Mesh network-oriented certificateless identity authentication method and device

Abstract

The invention discloses a certificateless identity authentication method and device for a mesh network. The method comprises the following steps: a key generation center KGC distributes system public parameters to terminal equipment; the terminal equipment generates a first public key and a first private key based on the system public parameters, and sends identity information to a key generation center KGC; the key generation center KGC generates a second private key and a second public key based on the identity information and the system public parameters, and sends the second private key and the second public key to the terminal equipment; the terminal device generates a target public key and a target private key with the second public key and the second private key based on the first public key and the first private key; and when any two terminal devices in the mesh network request to perform data interaction, the two terminal devices perform identity authentication based on the system public parameters, the target public key and the target private key, and complete encrypted data transmission during authentication. According to the invention, identity authentication can be carried out on the terminal equipment in the mesh network without a certificate, consumption of computing resources and electric quantity is reduced, and communication security of the mesh network is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of identity authentication, and in particular to a certificateless identity authentication method and system for a mesh network. Background Art

[0002] At present, mesh networks have the advantages of high reliability, low power consumption and simple network configuration. Based on this, more and more users choose mesh networks to break through the limitations of traditional routing networks.

[0003] In the application scenario of mesh network, the equipment is based on embedded chipsets or modules for operation and data transmission. At this time, the control instructions can be tampered by invading the equipment, thereby controlling the operation of the equipment in the mesh network. Therefore, it is very important to ensure that the data content in the mesh network is not obtained by unauthorized users.

[0004] In the prior art, data confidentiality and non-repudiation can be ensured by encrypting and signing data in a mesh network. However, encrypting and signing data consumes a lot of computing resources and power of the device, and the devices in the mesh network are usually limited in computing and power consumption. As a result, the device may not be able to respond to user instructions in time, giving users a bad experience. Summary of the invention

[0005] The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

[0006] To this end, the present invention proposes a certificateless identity authentication method for mesh networks, which can authenticate terminal devices in the mesh network without certificates, reducing the consumption of computing resources and power, improving user experience, and ensuring the communication security between terminal devices in the mesh network.

[0007] Another object of the present invention is to provide a certificateless identity authentication device for mesh networks.

[0008] To achieve the above object, the present invention proposes a certificateless identity authentication method for a mesh network, wherein the mesh network includes a key generation center KGC and multiple terminal devices, and the method includes:

[0009] The key generation center KGC distributes system public parameters to the terminal device;

[0010] The terminal device generates a first public key and a first private key based on the received system public parameters, and sends identity information to the key generation center KGC, wherein the identity information includes the first public key;

[0011] The key generation center KGC generates a second private key and a second public key of the terminal device based on the received identity information and the system public parameters, and sends the second private key and the second public key to the terminal device;

[0012] The terminal device generates a corresponding target public key and a target private key based on the first public key and the first private key and the received second public key and the second private key;

[0013] When any two terminal devices in the mesh network request data exchange, the two terminal devices perform identity authentication based on the system public parameters and the corresponding target public key and target private key, and complete encrypted data transmission while verifying.

[0014] The certificateless identity authentication method for mesh networks according to the embodiment of the present invention may also have the following additional technical features:

[0015] In one embodiment of the present invention, the key generation center KGC distributes system public parameters to the terminal device, including:

[0016] Get a prime number p, and based on the prime number p, generate a tuple {p, F p ,G p ,P}, where the G p is the elliptic curve F p The additive cyclic group of the points on G p The generator of

[0017] Determine the master key s, and generate the system public key P based on the master key s and the tuple pub ,in, is a set of positive integers;

[0018] The G p 、The F p , the P, the system public key P pub , the first Hash function H0, the second Hash function H1 and the third Hash function H2, are determined as the system common parameters params={F p ,G p ,P,P pub ,H0,H1,H2}, where the first hash function H0: It represents the addition of a {0, 1} bit string of arbitrary length and 3 additive groups G p The elements in are mapped to positive integers less than P; the second hash function H1:G p ×G p ×G p ×Gp ×{0,1} * →{0,1} n , which means that the 4 additive groups G p The elements in and a {0, 1} bit string of arbitrary length are mapped to a {0, 1} bit string of length n; the third hash function H2: It means to add three additive groups G p The elements in and 3 {0, 1} bit strings of arbitrary length are mapped to positive integers less than P;

[0019] Distribute the system common parameters to the terminal device.

[0020] In one embodiment of the present invention, the terminal device generates a first public key and a first private key based on the received system public parameters, and sends identity information to the key generation center KGC, including:

[0021] The terminal device i determines the corresponding secret value x i , and the secret value x i As the first private key,

[0022] Based on the parameter P in the system public parameters and the first private key x i , the corresponding first public key X is obtained by calculation i , where X i =x i ×P;

[0023] The identity ID of the terminal device i and the first public key X i The identity information is determined to be the identity information, and the identity information is sent to the key generation center KGC.

[0024] In one embodiment of the present invention, the key generation center KGC generates the second private key and the second public key of the terminal device based on the received identity information and the system public parameters, and sends the second private key and the second public key to the terminal device, including:

[0025] Randomly generate the first parameter r i , and based on the first parameter r i and the parameter P in the system public parameter to generate the second public key R i , where R i =r i ×P,

[0026] Based on the identity ID in the identity information i and the first public key X i, the first parameter r i , the second public key R i , the master key s, the system public key P pub and the prime number p, generate the second private key d i ;

[0027] Send the second public key R to the terminal device through a secure channel i and the second private key d i .

[0028] In one embodiment of the present invention, the terminal device generates a corresponding target public key and a target private key based on the received second public key and the received second private key, including:

[0029] The terminal device verifies the correctness of the second public key and the second private key;

[0030] When the verification is successful, the second private key d i and the first private key x i , determined as the corresponding target private key;

[0031] The second public key R i and the first public key X i , determine the corresponding target public key.

[0032] In one embodiment of the present invention, the two terminal devices include a first terminal device and a second terminal device; the two terminal devices perform identity authentication based on the system public parameters and the corresponding target public key and target private key, and complete encrypted data transmission at the same time of authentication, including:

[0033] The second terminal device B sends an authentication request to the first terminal device A, wherein the authentication request includes the identity ID of the second terminal device B. B 、Target public key PK B =(first public key X B , the second public key R B );

[0034] The first terminal device A is based on the identity ID of the second terminal device B B 、Target public key PK B and the plaintext m to be sent to generate a signature result to be verified, and send the signature result to be verified to the second terminal device B;

[0035] The second terminal device B is based on the corresponding first private key x B 、Second private key d B , the second public key R B and ID BVerifying the signature result to be verified to obtain a first target verification result;

[0036] If the first target verification result is verification passed, the second terminal device B completes the identity authentication of the first terminal device A and securely obtains the plaintext m sent by the first terminal device A.

[0037] In one embodiment of the present invention, the first terminal device A is based on the identity ID of the second terminal device B. B 、Target public key PK B The plaintext m to be sent generates the signature result to be verified, including:

[0038] The first terminal device A randomly generates a second parameter l, where:

[0039] Based on the second parameter l, the system public parameter and the identity ID of the second terminal device B B and the target public key PK B , the plaintext m to be invented is encrypted by the first formula to generate the third parameter ψ=(L,W,C), where the first formula is:

[0040] L = l × P;

[0041] h 0B =H0(ID B ,R B ,X B ,P pub );

[0042] T A =l×(R B +h 0B ×P pub +X B );

[0043] H=H2(L,T A ,τ,ID A ,ID B ,X A );

[0044] W=d A +l×H+x A mod p;

[0045] K=H1(T A ,L,X A ,R B ,ID B );

[0046]

[0047] Among them, X A is the first public key of the first terminal device A, x A is the first private key of the first terminal device A, d A is the second private key of the first terminal device A, ID A is the identity ID of the first terminal device A, τ is the timestamp, and m is the plain text;

[0048] The third parameter ψ, the timestamp τ, the identity ID of the first terminal device A A and the target public key PK A =(first public key X A , the second public key R A ) and is determined as the signature result to be verified.

[0049] In one embodiment of the present invention, the second terminal device B is based on the corresponding first private key x B 、Second private key d B , the second public key R B and ID B Verifying the signature result to be verified to obtain a first target verification result includes:

[0050] The second terminal device B is based on the corresponding first private key x B 、Second private key d B , the second public key R B and ID B , the system public parameters and the signature result to be verified, and generate the fourth parameter T through the second formula A ', the fifth parameter h 0A and a sixth parameter H′, wherein the second formula is:

[0051] T A ′=(d B +x B )×L;

[0052] h 0A =H0(ID A ,R A ,X A ,P pub );

[0053] H′=H2(L,T′ A ,τ,ID A ,ID B ,X A );

[0054] If the signature result to be verified and the first public key R of the first terminal device A A and the second public key X A , the fifth parameter h0A and the sixth parameter H′ satisfies the third formula, then the first target verification result is verification passed, wherein the third formula is W×P=R A +h 0A ×P pub +H′×L+X A ; Otherwise, the first target verification result is not verified;

[0055] If the first target verification result is that the verification is passed, the second terminal device B calculates the plaintext m using the fourth formula, wherein the fourth formula is:

[0056] K=H1(T′ A ,L,X A ,R B ,ID B );

[0057] m=K⊕C.

[0058] In one embodiment of the present invention, the system public parameters further include a fourth Hash function, wherein the fourth Hash function H4: {0,1} * →{0,1} n , indicating that a {0, 1} bit string of arbitrary length is mapped to a {0, 1} bit string of length n; the method further comprises:

[0059] After obtaining the plain text m, the second terminal device B calculates the plain text m by using the fifth formula to obtain the seventh parameter Hm, and sends the seventh parameter to the first terminal device A, wherein the fifth formula is: Hm=H4(m);

[0060] The first terminal device A receives the seventh parameter Hm sent by the second terminal device, and uses the plain text m to calculate the eighth parameter Hm′ through the fifth formula, and determines whether the seventh parameter is equal to the eighth parameter. If it is determined that the seventh parameter is equal to the eighth parameter, the second target verification result is obtained as verification passed;

[0061] If the second target verification result is verification passed, the first terminal device A completes the identity authentication of the second terminal device B, and the first terminal device A confirms that the second terminal device B correctly receives and decrypts the plaintext m.

[0062] To achieve the above object, the present invention provides a certificateless identity authentication device for a mesh network, wherein the mesh network includes a key generation center KGC and multiple terminal devices, and the device includes:

[0063] A first sending module, used for the key generation center KGC to distribute system public parameters to the terminal device;

[0064] A first generating module, configured for the terminal device to generate a first public key and a first private key based on the received system public parameters, and send identity information to the key generation center KGC, wherein the identity information includes the first public key;

[0065] A second generating module, configured for the key generation center KGC to generate a second private key and a second public key of the terminal device based on the received identity information and the system public parameters, and to send the second private key and the second public key to the terminal device;

[0066] A third generating module, configured for the terminal device to generate a corresponding target public key and a target private key based on the first public key and the first private key and the received second public key and the second private key;

[0067] The identity authentication module is used for performing identity authentication based on the system public parameters and the corresponding target public key and target private key when any two terminal devices in the mesh network request data interaction, and completing encrypted data transmission at the same time as the authentication.

[0068] The certificateless identity authentication method and device for mesh networks of the embodiments of the present invention can authenticate terminal devices in the mesh network without certificates, thereby reducing the consumption of computing resources and power, improving user experience, and ensuring the communication security between terminal devices in the mesh network.

[0069] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0071] Figure 1 is a flow chart of a certificateless identity authentication method for a mesh network according to an embodiment of the present invention;

[0072] Figure 2 is a flow chart of interaction between a key generation center and a terminal device according to an embodiment of the present invention;

[0073] Figure 3 is an interaction flow chart of two terminal devices according to an embodiment of the present invention;

[0074] Figure 4 is a comparison chart of the calculation efficiency of different solutions according to an embodiment of the present invention;

[0075] Figure 5 4 is a structural diagram of a certificateless identity authentication device for a mesh network according to an embodiment of the present invention. DETAILED DESCRIPTION

[0076] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0077] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0078] The following describes a certificateless identity authentication method and device for a mesh network proposed according to an embodiment of the present invention with reference to the accompanying drawings.

[0079] Figure 1 The present invention is a flowchart of a certificateless identity authentication method for a mesh network according to an embodiment of the present invention.

[0080] like Figure 1 As shown, the method includes:

[0081] Step 101: The key generation center KGC distributes system public parameters to terminal devices.

[0082] In one embodiment of the present invention, the mesh network may include a key generation center KGC and multiple terminal devices. In one embodiment of the present invention, before multiple terminal devices in the mesh network are networked and transmit data, it is necessary to determine the private key and public key of each terminal device so that identity authentication and data transmission can be performed according to their respective private keys and public keys. In addition, in one embodiment of the present invention, the terminal device needs to interact with the key generation center to determine the corresponding private key and public key.

[0083] Specifically, in one embodiment of the present invention, the method for the key generation center KGC to distribute system public parameters to terminal devices may include the following steps:

[0084] Step 1011, obtain the sum of prime numbers p, and based on the prime number p, generate a tuple {p, F p ,G p ,P}, where G p is the elliptic curve F p The additive cyclic group of the points on Gp The generator of

[0085] In one embodiment of the present invention, the prime number p can be obtained by user input or random selection. And, in one embodiment of the present invention, the above-mentioned tuple {p, F p ,G p ,P} The method is the same as the prior art, and the embodiments of the present disclosure will not be described in detail here.

[0086] Step 1012: determine the master key s, and generate the system public key P based on the master key s and the tuple pub ,in, is a set of positive integers;

[0087] In one embodiment of the present invention, the master key s may be determined by random selection.

[0088] And, in one embodiment of the present invention, after determining the master key s, the system public key P can be obtained by calculation based on the master key s and P in the above tuple: pub , where P pub =s×P.

[0089] Step 1013: G p 、F p , P, system public key P pub , the first hash function H0, the second hash function H1 and the third hash function H2 are determined as system public parameters

[0090] params = {F p ,G p ,P,P pub ,H0,H1,H2};

[0091] In one embodiment of the present invention, the first hash function H0 is: It means that a {0, 1} bit string of arbitrary length and 3 additive groups G p The elements in are mapped to positive integers less than P; the second hash function H1:G p ×G p ×G p ×G p ×{0,1} * →{0,1} n , which means that the 4 additive groups G p The elements in and a {0, 1} bit string of arbitrary length are mapped to a {0, 1} bit string of length n; the third hash function H2: It means to add three additive groups G pThe elements in and three {0, 1} bit strings of arbitrary length are mapped to positive integers less than P.

[0092] Step 1014: Distribute system common parameters to terminal devices.

[0093] In one embodiment of the present invention, after the key generation center determines the system public parameters through the above steps, it can distribute the system public parameters to each terminal device in the mesh network.

[0094] Step 102: The terminal device generates a first public key and a first private key based on the received system public parameters, and sends identity information to a key generation center KGC.

[0095] In one embodiment of the present invention, after the terminal device receives the system public parameters sent by the key generation center, the terminal device can generate identity information based on the received system public parameters, and send the identity information to the key generation center KGC, so that the key generation center KGC can subsequently generate a second public key and a second private key based on the identity information.

[0096] Specifically, in one embodiment of the present invention, the method in which the terminal device generates a first public key and a first private key based on the received system public parameters and sends identity information to the key generation center KGC may include the following steps:

[0097] Step 1021, terminal device i determines the corresponding secret value x i , and the secret value x i As the first private key,

[0098] In one embodiment of the present invention, the terminal device i can determine the corresponding secret value x by random selection. i .

[0099] Step 1022: based on the parameter P in the system public parameters and the first private key x i , the corresponding first public key X is obtained by calculation i , where X i =x i ×P;

[0100] Step 1023: The identity ID of the terminal device i and the first public key X i The identity information is determined to be identity information, and the identity information is sent to the key generation center KGC.

[0101] Step 103: The key generation center KGC generates a second private key and a second public key of the terminal device based on the received identity information and system public parameters, and sends the second private key and the second public key to the terminal device.

[0102] In one embodiment of the present invention, after receiving the identity information and system public parameters sent by the terminal device, the key generation center KGC can generate a second private key and a second public key of the terminal device based on the received identity information and system public parameters, and send the second private key and the second public key to the terminal device.

[0103] Specifically, in one embodiment of the present invention, the key generation center KGC generates a second private key and a second public key of a terminal device based on the received identity information and system public parameters, and sends the second private key and the second public key to the terminal device. The method may include the following steps:

[0104] Step 1031, randomly generate a first parameter r i , and based on the first parameter r i Generate the second public key R with the parameter P in the system public parameters i , where R i =r i ×P,

[0105] Step 1032, based on the identity ID in the identity information i and the first public key X i , the first parameter r i , the second public key R i , master key s, system public key P pub and prime number p, generate the second private key d i ;

[0106] Among them, in one embodiment of the present invention, the identity ID in the identity information is i and the first public key X i , the first parameter r i , the second public key R i , master key s, system public key P pub and prime number p, generate the second private key d i The method may include: based on the identity ID in the identity information i and the first public key X i , the first parameter r i , the second public key R i , master key s, system public key P pub and prime number p, generate the second private key d through the private key formula i , where the private key formula is:

[0107] h 0i =H0(ID i ,R i ,X i ,P pub );

[0108] d i =r i +s×h 0i mod p.

[0109] Step 1033: Send the second public key R to the terminal device through a secure channel i and the second private key d i .

[0110] Step 104: The terminal device generates a corresponding target public key and a target private key based on the first public key and the first private key and the received second public key and the second private key.

[0111] In one embodiment of the present invention, after receiving the second public key and the second private key sent by the key generation center, the terminal device can generate a corresponding target public key and a target private key based on the received second public key and the second private key.

[0112] Specifically, in one embodiment of the present invention, a method for a terminal device to generate a corresponding target public key and a target private key based on a first public key and a first private key and a received second public key and a second private key may include the following steps:

[0113] Step 1041, the terminal device verifies the correctness of the second public key and the second private key;

[0114] In one embodiment of the present invention, after the terminal device receives the second public key and the second private key, it is necessary to verify the correctness of the second public key and the second private key to determine whether the received second public key and the second private key are correct.

[0115] And, in one embodiment of the present invention, if the second public key R i and the second private key d i Satisfy i ×P=R i +h 0i ×P pub , then determine the second public key R i and the second private key d i Pass the correctness verification; otherwise, fail the correctness verification. In one embodiment of the present invention, if the correctness verification fails, the terminal device sends a message indicating that the correctness verification fails to be passed to the key generation center, and after the key generation center receives the message indicating that the correctness verification fails to be passed, it resends the second public key and the second private key to the terminal device until the correctness verification passes.

[0116] Step 1042, when verification is successful, the second private key d i and the first private key x i , determined as the corresponding target private key;

[0117] Among them, in one embodiment of the present invention, when the verification is passed, the first private key d i and the first private key x i , determined as the corresponding target private key SK i =(d i ,x i ).

[0118] Step 1043: The second public key R i and the first public key X i , determine the corresponding target public key.

[0119] In one embodiment of the present invention, the second public key R i and the first public key X i , determined as the corresponding target public key PK i =(X i ,R i ).

[0120] Step 105: When any two terminal devices in the mesh network request data exchange, the two terminal devices perform identity authentication based on the system public parameters and the corresponding target public key and target private key, and complete encrypted data transmission at the same time as the authentication.

[0121] In one embodiment of the present invention, each terminal device in the mesh network can determine the target private key and the target public key through the above steps, and when any two terminal devices in the mesh network request data interaction, the two terminal devices perform identity authentication based on the system public parameters and the corresponding target public key and target private key, and complete encrypted data transmission at the same time as the authentication.

[0122] Specifically, in one embodiment of the present invention, the above-mentioned arbitrary two terminal devices may include a first terminal device and a second terminal device, and the above-mentioned two terminal devices perform identity authentication based on system public parameters and corresponding target public keys and target private keys, and the method for completing encrypted data transmission during authentication may include the following steps:

[0123] Step 1051: The second terminal device B sends an authentication request to the first terminal device A, wherein the authentication request includes the identity ID of the second terminal device B. B 、Target public key PK B =(first public key X B , the second public key R B );

[0124] Step 1052: The first terminal device A uses the identity ID of the second terminal device B to B 、Target public key PK BGenerate a signature result to be verified with the plaintext m to be sent, and send the signature result to be verified to the second terminal device B;

[0125] In one embodiment of the present invention, the first terminal device A is based on the identity ID of the second terminal device B. B 、Target public key PK B The method for generating a signature result to be verified with the plaintext m to be sent may include the following steps:

[0126] Step 10521: The first terminal device A randomly generates a second parameter l, where:

[0127] Step 10522: Based on the second parameter l, the system public parameter and the identity ID of the second terminal device B B and the target public key PK B , the plaintext m to be sent is signed using the first formula to generate the third parameter ψ=(L, W, C), where the first formula is:

[0128] L = l × P;

[0129] h 0B =H0(ID B ,R B ,X B ,P pub );

[0130] T A =l×(R B +h 0B ×P pub +X B );

[0131] H=H2(L,T A ,τ,ID A ,ID B ,X A );

[0132] W=d A +l×H+x A mod p;

[0133] K=H1(T A ,l,X A ,R B ,ID B );

[0134]

[0135] Among them, X A is the first public key of the first terminal device A, x A is the first private key of the first terminal device A, dA is the second private key of the first terminal device A, ID A is the identity ID of the first terminal device A, τ is the timestamp, and m is the plain text;

[0136] Step 10523: The third parameter ψ, the timestamp τ, and the identity ID of the first terminal device A are A and the target public key PK A =(first public key X A , the second public key R A ) and is determined as the signature result to be verified.

[0137] Step 1053: The second terminal device B uses the corresponding first private key x B 、Second private key d B , the second public key R B and ID B Verify the signature result to be verified to obtain a first target verification result;

[0138] In one embodiment of the present invention, after receiving the signature result to be verified sent by the first terminal device, the second terminal device B can verify the signature result to be verified to obtain the first target verification result.

[0139] Specifically, in one embodiment of the present invention, the second terminal device B is based on the corresponding first private key x B 、Second private key d B , the second public key R B and ID B The method for verifying the signature result to be verified and obtaining the first target verification result may include the following steps:

[0140] Step 10531: The second terminal device B uses the corresponding first private key x B 、Second private key d B , the second public key R B and ID B , system public parameters and the signature result to be verified, and generate the fourth parameter T′ through the second formula A 、The fifth parameter h 0A and the sixth parameter H′, where the second formula is:

[0141] T′ A =(d B +x B )×L;

[0142] h 0A =H0(ID A ,R A ,X A ,P pub );

[0143] H′=H2(L,T′ A ,τ,ID A ,ID B ,X A );

[0144] Step 10532: If the signature result to be verified and the first public key R of the first terminal device A A and the second public key X A 、The fifth parameter h 0A and the sixth parameter H′ satisfies the third formula, then the first target verification result is verification passed, where the third formula is W×P=R A +h 0A ×P pub +H′×L+X A ; Otherwise, the first target verification result is not verified.

[0145] Among them, in one embodiment of the present invention, the above T A ′=(d B +x B )×L=(r B +h 0B s+x B )×l×P=l×(R B +h 0B ×P pub +X B )=T A ; H′=H2(L,T A ′,τ,ID A ,ID B ,X A )=H. Therefore, W·P=(d A +lH+x A )·P=R A +h 0A ·P pub +H′·L+X A .

[0146] Step 1054: If the first target verification result is that the verification is passed, the second terminal device B calculates the plain text m using the fourth formula, where the fourth formula is:

[0147] K=H1(T′ A ,L,X A ,R B ,ID B );

[0148]

[0149] Among them, in one embodiment of the present invention, if the first target verification result is passed, the second terminal device B and the first terminal device A pass the identity authentication and can obtain the plaintext m transmitted simultaneously; if the first target verification result is not passed, the second terminal device B and the first terminal device A fail to pass the identity authentication and cannot perform subsequent data transmission.

[0150] Furthermore, in one embodiment of the present invention, the system common parameters may further include a fourth hash function, wherein the fourth hash function H4: {0,1} * →{0,1} n , indicating that a {0, 1} bit string of arbitrary length is mapped to a {0, 1} bit string of length n; when the second terminal device B completes the identity authentication of the first terminal device A and securely obtains the plaintext m sent by the first terminal device A, the above method may further include the following steps:

[0151] Step 1054: After obtaining the plain text m, the second terminal device B calculates the plain text m using the fifth formula to obtain the seventh parameter Hm, and sends the seventh parameter to the first terminal device A, wherein the fifth formula is: Hm=H4(m);

[0152] Step 1055: The first terminal device A receives the seventh parameter Hm sent by the second terminal device, and uses the plain text m to calculate the eighth parameter Hm′ through the fifth formula, and determines whether the seventh parameter is equal to the eighth parameter. If it is determined that the seventh parameter is equal to the eighth parameter, the second target verification result is obtained as verification passed.

[0153] In one embodiment of the present invention, the first terminal device A can obtain the eighth parameter Hm′ through the fifth formula.

[0154] Also, in one embodiment of the present invention, after the first terminal device A receives the seventh parameter Hm sent by the second terminal device, it compares the eighth parameter Hm′ with the seventh parameter Hm to determine whether the eighth parameter Hm′ is equal to the seventh parameter Hm; if the eighth parameter Hm′ is equal to the seventh parameter Hm, the second target verification result is verification passed; if the eighth parameter Hm′ is not equal to the seventh parameter Hm, the second target verification result is verification failed.

[0155] Step 1056: If the second target verification result is verification passed, the first terminal device A completes the identity authentication of the second terminal device B, and the first terminal device A confirms that the second terminal device B correctly receives and decrypts the plaintext m.

[0156] In one embodiment of the present invention, if the second target verification result is not verified, the first terminal device A and the second terminal device B cannot perform subsequent data transmission.

[0157] Based on the above description, Figure 2 This is a flowchart of the interaction between a key generation center and a terminal device proposed in an embodiment of the present invention. Figure 2 As shown, the interaction method between the key generation center and the terminal device may include the following steps:

[0158] Step 201: The key generation center KGC generates system common parameters params={F p ,G p ,P,P pub ,H0,H1,H2};

[0159] Step 202: The key generation center KGC distributes system public parameters to the terminal device;

[0160] Step 203: The terminal device randomly selects a first private key x i , and based on the parameter P in the system public parameters and the first private key x i , through X i =x i ×P calculates the corresponding first public key X i ,in,

[0161] Step 204: The terminal device sends the identity ID to the key generation center KGC. i and the first public key X i ;

[0162] Step 205: The key generation center generates a key based on the received identity ID. i 、First public key X i and the system public parameters to generate the second private key d of the terminal device i and the second public key R i ;

[0163] Step 206: The key generation center sends the second private key d to the terminal device. i and the second public key R i ;

[0164] Step 207: The terminal device verifies the correctness of the second public key and the second private key, and after the verification is passed, the second private key d i and the first private key x i , determined as the corresponding target private key SK i =(d i ,x i ), the first public key R i and the second public key X i , determine the corresponding target public key PK i =(X i ,R i ).

[0165] Based on the above description, Figure 3 FIG. 1 is a flow chart of interaction between two terminal devices proposed in an embodiment of the present invention. Figure 3 As shown, the interaction method between the first terminal device A and the second terminal device B may include the following steps:

[0166] Step 301: The second terminal device B sends the identity ID of the second terminal device B to the first terminal device A. B 、Target public key PK B =(first public key X B , the second public key R B );

[0167] Step 302: The first terminal device A randomly generates a second parameter l, where:

[0168] Based on the second parameter l, the system public parameter and the identity ID of the second terminal device B B and the target public key PK B , the plaintext m to be sent is signed using the first formula to generate the third parameter ψ=(L, W, C), where the first formula is:

[0169] L = l × P;

[0170] h 0B =H0(ID B ,R B ,X B ,P pub );

[0171] T A =l×(R B +h 0B ×P pub +X B );

[0172] H=H2(L,T A ,τ,ID A ,ID B ,X A );

[0173] W=d A +l×H+x A mod p;

[0174] K=H1(T A ,L,X A ,R B ,ID B );

[0175]

[0176] Among them, X A is the first public key of the first terminal device A, x A is the first private key of the first terminal device A, d A is the second private key of the first terminal device A, ID A is the identity ID of the first terminal device A, τ is the timestamp, and m is the plain text;

[0177] The third parameter ψ, the timestamp τ, and the identity ID of the first terminal device A are A and the target public key PK A =(first public key X A , the second public key R A ) and is determined as the signature result to be verified.

[0178] Step 303: The first terminal device A sends the signature result to be verified to the second terminal device B, where the signature result to be verified includes the third parameter ψ, the timestamp τ, the identity ID of the first terminal device A, and the A and the target public key PK A =(first public key X A , the second public key R A );

[0179] Step 304: The second terminal device B uses the corresponding first private key x b 、Second private key d B , the second public key R B and ID B , system public parameters and the signature result to be verified, and generate the fourth parameter T through the second formula A ', the fifth parameter h 0A and the sixth parameter H′, where the second formula is:

[0180] T A ′=(d B +x B )×L;

[0181] h 0A =H0(ID A ,R A ,X A ,P pub );

[0182] H′=H2(L,T A ′,τ,ID A ,ID B ,X A );

[0183] If the signature result to be verified, the second public key R of the first terminal device A A and the first public key X A、The fifth parameter h 0A and the sixth parameter H′ satisfies the third formula, then the first target verification result is verification passed, where the third formula is W×P=R A +h 0A ×P pub +H′×L+X A ; Otherwise, the first target verification result is not verified.

[0184] It should be noted that, in one embodiment of the present invention, the above certificateless identity authentication scheme may be attacked by two types of adversaries: Type I adversary A I and Type II Adversary A II . A I Without knowing the master key, A can replace any user's public key. I Also known as a malicious user. II Knowing the master key but being unable to replace the user's public key means that a malicious KGC can generate a partial private key for the user. Under the condition of basic security, the above scheme should at least have confidentiality and unforgeability.

[0185] (I) A I Confidentiality under Quasi-Adversarial Attacks

[0186] Definition 1: Confidentiality under attack by a class I adversary. If the attacker A I The above scheme is IND-CLSC-CCA2-I secure if it has a non-negligible advantage in winning Game1 without probabilistic polynomial time.

[0187] Game 1 process is as follows:

[0188] (1) Initialization phase: Let the challenger be C I , run the system initialization algorithm to generate system public parameters params and master key msk, and send params to A I , confidential msk.

[0189] (2) Stage 1: Adversary A I Perform polynomial bounded query

[0190] Public key generation query: Adversary A I Provide identity ID i , Challenger C I Send the corresponding public key to adversary A I .

[0191] Hash query: Adversary A I When asking for the value of the hash function, C I Send it to A I .

[0192] Partial key generation query: A I Provide identity ID i , C I The corresponding partial private key is generated by the partial key generation algorithm and sent to A I .

[0193] Private key generation query: A I Provide identity ID i , C I Query the user's first private key and partial private key, obtain the user's complete private key by extracting the complete public-private key algorithm, and then return the complete user private key to A I .

[0194] Public key replacement query: Adversary A I Provide identity ID i and the new public key PK′ i , Challenger C I The current public key PK i Replace with the new public key PK′ i , A I No need to provide PK′ i The corresponding first private key x i .

[0195] Signcryption query: A I Provide two identities and one message (ID A , ID B , m), C I Calculate the signature ciphertext σ and return σ to the adversary A I If ID A The public key of C has been replaced. I Don't know ID A The first private key requires A I Provide the sender's first private key x i , let C i Compute the signcrypted ciphertext.

[0196] Decryption query: A i Provide two identities and a signed ciphertext (ID A , ID B ,σ),C I Decrypt the signcryption and return m or the symbol ⊥ to A I If ID B The public key of has been replaced, then adversary A needs I Provide ID B The first private key x i , let C I Decrypt the signature.

[0197] (3) Challenge phase:

[0198] After Phase 1, A I Generate two messages of equal length {m0,m1} and As a challenge identity, C I Randomly select a message b∈{0,1}, and After executing the signcryption algorithm, the ciphertext σ is generated * , and σ * Return to A I .

[0199] (4) Guessing stage: A I Perform polynomially bounded queries as in stage 1. I The restrictions are as follows:

[0200] 1) If the public key has been replaced, then A I It is not possible to extract the private keys of any identity.

[0201] 2) A I The ID cannot be extracted at any time B The private key of

[0202] 3) If The public key of A has been replaced before the challenge phase. I Unable to extract Part of the private key.

[0203] 4) In the guessing stage, A I Unable to The ciphertext σ * Perform a decryption query unless or The public key is replaced after the challenge phase.

[0204] (5) Finally, A I Guess b′, if b′=b, then adversary A I Win this game.

[0205] In the random oracle model, suppose an adversary A I Execute at most q S Second sign-cryptographic query, q SK The private key extraction query is performed in polynomial time, and the probability of winning Game 1 in the above definition 1 is not negligible. Then there is an algorithm that can win Game 1 with a non-negligible advantage. Solve the CDH problem in polynomial time, where q S A I The number of signcryption queries, q SK A I The number of private key extraction inquiries, e is the natural logarithm base, and λ is the security parameter.

[0206] Proof: Let algorithm C I is an example of solving the CDH problem. The input is (P, a·P, b·P) and the expected If a·b·P is unknown, calculate it. I is a challenger, let P pub =a·P( Is the system master key and is not C I Get), C I Run the initialization algorithm, get the public parameters params, and send params to A I , and maintain an empty list L sk , L H0 , L H1 , L H2 and L pk Used to track A I For user private key extraction query, H0 query, H1 query, H2 query, public key generation query. Among them, params = {F p ,G p ,P,P pub ,H0,H1,H2}, system public key P pub =a·P,L H0 The tuple format is (ID i ,R i ,X i ,P pub ,h 0i ), L H1 The tuple format is (T i ,L,X i ,R j ,ID j ,K),L H2 The tuple format is (L,T i ,τ,ID i ,ID j ,X i ,H),L pk The tuple format is (ID i ,R i ,X i ,c),L sk The tuple format is (ID i ,d i ,x i ).

[0207] Phase 1: Query phase. Adversary A I Perform polynomially bounded queries.

[0208] (1) Public key generation query: A I Provide identity ID iPerform a public key generation query. If L pk Exists in (ID i ,R i ,X i ,c), then C I Return i ,X i ) to A I , where c∈{0,1}, (In the game, A I Select q s identities to perform signcryption query, and select one identity as the challenge identity); otherwise, randomly select a value from c.

[0209] If c = 0, C I Random Selection Calculate R i =d i Ph 0i ·P pub ,X i =x i P, satisfied Otherwise, reselect In L sk , L pk and L H0 Add (ID i ,d i ,x i )、(ID i ,R i ,X i ,c) and (ID i ,R i ,X i ,P pub ,h 0i ), then return (R i ,X i ) to A I .

[0210] If c = 1, C I Calculate X i =α1·P,R i =α2·P, where α1 and α2 are C I Two parameters are known, and X i and R i Must meet Otherwise, α1 and α2 need to be reselected, respectively in L pk and L H0 Add a tuple (ID i ,R i ,X i ,c) and (ID i ,Ri ,X i ,P pub ,h 0i ), then return (R i ,X i ) to A I .

[0211] (2) H0 query: A I Provide (ID i ,R i ,X i ,P pub ) and ask C I , C I from Query in (ID i ,R i ,X i ,P pub ,h 0i ), if it exists, then h 0i Return to A I ; Otherwise, execute the public key generation query and add (ID i ,R i ,X i ,P pub ,h 0i )arrive in, and from Extract h 0i Return it to A I .

[0212] (3) H1 query: When C I Receive A I (T i ,L,X i ,R j ,ID j ) When asked, C I from Find the corresponding tuple (T i ,L,X i ,R j ,ID j ,K), if it exists, K will be returned to A I ; Otherwise, select a random number And meet And (T i ,L,X i ,R j ,ID j ,K)Update to In the above example, K is returned to A. I .

[0213] (4) H2 asks: When C I Receive AI (L,T i ,τ,ID i ,ID j ,X i ) When asked, C I from Find the corresponding tuple (L,T i ,τ,ID i ,ID j ,X i ,H), if it exists, it will return H to A I Otherwise, pick a random number And (L,T i ,τ,ID i ,ID j ,X i ,H) Update to L H2 , return H to A I .

[0214] (5) Private key extraction query: A I Provide identity ID i , C I View L sk Does (ID i ,d i ,x i ), if it exists, returns the private key (d i ,x i ) to A I ; Otherwise, execute the public key generation query, obtain the corresponding tuple, and return the private key (d i ,x i ) to A I .

[0215] (6) Public key replacement query: A I You can choose any new public key (R i ′,X i ′) replaces the original public key (R i ,X i ).

[0216] (7) Signcryption query: When C I Receive A I When the signcryption query is made, pk Find in (ID A ,R A ,X A ,c), if c=1, then C I Terminate; otherwise, find L sk and L pk , obtain the corresponding private key and public key, and execute the signcryption algorithm to obtain ψ=(L,W,C), and return ψ to A I.

[0217] (8) Decryption query: When C I Receive A I When the decryption query is made, pk Find in (ID B ,R B ,X B ,c), perform the following operations.

[0218] If (ID B ,R B ,X B ,c) exists and c=0, then in L sk Query the corresponding private key (d B ,x B ), L pk Query the corresponding public key (R A ,X A ), decrypt the signcryption algorithm on ψ to obtain m and H, and send it to A I Send m; but if it is found that the input ciphertext ψ is not a valid ciphertext, then C I termination.

[0219] If (ID B ,R B ,X B ,c) exists and c=1, when there is calculate If the equation W·P=R A +h 0A ·P pub +H·L+X A If established, then i Return m, otherwise C I termination.

[0220] If (ID B ,R B ,X B ) does not exist, indicating that the public key has been replaced, C I Query Get (ID A ,R′ A ,X′ A ,P pub ,h 0A ), (T A ,L,X′ A ,R′ B ,ID B ,K) and (L,T A ,τ,ID A ,ID B ,X′ A ,H), calculate If W·P=R′ A +h 0A ·P pub +H·L+X′ A If true, return m, otherwise C I termination.

[0221] Phase 2 Challenge Phase.

[0222] After a limited number of inquiries, A I Randomly select ID A 、ID B As the identity accepting the challenge, and two plaintext messages m0 and m1 of equal length, C I ID B Execute the public key generation query to obtain (ID B ,R B ,X B ,c). If c=0, then C I Terminate; if c=1, C I Randomly select β∈{0,1} and let L * = b·P, Select to meet Random number Then calculate and Finally, we select W that satisfies the equation * ·P=tr A +h 0A ·P pub +H * ·L * +X A of And ψ * =(L * ,W * ,C * ) returns to A I .

[0223] A I Perform a bounded probability polynomial query. When the query terminates, output β′∈{0,1} as a guess for β. If β′=β, C I Output as a valid solution to the CDH hard problem; otherwise, there is no solution to the CDH problem.

[0224] If A I ID A 、ID B The private key extraction query is executed, then C I The probability that the challenge fails and it does not execute the query is Among them, 2 λ is the size of the key space; CI The probability of not terminating during the inquiry phase is C I The probability of not terminating in the challenge phase is Pr[ε3]=δ.

[0225] Finally, C I The probability that the whole process does not terminate is in, And when q s When it is large enough, (1-δ) qs →e -1 Therefore, Algorithm C I The probability of not terminating is at least

[0226] In summary, if C I The probability of not stopping execution during the entire process is And A I Can break the confidentiality of this scheme with a non-negligible probability ε, then C I will be in polynomial time with non-negligible probability Solve the CDH difficulty problem. Proof completed.

[0227] (2)A II Confidentiality under Quasi-Adversarial Attacks

[0228] Definition 2: Confidentiality under Type II adversary attack. If attacker A II If Game 2 is not won in probabilistic polynomial time, then the certificateless signcryption scheme is IND-CLSC-CCA2-II secure.

[0229] Game 2 process is as follows:

[0230] (1) Initialization phase: Let the challenger be C II , run the system initialization algorithm to generate system public parameters params and master key msk, and send params to A II , confidential msk.

[0231] (2) Phase 1: A II All queries in Definition 2.3 except the public key replacement query may be executed.

[0232] (3) The challenge phase is the same as step (3) of Game 1.

[0233] (4) Guessing stage: A II A polynomially bounded query can be performed in stage 1. II The restrictions are as follows:

[0234] 1) A IIThe ID cannot be extracted at any time B The private key of

[0235] 2) In the guessing stage, A II Unable to The ciphertext σ * Perform a decryption query.

[0236] (5) Finally, Adversary A II Output the guess b′. If b′=b, then the adversary A II Win this game.

[0237] In the random oracle model, suppose an adversary A II Execute at most q S Second sign-cryptographic query, q SK The private key extraction query is performed in polynomial time, and the game 2 in the above definition 2 is won with a non-negligible probability ε. Then there is an algorithm that can win the game 2 in the above definition 2 with a non-negligible advantage in polynomial time. Successfully solved the CDH problem, where q S A II Number of signcryption queries, q SI A II The number of times the private key extraction query is performed, e is the natural logarithm base, and λ is the security parameter. Proof method is the same as (I) A I The confidentiality under similar adversary attacks is similar and will not be elaborated on here.

[0238] (III) A I Unforgeability under quasi-adversarial attacks

[0239] Define the unforgeability under the attack of type 3I adversary. If the attacker A I There is a non-negligible advantage in winning Game 3 without probabilistic polynomial time, so the certificateless signcryption scheme is EUF-CLSC-CMA-I secure.

[0240] Game 3 The game process is as follows:

[0241] (1) Initialization phase: Same as step (1) of Game1.

[0242] (2) As in (2) of Definition 1, perform polynomially bounded query.

[0243] (3) Forgery stage: A I In the message * Output a new signature σ * , As the sender, As the receiver, run the decryption algorithm. If the output is not the symbol ⊥ and the following conditions are met, then the adversary AI Win this game.

[0244] 1) If the public key has been replaced, then A I It is not possible to extract the private keys of any identity.

[0245] 2) A I Cannot be withdrawn at any time The private key of

[0246] 3) If The public key of A has been replaced before the challenge phase. I Unable to extract Part of the private key.

[0247] 4) σ * Not As the sender, As the recipient message m * The signcryption query output on .

[0248] In the random oracle model, suppose an adversary A I Execute at most q S Second sign-cryptographic query, q SK The private key extraction query is performed in polynomial time, and the game 3 in the above definition 3 is won with a non-negligible probability ε. Then there is an algorithm that can win the game 3 in polynomial time with a non-negligible advantage. Successfully solved the ECDL problem, where q S A I Number of signcryption queries, q SK A I The number of private key extraction inquiries, e is the natural logarithm base.

[0249] Proof: Assume that algorithm C I is an example of solving the ECDL problem, where the input is (a, a·P) and the goal is to If a is unknown, calculate a. I is a challenger, let P pub =a·P,C I Run the system to build the algorithm, output the public parameters params, and send params to A I , and maintain an initially empty list L sk , L H0 , L H1 , L H2 and L pk Used to track A I For user private key extraction query, H0 query, H1 query, H2 query, user private key extraction query. Among them, params = {F p ,Gp ,P,P pub ,H0,H1,H2}, master public key P pub =a·P,L H0 The tuple format is (ID i ,R i ,X i ,P pub ,h 0i ), L H1 The tuple format is (T i ,L,X i ,R j ,ID j ,K),L H2 The tuple format is (L,T i ,τ,ID i ,ID j ,X i ,H),L pk The tuple format is (ID i ,R i ,X i ,c),L sk The tuple format is (ID i ,d i ,x i ).

[0250] Phase 1: Inquiry phase.

[0251] Adversary A I Execution (I) A I The public key generation query, H0 query, H1 query, H2 query, private key extraction query and public key replacement query in confidentiality under similar adversary attacks. The signature and signature verification queries are described as follows.

[0252] Signature Query: When C I Receive A I About Sender ID A , Receiver ID B , when the signature query with timestamp τ is executed, the relevant information of the receiver is obtained through the public key generation query and H0 query. I In L pk Find the corresponding tuple (ID A ,R A ,X A ,c).

[0253] If c = 1, then C I Terminate; otherwise, C I Find L sk Get the corresponding private key and execute the signcryption algorithm to get ψ=(L,W,C), and return ψ to A I .

[0254] Signature verification query: When C I Receive A I When the decryption query is made, pk Find the corresponding (ID A ,R A ,X A ,c), perform the following operations.

[0255] If it exists and c=0, then C I Execute the signature verification algorithm, but if it is found that the signature to be verified is not a valid signature, then C I termination;

[0256] If it exists and c=1, query L H0 , L H1 , L H2 , get (ID A ,R A ,X A ,P pub ,h 0A )、(T A ,L,X A ,R B ,ID B ,K) and (L,T A ,τ,ID A ,ID B ,X A ,H), if the equation W·P=R A +h 0A ·P pub +H·L+X A If true, the verification is successful, otherwise C I termination;

[0257] If it does not exist, it means that the public key has been replaced. I Query L H0 , L H1 , L H2 , get (ID A ,R′ A ,X′ A ,P pub ,h 0A )、(T A ,L,X′ A ,R′ B ,ID B ,K) and (L,T A ,τ,ID A ,ID B ,X′ A ,H) and, if the equation W·P=R′ A +h 0A ·P pub+H·L+X′ A If true, the verification is successful, otherwise C I termination.

[0258] Phase 2: Forgery phase.

[0259] After a limited number of inquiries, A I Random Selection Calculate L * = l * ·P,H * =H2(L * ,T A ,τ,ID A ,ID B ,X A ), select the equation that satisfies W * P = R A +h 0A ·P pub +H * ·L * +X A Random number And output the forged signature ψ * =(L * ,W * ) returns to A I If the signature forgery is successful and c=1, C I Output as the solution to the ECDL problem; otherwise, C I ECDL issues not resolved.

[0260] If A I Executed ID A The private key extraction query is C I The probability that the challenge fails and it does not execute the query is Among them, 2 λ is the size of the key space; C I The probability of not terminating during the inquiry phase is C I The probability that signature forgery is not terminated during the challenge phase is Pr[ε3]=δ.

[0261] Finally, C I The probability of not terminating during the entire simulation process is in, And when q s When it is big enough,

[0262] In summary, Adversary A I If the unforgeability of the proposed scheme can be broken with a non-negligible probability ε, then C IWith a non-negligible probability Solve the ECDL problem.

[0263] (IV) A II Unforgeability under quasi-adversarial attacks

[0264] Definition 4: Unforgeability under Type II adversary attack. If attacker A II If Game 4 is not won in probabilistic polynomial time, then we say that the certificateless signcryption scheme is EUF-CLSC-CMA-I secure.

[0265] Game 4 process is as follows:

[0266] (1) Initialization phase: Same as step (1) of Game2.

[0267] (2) As in (2) of Definition 2, perform polynomially bounded query.

[0268] (3) Forgery stage:

[0269] Adversary A II In the message * Output a new signature σ * , As the sender, As the receiver, run the decryption algorithm. If the output is not the symbol ⊥ and the following conditions are met, then the adversary A II Win this game.

[0270] 1) A II Cannot be withdrawn at any time The private key of

[0271] 2) σ * Not As the sender, As the recipient message m * The signcryption query output on .

[0272] In the random oracle model, suppose an adversary A II Execute at most q S Second sign-cryptographic query, q SK The private key extraction query is performed in polynomial time, and the game 4 in the above definition 4 is won with a non-negligible probability ε. Then there is an algorithm that can win the game 4 in polynomial time with a non-negligible advantage. Successfully solved the ECDL problem, where q S A II The number of signcryption queries, q SK A II The number of times the private key extraction query is performed, e is the natural logarithm base. The proof method is the same as (III) AI The unforgeability under the attack of similar adversaries is similar and will not be repeated here. In summary, it is proved that the above scheme guarantees the communication security between terminal devices in the mesh network.

[0273] In addition, in one embodiment of the present invention, the performance of the three certificateless signcryption schemes of the present invention scheme and scheme 1 (Seo S, Bertino E. Elliptic curve cryptography based certificateless hybrid signcryption scheme without pairing [J]. CERIAS, West Lafayette, IN, USA, Tech. Rep. CERIAS TR, 2013, 10: 2013.), scheme 2 (Luo W, Ma W. Secure and efficient data sharing scheme based on certificateless hybrid signcryption for cloud storage [J]. Electronics, 2019, 8 (5): 590.), and scheme 3 (Kasyoka P, Kimwele M, Angolo SM. Crypt analysis of a pairing-free certificateless signcryption scheme [J]. Ict Express, 2021, 7 (2): 200-204.) are compared.

[0274] Among them, select an elliptic curve E:y 2 =x 3 +ax+b mod p, G is an additive group of order p on the elliptic curve, and p and q are both 160-bit prime numbers. The simulation experiment was run using the MIRACL library on a computer (Intel Core i7@1.8GHz CPU, 8GB RAM, and Windows 10 operating system). Table 1 shows the running timeline of different operations.

[0275] Table 1

[0276]

[0277]

[0278] As shown in Table 1, the running time of different operations is: modular addition operation T ma = 0.0006ms, modular multiplication operation T mm= 0.0022ms, general hash operation T hs =0.0038ms, point addition operation T pa = 0.0013ms, point multiplication operation T pm =0.2171ms.

[0279] And, Table 2 is a comparison table of the efficiency of different schemes.

[0280] Table 2

[0281]

[0282] As shown in Table 2, Solution 1 and the solution of the present invention are safe, but Solution 2 and Solution 3 have security loopholes. Figure 4 This is a comparison chart of the calculation efficiency of different solutions proposed in the embodiment of the present invention. Figure 4 As shown, from the perspective of computing performance, it can be seen that the scheme of the present invention performs three point multiplication operations, three general hash operations, two modular addition operations, two point addition operations and one modular multiplication operation in the encryption stage, and performs four point multiplication operations, three point addition operations and three general hash operations in the decryption stage. Based on this, the total computing cost of the scheme of the present invention is 1.5524 milliseconds, which is 29.82% less than that of scheme 1 and 22.08% less than that of scheme 2. The total computing cost is 16.41% more than that of scheme 3, which reduces the consumption of computing resources and electricity, and the scheme of the present invention is more secure.

[0283] The embodiment of the present invention proposes a certificateless identity authentication method for a mesh network, wherein the mesh network includes a key generation center KGC and multiple terminal devices, and the method includes: the key generation center KGC distributes system public parameters to the terminal device; the terminal device generates identity information based on the received system public parameters, and sends the identity information to the key generation center KGC; the key generation center KGC generates a first private key and a first public key of the terminal device based on the received identity information and the system public parameters, and sends the first private key and the first public key to the terminal device; the terminal device generates a corresponding target public key and a target private key based on the received first public key and the first private key; when any two terminal devices in the mesh network request data interaction, the two terminal devices perform identity authentication based on the system public parameters and the corresponding target public key and the target private key, and perform data transmission after the verification is passed. Therefore, the present invention can authenticate the terminal devices in the mesh network without a certificate, reduces the consumption of computing resources and power, improves the user experience, and ensures the communication security between the terminal devices in the mesh network.

[0284] In order to implement the above embodiment, Figure 5As shown, this embodiment also provides a certificateless identity authentication device 10 for mesh networks, which includes a first sending module 501, a first generating module 502, a second generating module 503, a third generating module 504 and an identity authentication module 505;

[0285] The first sending module 501 is used for the key generation center KGC to distribute system public parameters to the terminal device;

[0286] A first generating module 502 is used for the terminal device to generate a first public key and a first private key based on the received system public parameters, and send identity information to a key generation center KGC, wherein the identity information includes the first public key;

[0287] The second generation module 503 is used for the key generation center KGC to generate a second private key and a second public key of the terminal device based on the received identity information and system public parameters, and send the second private key and the second public key to the terminal device;

[0288] The third generating module 504 is used for the terminal device to generate a corresponding target public key and a target private key based on the first public key and the first private key and the received second public key and the second private key;

[0289] The identity authentication module 505 is used for when any two terminal devices in the mesh network request to exchange data, the two terminal devices perform identity authentication based on the system public parameters and the corresponding target public key and target private key, and complete the encrypted data transmission at the same time of authentication.

[0290] In one embodiment of the present invention, the first sending module 501 is specifically used for:

[0291] Get a prime number p, and based on the prime number p, generate a tuple {p,F p ,G p ,P}, where G p is the elliptic curve F p The additive cyclic group of the points on G p The generator of

[0292] Determine the master key s and generate the system public key P based on the master key s and the tuple pup ,in, is a set of positive integers;

[0293] G p 、F p , P, system public key P pub , the first Hash function H0, the second Hash function H1 and the third Hash function H2, are determined as system common parameters params={F p ,G p ,P,P pub,H0,H1,H2}, where the first hash function H0: It represents the addition of a {0, 1} bit string of arbitrary length and 3 additive groups G p The elements in are mapped to positive integers less than P; the second hash function H1:G p ×G p ×G p ×G p ×{0,1} * →{0,1} n , which means that the 4 additive groups G p The elements in and a {0, 1} bit string of arbitrary length are mapped to a {0, 1} bit string of length n; the third hash function H2: It means to add three additive groups G p The elements in and 3 {0, 1} bit strings of arbitrary length are mapped to positive integers less than P;

[0294] Distribute system common parameters to terminal devices.

[0295] In one embodiment of the present invention, the first generating module 502 is specifically used to:

[0296] Terminal device i determines the corresponding secret value x i , and the secret value x i As the first private key,

[0297] Based on the parameter P in the system public parameters and the first private key x i , the corresponding first public key X is obtained by calculation i , where X i =x i ×P;

[0298] The terminal device's identity ID i and the first public key X i The identity information is determined to be identity information, and the identity information is sent to the key generation center KGC.

[0299] In one embodiment of the present invention, the second generating module 503 is specifically used for:

[0300] Randomly generate the first parameter r i , and based on the first parameter r i Generate the second public key R with the parameter P in the system public parameters i , where R i =r i ×P,

[0301] Based on the identity ID in the identity informationi and the first public key X i , the first parameter r i , the second public key R i , master key s, system public key P pub and prime number p, generate the second private key d i ;

[0302] Send the second public key R to the terminal device through a secure channel i and the second private key d i .

[0303] In one embodiment of the present invention, the third generating module 504 is specifically used for:

[0304] The terminal device verifies the correctness of the second public key and the second private key;

[0305] When the verification is successful, the second private key d i and the first private key x i , determined as the corresponding target private key;

[0306] The second public key R i and the first public key X i , determine the corresponding target public key.

[0307] In one embodiment of the present invention, the two terminal devices include a first terminal device and a second terminal device; the identity authentication module 505 is specifically used to:

[0308] The second terminal device B sends an authentication request to the first terminal device A, wherein the authentication request includes the identity ID of the second terminal device B. B 、Target public key PK B =(first public key X B , the second public key R B );

[0309] The first terminal device A is based on the identity ID of the second terminal device B B 、Target public key PK B Generate a signature result to be verified with the plaintext m to be sent, and send the signature result to be verified to the second terminal device B;

[0310] The second terminal device B uses the corresponding first private key x B 、Second private key d B , the second public key R B and ID B Verify the signature result to be verified to obtain a first target verification result;

[0311] If the first target verification result is verification passed, the second terminal device B completes the identity authentication of the first terminal device A and securely obtains the plaintext m sent by the first terminal device A.

[0312] In one embodiment of the present invention, the identity authentication module 505 is further used to:

[0313] The first terminal device A randomly generates a second parameter l, where:

[0314] Based on the second parameter l, the system public parameter and the identity ID of the second terminal device B B and the target public key PK B , the plaintext m to be sent is signed using the first formula to generate the third parameter ψ=(L, W, C), where the first formula is:

[0315] L = l × P;

[0316] h 0B =H0(ID B ,R B ,X B ,P pub );

[0317] T A =l×(R B +h 0B ×P pub +X B );

[0318] H=H2(L,T A ,τ,ID A ,ID B ,X A );

[0319] W=d A +l×H+x A mod p;

[0320] K=H1(T A ,L,X A ,R B ,ID B );

[0321]

[0322] Among them, X A is the first public key of the first terminal device A, x A is the first private key of the first terminal device A, d A is the second private key of the first terminal device A, ID A is the identity ID of the first terminal device A, τ is the timestamp, and m is the plain text;

[0323] The third parameter ψ, the timestamp τ, and the identity ID of the first terminal device A are A and the target public key PK A =(first public key X A , the second public key R A ) and is determined as the signature result to be verified.

[0324] In one embodiment of the present invention, the identity authentication module 505 is further used to:

[0325] The second terminal device B uses the corresponding first private key x B 、Second private key d B , the second public key R B and ID B , system public parameters and the signature result to be verified, and generate the fourth parameter T′ through the second formula A 、The fifth parameter h 0A and a sixth parameter H′, wherein the second formula is:

[0326] T′ A =(d B +x j )×L;

[0327] h 0A =H0(ID A ,R A ,X A ,P pub );

[0328] H′=H2(L,T A ′,τ,ID A ,ID B ,X A );

[0329] If the signature result to be verified, the first public key R of the first terminal device A A and the second public key X A 、The fifth parameter h 0A and the sixth parameter H′ satisfies the third formula, then the first target verification result is verification passed, where the third formula is W×P=R A +h 0A ×P pub +H′×L+X A ; Otherwise, the first target verification result is not verified;

[0330] If the first target verification result is that the verification is passed, the second terminal device B calculates the plaintext m through the fourth formula, where the fourth formula is:

[0331] K=H1(TA ′,L,X A ,R B ,ID B );

[0332]

[0333] In one embodiment of the present invention, the system common parameters further include a fourth Hash function, wherein the fourth Hash function H4: {0,1} * →{0,1} n , indicating that a {0, 1} bit string of arbitrary length is mapped to a {0, 1} bit string of length n; the above device is also used for:

[0334] After the second terminal device B obtains the plain text m, it calculates the plain text m by using the fifth formula to obtain the seventh parameter Hm, and sends the seventh parameter to the first terminal device A, wherein the fifth formula is: Hm=H4(m);

[0335] The first terminal device A receives the seventh parameter Hm sent by the second terminal device, and uses the plain text m to calculate the eighth parameter Hm′ through the fifth formula, and determines whether the seventh parameter is equal to the eighth parameter. If it is determined that the seventh parameter is equal to the eighth parameter, the second target verification result is obtained as verification passed;

[0336] If the second target verification result is verification passed, the first terminal device A completes the identity authentication of the second terminal device B, and the first terminal device A confirms that the second terminal device B correctly receives and decrypts the plaintext m.

[0337] According to the certificateless identity authentication device for mesh networks of an embodiment of the present invention, the mesh network includes a key generation center KGC and multiple terminal devices. The device can authenticate the terminal devices in the mesh network without certificates, thereby reducing the consumption of computing resources and power, improving user experience, and ensuring the communication security between terminal devices in the mesh network.

[0338] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0339] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

Claims

1. A certificateless identity authentication method for mesh networks, characterized in that: The mesh network includes a key generation center KGC and multiple terminal devices, and the method includes: The key generation center KGC distributes system public parameters to the terminal device; The terminal device generates a first public key and a first private key based on the received system public parameters, and sends identity information to the key generation center KGC, wherein the identity information includes the first public key; The key generation center KGC generates a second private key and a second public key of the terminal device based on the received identity information and the system public parameters, and sends the second private key and the second public key to the terminal device; The terminal device generates a corresponding target public key and a target private key based on the first public key and the first private key and the received second public key and the second private key; When any two terminal devices in the mesh network request data exchange, the two terminal devices perform identity authentication based on the system public parameters and the corresponding target public key and target private key, and complete encrypted data transmission at the same time as the authentication.

2. The method according to claim 1, characterized in that The key generation center KGC distributes system public parameters to the terminal device, including: Get a prime number p, and based on the prime number p, generate a tuple {p, F p ,G p ,P}, where the G p is the elliptic curve F p The additive cyclic group of the points on G p The generator of Determine the master key s, and generate the system public key P based on the master key s and the tuple pub ,in, is a set of positive integers; The G p 、The F p , the P, the system public key P pub , the first Hash function H0, the second Hash function H1 and the third Hash function H2, are determined as the system common parameters params={F p ,G p ,P,P pub ,H0,H1,H2}, where the first hash function It represents the addition of a {0, 1} bit string of arbitrary length and 3 additive groups G p The elements in are mapped to positive integers less than P; the second hash function H1:G p ×G p ×G p ×G p ×{0,1} * →{0,1} n , which means that the 4 additive groups G p The elements in and a {0, 1} bit string of arbitrary length are mapped to a {0, 1} bit string of length n; the third hash function It means to add three additive groups G p The elements in and three {0, 1} bit strings of arbitrary length are mapped to positive integers less than P; Distribute the system common parameters to the terminal device.

3. The method according to claim 2, characterized in that The terminal device generates a first public key and a first private key based on the received system public parameters, and sends identity information to the key generation center KGC, including: The terminal device i determines the corresponding secret value x i , and the secret value x i As the first private key, Based on the parameter P in the system public parameters and the first private key x i , the corresponding first public key X is obtained by calculation i , where X i =x i ×P; The identity ID of the terminal device i and the first public key X i The identity information is determined to be the identity information, and the identity information is sent to the key generation center KGC.

4. The method according to claim 3, characterized in that The key generation center KGC generates a second private key and a second public key of the terminal device based on the received identity information and the system public parameter, and sends the second private key and the second public key to the terminal device, including: Randomly generate the first parameter r i , and based on the first parameter r i and the parameter P in the system public parameter to generate the second public key R i ,in, Based on the identity ID in the identity information i and the first public key X i , the first parameter r i , the second public key R i , the master key s, the system public key P pub and the prime number p, generate the second private key d i ; Send the second public key R to the terminal device through a secure channel i and the second private key d i .

5. The method according to claim 4, characterized in that The terminal device generates a corresponding target public key and a target private key based on the received second public key and the received second private key, including: The terminal device verifies the correctness of the second public key and the second private key; When the verification is successful, the second private key d i and the first private key x i , determined as the corresponding target private key; The second public key R i and the first public key X i , determine the corresponding target public key.

6. The method according to claim 5, characterized in that The two terminal devices include a first terminal device and a second terminal device; the two terminal devices perform identity authentication based on the system public parameters and the corresponding target public key and target private key, and complete encrypted data transmission at the same time of authentication, including: The second terminal device B sends an authentication request to the first terminal device A, wherein the authentication request includes the identity ID of the second terminal device B. B 、Target public key PK B =(first public key X B , the second public key R B ); The first terminal device A is based on the identity ID of the second terminal device B B 、Target public key PK B and the plaintext m to be sent to generate a signature result to be verified, and send the signature result to be verified to the second terminal device B; The second terminal device B is based on the corresponding first private key x B 、Second private key d B , the second public key R B and ID B Verifying the signature result to be verified to obtain a first target verification result; If the first target verification result is verification passed, the second terminal device B completes the identity authentication of the first terminal device A and securely obtains the plaintext m sent by the first terminal device A.

7. The method according to claim 6, characterized in that The first terminal device A is based on the identity ID of the second terminal device B B 、Target public key PK B The plaintext m to be sent generates the signature result to be verified, including: The first terminal device A randomly generates a second parameter l, where: Based on the second parameter l, the system public parameter and the identity ID of the second terminal device B B and the target public key PK B , the plaintext m to be sent is signed using the first formula to generate the third parameter ψ=(L, W, C), where the first formula is: L = l × P; h 0B =H0(ID B ,R B ,X B ,P pub ); T A =l×(R B +h 0B ×P pub +X B ); H=H2(L,T A ,τ,ID A ,ID B ,X A ); W=d A +l×H+x A mod p; K=H1(T A ,L,X A ,R B ,ID B ); Among them, X A is the first public key of the first terminal device A, x A is the first private key of the first terminal device A, d A is the second private key of the first terminal device A, ID A is the identity ID of the first terminal device A, τ is the timestamp, and m is the plain text; The third parameter ψ, the timestamp τ, the identity ID of the first terminal device A A and the target public key PK A =(first public key X A , the second public key R A ) and is determined as the signature result to be verified.

8. The method according to claim 6, characterized in that The second terminal device B is based on the corresponding first private key x B 、Second private key d B , the second public key R B and ID B Verifying the signature result to be verified to obtain a first target verification result includes: The second terminal device B is based on the corresponding first private key x B 、Second private key d B , the second public key R B and ID B , the system public parameters and the signature result to be verified, and generate the fourth parameter T′ through the second formula A 、The fifth parameter h 0A and a sixth parameter H′, wherein the second formula is: T′ A =(d B +x B )×L; h 0A =H0(ID A ,R A ,X A ,P pub ); H′=H2(L,T′ A ,τ,ID A ,ID B ,X A ); If the signature result to be verified and the first public key R of the first terminal device A A and the second public key X A , the fifth parameter h 0A and the sixth parameter H′ satisfies the third formula, then the first target verification result is verification passed, wherein the third formula is W×P=R A +h 0A ×P pub +H′×L+X A ; Otherwise, the first target verification result is not verified; If the first target verification result is that the verification is passed, the second terminal device B calculates the plaintext m using the fourth formula, wherein the fourth formula is: K=H1(T′ A ,L,X A ,R B ,ID B ); 9. The method according to claim 6, characterized in that The system public parameters also include a fourth Hash function, wherein the fourth Hash function H4: {0,1} * →{0,1} n , indicating that a {0, 1} bit string of arbitrary length is mapped to a {0, 1} bit string of length n; the method further comprises: After obtaining the plain text m, the second terminal device B calculates the plain text m by using the fifth formula to obtain the seventh parameter Hm, and sends the seventh parameter to the first terminal device A, wherein the fifth formula is: Hm=H4(m); The first terminal device A receives the seventh parameter Hm sent by the second terminal device, and uses the plain text m to calculate the eighth parameter Hm′ through the fifth formula, and determines whether the seventh parameter is equal to the eighth parameter. If it is determined that the seventh parameter is equal to the eighth parameter, the second target verification result is obtained as verification passed; If the second target verification result is verification passed, the first terminal device A completes the identity authentication of the second terminal device B, and the first terminal device A confirms that the second terminal device B correctly receives and decrypts the plaintext m.

10. A certificateless identity authentication device for mesh networks, characterized in that: The mesh network includes a key generation center KGC and multiple terminal devices, and the device includes: A first sending module, used for the key generation center KGC to distribute system public parameters to the terminal device; A first generating module, configured for the terminal device to generate a first public key and a first private key based on the received system public parameters, and send identity information to the key generation center KGC, wherein the identity information includes the first public key; A second generating module, configured for the key generation center KGC to generate a second private key and a second public key of the terminal device based on the received identity information and the system public parameters, and to send the second private key and the second public key to the terminal device; A third generating module, configured for the terminal device to generate a corresponding target public key and a target private key based on the first public key and the first private key and the received second public key and the second private key; The identity authentication module is used for performing identity authentication based on the system public parameters and the corresponding target public key and target private key when any two terminal devices in the mesh network request data interaction, and completing encrypted data transmission at the same time as the authentication.

Images