 x , then calculate m = c1 × s -1 , m is the decrypted information, that is, m = g0 ab mod p, where c1=(g0 ab mod p)h r , c2=g1 r , x is the private key of the supervisory device.

[0183] Therefore, in an embodiment of the present application, the verification device can verify whether the private key of the supervisory device can decrypt the ciphertext information based on the zero-knowledge proof information, and verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal. Thus, it can be ensured that the supervisory device can decrypt the communication key determined by negotiation between the first terminal and the second terminal after obtaining the ciphertext information, and further, the supervisory device can monitor the side communication between the first terminal and the second terminal.

[0184] The above text, in combination with Figures 2 to 4, describes in detail the method embodiment of the present application. The following text, in combination with Figures 5 to 10, describes in detail the device embodiment of the present application. It should be understood that the device embodiment and the method embodiment correspond to each other, and similar descriptions can refer to the method embodiment.

[0185] FIG5 shows a schematic block diagram of a verification device 400 according to an embodiment of the present application. As shown in FIG5 , the verification device 400 includes:

[0186] The communication unit 410 is configured to receive first information;

[0187] Among them, the first information includes the key negotiation parameters, ciphertext information and zero-knowledge proof information of the first terminal. The ciphertext information is derived based on the public key of the supervisory device, the communication key determined by negotiation between the first terminal and the second terminal, and the first random number generated by the first terminal. The zero-knowledge proof information includes first proof information and second proof information. The first proof information is determined based on the ciphertext information, and the second proof information is determined based on the ciphertext information and / or the key negotiation parameters of the first terminal. The first proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information. The second proof information is used to verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal. The first terminal and the second terminal communicate sideways through the relay terminal.

[0188] In some embodiments, the verification device 400 further includes: a processing unit 420;

[0189] The processing unit 420 is configured to verify, based on the first certification information, whether the private key of the supervisory device can decrypt the ciphertext information;

[0190] If the verification result corresponding to the first certification information indicates that the private key of the supervisory device can decrypt the ciphertext information, the processing unit 420 is configured to verify, based on the second certification information, whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal;

[0191] When the verification result corresponding to the second certification information indicates that the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, the communication unit 410 is further configured to send the ciphertext information to the supervision device.

[0192] In some embodiments, the communication unit 410 is specifically configured to:

[0193] The encrypted information is sent to the supervisory device via the blockchain.

[0194] In some embodiments, the verification device is the relay terminal, or the verification device is a third-party network device.

[0195] In some embodiments, the verification device 400 further includes: a processing unit 420;

[0196] The processing unit 420 is configured to decrypt the ciphertext information according to the private key of the supervisory device;

[0197] The processing unit 420 is configured to verify, based on the second certification information, whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal;

[0198] When the verification result corresponding to the second proof information indicates that the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, the processing unit 420 is used to obtain the communication key determined by negotiation between the first terminal and the second terminal.

[0199] In some embodiments, the communication unit 410 is specifically configured to:

[0200] Receive the first information sent by the relay device.

[0201] In some embodiments, the verification device is the supervisory device.

[0202] In some embodiments, the processing unit 420 is specifically configured to:

[0203] Zero-knowledge verification is performed based on the first proof information, and when the verification result is that the first random number in the first part of the ciphertext information is the same as the value of the first random number in the second part of the ciphertext information, the verification result corresponding to the first proof information indicates that the private key of the supervisory device can decrypt the ciphertext information.

[0204] In some embodiments, the processing unit 420 is specifically configured to:

[0205] Zero-knowledge verification is performed based on the second proof information, and when the verification result is that the second random number in the key obtained by decrypting the ciphertext information is the same as the value of the second random number in the key negotiation parameter of the first terminal, the verification result corresponding to the second proof information indicates that the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

[0206] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is determined based on a second random number generated by the first terminal and a key negotiation parameter of the second terminal; and / or,

[0207] The communication key determined by negotiation between the first terminal and the second terminal is determined based on a third random number generated by the second terminal and a key negotiation parameter of the first terminal.

[0208] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is g0 ab mod p;

[0209] Among them, the key negotiation parameter of the first terminal is g0 a mod p, the key negotiation parameter of the second terminal is g0 b mod p, a is the second random number, b is the third random number, p is a random prime number, and mod represents a modulo operation.

[0210] In some embodiments, the ciphertext information is ((g0 ab mod p)h r ,g1 r );

[0211] Among them, the first part of the ciphertext information is (g0 ab mod p)h r , the second part of the ciphertext information is g1 r ;

[0212] Wherein, g0 and g1 are both generators, a is the second random number generated by the first terminal, b is the third random number generated by the second terminal, p is a random prime number, and h=g1 x , r is a first random number generated by the first terminal, g1 and h are both public keys of the supervisory device, x is a private key of the supervisory device, and mod represents a modulo operation.

[0213] In some embodiments, the communication unit may be a communication interface or a transceiver, or an input / output interface of a communication chip or a system on chip. The processing unit may be one or more processors.

[0214] It should be understood that the verification device 400 according to the embodiment of the present application may correspond to the verification device in the embodiment of the method of the present application, and the above-mentioned and other operations and / or functions of each unit in the verification device 400 are respectively for realizing the corresponding processes of the verification device in the method 200 shown in Figure 2. For the sake of brevity, they will not be repeated here.

[0215] FIG6 shows a schematic block diagram of a terminal device 500 according to an embodiment of the present application. The terminal device 500 is a first terminal, and the first terminal and the second terminal perform side communication via a relay terminal. As shown in FIG6 , the terminal device 500 includes:

[0216] The communication unit 510 is configured to send first information;

[0217] Among them, the first information includes the key negotiation parameters, ciphertext information and zero-knowledge proof information of the first terminal, the ciphertext information is derived based on the public key of the supervisory device, the communication key determined by negotiation between the first terminal and the second terminal, and the first random number generated by the first terminal, the zero-knowledge proof information includes first proof information and / or second proof information, the first proof information is determined based on the ciphertext information, the second proof information is determined based on the ciphertext information and the key negotiation parameters of the first terminal, the first proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and the second proof information is used to verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

[0218] In some embodiments, the first certification information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, including:

[0219] The first proof information is used to verify the device for zero-knowledge verification, and when the verification result is that the first random number in the first part of the ciphertext information is the same as the value of the first random number in the second part of the ciphertext information, the verification result corresponding to the first proof information indicates that the private key of the supervisory device can decrypt the ciphertext information.

[0220] In some embodiments, the second certification information is used to verify whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, including:

[0221] The second proof information is used by the verification device to perform zero-knowledge verification, and when the verification result is that the second random number in the key decrypted from the ciphertext information is the same as the value of the second random number in the key negotiation parameter of the first terminal, the verification result corresponding to the second proof information indicates that the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

[0222] In some embodiments, the verification device is the relay terminal, or the verification device is a third-party network device, or the verification device is the supervisory device.

[0223] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is determined based on a second random number generated by the first terminal and a key negotiation parameter of the second terminal; and / or,

[0224] The communication key determined by negotiation between the first terminal and the second terminal is determined based on a third random number generated by the second terminal and a key negotiation parameter of the first terminal.

[0225] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is g0 ab mod p;

[0226] Among them, the key negotiation parameter of the first terminal is g0 a mod p, the key negotiation parameter of the second terminal is g0 b mod p, a is the second random number, b is the third random number, p is a random prime number, and mod represents a modulo operation.

[0227] In some embodiments, the ciphertext information is ((g0 ab mod p)h r ,g1 r );

[0228] Among them, the first part of the ciphertext information is (g0 ab mod p)h r , the second part of the ciphertext information is g1 r ;

[0229] Wherein, g0 and g1 are both generators, a is the second random number generated by the first terminal, b is the third random number generated by the second terminal, p is a random prime number, and h=g1 x , r is a first random number generated by the first terminal, g1 and h are both public keys of the supervisory device, x is a private key of the supervisory device, and mod represents a modulo operation.

[0230] In some embodiments, the communication unit may be a communication interface or a transceiver, or an input / output interface of a communication chip or a system on chip.

[0231] It should be understood that the terminal device 500 according to the embodiment of the present application may correspond to the first terminal in the embodiment of the method of the present application, and the above-mentioned and other operations and / or functions of each unit in the terminal device 500 are respectively for implementing the corresponding processes of the first terminal in the method 200 shown in Figure 2. For the sake of brevity, they will not be repeated here.

[0232] FIG7 shows a schematic block diagram of a supervisory device 600 according to an embodiment of the present application. As shown in FIG7 , the supervisory device 600 includes:

[0233] Communication unit 610, configured to receive ciphertext information; wherein the ciphertext information is derived based on the public key of the supervisory device, a communication key determined by negotiation between the first terminal and the second terminal, and a first random number generated by the first terminal, the first terminal and the second terminal performing sideways communication via the relay terminal;

[0234] The processing unit 620 is configured to decrypt the ciphertext information according to the private key of the supervisory device to obtain a communication key determined by negotiation between the first terminal and the second terminal.

[0235] In some embodiments, the communication unit 610 is specifically configured to:

[0236] The encrypted information is received through the blockchain.

[0237] In some embodiments, the communication unit 610 is further configured to receive confirmation information indicating that the zero-knowledge proof information has been verified, wherein the zero-knowledge proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and to verify whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal;

[0238] The processing unit 620 is specifically configured to:

[0239] After verifying that the confirmation information is valid, the ciphertext information is decrypted according to the private key of the supervisory device.

[0240] In some embodiments, the communication unit 610 is specifically configured to:

[0241] The confirmation information that the zero-knowledge proof information has been verified is received through the blockchain.

[0242] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is determined based on a second random number generated by the first terminal and a key negotiation parameter of the second terminal; and / or,

[0243] The communication key determined by negotiation between the first terminal and the second terminal is determined based on a third random number generated by the second terminal and a key negotiation parameter of the first terminal.

[0244] In some embodiments, the communication key determined by negotiation between the first terminal and the second terminal is g0 ab mod p;

[0245] Among them, the key negotiation parameter of the first terminal is g0 a mod p, the key negotiation parameter of the second terminal is g0 b mod p, a is the second random number, b is the third random number, p is a random prime number, and mod represents a modulo operation.

[0246] In some embodiments, the ciphertext information is ((g0 ab mod p)h r ,g1 r );

[0247] Among them, the first part of the ciphertext information is (g0 ab mod p)h r , the second part of the ciphertext information is g1 r ;

[0248] Wherein, g0 and g1 are both generators, a is the second random number generated by the first terminal, b is the third random number generated by the second terminal, p is a random prime number, and h=g1 x , r is a first random number generated by the first terminal, g1 and h are both public keys of the supervisory device, x is a private key of the supervisory device, and mod represents a modulo operation.

[0249] In some embodiments, the communication unit may be a communication interface or a transceiver, or an input / output interface of a communication chip or a system on chip. The processing unit may be one or more processors.

[0250] It should be understood that the supervision device 600 according to the embodiment of the present application may correspond to the supervision device in the embodiment of the method of the present application, and the above-mentioned and other operations and / or functions of each unit in the supervision device 600 are respectively for implementing the corresponding processes of the supervision device in the method 300 shown in Figure 4. For the sake of brevity, they will not be repeated here.

[0251] Figure 8 is a schematic structural diagram of a communication device 700 provided in an embodiment of the present application. The communication device 700 shown in Figure 8 includes a processor 710, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0252] In some embodiments, as shown in FIG8 , the communication device 700 may further include a memory 720. The processor 710 may call and execute a computer program from the memory 720 to implement the method in the embodiment of the present application.

[0253] The memory 720 may be a separate device independent of the processor 710 , or may be integrated into the processor 710 .

[0254] In some embodiments, as shown in FIG8 , the communication device 700 may further include a transceiver 730 , and the processor 710 may control the transceiver 730 to communicate with other devices. Specifically, the transceiver 730 may send information or data to other devices or receive information or data sent by other devices.

[0255] The transceiver 730 may include a transmitter and a receiver. The transceiver 730 may further include an antenna, and the number of antennas may be one or more.

[0256] In some embodiments, the processor 710 can implement the functions of the processing unit in the verification device, or the processor 710 can implement the functions of the processing unit in the terminal device, or the processor 710 can implement the functions of the processing unit in the supervision device. For the sake of brevity, it will not be repeated here.

[0257] In some embodiments, the transceiver 730 may implement the functions of a communication unit in a terminal device, which will not be described in detail here for the sake of brevity.

[0258] In some embodiments, the transceiver 730 may implement the functionality of a communication unit in the verification device, which will not be described in detail here for the sake of brevity.

[0259] In some embodiments, the transceiver 730 may implement the function of a communication unit in the supervisory device, which will not be described in detail here for the sake of brevity.

[0260] In some embodiments, the communication device 700 may specifically be a verification device of an embodiment of the present application, and the communication device 700 may implement the corresponding processes implemented by the verification device in each method of the embodiment of the present application. For the sake of brevity, they will not be repeated here.

[0261] In some embodiments, the communication device 700 may specifically be a terminal device of an embodiment of the present application, and the communication device 700 may implement the corresponding processes implemented by the terminal device in each method of the embodiment of the present application. For the sake of brevity, they will not be repeated here.

[0262] In some embodiments, the communication device 700 may specifically be a supervisory device in an embodiment of the present application, and the communication device 700 may implement the corresponding processes implemented by the supervisory device in each method in the embodiment of the present application. For the sake of brevity, they will not be described here.

[0263] Figure 9 is a schematic structural diagram of an apparatus according to an embodiment of the present application. The apparatus 800 shown in Figure 9 includes a processor 810, which can call and execute a computer program from a memory to implement the method according to the embodiment of the present application.

[0264] In some embodiments, as shown in FIG9 , the apparatus 800 may further include a memory 820 , wherein the processor 810 may call and execute a computer program from the memory 820 to implement the method in the embodiment of the present application.

[0265] The memory 820 may be a separate device independent of the processor 810 , or may be integrated into the processor 810 .

[0266] In some embodiments, the apparatus 800 may further include an input interface 830. The processor 810 may control the input interface 830 to communicate with other devices or chips, and specifically, may obtain information or data sent by other devices or chips. Optionally, the processor 810 may be located inside or outside the chip.

[0267] In some embodiments, the processor 810 can implement the functions of a processing unit in a terminal device, or the processor 810 can implement the functions of a processing unit in a verification device, or the processor 810 can implement the functions of a processing unit in a supervision device. For the sake of brevity, it will not be repeated here.

[0268] In some embodiments, the input interface 830 may implement the function of a communication unit in a terminal device, or the input interface 830 may implement the function of a communication unit in a verification device, or the input interface 830 may implement the function of a communication unit in a supervisory device.

[0269] In some embodiments, the apparatus 800 may further include an output interface 840. The processor 810 may control the output interface 840 to communicate with other devices or chips, specifically, to output information or data to other devices or chips. Optionally, the processor 810 may be located inside or outside the chip.

[0270] In some embodiments, the output interface 840 may implement the function of a communication unit in a terminal device, or the output interface 840 may implement the function of a communication unit in a supervisory device, or the output interface 840 may implement the function of a communication unit in a verification device.

[0271] In some embodiments, the apparatus can be applied to the verification device in the embodiments of the present application, and the apparatus can implement the corresponding processes implemented by the verification device in each method of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0272] In some embodiments, the apparatus can be applied to the supervisory device in the embodiments of the present application, and the apparatus can implement the corresponding processes implemented by the supervisory device in the various methods in the embodiments of the present application. For the sake of brevity, they will not be described here.

[0273] In some embodiments, the apparatus can be applied to the terminal device in the embodiments of the present application, and the apparatus can implement the corresponding processes implemented by the terminal device in the various methods in the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0274] In some embodiments, the device mentioned in the embodiments of the present application may also be a chip, such as a system-on-chip, a system-on-chip, a chip system, or a system-on-chip chip.

[0275] FIG10 is a schematic block diagram of a communication system 900 provided in an embodiment of the present application. As shown in FIG10 , the communication system 900 includes a first terminal 910 , a relay terminal 920 , a second terminal 930 , and a supervisory device 940 .

[0276] Among them, the first terminal 910 can be used to implement the corresponding functions implemented by the first terminal in the above method, the relay terminal 920 can be used to implement the corresponding functions implemented by the relay terminal in the above method, and the supervision device 940 can be used to implement the corresponding functions implemented by the supervision device in the above method. For the sake of brevity, they will not be repeated here.

[0277] It should be understood that the processor of the embodiments of the present application may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method embodiment can be completed by hardware integrated logic circuits in the processor or software instructions. The above processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0278] It is understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0279] It should be understood that the above-mentioned memories are exemplary but not restrictive. For example, the memories in the embodiments of the present application may also be static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM RAM (DR RAM), etc. In other words, the memories in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0280] An embodiment of the present application also provides a computer-readable storage medium for storing a computer program.

[0281] In some embodiments, the computer-readable storage medium can be applied to the verification device in the embodiments of the present application, and the computer program enables the computer to execute the corresponding processes implemented by the verification device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0282] In some embodiments, the computer-readable storage medium can be applied to the terminal device in the embodiments of the present application, and the computer program enables the computer to execute the corresponding processes implemented by the terminal device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0283] In some embodiments, the computer-readable storage medium can be applied to the supervision device in the embodiments of the present application, and the computer program enables the computer to execute the corresponding processes implemented by the supervision device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0284] An embodiment of the present application also provides a computer program product, including computer program instructions.

[0285] In some embodiments, the computer program product can be applied to the verification device in the embodiments of the present application, and the computer program instructions enable the computer to execute the corresponding processes implemented by the verification device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0286] In some embodiments, the computer program product can be applied to the terminal device in the embodiments of the present application, and the computer program instructions enable the computer to execute the corresponding processes implemented by the terminal device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0287] In some embodiments, the computer program product can be applied to the supervision device in the embodiments of the present application, and the computer program instructions enable the computer to execute the corresponding processes implemented by the supervision device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0288] The embodiment of the present application also provides a computer program.

[0289] In some embodiments, the computer program can be applied to the verification device in the embodiments of the present application. When the computer program runs on a computer, the computer executes the corresponding processes implemented by the verification device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0290] In some embodiments, the computer program can be applied to the terminal device in the embodiments of the present application. When the computer program runs on the computer, the computer executes the corresponding processes implemented by the terminal device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0291] In some embodiments, the computer program can be applied to the supervision device in the embodiments of the present application. When the computer program runs on a computer, the computer executes the corresponding processes implemented by the supervision device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0292] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0293] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0294] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0295] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0296] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0297] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. In view of this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0298] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A key verification method, characterized in that: Applied to a verification device, the method includes: The verification device receives first information; Among them, the first information includes the key negotiation parameters, ciphertext information and zero-knowledge proof information of the first terminal, the ciphertext information is derived based on the public key of the supervisory device, the communication key determined by negotiation between the first terminal and the second terminal, and the first random number generated by the first terminal, the zero-knowledge proof information includes first proof information and second proof information, the first proof information is determined based on the ciphertext information, and the second proof information is determined based on the ciphertext information and / or the key negotiation parameters of the first terminal, the first proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and the second proof information is used to verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, and the first terminal and the second terminal perform side communication through the relay terminal.

2. The method according to claim 1, wherein The method further comprises: The verification device verifies, based on the first certification information, whether the private key of the supervisory device can decrypt the ciphertext information; If the verification result corresponding to the first certification information indicates that the private key of the supervisory device can decrypt the ciphertext information, the verification device verifies, based on the second certification information, whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal; When the verification result corresponding to the second certification information indicates that the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, the verification device sends the ciphertext information to the supervision device.

3. The method according to claim 2, wherein The verification device sending the encrypted information to the supervision device includes: The verification device sends the encrypted information to the supervision device through the blockchain.

4. The method according to claim 2 or 3, wherein: The verification device is the relay terminal, or the verification device is a third-party network device.

5. The method according to claim 1, wherein The method further comprises: The verification device decrypts the ciphertext information according to the private key of the supervisory device; The verification device verifies, based on the second certification information, whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal; When the verification result corresponding to the second proof information indicates that the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, the verification device obtains the communication key determined by negotiation between the first terminal and the second terminal.

6. The method according to claim 5, wherein The verification device receives first information, including: The verification device receives the first information sent by the relay device.

7. The method according to claim 5 or 6, wherein: The verification device is the supervision device.

8. The method according to any one of claims 2 to 4, characterized in that The verification device verifies, based on the first certification information, whether the private key of the supervisory device can decrypt the ciphertext information, including: The verification device performs zero-knowledge verification based on the first proof information, and when the verification result is that the first random number in the first part of the ciphertext information is the same as the value of the first random number in the second part of the ciphertext information, the verification result corresponding to the first proof information indicates that the private key of the supervisory device can decrypt the ciphertext information.

9. The method according to any one of claims 2 to 8, characterized in that The verification device verifies, based on the second certification information, whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, including: The verification device performs zero-knowledge verification based on the second proof information, and when the verification result is that the second random number in the key decrypted from the ciphertext information is the same as the value of the second random number in the key negotiation parameter of the first terminal, the verification result corresponding to the second proof information indicates that the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

10. The method according to any one of claims 1 to 9, characterized in that The communication key determined by negotiation between the first terminal and the second terminal is determined based on a second random number generated by the first terminal and a key negotiation parameter of the second terminal; and / or, The communication key determined by negotiation between the first terminal and the second terminal is determined based on a third random number generated by the second terminal and a key negotiation parameter of the first terminal.

11. The method according to claim 10, wherein The communication key determined by negotiation between the first terminal and the second terminal is g0 ab mod p; Among them, the key negotiation parameter of the first terminal is g0 a mod p, the key negotiation parameter of the second terminal is g0 b mod p, a is the second random number, b is the third random number, p is a random prime number, and mod represents a modulo operation.

12. The method according to any one of claims 1 to 11, characterized in that The ciphertext information is ((g0 ab mod p)h r ,g1 r ); The first part of the ciphertext information is (g0 ab mod p)h r , the second part of the ciphertext information is g1 r ; Wherein, g0 and g1 are both generators, a is the second random number generated by the first terminal, b is the third random number generated by the second terminal, p is a random prime number, and h=g1 x , r is a first random number generated by the first terminal, g1 and h are both public keys of the supervisory device, x is a private key of the supervisory device, and mod represents a modulo operation.

13. A key verification method, characterized in that: Applied to a first terminal, the first terminal and a second terminal perform sideline communication via a relay terminal, the method comprising: The first terminal sends first information; Among them, the first information includes the key negotiation parameters, ciphertext information and zero-knowledge proof information of the first terminal, the ciphertext information is derived based on the public key of the supervisory device, the communication key determined by negotiation between the first terminal and the second terminal, and the first random number generated by the first terminal, the zero-knowledge proof information includes first proof information and / or second proof information, the first proof information is determined based on the ciphertext information, and the second proof information is determined based on the ciphertext information and the key negotiation parameters of the first terminal, the first proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and the second proof information is used to verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

14. The method according to claim 13, wherein The first certification information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, including: The first proof information is used to verify the device for zero-knowledge verification, and when the verification result is that the first random number in the first part of the ciphertext information is the same as the value of the first random number in the second part of the ciphertext information, the verification result corresponding to the first proof information indicates that the private key of the supervisory device can decrypt the ciphertext information.

15. The method according to claim 13, wherein The second certification information is used to verify whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, including: The second proof information is used by the verification device to perform zero-knowledge verification, and when the verification result is that the second random number in the key decrypted from the ciphertext information is the same as the value of the second random number in the key negotiation parameter of the first terminal, the verification result corresponding to the second proof information indicates that the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

16. The method according to claim 14 or 15, characterized in that The verification device is the relay terminal, or the verification device is a third-party network device, or the verification device is the supervision device.

17. The method according to any one of claims 13 to 16, characterized in that The communication key determined by negotiation between the first terminal and the second terminal is determined based on a second random number generated by the first terminal and a key negotiation parameter of the second terminal; and / or, The communication key determined by negotiation between the first terminal and the second terminal is determined based on a third random number generated by the second terminal and a key negotiation parameter of the first terminal.

18. The method according to claim 17, wherein The communication key determined by negotiation between the first terminal and the second terminal is g0 ab mod p; Among them, the key negotiation parameter of the first terminal is g0 a mod p, the key negotiation parameter of the second terminal is g0 b mod p, a is the second random number, b is the third random number, p is a random prime number, and mod represents a modulo operation.

19. The method according to any one of claims 13 to 18, wherein The ciphertext information is ((g0 ab mod p)h r ,g1 r ); The first part of the ciphertext information is (g0 ab mod p)h r , the second part of the ciphertext information is g1 r ; Wherein, g0 and g1 are both generators, a is the second random number generated by the first terminal, b is the third random number generated by the second terminal, p is a random prime number, and h=g1 x , r is a first random number generated by the first terminal, g1 and h are both public keys of the supervisory device, x is a private key of the supervisory device, and mod represents a modulo operation.

20. A key acquisition method, characterized in that: Applied to a supervisory device, the method includes: The supervisory device receives ciphertext information; wherein the ciphertext information is derived based on a public key of the supervisory device, a communication key determined by negotiation between a first terminal and a second terminal, and a first random number generated by the first terminal, and the first terminal and the second terminal perform sideways communication via a relay terminal; The supervisory device decrypts the ciphertext information according to the private key of the supervisory device to obtain the communication key determined by negotiation between the first terminal and the second terminal.

21. The method according to claim 20, wherein The supervisory device receives encrypted information, including: The supervisory device receives the encrypted information through the blockchain.

22. The method according to claim 20 or 21, wherein: The method further comprises: The supervisory device receives confirmation information indicating that the zero-knowledge proof information has been verified, wherein the zero-knowledge proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and whether the key obtained by decrypting the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal; The supervisory device decrypting the ciphertext information according to the private key of the supervisory device includes: After verifying that the confirmation information is valid, the supervisory device decrypts the ciphertext information according to the private key of the supervisory device.

23. The method according to claim 22, wherein The supervisory device receives confirmation information indicating that the zero-knowledge proof information has been verified, including: The supervisory device receives the confirmation information that the zero-knowledge proof information has been verified through the blockchain.

24. The method according to any one of claims 20 to 23, wherein The communication key determined by negotiation between the first terminal and the second terminal is determined based on a second random number generated by the first terminal and a key negotiation parameter of the second terminal; and / or, The communication key determined by negotiation between the first terminal and the second terminal is determined based on a third random number generated by the second terminal and a key negotiation parameter of the first terminal.

25. The method of claim 24, wherein: The communication key determined by negotiation between the first terminal and the second terminal is g0 ab mod p; Among them, the key negotiation parameter of the first terminal is g0 a mod p, the key negotiation parameter of the second terminal is g0 b mod p, a is the second random number, b is the third random number, p is a random prime number, and mod represents a modulo operation.

26. The method according to any one of claims 20 to 25, characterized in that The ciphertext information is ((g0 ab mod p)h r ,g1 r ); The first part of the ciphertext information is (g0 ab mod p)h r , the second part of the ciphertext information is g1 r ; Wherein, g0 and g1 are both generators, a is the second random number generated by the first terminal, b is the third random number generated by the second terminal, p is a random prime number, and h=g1 x , r is a first random number generated by the first terminal, g1 and h are both public keys of the supervisory device, x is a private key of the supervisory device, and mod represents a modulo operation.

27. A verification device, characterized in that: include: a communication unit, configured to receive first information; Among them, the first information includes the key negotiation parameters, ciphertext information and zero-knowledge proof information of the first terminal, the ciphertext information is derived based on the public key of the supervisory device, the communication key determined by negotiation between the first terminal and the second terminal, and the first random number generated by the first terminal, the zero-knowledge proof information includes first proof information and second proof information, the first proof information is determined based on the ciphertext information, and the second proof information is determined based on the ciphertext information and / or the key negotiation parameters of the first terminal, the first proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and the second proof information is used to verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal, and the first terminal and the second terminal perform side communication through the relay terminal.

28. A terminal device, characterized in that: The terminal device is a first terminal, and the first terminal and the second terminal perform side communication via a relay terminal. The terminal device includes: a communication unit, configured to send first information; Among them, the first information includes the key negotiation parameters, ciphertext information and zero-knowledge proof information of the first terminal, the ciphertext information is derived based on the public key of the supervisory device, the communication key determined by negotiation between the first terminal and the second terminal, and the first random number generated by the first terminal, the zero-knowledge proof information includes first proof information and / or second proof information, the first proof information is determined based on the ciphertext information, and the second proof information is determined based on the ciphertext information and the key negotiation parameters of the first terminal, the first proof information is used to verify whether the private key of the supervisory device can decrypt the ciphertext information, and the second proof information is used to verify whether the key decrypted from the ciphertext information is the communication key determined by negotiation between the first terminal and the second terminal.

29. A monitoring device, characterized in that: include: a communication unit configured to receive ciphertext information, wherein the ciphertext information is derived based on a public key of the supervisory device, a communication key determined by negotiation between a first terminal and a second terminal, and a first random number generated by the first terminal, wherein the first terminal and the second terminal perform sideways communication via a relay terminal; The processing unit is configured to decrypt the ciphertext information according to the private key of the supervisory device to obtain a communication key determined by negotiation between the first terminal and the second terminal.

30. A verification device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, so that the verification device executes the method according to any one of claims 1 to 12.

31. A terminal device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, so that the terminal device executes the method according to any one of claims 13 to 19.

32. A monitoring device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, so that the supervision device executes the method according to any one of claims 20 to 26.

33. A chip, characterized in that: include: A processor for calling and running a computer program from a memory so that a device equipped with the chip performs the method according to any one of claims 1 to 12, or a device equipped with the chip performs the method according to any one of claims 13 to 19, or a device equipped with the chip performs the method according to any one of claims 20 to 26.

34. A computer-readable storage medium, characterized in that Used to store a computer program, when the computer program is executed, the method according to any one of claims 1 to 12 is implemented, or the method according to any one of claims 13 to 19 is implemented, or the method according to any one of claims 20 to 26 is implemented.

35. A computer program product, characterized in that The method comprises computer program instructions, and when the computer program instructions are executed, the method according to any one of claims 1 to 12 is implemented, or the method according to any one of claims 13 to 19 is implemented, or the method according to any one of claims 20 to 26 is implemented.

36. A computer program, characterized in that When the computer program is executed, the method according to any one of claims 1 to 12 is implemented, or the method according to any one of claims 13 to 19 is implemented, or the method according to any one of claims 20 to 26 is implemented.

Images