Group key negotiation method for resisting collusion attack

Abstract

The invention relates to a group key negotiation method for resisting collusion attacks, relates to the technical field of cryptology, and solves the problem that an existing group key negotiation protocol cannot resist the collusion attacks of multiple users. The method comprises the following steps: a trusted center outputs system parameters according to input safety parameters; each user terminal generates a public and private key pair of the user terminal according to the system parameters; each user terminal generates respective authentication information according to the random challenge values of all the user terminals, the public keys of the adjacent user terminals, respective private keys and the system parameters; each user terminal performs a first round of verification on the authentication information of other user terminals according to the system parameters, and determines a session key shared among the user terminals according to a first round of verification result; each user terminal generates respective verification information according to the session key, the respective private key, the random challenge values of all user terminals and the system parameters; and each user terminal performs a second round of verification on the verification information of other user terminals according to the system parameters, and determines whether to adopt the session key or not according to a second round of verification result.

Description

Technical Field

[0001] This invention relates to the field of cryptography, and in particular to a group key negotiation method to resist collusion attacks. Background Technology

[0002] With the continuous development of technologies such as distributed computing and 5G mobile communication, people are no longer limited to simple one-to-one communication. The demand for large-scale many-to-many communication between nodes is constantly increasing, such as large-scale machine communication, multi-node collaborative work, and information sharing. In most cases, the data transmitted in many-to-many communication scenarios is not publicly available data, but needs to be limited to a certain scope (e.g., only known to participating nodes). At the same time, it is necessary to prevent other malicious nodes from sending false data that could affect the judgment results of the communication data. Therefore, it is essential to ensure the confidentiality and authentication of transmitted data. Group key agreement protocols (also known as "group key negotiation protocols") interact based on the identity information of all participating users, ensuring that all participating users generate the same session key, and guaranteeing that only participating users can generate this session key. Therefore, it can meet the security requirements of data transmission in many-to-many communication scenarios.

[0003] The organizational structure of users participating in group key negotiation protocols can be categorized into ring structures, tree structures, octopus structures, etc. In a ring structure, because a user only communicates with their adjacent users during some communication sessions, if two of a user's adjacent users collude, they could potentially impersonate that user during key negotiation. Therefore, most current ring-structured group key negotiation protocols are unable to defend against multi-user collusion attacks. Summary of the Invention

[0004] Based on the above analysis, the embodiments of the present invention aim to provide a group key negotiation method to resist collusion attacks, thereby solving the problem that existing group key negotiation protocols cannot resist multi-user collusion attacks.

[0005] This invention provides a group key negotiation method to resist collusion attacks, comprising the following steps:

[0006] The Trust Center outputs system parameters based on the input security parameters. These system parameters are the system parameters of a communication system composed of several user terminals.

[0007] Each user terminal generates its own public-private key pair based on the system parameters.

[0008] Each user terminal generates its own authentication information based on the random challenge value of all user terminals, the public keys of adjacent user terminals, its own private key, and the system parameters.

[0009] Each user terminal performs a first round of verification on the authentication information of other user terminals based on the system parameters, and determines the session key shared among the user terminals based on the results of the first round of verification.

[0010] Each user terminal generates its own verification information based on the session key, its own private key, the random challenge value of all user terminals, and the system parameters;

[0011] Each user terminal performs a second round of verification on the verification information of other user terminals based on the system parameters, and determines whether to use the session key based on the results of the second round of verification.

[0012] Based on a further improvement to the above method, each user terminal generates its own authentication information according to the random challenge value of all user terminals, the public keys of adjacent user terminals, its own private key, and the system parameters, including:

[0013] Each user terminal broadcasts its own user identity, its own public key, and its own random challenge value.

[0014] Each user terminal sorts the user identities of all user terminals to obtain a list of users that are connected end to end;

[0015] Each user terminal generates its own authentication information based on the random challenge value of all user terminals, the random challenge value and public key of the user terminal adjacent to each user terminal's user identity in the user list, its own private key, and the system parameters.

[0016] Based on a further improvement of the above method, each user terminal generates its own authentication information according to the random challenge value of all user terminals, the random challenge value and public key of the user terminal adjacent to each user terminal's user identity in the user list, its own private key, and the system parameters, including:

[0017] Each user terminal generates a first intermediate value and a second intermediate value based on the random challenge values ​​of all user terminals, the random challenge values ​​and public keys of user terminals adjacent to each user terminal's user identity in the user list, the user identities of all user terminals, and the system parameters.

[0018] Each user terminal generates a third intermediate value based on the random challenge values ​​of all user terminals, the user identities of all user terminals, their respective random numbers, their respective private keys, and the system parameters. The random challenge values ​​of each user terminal are determined by the random numbers of each user terminal and the system parameters.

[0019] Each user terminal generates its own authentication information based on the first intermediate value, the second intermediate value, and the second intermediate value.

[0020] Based on a further improvement of the above method, the system parameters include a symmetric encryption / decryption algorithm. Each user terminal generates its own verification information based on the session key, its own private key, and the system parameters, including:

[0021] Each user terminal uses a symmetric encryption algorithm to encrypt its own second intermediate value to obtain verification information;

[0022] Furthermore, each user terminal performs a second round of verification on the verification information of other user terminals based on the system parameters, including:

[0023] Each user terminal generates a fourth intermediate value for each of the other user terminals based on the random challenge value and public key of each other user terminal and the system parameters.

[0024] Each user terminal uses a symmetric decryption algorithm to decrypt the verification information of other user terminals to obtain the third intermediate value of other user terminals;

[0025] Each user terminal verifies the relationship between the fourth intermediate value and the third intermediate value of other user terminals.

[0026] Based on a further improvement of the above method, the trusted center outputs system parameters according to the input security parameters, including:

[0027] The Trusted Center performs the following operations:

[0028] Choose a large prime number p and the coefficients a and b of the elliptic curve, and construct the elliptic curve E:y 2 =x 3 +ax+bmod p;

[0029] Choose an additive cyclic group G1 with a prime number q on the elliptic curve E, whose generator is G;

[0030] Choose hash function H1: {0,1}*→Z q * and hash function And, where {0,1}* is a bit string of 0s and 1s of arbitrary length, Z q * represents the set of integers less than q that are relatively prime to q. For the value space of the symmetric encryption key, the Determined by the aforementioned safety parameters;

[0031] Choose a symmetric encryption algorithm: Symmetric decryption algorithm: Dec: Where {0,1}* is a bit string of arbitrary length consisting of 0s and 1s, Enc(K,M) represents encrypting the plaintext message M using the symmetric key K, and Dec(K,C) represents decrypting the ciphertext message C using the symmetric key K. For the value space of the symmetric encryption key, the Determined by the aforementioned safety parameters;

[0032] Output the parameters G1, a, b, p, q, G, H1, and H2 as system parameters.

[0033] Based on a further improvement of the above method, each user terminal generates its own public-private key pair according to the system parameters, including:

[0034] Each user terminal from Z q Randomly select its private key sk and calculate its public key PK according to the formula PK = sk·G;

[0035] Furthermore, the random challenge value for each user terminal is generated in the following way:

[0036] Each user terminal selects a random number r i The random challenge value for each user terminal is calculated using the following formula:

[0037] R i =r i ·G, where r i Representing user identity U i The random number R selected by the corresponding user terminal i Representing user identity U i The corresponding random challenge value for the user terminal.

[0038] Based on a further improvement of the above method, each user terminal generates its own authentication information according to the random challenge value of all user terminals, the random challenge value and public key of the user terminal adjacent to each user terminal's user identity in the user list, its own private key, and the system parameters, including:

[0039] Each user terminal should perform the following steps:

[0040] Step S10: Calculate the first intermediate value and the second intermediate value for each user terminal according to the following formula:

[0041] Z i+1 =R i+1 +h·PK i+1 , Z i-1 =R i-1 +h·PK i-1 Where h = H1(U0, U1, ..., U n-1 ,

[0042] R0,R1,…,R n-1 Z i+1 and Z i-1 PK represents the first and second median values, respectively. i+1 and PK i-1 R0, R1, ..., R represent the public keys of adjacent user terminals, respectively. n-1 The random challenge value representing all user terminals, {U0,U1,…,U n-1} represents a list of user identities;

[0043] Step S20: Calculate the third intermediate value for each according to the following formula;

[0044] x i =r i +h·sk i , among which, sk i Representing user identity U i The corresponding user terminal's private key, x i Representing user identity U i The third intermediate value corresponding to the user terminal;

[0045] Step S30: Calculate the respective authentication information according to the following formula:

[0046] X i =x i (Z i+1 -Z i-1 ), where X i Representing user identity U i The authentication information of the corresponding user terminal.

[0047] Based on a further improvement of the above method, each user terminal performs a first round of verification on the authentication information of other user terminals according to the system parameters, and determines the shared session key among the user terminals based on the first round of verification results. This includes each user terminal performing the following steps:

[0048] Step S110: Obtain authentication information X for all user terminals. j Determine whether the following equation is true:

[0049] X0 + X1 + … + X n-1 =O, where j = 0, 1, 2, ..., n-1, and O is the zero element in group G1;

[0050] Step S120: If step S110 passes the verification, calculate the shared secret value twk between each user terminal according to the following formula. i :

[0051] twk i =nxi Z i-1 +(n-1)X i +(n-2)X i+1 +…+X i+n-2 , where i = 0, 1, 2, ..., n-1;

[0052] Step S130: Calculate the session key wk between each user terminal according to the following formula. i :

[0053] wk i =H2(twk) i ,U0,U1,…,U n-1 ,X0,X1,…,X n-1 ).

[0054] Based on a further improvement of the above method, each user terminal generates its own verification information according to the session key, its own private key, and the system parameters, including the following steps performed by each user terminal:

[0055] According to equation C i =Enc(wk i ,x i Calculate their respective verification information C i ;

[0056] Furthermore, each user terminal performs a second round of verification on the authentication information of other user terminals based on the system parameters, and determines whether to use the session key based on the results of the second round of verification. This includes each user terminal performing the following steps:

[0057] Step S100: For all other user terminals j∈{0,1,2,…,n-1} and j≠i, calculate the fourth intermediate value for all other user terminals according to the following equation:

[0058] Z j =R j +h·PK j Among them, PK j Representing user identity U j The public key of the corresponding user terminal, R j Representing user identity U j The corresponding random challenge value of the user terminal, Z j Representing user identity U j The fourth intermediate value corresponding to the user terminal;

[0059] Step S200: For all other user terminals j∈{0,1,2,…,n-1}, j≠i, according to equation x j =Dec(wk j C jCalculate the third intermediate value x for all other user terminals. j ;

[0060] Step S300: For all other user terminals j∈{0,1,2,…,n-1} and j≠i, verify equation x. j ·G=Z j Check if the conditions are met. If all conditions are met, then the session key is set to wk. i .

[0061] Based on a further improvement to the above method, if the session keys determined by each user terminal are inconsistent, the user who sent the error message is identified using the following method:

[0062] If the equation X0+X1+…+X in step S110 is true, then… n-1 If 0 is not true, then all user terminals are required to publish their second intermediate value x calculated according to step S20. j And for all user terminals j∈{0,1,2,…,n-1}, verify equation X. j =x j (Z j+1 -Z j-1 ) and equation x j ·G=Z j Whether the equation is true or false, the user terminal j that sent the error message is the one that determined the equation.

[0063] If the equation x in step S300 j ·G=Z j If the equation is not true, then the user terminal j that sent the error message is the one that is not true.

[0064] If the equation X0+X1+…+X in step S110 is true, then… n-1 =O and the equation x in step S300 j ·G=Z j If all conditions are met, but the session keys generated by each user terminal are inconsistent, then all user terminals are required to publish their second intermediate value x calculated according to step S20. j And for all user terminals j∈{0,1,2,…,n-1}, verify equation X. j =x j (Z j+1 -Z j-1 If the equation is not true, the user terminal j that sent the error message is the one that determined whether the equation was true.

[0065] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0066] 1. This solution breaks free from the limitations of a ring structure, effectively preventing the information gap advantage that arises when only some users know certain key parameters, thus avoiding collusive attacks to a certain extent.

[0067] 2. This scheme broadcasts the random challenge value generated by each user and verifies it based on the user's identity information, ensuring that the random challenge value and its authentication information can only be generated by legitimate users and cannot be forged by other users.

[0068] 3. This solution provides error tracing functionality to ensure timely detection of user errors and guarantee data reliability during group communication.

[0069] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0070] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0071] Figure 1 This is a flowchart illustrating a group key negotiation method for resisting collusion attacks according to an embodiment of the present invention. Detailed Implementation

[0072] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0073] Figure 1 This is a flowchart illustrating a group key negotiation method for resisting collusion attacks according to an embodiment of the present invention.

[0074] The following combination Figure 1 An embodiment of the present invention will be described.

[0075] like Figure 1 As shown, the group key negotiation method for resisting collusion attacks includes:

[0076] Step 101: The Trusted Center outputs system parameters based on the input security parameters. The system parameters are the system parameters of a communication system composed of several user terminals.

[0077] In this embodiment, the trusted center can output system parameters according to an initialization algorithm. This initialization algorithm takes a security parameter as input and outputs the system parameters of the communication system consisting of the trusted center and multiple user terminals.

[0078] In some embodiments, the initialization algorithm includes performing the following operations:

[0079] The algorithm takes the security parameter κ as input and performs the following operations:

[0080] 1. Choose a large prime number p and the coefficients a and b of the elliptic curve, and construct the elliptic curve E:y 2 =x 3 +ax+b modp, where "mod" is the modulo operation and "b mod p" represents the remainder when b is divided by p.

[0081] 2. Choose an additive cyclic group G1 with order q on the elliptic curve E, whose generator is G.

[0082] 3. Choose hash function H1: {0,1}*→Z q * and hash function Where {0,1}* is a bit string of 0s and 1s of arbitrary length, Z q * represents the set of integers less than q that are relatively prime to q. For the value space of the symmetric encryption key, the Determined by the aforementioned safety parameters.

[0083] 4. Choose a symmetric encryption algorithm: Symmetric decryption algorithm: Dec: Where {0,1}* is a bit string of 0s and 1s of arbitrary length, and Enc(K,M) and Dec(K,C) represent encrypting plaintext message M using symmetric key K and decrypting ciphertext message C using symmetric key K, respectively. For the value space of the symmetric encryption key, It is determined by the security parameter κ.

[0084] 5. Output parameters G1, a, b, p, q, G, H1, and H2 as system parameters.

[0085] In other embodiments, the initialization algorithm includes performing the following operations:

[0086] 1. Choose a large prime number p and the coefficients a and b of the elliptic curve, and construct the elliptic curve E:y 2 =x 3 +ax+b modp, where "mod" is the modulo operation and "b mod p" represents the remainder when b is divided by p.

[0087] 2. Choose an additive cyclic group G1 with order q on the elliptic curve E, whose generator is G.

[0088] 3. Choose hash function H1: {0,1}*→Z q * and hash function Where {0,1}* is a bit string of 0s and 1s of arbitrary length, Z q * represents the set of integers less than q that are relatively prime to q. For the value space of the symmetric encryption key, the Determined by the aforementioned safety parameters.

[0089] 4. Choose a symmetric encryption algorithm: Symmetric decryption algorithm: Dec: Where {0,1}* is a bit string of 0s and 1s of arbitrary length, and Enc(K,M) and Dec(K,C) represent encrypting plaintext message M using symmetric key K and decrypting ciphertext message C using symmetric key K, respectively. For the value space of the symmetric encryption key, It is determined by the security parameter κ.

[0090] 5. From Z q * Randomly select the master private key s from the formula P pub =sG calculates the master public key P pub .

[0091] 6. Set parameters G1, a, b, p, q, G, H1, H2, P pub The output is system parameters, and the master private key s is secretly stored.

[0092] Step 102: Each user terminal generates its own public-private key pair according to the system parameters.

[0093] In this embodiment, a key generation algorithm can generate a public-private key pair for each user terminal's user identity; otherwise, it returns the symbol ⊥ to indicate algorithm failure. This key generation algorithm can be executed by each user terminal. The algorithm can take system parameters as input and generate a public-private key pair for each user identity; otherwise, it returns the symbol ⊥ to indicate algorithm failure.

[0094] In some embodiments, the key generation algorithm includes the following steps:

[0095] 1. From Z q Randomly select its private key sk and calculate its public key PK according to the formula PK = sk·G.

[0096] In other embodiments, the key generation algorithm generates a public-private key pair and user certificate for each user terminal's user identity; otherwise, it returns the symbol ⊥ to indicate that the algorithm has failed. This key generation algorithm can be jointly executed by each user terminal and the trusted center. The algorithm can take system parameters, user identity, and the trusted center's master private key as input to generate a public-private key pair and user certificate for each user identity; otherwise, it returns the symbol ⊥ to indicate that the algorithm has failed.

[0097] In some embodiments, the key generation algorithm includes the following steps:

[0098] Let U represent the user identity of the user terminal. After user U registers with the Trusted Center, the user terminal performs the following steps:

[0099] 1. From Z q Randomly select its private key sk and calculate its public key PK according to the formula PK = sk·G.

[0100] 2. Send the public key PK and user identity U to the trusted center.

[0101] After verifying a user's identity, the trusted center can use its master private key s to sign the user's public key PK and user identity U to obtain the user certificate Cert. U and the user certificate Cert U Send it to the user terminal. For example, here is the user certificate Cert. U It can be an X.509 signing certificate.

[0102] Afterwards, the user terminal sets user U's public / private key pair to (PK, sk) and the user certificate to Cert. U .

[0103] Step 103: Each user terminal generates its own authentication information based on the random challenge value of all user terminals, the public key of adjacent user terminals, its own private key, and the system parameters.

[0104] In this embodiment, each user terminal can achieve identity authentication through a group key negotiation algorithm. This group key negotiation algorithm can be a probabilistic algorithm that takes the identity information and public / private key pairs of participating users as input and achieves identity authentication through four stages of interaction. In the first stage, all participating users generate random challenge values ​​and broadcast them along with their own identity information. In the second stage, all participating users use their private keys and the random challenge values ​​of their neighboring users to generate and broadcast authentication information. In the third stage, all participating users use the authentication information to generate a shared session key and use this session key to encrypt their own secret information, thereby generating and broadcasting verification information. In the fourth stage, all participating users verify the identity information of other users using the verification information.

[0105] In this embodiment, the key negotiation algorithm may include an authentication information generation algorithm, a verification information generation algorithm, an authentication information verification algorithm, and a verification information verification algorithm.

[0106] In some embodiments, the authentication information generation algorithm includes the following steps:

[0107] Step S11: Each user terminal broadcasts its own user identity, its own public key, and its own random challenge value.

[0108] Step S22: Each user terminal sorts the user identities of all user terminals to obtain a list of users that are connected end to end.

[0109] Step S33: Each user terminal generates its own authentication information and sends it to all other user terminals based on the random challenge value of all user terminals, the random challenge value and public key of the user terminal adjacent to the user identity of each user terminal in the user list, its own private key, and the system parameters.

[0110] Steps S11-S33 will be explained below with reference to a specific implementation method.

[0111] Assume that there are n users participating in this group key negotiation protocol, whose identities are {U0, U1, ..., U...} n-1}. Among them, user U i The corresponding public / private key pair and certificate are PK, respectively. i ,sk i Cert Ui (i = 0, 1, ..., n-1). Each user U i Perform the following operations:

[0112] Phase 1:

[0113] 1. Randomly generate random number r i And calculate user U according to the following formula i Random challenge value R i :

[0114] R i =r i ·G, where the random number r i It can be generated using a pseudo-random function.

[0115] 2. Broadcast your own random challenge value R i , one's own user identity U i PK with your own public key i and its own user certificate Cert Ui .

[0116] Phase Two:

[0117] User U i After receiving the user identities, public keys, and user certificates of all users, the system first verifies the user certificates of all other users using the master public key. Once verification is successful, all participating users can be sorted according to specific rules to obtain a contiguous list of users {U0, U1, ..., U...}. n-1}, where U0 is user U n-1 The next item. For example, a specific rule here could be the alphabetical order of the first letters of the user's identity.

[0118] Step S10: Obtain the random challenge value R of adjacent user terminals. i-1 and R i+1 Then, the first intermediate value Z for each user terminal is calculated according to the following formula. i+1 Second intermediate value Z i-1 :

[0119] Z i+1 =R i+1 +h·PK i+1 , Z i-1 =R i-1 +h·PK i-1 Where h = H1(U0, U1, ..., U n-1 ,

[0120] R0,R1,…,R n-1 ), PK i+1 and PK i-1 Representing adjacent user terminals U i+1 and U i-1 The public keys, R0, R1, ..., R n-1 The random challenge value representing all user terminals, {U0,U1,…,U n-1} represents a list of user identities.

[0121] Step S20: Calculate the respective third intermediate value x according to the following formula. i ;

[0122] x i =r i +h·sk i , among which, sk i Representing user identity U i The private key of the corresponding user terminal.

[0123] Step S30: Calculate the respective authentication information X according to the following formula. i and the authentication information X i Send to all other user terminals:

[0124] X i=x i (Z i+1 -Z i-1 ).

[0125] Step 104: Each user terminal performs a first round of verification on the authentication information of other user terminals according to the system parameters, and determines the session key shared among the user terminals based on the results of the first round of verification.

[0126] In this embodiment, each user terminal can achieve identity authentication through a group key negotiation algorithm. This group key negotiation algorithm can be a probabilistic algorithm that takes the identity information and public / private key pairs of participating users as input and achieves identity authentication through four stages of interaction. In the first stage, all participating users generate random challenge values ​​and broadcast them along with their own identity information. In the second stage, all participating users use their private keys and the random challenge values ​​of their neighboring users to generate and broadcast authentication information. In the third stage, all participating users use the authentication information to generate a shared session key and use this session key to encrypt their own secret information, thereby generating and broadcasting verification information. In the fourth stage, all participating users verify the identity information of other users using the verification information.

[0127] In this embodiment, the key negotiation algorithm may include an authentication information generation algorithm, a verification information generation algorithm, an authentication information verification algorithm, and a verification information verification algorithm.

[0128] In some embodiments, the authentication information verification algorithm includes the following steps:

[0129] Each user terminal performs a first round of verification on the authentication information of other user terminals based on the system parameters, and determines the session key shared among the user terminals based on the results of the first round of verification.

[0130] Step S104 will be described below with reference to a specific implementation method.

[0131] Assume that there are n users participating in this group key negotiation protocol, whose identities are {U0, U1, ..., U...} n-1}. Among them, user U i The corresponding public / private key pair and certificate are PK, respectively. i ,sk i Cert Ui (i = 0, 1, ..., n-1). User U i The authentication information generation algorithm described above generated authentication information X. i .

[0132] Each user U i Perform the following operations:

[0133] Step S110: Obtain authentication information X for all users j After (j = 0, 1, 2, ..., n-1), determine whether the following equation is true:

[0134] X0 + X1 + … + X n-1 =O, where j = 0, 1, 2, ..., n-1, and O is the zero element in group G1. If the equation is true, proceed to the next step; otherwise, return to the symbol ⊥ and terminate execution.

[0135] Step S120: If the first round of verification passes, calculate the shared secret value twk between each user terminal according to the following formula. i :

[0136] twk i =nx i Z i-1 +(n-1)X i +(n-2)X i+1 +…+X i+n-2 , where i = 0, 1, 2, ..., n-1.

[0137] Step S130: Calculate the session key wk between each user terminal according to the following formula. i :

[0138] wk i =H2(twk) i ,U0,U1,…,U n-1 ,X0,X1,…,X n-1 ).

[0139] Step 105: Each user terminal generates its own verification information based on the session key, its own private key, the random challenge value of all user terminals, and the system parameters.

[0140] In this embodiment, each user terminal can achieve identity authentication through a group key negotiation algorithm. This group key negotiation algorithm can be a probabilistic algorithm that takes the identity information and public / private key pairs of participating users as input and achieves identity authentication through four stages of interaction. In the first stage, all participating users generate random challenge values ​​and broadcast them along with their own identity information. In the second stage, all participating users use their private keys and the random challenge values ​​of their neighboring users to generate and broadcast authentication information. In the third stage, all participating users use the authentication information to generate a shared session key and use this session key to encrypt their own secret information, thereby generating and broadcasting verification information. In the fourth stage, all participating users verify the identity information of other users using the verification information.

[0141] In this embodiment, the key negotiation algorithm may include an authentication information generation algorithm, a verification information generation algorithm, an authentication information verification algorithm, and a verification information verification algorithm.

[0142] In some embodiments, the verification information generation algorithm includes the following steps:

[0143] Each user terminal generates its own verification information based on the session key, its own private key, the random challenge value of all user terminals, and the system parameters.

[0144] Step S105 will be explained below with reference to a specific implementation method.

[0145] Assume that there are n users participating in this group key negotiation protocol, whose identities are {U0, U1, ..., U...} n-1}. Among them, user U i The corresponding public / private key pair and certificate are PK, respectively. i ,sk i Cert Ui (i = 0, 1, ..., n-1). User U i The authentication information generation algorithm described above generated authentication information X. i Based on the authentication information verification algorithm described above, session keys wk were generated between each user terminal. i .

[0146] Each user U i Perform the following operations:

[0147] Each user terminal according to equation C i =Enc(wk i ,x i Calculate their respective verification information C i .

[0148] Step 106: Each user terminal performs a second round of verification on the verification information of other user terminals according to the system parameters, and determines whether to use the session key based on the results of the second round of verification.

[0149] In this embodiment, each user terminal can achieve identity authentication through a group key negotiation algorithm. This group key negotiation algorithm can be a probabilistic algorithm that takes the identity information and public / private key pairs of participating users as input and achieves identity authentication through four stages of interaction. In the first stage, all participating users generate random challenge values ​​and broadcast them along with their own identity information. In the second stage, all participating users use their private keys and the random challenge values ​​of their neighboring users to generate and broadcast authentication information. In the third stage, all participating users use the authentication information to generate a shared session key and use this session key to encrypt their own secret information, thereby generating and broadcasting verification information. In the fourth stage, all participating users verify the identity information of other users using the verification information.

[0150] In this embodiment, the key negotiation algorithm may include an authentication information generation algorithm, a verification information generation algorithm, an authentication information verification algorithm, and a verification information verification algorithm.

[0151] In some embodiments, the verification information verification algorithm includes the following steps:

[0152] Each user terminal performs a second round of verification on the verification information of other user terminals based on the system parameters, and determines whether to use the session key based on the results of the second round of verification.

[0153] Step S106 will be described below with reference to a specific implementation method.

[0154] Assume that there are n users participating in this group key negotiation protocol, whose identities are {U0, U1, ..., U...} n-1}. Among them, user U i The corresponding public / private key pair and certificate are PK, respectively. i ,sk i Cert Ui (i = 0, 1, ..., n-1). User U i The authentication information generation algorithm described above generated authentication information X. i Based on the authentication information verification algorithm described above, session keys wk were generated between each user terminal. i Based on the verification information generation algorithm described above, verification information C for each user terminal was generated. i .

[0155] Each user U i Perform the following operations:

[0156] Step S100: For all other user terminals j∈{0,1,2,…,n-1} and j≠i, calculate the fourth intermediate value for all other user terminals according to the following equation:

[0157] Zj =R j +h·PK j Among them, PK j Representing user identity U j The public key of the corresponding user terminal, R j Representing user identity U j The corresponding random challenge value of the user terminal, Z j Representing user identity U j The fourth intermediate value corresponding to the user terminal;

[0158] Step S200: For all other user terminals j∈{0,1,2,…,n-1}, j≠i, according to equation x j =Dec(wk j C j Calculate the third intermediate value x for all other user terminals. j ;

[0159] Step S300: For all other user terminals j∈{0,1,2,…,n-1} and j≠i, verify equation x. j ·G=Z j Check if the conditions are met. If all conditions are met, then the session key is set to wk. i .

[0160] In the above embodiment, by broadcasting the random challenge value generated by each user in the first stage and verifying it according to the user's identity in step S300, the random challenge value and its authentication information X in the second stage are guaranteed. i It can only be generated by legitimate users and cannot be forged by other users.

[0161] In the above embodiments, each participating user can calculate the fourth intermediate value Z for all users. j The parameters (j∈{0,1,2,…,n-1}) are freed from the constraints of the circular structure, which can effectively prevent the information gap advantage brought about by some parameters being known only to some users, and also avoid collusion attacks to a certain extent.

[0162] In other embodiments, the present invention also provides an error tracing method. Specifically, if the session keys determined by each user terminal are inconsistent, the user who sent the error message is determined by the following method:

[0163] If the equation X0+X1+…+X in step S110 is true, then… n-1 If 0 is not true, then all user terminals are required to publish their second intermediate value x calculated according to step S20. j And for all user terminals j∈{0,1,2,…,n-1}, verify equation X.j =x j (Z j+1 -Z j-1 ) and equation x j ·G=Z j Whether the equation is true or false, the user terminal j that sent the error message is the one that determined the equation.

[0164] If the equation x in step S300 j ·G=Z j If the equation is not true, then the user terminal j that sent the error message is the one that is not true.

[0165] If the equation X0+X1+…+X in step S110 is true, then… n-1 =O and the equation x in step S300 j ·G=Z j If all conditions are met, but the session keys generated by each user terminal are inconsistent, then all user terminals are required to publish their second intermediate value x calculated according to step S20. j And for all user terminals j∈{0,1,2,…,n-1}, verify equation X. j =x j (Z j+1 -Z j-1 If the equation is not true, the user terminal j that sent the error message is the one that determined whether the equation was true.

[0166] The above embodiments provide error tracing functionality, ensuring that user errors can be detected in a timely manner and guaranteeing the reliability of data during group communication.

[0167] The embodiments described above have at least the following beneficial technical effects:

[0168] 1. This solution breaks free from the limitations of a ring structure, effectively preventing the information gap advantage that arises when only some users know certain key parameters, thus avoiding collusive attacks to a certain extent.

[0169] 2. This scheme broadcasts the random challenge value generated by each user and verifies it based on the user's identity information, ensuring that the random challenge value and its authentication information can only be generated by legitimate users and cannot be forged by other users.

[0170] 3. This solution provides error tracing functionality to ensure timely detection of user errors and guarantee data reliability during group communication.

[0171] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A group key negotiation method to resist collusion attacks, characterized in that, The steps include: The Trust Center outputs system parameters based on the input security parameters. These system parameters are the system parameters of a communication system composed of several user terminals. Each user terminal generates its own public-private key pair based on the system parameters. Each user terminal generates its own authentication information based on the random challenge value of all user terminals, the public keys of adjacent user terminals, its own private key, and the system parameters. Each user terminal performs a first round of verification on the authentication information of other user terminals based on the system parameters, and determines the session key shared among the user terminals based on the results of the first round of verification. Each user terminal generates its own verification information based on the session key, its own private key, the random challenge value of all user terminals, and the system parameters; Each user terminal performs a second round of verification on the verification information of other user terminals based on the system parameters, and determines whether to use the session key based on the results of the second round of verification.

2. The group key negotiation method for resisting collusion attacks according to claim 1, characterized in that, Each user terminal generates its own authentication information based on the random challenge value from all user terminals, the public keys of adjacent user terminals, its own private key, and the system parameters, including: Each user terminal broadcasts its own user identity, its own public key, and its own random challenge value. Each user terminal sorts the user identities of all user terminals to obtain a list of users that are connected end to end; Each user terminal generates its own authentication information based on the random challenge value of all user terminals, the random challenge value and public key of the user terminal adjacent to each user terminal's user identity in the user list, its own private key, and the system parameters.

3. The group key negotiation method for resisting collusion attacks according to claim 2, characterized in that, Each user terminal generates its own authentication information based on the random challenge values ​​of all user terminals, the random challenge values ​​and public keys of user terminals adjacent to each user terminal's user identity in the user list, its own private key, and the system parameters, including: Each user terminal generates a first intermediate value and a second intermediate value based on the random challenge values ​​of all user terminals, the random challenge values ​​and public keys of user terminals adjacent to each user terminal's user identity in the user list, the user identities of all user terminals, and the system parameters. Each user terminal generates a third intermediate value based on the random challenge values ​​of all user terminals, the user identities of all user terminals, their respective random numbers, their respective private keys, and the system parameters. The random challenge values ​​of each user terminal are determined by the random numbers of each user terminal and the system parameters. Each user terminal generates its own authentication information based on the first intermediate value, the second intermediate value, and the third intermediate value.

4. The group key negotiation method for resisting collusion attacks according to claim 3, characterized in that, The system parameters include a symmetric encryption / decryption algorithm. Each user terminal generates its own verification information based on the session key, its own private key, and the system parameters, including: Each user terminal uses a symmetric encryption algorithm to encrypt its own second intermediate value to obtain verification information; Furthermore, each user terminal performs a second round of verification on the verification information of other user terminals based on the system parameters, including: Each user terminal generates a fourth intermediate value for each of the other user terminals based on the random challenge value and public key of each other user terminal and the system parameters. Each user terminal uses a symmetric decryption algorithm to decrypt the verification information of other user terminals to obtain the third intermediate value of other user terminals; Each user terminal verifies the relationship between the fourth intermediate value and the third intermediate value of other user terminals.

5. The group key negotiation method for resisting collusion attacks according to claim 2, characterized in that, The trusted center outputs system parameters based on the input security parameters, including: The Trusted Center performs the following operations: Choose a large prime number p and the coefficients a and b of the elliptic curve, and construct the elliptic curve E:y 2 =x 3 +ax+bmod p; Choose an additive cyclic group G1 with a prime number q on the elliptic curve E, whose generator is G; Choose hash function H1: {0,1}*→Z q * and hash function And, where {0,1}* is a bit string of 0s and 1s of arbitrary length, Z q * represents the set of integers less than q that are relatively prime to q. For the value space of the symmetric encryption key, the Determined by the aforementioned safety parameters; Choose a symmetric encryption algorithm: Symmetric decryption algorithm: Dec: Where {0,1}* is a bit string of arbitrary length consisting of 0s and 1s, Enc(K,M) represents encrypting the plaintext message M using the symmetric key K, and Dec(K,C) represents decrypting the ciphertext message C using the symmetric key K. For the value space of the symmetric encryption key, the Determined by the aforementioned safety parameters; Output the parameters G1, a, b, p, q, G, H1, and H2 as system parameters.

6. The group key negotiation method for resisting collusion attacks according to claim 5, characterized in that, Each user terminal generates its own public-private key pair based on the system parameters, including: Each user terminal from Z q Randomly select its private key sk and calculate its public key PK according to the formula PK = sk·G; Furthermore, the random challenge value for each user terminal is generated in the following way: Each user terminal selects a random number r i The random challenge value for each user terminal is calculated using the following formula: R i =r i ·G, where r i Representing user identity U i The random number R selected by the corresponding user terminal i Representing user identity U i The corresponding random challenge value for the user terminal.

7. The group key negotiation method for resisting collusion attacks according to claim 6, characterized in that, Each user terminal generates its own authentication information based on the random challenge values ​​of all user terminals, the random challenge values ​​and public keys of user terminals adjacent to each user terminal's user identity in the user list, its own private key, and the system parameters, including: Each user terminal should perform the following steps: Step S10: Calculate the first intermediate value and the second intermediate value for each user terminal according to the following formula: Z i+1 =R i+1 +h·PK i+1 , Z i-1 =R i-1 +h·PK i-1 Where h = H1(U0, U1, ..., U n-1 , R0,R1,…,R n-1 Z i+1 and Z i-1 PK represents the first and second median values, respectively. i+1 and PK i-1 R0, R1, ..., R represent the public keys of adjacent user terminals, respectively. n-1 The random challenge value representing all user terminals, {U0,U1,…,U n-1 } represents a list of user identities; Step S20: Calculate the third intermediate value for each according to the following formula; x i =r i +h·sk i , among which, sk i Representing user identity U i The corresponding user terminal's private key, x i Representing user identity U i The third intermediate value corresponding to the user terminal; Step S30: Calculate the respective authentication information according to the following formula: X i =x i (Z i+1 –Z i-1 ), where X i Representing user identity U i The authentication information of the corresponding user terminal.

8. The group key negotiation method for resisting collusion attacks according to claim 7, characterized in that, Each user terminal performs a first round of verification on the authentication information of other user terminals based on the system parameters, and determines the shared session key among the user terminals based on the first round of verification results. This includes each user terminal performing the following steps: Step S110: Obtain authentication information X for all user terminals. j Determine whether the following equation is true: X0 + X1 + … + X n-1 =O, where j = 0, 1, 2, ..., n-1, and O is the zero element in group G1; Step S120: If step S110 passes the verification, calculate the shared secret value twk between each user terminal according to the following formula. i : twk i =nx i Z i-1 +(n-1)X i +(n-2)X i+1 +…+X i+n-2 , where i = 0, 1, 2, ..., n-1; Step S130: Calculate the session key wk between each user terminal according to the following formula. i : wk i =H2(twk i ,U0,U1,…,U n-1 ,X0,X1,…,X n-1 )。 9. The group key negotiation method for resisting collusion attacks according to claim 8, characterized in that, Each user terminal generates its own verification information based on the session key, its own private key, and the system parameters, including the following steps performed by each user terminal: According to equation C i =Enc(wk i ,x i Calculate their respective verification information C i ; Furthermore, each user terminal performs a second round of verification on the authentication information of other user terminals based on the system parameters, and determines whether to use the session key based on the results of the second round of verification. This includes each user terminal performing the following steps: Step S100: For all other user terminals j∈{0,1,2,…,n-1} and j≠i, calculate the fourth intermediate value for all other user terminals according to the following equation: Z j =R j +h·PK j Among them, PK j Representing user identity U j The public key of the corresponding user terminal, R j Representing user identity U j The corresponding random challenge value of the user terminal, Z j Representing user identity U j The fourth intermediate value corresponding to the user terminal; Step S200: For all other user terminals j∈{0,1,2,…,n-1}, j≠i, according to equation x j =Dec(wk j C j Calculate the third intermediate value x for all other user terminals. j ; Step S300: For all other user terminals j∈{0,1,2,…,n-1} and j≠i, verify equation x. j ·G=Z j Check if the conditions are met. If all conditions are met, then the session key is set to wk. i .

10. The group key negotiation method for resisting collusion attacks according to claim 9, characterized in that, If the session keys determined by each user terminal are inconsistent, the user who sent the error message will be identified using the following method: If the equation X0+X1+…+X in step S110 is true, then… n-1 If 0 is not true, then all user terminals are required to publish their second intermediate value x calculated according to step S20. j And for all user terminals j∈{0,1,2,…,n-1}, verify equation X. j =x j (Z j+1 –Z j-1 ) and equation x j ·G=Z j Whether the equation is true or false, the user terminal j that sent the error message is the one that determined the equation. If the equation x in step S300 j ·G=Z j If the equation is not true, then the user terminal j that sent the error message is the one that is not true. If the equation X0+X1+…+X in step S110 is true, then… n-1 =O and the equation x in step S300 j ·G=Z j If all conditions are met, but the session keys generated by each user terminal are inconsistent, then all user terminals are required to publish their second intermediate value x calculated according to step S20. j And for all user terminals j∈{0,1,2,…,n-1}, verify equation X. j =x j (Z j+1 –Z j-1 If the equation is not true, the user terminal j that sent the error message is the one that determined whether the equation was true.

Images