User-device decoupling certificateless signature method

Abstract

The invention discloses a user-equipment decoupling certificateless signature method, which comprises the following steps of: extracting biological information of a user by using a fuzzy extractor, separating keys of the user and equipment, and successfully realizing fine-grained identity authentication and message authentication of user and equipment decoupling; after the user successfully logs in the device, the signature generated by the device contains the secret information generated by the biological characteristics of the user, and the authenticity of the identity is further ensured through joint verification of the user and the device. According to the invention, by introducing the category identifier and carrying out category division on the equipment in the system, the user can log in any equipment belonging to a certain category, and a more flexible authentication process is realized. According to the method, the requirement on the computing power of a user side is eliminated, and the realizability in an actual scene is improved. According to the method, a pairing-free certificateless signature mechanism is adopted, complex bilinear mapping operation in a traditional certificateless signature mechanism is avoided, and the method has the performance characteristic of relatively low calculation overhead.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, relates to a certificateless signature technology, and mainly relates to a user-device decoupling certificateless signature method. Background Art

[0002] Traditional digital signature technologies based on public key cryptography typically use a certificate-based public key infrastructure (PKI) to implement authentication. However, this scheme suffers from complex certificate management and high computational overhead. To address these issues, identity-based public key cryptography (ID-PKC) uses a private key generator (PKG) to generate a user's private key and derive the public key from their identity information, avoiding the complex distribution and management of public key certificates. However, the implementation of a PKG also introduces the key escrow problem: if the PKG is compromised or no longer trustworthy, it can lead to the leakage of sensitive information within the system and incorrect authentication processes. To address the key escrow problem, Al-Riyami and Paterson proposed certificateless public key cryptography (CL-PKC). By replacing the PKG with a semi-trusted key generation center (KGC) and introducing a user-selected random number in the key generation process, CL-PKC ensures the confidentiality of the private key, meaning that the KGC cannot obtain the user's complete private key. Early CL-PKC schemes were mostly based on bilinear mapping construction, which had a large computational overhead. However, the introduction of certificateless signature schemes based on elliptic curves in recent years has greatly improved the computational performance of the schemes.

[0003] However, in the current signature schemes under the CL-PKC system, users and the devices they use are usually regarded as the same entity and bound to each other in the scheme. In reality, there is often no one-to-one correspondence between users and devices. For example, in scenarios such as car rental or smart device sharing, in order to improve the utilization rate of shared devices, the binding relationship between users and devices is usually not predetermined and only exists when the user uses the device. Existing schemes cannot meet the security requirements in these scenarios, such as identifying and tracking the actual current user of the device. In addition, the pre-specified binding relationship also hinders the convenient access of users to devices in reality, which greatly limits the flexibility of the authentication scheme.

[0004] In order to address the problems of fixed user-device binding relationship and lack of flexibility in authentication schemes in practical applications of the CL-PKC system, it is urgent to propose a low-overhead certificateless signature scheme that supports decoupling of users and devices. The scheme should support users to dynamically log in to devices and identify and track the user currently using the device based on the signature generated by the device. Summary of the Invention

[0005] The present invention is aimed at the limitation problem of treating users and devices as the same entity in existing certificateless signature technologies, and provides a certificateless signature method with user-device decoupling, including system initialization, device registration, user registration, user login, signature generation and signature verification stages. By using a fuzzy extractor to extract biometric information of users and separate the keys of users and devices, fine-grained identity authentication and message authentication with user and device decoupling are successfully achieved; the present invention introduces category identifiers and categorizes the devices in the system, so that users can log in to any device belonging to a certain category instead of specifying a certain individual, thus achieving a more flexible authentication process. The present invention also eliminates the need for computing power on the user side, that is, users do not need to use additional computing terminals or devices to complete authentication, which improves feasibility in actual scenarios. At the same time, the present invention adopts a certificateless signature mechanism without pairing, avoiding the complex bilinear mapping operations in traditional certificateless signature mechanisms, and has the performance characteristics of low computational overhead in the signature generation and signature verification processes.

[0006] To achieve the above objectives, the present invention adopts a technical solution: a certificateless signature method with user-device decoupling, comprising at least the following steps:

[0007] S1, system initialization phase: executed by the key generation center KGC, the input is the security parameter λ, and the output is the system private key s and the system public key P pub ;

[0008] S2, device registration phase: This is performed by the KGC and the device. The KGC inputs the device's real identity VID and partial public key R, and outputs the device's pseudo-identity PVID, its private type identifier and public category identifier (gid, GID), and the device's partial private key d. (PVID, gid, d, R) is sent to the device via a secure channel, and the GID is broadcast system-wide.

[0009] S3, user registration phase: performed by KGC and the user. KGC inputs the user's real identity UID, biometric information Bio, and target category identifier GID, and outputs the user's pseudo-identity PID, biometric auxiliary information τ, login authentication identifier U, information authentication identifier V, and user public key B. Among them, (PID, B, τ, U, V) will be broadcasted throughout the system;

[0010] S4, user login stage: executed by the user, the input is biometric information Bio, and the output is login success / failure;

[0011] S5, signature generation phase: executed by the sender user through the logged-in device, with the input being the sender device private key SK, the sender device pseudo-identity PVID, the sender user private key f, the sender user pseudo-identity PID, and the message m, and the output being the signature c = (σ, Y);

[0012] S6, signature verification phase: executed by the receiving device, with the input being the message m, signature c, sender device public key PK, sender device pseudo identity PVID, sender user public key B and sender user pseudo identity PID, and the output being signature authentication pass / fail.

[0013] As an improvement of the present invention, in the system initialization phase of step S1, a security parameter λ is input to the key generation center KGC, and an elliptic curve group G of order q and a generator P of G are selected; the key generation center KGC selects five different hash functions {H0, H1, H2, H3, H4}, where:

[0014]

[0015] Key Generation Center KGC randomly selected As the system private key, and calculate the system public key P pub =sP.

[0016] As another improvement of the present invention, in step S2, based on the key generation center KGC, the specific method of generating the pseudo identity PVID and the device partial private key d according to the device's real identity VID and partial public key R is:

[0017] (a) Random selection

[0018] (b)R i =r i P;

[0019] (c)

[0020] (d)h 1i =H1(PVID i , X i , R i , P pub );

[0021] (e)d i =r i +sh 1i mod q;

[0022] Among them, r i is the random number selected by KGC, R i Partial public key of device i generated by KGC, T mis the current corresponding timestamp, s is the system private key, PVID i is the pseudo identity of device i, VID i is the real identity of device i, X i is the partial public key of device i, h 1i is the digest value output by the H1 hash function, d i Partial private key of device i generated for KGC.

[0023] As another improvement of the present invention, in step S3, the key generation center KGC uses a fuzzy extractor to generate the real identity UID provided by user j. j and biometric information j , generate the corresponding pseudo identity PID j , the specific generation method is as follows:

[0024] (a) Random selection

[0025] (b)Gen(Bio j )=(θ j , τ j );

[0026] (c) Among them, v is the random number selected by KGC, Bio j The biometric information provided by user j, θ j is the biometric secret information corresponding to user j, τ j The biometric auxiliary information and UID corresponding to user j j is the real identity and PID of user j j is the pseudo identity corresponding to user j, T j The current corresponding timestamp;

[0027] The key generation center KGC uses the biometric secret information θ corresponding to user j j And the public category identifier GID j , generate login authentication identifier U j , Information authentication mark V j And user public key B j , the specific generation method is as follows:

[0028] (a) Random selection

[0029] (b)B j =b j P;

[0030] (c)h 1j =H1(PID j , GID j, B j , P pub );

[0031] (d)f j =b j +sh 1j mod q;

[0032] (e) randomly selecting

[0033] (f) U j =u i P;

[0034] (g)

[0035] wherein, b j , u j are random numbers selected by the KGC, B j is the public key corresponding to the user j, GID j is the public category identifier selected by the user j, h 1j is the digest value output by the H1 hash function, f j is the private key corresponding to the user j, U j is the login authentication identifier corresponding to the user j, and V j is the information authentication identifier corresponding to the user j.

[0036] As another improvement of the present application, the step S4 user login stage specifically comprises the following steps:

[0037] S41: after receiving the login request of the user j and the corresponding biometric information Bio j , the device i calculates the biometric secret information θ j = Rep(Bio j , τ j ) through the fuzzy extractor and the biological auxiliary information τ j ;

[0038] S42: the device i calculates the private key f j of the user j according to the biometric secret information θ j calculated in step S41, and the specific calculation method is as follows:

[0039] S421: h 1j = H1(PID j , GID j , B j , P pub );

[0040] S422:

[0041] S43: Device i verifies equation f j P=B j +h 1j P pub Is it true? If so, user j successfully logs in; otherwise, device i will reject the login request.

[0042] As a further improvement of the present invention, in the step S5 signature generation phase, device i generates the signature based on its own private key SK i PVID i 、User j's private key f j , Pseudo Identity PID j and the original message m i , generate the corresponding signature c i =(σ i , Y i ), the specific generation method is as follows:

[0043] (a) Random selection

[0044] (b)Y i =y i P;

[0045] (c)EID ij =PVID i ||PID j ;

[0046] (d)h 3i =H3(m i , EID ij , PK i , Y i , B h , T i );

[0047] (e)h 4i =H4(m i , EID ij , PK i , T i );

[0048] (f)σ i =y i +h 3i x i +h 4i (d i +f j )mod q

[0049] Among them, y i The random number selected by KGC, Y i Signature verification identifier, EID ijPVID is the pseudo identity of the device i i With user j pseudo identity PID j The collection of m i The message to be signed, PK i is the public key corresponding to device i, B j is the public key of user j, h 3i , h 4i They are the digest values ​​output by H3 hash function, H4 hash function, and x i is the partial private key of device i, T i is the current corresponding timestamp, σ i Sign the output portion.

[0050] As a further improvement of the present invention, in the signature verification phase of step S6, the receiving device k confirms the freshness of the message tuple by checking the timestamp, ignores outdated message tuples, and then verifies the validity of the signature. The verification process is as follows:

[0051] (a)h 3i =H3(m i , EID ij , PK i , Y i , B j , T i )

[0052] (b)h 4i =H4(m i , EID ij , PK i , T i );

[0053] (c) Verify the equation Is it true? If the equation is true, the receiving device k will c i Considered as message m i Otherwise, the authentication fails.

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] (1) The present invention decouples the user from the device and includes verification of both the device and the user during the authentication process. When a user successfully logs into the device, the signature generated by the device includes secret information generated by the user's biometrics, thereby achieving fine-grained identity authentication and message authentication. The present invention supports users dynamically logging into the device and can identify and track the user currently using the device based on the signature generated by the device.

[0056] (2) The present invention introduces category identification and classifies devices according to their characteristics. Users can select any device in the same category rather than a specific individual to log in and perform subsequent authentication operations, thereby achieving a more flexible authentication process in real scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a flowchart of the steps of a certificateless signing method with user-device decoupling in Example 1 of the present invention. DETAILED DESCRIPTION

[0058] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0059] Example 1

[0060] A certificateless signature method for user-device decoupling. In this embodiment, a smart shared vehicle is used as an example. The certificateless signature method for user-device decoupling in the smart shared vehicle scenario is as follows: Figure 1 As shown, it at least includes the following steps:

[0061] Step S1, system initialization phase: the key generation center KGC executes the initialization algorithm according to the input security parameter λ, and outputs the system private key s and the system public key P pub The system initialization stage of step S1 specifically includes the following steps:

[0062] S11: KGC inputs the security parameter λ and then selects an elliptic curve group G of order q and a generator P of G;

[0063] S12: KGC selects five different hash functions {H0, H1, H2, H3, H4}, where

[0064]

[0065] S13: KGC random selection As the system private key, and calculate the system public key P pub =sP;

[0066] S14: KGC sets the system parameter params= <G,q,P,P pub , T pub , H0, H1, H2, H3, H4> public.

[0067] Step S2, device registration phase: performed by KGC and the device, in this embodiment, performed by KGC and shared vehicle i, KGC inputs the real identity VID of the shared vehicle i and part of the public key R i, output the pseudo identity PVID of the shared vehicle i , private and public category identifiers (gid i , GID i ) and the shared vehicle private key d i Among them, (PVID i ,gid i , d i , R i ) will be sent to the shared vehicle via a secure channel, and the GID i The system will broadcast the information. The shared vehicle registration phase in step S2 specifically includes the following steps:

[0068] S21: Shared vehicle i is randomly selected And calculate the partial public key X i =x i P;

[0069] S22: Shared vehicle i will (VID i , X i ) is sent to KGC through a secure channel, where VID i Indicates the real identity of the shared vehicle;

[0070] S23: KGC uses the real identity VID of the shared vehicle i i and part of the public key R i , generate a pseudo identity PVID for shared vehicle i i , part of the private key d i and part of the public key R i , the generation method is as follows;

[0071] (a) Random selection

[0072] (b)R i =r i P;

[0073] (c)

[0074] (d)h 1i =H1(PVID i , X i , R i , P pub );

[0075] (e)d i =r i +sh 1i mod q;

[0076] Among them, r i is the random number selected by KGC, Ri Partial public key of shared vehicle i generated by KGC, T m is the current corresponding timestamp, s is the system private key, PVID i is the pseudo identity of shared vehicle i, VID i is the real identity of the shared vehicle i, X i is the public key of the shared vehicle i, h 1i is the digest value output by the H1 hash function, d i Partial private key of shared vehicle i generated by KGC;

[0077] S24: KGC assigns corresponding private category identifiers and public category identifiers to shared vehicle i based on its relevant features; if the device can be classified into an existing category, it is directly assigned; otherwise, KGC randomly selects a private category identifier. And calculate the corresponding public category identifier GID = gidP; after the allocation is completed, the category identifier corresponding to the shared vehicle i is (gid i , GID i );

[0078] S25: KGC will (PVID i ,gid i , d i , R i ) is sent to the shared vehicle i through a secure channel, and GID i Broadcast system-wide;

[0079] S26: Shared vehicle i sets its own public key as PK i =(X i , R i ), the private key is SK i =(x i , d i ).

[0080] Step S3, user registration phase: performed by KGC and user j, KGC inputs the user's real identity UID j , Biometric Information j And the target category identifier GID j , output the pseudo identity PID of user j j , biological auxiliary information τ j , login authentication identifier U j , Information authentication mark V j , and user public key B j Among them, (PID j , B j , τ j , U j , V j) will be broadcasted within the system; the complete key generation phase of step S3 specifically includes the following steps:

[0081] S31: KGC uses the fuzzy extractor to extract the real identity UID provided by user j. j and biometric information j , generate the corresponding pseudo identity PID j , the generation method is as follows:

[0082] (a) Random selection

[0083] (b)Gen(Bio j )=(θ j , τ j );

[0084] (c) Among them, v is the random number selected by KGC, Bio j The biometric information provided by user j, θ j is the biometric secret information corresponding to user j, τ j is the biometric auxiliary information corresponding to user j, UID j is the real identity and PID of user j j is the pseudo identity corresponding to user j, T j The current corresponding timestamp;

[0085] S32: KGC calculates the biometric secret information θ corresponding to user j j And the public category identifier GID j , generate login authentication identifier U j , Information authentication mark V j , and user public key B j , the generation method is as follows:

[0086] (a) Random selection

[0087] (b)B j =b j P;

[0088] (c)h 1j =H1(PID j , GID j , F j , P pub );

[0089] (d)f j =b j +sh 1j mod q;

[0090] (e) Random selection

[0091] (f)U j =u j P;

[0092] (g) Among them, b j ,u j is the random number selected by KGC, B j Public key and GID corresponding to user j j The public category identifier selected by user j, h 1j is the summary value output by the H1 hash function, f j is the private key corresponding to user j, U j is the login authentication identifier corresponding to user j, V j is the information authentication identifier corresponding to user j;

[0093] S33: KGC will (PID j , B j , τ j , V j , U j , GID j ) is stored in the local list L, and (PID j , B j , τ j , V j , U j , T j ) is broadcast system-wide.

[0094] Step S4, user login phase: performed by user j and shared vehicle i, with the input being user j’s biometric information Bio j , the output is login success / failure; the step S4 user login stage specifically includes the following steps:

[0095] S41: When shared vehicle i receives the login request of user j and the corresponding biometric information Bio j After that, the shared vehicle i is extracted by the fuzzy extractor and the previously received bio-assisted information τ j , calculate θ j =Rep(Bio j , τ j );

[0096] S42: Shared vehicle i extracts the biometric secret information θ of user j j , calculate the private key f of user j j , the calculation method is as follows:

[0097] (a)h 1j=H1(PID j , GID j , B j , P pub );

[0098] (b)

[0099] S43: Shared vehicle i verifies equation f j P=B j +h 1j P pub If true, user j successfully logs in; otherwise, shared vehicle i will reject the login request.

[0100] Step S5, signature generation phase: executed by the sender user j through the logged-in shared vehicle i, and the input is the private key SK of the shared vehicle i i PVID i , the private key f of the sender user j j , Pseudo Identity PID j And the message m i , the output is signature c i =(σ i , Y i ); the step S5 signature generation stage specifically includes the following steps:

[0101] S51: Shared vehicle i uses its own private key SK i , own pseudo identity PVID i 、User j's private key f j , Pseudo Identity PID j and the original message m i , generate the corresponding signature c i =(σ i , Y i ), the generation method is as follows:

[0102] (a) Random selection

[0103] (b)Y i =y i P;

[0104] (c)EID ij =PVID i ||PID j

[0105] (d)h 3i =H3(m i , EID ij , PK i , Y i , B j , Ti );

[0106] (e)h 4i =H4(m i , EID ij , PK i , T i );

[0107] (f)σ i =y i +h 3i x i +h 4i (d i +f j )mod q

[0108] Among them, y i The random number selected by KGC, Y i Signature verification identifier, EID ij Pseudo identity PVID for shared vehicles i With user j pseudo identity PID j The collection of m i The message to be signed, PK i is the public key corresponding to the shared vehicle i, B j is the public key of user j, h 3i , h 4i They are the digest values ​​output by H3 hash function, H4 hash function, and x i is the private key of the shared vehicle i, T i is the current corresponding timestamp, σ i Sign the output portion:

[0109] S52: Shared vehicle i sends a message tuple (m containing the signature, original message and related parameters) i , c i , EID ij , PK i , B j , T i ) is sent to the recipient’s shared vehicle.

[0110] Step S6, signature verification phase: performed by the recipient's shared vehicle k, with the input being message m i 、Signature c i , the sender shares the public key PK of vehicle i i PVID i , the public key B of the sender user j j and pseudo-identity PID j The output is signature authentication pass / fail; the signature verification phase in step S6 specifically includes the following steps:

[0111] S61: The receiving shared vehicle k that is already logged in first confirms the freshness of the message tuple by checking the timestamp and ignores outdated message tuples;

[0112] S62: Shared vehicle k verifies the validity of the signature based on the received message tuple. The verification process is as follows:

[0113] (a)h 3i =H3(m i , iID ij , PK i , Y i , B j , T i )

[0114] (b)h 4i =H4(m i , EID ij , PK i , T i );

[0115] (c) Verify the equation Is it true?

[0116] If the equation holds true, then the shared vehicle k will c i Considered as message m i Otherwise, the authentication fails.

[0117] In summary, the present invention proposes a certificateless signature method with user-device decoupling. By using a fuzzy extractor to extract biometric information of the user and separating the keys of the user and the device, fine-grained identity authentication and message authentication with decoupling of the user and the device are successfully achieved. In addition, the present invention introduces category identification and divides the devices in the system into categories, so that users can log in to any device belonging to a certain category, realizing a more flexible authentication process. The present invention eliminates the need for computing power on the user side and improves the feasibility in practical scenarios. At the same time, the present invention adopts a certificateless signature mechanism without pairing, thereby avoiding the complex bilinear mapping operations in the traditional certificateless signature mechanism, and the computational overhead of the signature generation and signature verification process is low.

[0118] It should be noted that the above content merely illustrates the technical idea of ​​the present invention and cannot be used to limit the scope of protection of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications all fall within the scope of protection of the claims of the present invention.

Claims

1. A certificateless signature method with user-device decoupling, characterized in that: At least the following steps are included: S1, system initialization phase: executed by the key generation center KGC, the input is the security parameter λ, and the output is the system private key s and the system public key P pub ; S2, device registration phase: The device's real identity VID and partial public key R are input to the key generation center KGC, and the device's pseudo-identity PVID, private and public category identifiers (gid, GID), and partial device private key d are output. Among them, (PVID, gid, d, R) will be sent to the device via a secure channel, and the GID will be broadcast system-wide. S3, user registration phase: The user's real identity UID, biometric information Bio, and target category identifier GID are input to the key generation center KGC. The fuzzy extractor is used to output the user's pseudo identity PID, biometric auxiliary information τ, login authentication identifier U, information authentication identifier V, and user public key B. Among them, (PID, B, τ, U, V) will be broadcasted within the system. S4, user login stage: After receiving the user's login request and biometric information Bio, the device performs verification and determines whether the login is successful or failed; S5, signature generation phase: executed by the sender user through the logged-in device, with the input being the sender device private key SK, the sender device pseudo-identity PVID, the sender user private key f, the sender user pseudo-identity PID, and the message m, and the output being the signature c = (σ, Y); S6, signature verification phase: executed by the receiving device, with the input being the message m, signature c, sender device public key PK, sender device pseudo identity PVID, sender user public key F and sender user pseudo identity PID, and the output being signature authentication pass / fail.

2. The certificateless signature method with user-device decoupling according to claim 1, characterized in that: In the system initialization phase of step S1, a security parameter λ is input to the key generation center KGC, and an elliptic curve group G of order q and a generator P of G are selected; the key generation center KGC selects five different hash functions {H0, H1, H2, H3, H4}, where: Key Generation Center KGC randomly selected As the system private key, and calculate the system public key P pub =sP.

3. The certificateless signature method with user-device decoupling according to claim 2, characterized in that: In step S2, based on the key generation center KGC, according to the real identity VID of device i i and partial public key X i Generate the corresponding pseudo identity PVID i and partial private key d i The specific method is: (a) Random selection (b)R i =r i P; (c) (d)h 1i =H1(PVID i ,X i ,R i ,P pub ); (e)d i =r i +sh 1i mid q; Among them, r i is the random number selected by KGC, R i Partial public key of device i generated by KGC, T m is the current corresponding timestamp, s is the system private key, PVID i is the pseudo identity of device i, VID i is the real identity of device i, X i is the partial public key of device i, h 1i is the digest value output by the H1 hash function, d i Partial private key of device i generated for KGC.

4. The certificateless signature method with user-device decoupling according to claim 2, characterized in that: In step S3, the key generation center KGC uses a fuzzy extractor to generate the key according to the real identity UID provided by user j. j and biometric information j , generate the corresponding pseudo identity PID j , the specific generation method is as follows: (a) Random selection (b)Gen(Bio j )=(θ j ,t j ); (c) Among them, v is the random number selected by KGC, Bio j The biometric information provided by user j, θ j is the biometric secret information corresponding to user j, τ j is the biometric auxiliary information corresponding to user j, UID j is the real identity and PID of user j j is the pseudo identity corresponding to user j, T j The current corresponding timestamp; The key generation center KGC uses the biometric secret information θ corresponding to user j j And the public category identifier GID j , generate login authentication identifier U j , Information authentication mark V j And user public key B j , the specific generation method is as follows: (a) Random selection (b)B j =b j P; (c)h 1j =H1(PID j ,GID j ,B j ,P pub ); (d)f j =b j +sh 1j mod q; (e) Random selection (f)U j =in j P; (g) Among them, b j ,u j is the random number selected by KGC, B j Public key and GID corresponding to user j j The public category identifier selected by user j, h 1j is the summary value output by the H1 hash function, f j is the private key corresponding to user j, U j is the login authentication identifier corresponding to user j, V j is the information authentication identifier corresponding to user j.

5. The certificateless signature method with user-device decoupling according to claim 4, characterized in that: The user login stage in step S4 specifically includes the following steps: S41: Device i receives the login request and corresponding biometric information Bio from user j j After that, device i uses fuzzy extractor and bio-assisted information τ j , calculate the biological secret information θ j =Rep(Bio j , τ j ); S42: Device i obtains the biometric secret information θ calculated in step S41 j , calculate the private key f of user j j , the specific calculation method is as follows: S421:h 1j =H1(PID j ,GID j ,B j ,P pub ); S422： S43: Device i verifies equation f j P=B j +h 1j P pub Is it true? If so, user j successfully logs in; otherwise, device i will reject the login request.

6. The certificateless signature method with user-device decoupling according to claim 1, characterized in that: In the step S5 signature generation phase, device i generates a signature based on its own private key SK i PVID i 、User j's private key f j , Pseudo Identity PID j and the original message m i , generate the corresponding signature c i =(σ i , Y i ), the specific generation method is as follows: (a) Random selection (b)Y i =y i P; (c)EID ij =PVID i ||PID j ; (d)h 3i =H3(m i ,EID ij ,PK i ,Y i ,B j ,T i ); (e)h 4i =H4(m i ,EID ij ,PK i ,T i ); (f)σ i =y i +h 3i x i +h 4i (d i +f j )mod q Among them, y i The random number selected by KGC, Y i Signature verification identifier, EID ij PVID is the pseudo identity of the device i i With user j pseudo identity PID j The collection of m i The message to be signed, PK i is the public key corresponding to device i, B j is the public key of user j, h 3i , h 4i They are the digest values ​​output by H3 hash function, H4 hash function, and x i is the partial private key of device i, T i is the current corresponding timestamp, σ i Sign the output portion.

7. The certificateless signature method with user-device decoupling according to claim 6, characterized in that: In the signature verification phase of step S6, the receiving device k confirms the freshness of the message tuple by checking the timestamp, ignores outdated message tuples, and then verifies the validity of the signature. The verification process is as follows: (a)h 3i =H3(m i ,EID ij ,PK i ,Y i ,B j ,T i ) (b)h 4i =H4(m i ,EID ij ,PK i ,T i ); (c) Verify the equation Is it true? If the equation is true, the receiving device k will c i Considered as message m i Otherwise, the authentication fails.

Images