Smart park one-way anti-quantum attack identity authentication method, device and medium

Abstract

The application provides a one-way quantum attack resistant identity authentication method and device for a smart park and a medium, and belongs to the technical field of smart park safety management and control. The method comprises: based on a system administrator performing a system initialization operation, generating a first public-private key pair corresponding to the system administrator; generating a second public-private key pair corresponding to a park user through a key generation center, and distributing the second public-private key pair to a park user terminal. In response to an access request from the park user terminal, based on a preset quantum-resistant signature generation algorithm and operation intermediate information of the system initialization operation, a quantum-resistant digital signature corresponding to the access request is generated and sent to the park user terminal; after receiving a user verification digital signature from the park user terminal, the user verification digital signature is verified based on a second public key in the corresponding second public-private key pair, to determine whether to allow the park user terminal to access the corresponding smart park system according to a first verification result obtained by the verification.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of smart park security management and control, and in particular to a one-way quantum attack-resistant identity authentication method for a smart park, a device and a medium. BACKGROUND

[0002] In the current digital era, smart parks, as a product of the deep integration of information technology and urban development, have become an important carrier for improving urban operational efficiency and improving the quality of life of residents. Through technologies such as the Internet of Things, cloud computing, and big data, smart park systems have achieved extensive connection and data interaction between devices and users. Identity authentication, as the first line of defense to protect system security, is of great importance.

[0003] Currently, most mainstream identity authentication relies on public key cryptography based on mathematical difficult problems. However, the rapid development of quantum computing technology has brought unprecedented challenges to traditional identity authentication systems. In the face of the powerful computing power of quantum computers, traditional identity authentication algorithms based on mathematical difficult problems face the risk of being quickly cracked, which will result in the loss of security of traditional identity authentication mechanisms that rely on these difficult problems, and will expose the smart park system to serious threats such as system breaches and user privacy leaks, causing users to lose trust in the privacy and security of smart parks.

[0004] Under this background, in order to ensure that smart parks can operate safely, stably, and efficiently in the era of quantum computing, and to protect users' privacy information from being leaked, it is urgent to design an identity authentication scheme that is resistant to quantum attacks. The existing scheme cannot effectively resist quantum attacks by external adversaries, and it is difficult to adapt to the complex and diverse device environment in smart parks, providing effective protection for users' privacy and security. SUMMARY

[0005] To solve the above problems, the embodiments of the present application provide a one-way quantum attack-resistant identity authentication method for a smart park, a device and a medium, which can effectively resist quantum attacks by external adversaries and adapt to the complex and diverse device environment in smart parks, providing effective protection for users' privacy and security.

[0006] In a first aspect, the embodiments of the present application provide a one-way quantum attack-resistant identity authentication method for a smart park, which comprises:

[0007] Based on the system administrator performing a system initialization operation, a first public-private key pair corresponding to the system administrator is generated; the first public-private key pair includes a first public key and a first private key;

[0008] A second public-private key pair corresponding to a park user is generated through a key generation center and distributed to a park user terminal; the second public-private key pair includes a second public key and a second private key;

[0009] generate an anti-quantum digital signature corresponding to the access request based on a preset anti-quantum signature generation algorithm and operation intermediate information of the system initialization operation, and send the anti-quantum digital signature to the park user terminal;

[0010] After receiving the user verification digital signature from the park user terminal, verify the user verification digital signature based on a second public key in the corresponding second public-private key pair to determine whether to allow the park user terminal to access the corresponding smart park system according to a first verification result obtained by verification, wherein the user verification digital signature is generated after the park user terminal verifies the anti-quantum digital signature and obtains a second verification result.

[0011] In an implementation manner of the present application, based on the system administrator performing the system initialization operation, a first public-private key pair corresponding to the system administrator is generated, specifically including:

[0012] A first random seed, a second random seed and a third random seed are generated by a randomly selected 256-bit random number;

[0013] A corresponding random matrix is generated according to the first random seed, and a first private key vector and a second private key vector are generated according to the second random seed;

[0014] A random vector is generated according to the random matrix, the first private key vector and the second private key vector;

[0015] The random vector is decomposed into a first decomposition vector and a second decomposition vector, wherein the first decomposition vector corresponds to the high bit part of the random vector, and the second decomposition vector corresponds to the low bit part of the random vector;

[0016] A first hash value is generated based on a first preset hash function, the first random seed and the first decomposition vector;

[0017] The first public key is generated according to the first random seed and the first decomposition vector, and the first private key is generated according to the first random seed, the third random seed, the first hash value, the first private key vector, the second private key vector and the second decomposition vector, so that the first public-private key pair is generated according to the first public key and the first private key, and the first public key is executed by the smart park system.

[0018] In an implementation manner of the present application, based on a preset anti-quantum signature generation algorithm and operation intermediate information of the system initialization operation, an anti-quantum digital signature corresponding to the access request is generated, specifically including:

[0019] The received access request and the first hash value are used as inputs to the preset quantum-resistant signature generation algorithm to calculate the corresponding second hash value;

[0020] Based on the second hash value, the third random seed, the random matrix, the first decomposition vector, and the second decomposition vector, the quantum-resistant digital signature is generated by performing rejection sampling through the preset quantum-resistant signature generation algorithm.

[0021] In one implementation of this application, the verification of the quantum-resistant digital signature based on the campus user terminal specifically includes:

[0022] The user terminal in the park receives the quantum-resistant digital signature and determines the random matrix using the first random seed in the first public key;

[0023] The user terminal in the park determines the second hash value based on the first random seed, the access request, and the first decomposition vector in the first public key;

[0024] The user terminal in the park determines a third decomposition vector corresponding to a preset intermediate vector based on the second element in the quantum-resistant digital signature; wherein, the preset intermediate vector is determined based on the random matrix, the first element in the quantum-resistant digital signature, the third hash value, and the first decomposition vector; the third hash value is obtained based on the second hash value and the fourth decomposition vector;

[0025] The park user terminal verifies the third hash value, the first element, and the second element based on the third decomposition vector, the preset first element coefficient range, and the preset second element verification conditions, respectively.

[0026] If the third hash value, the first element, and the second element are all verified successfully, the user terminal in the park determines that the second verification result is successful; otherwise, it is unsuccessful.

[0027] In one implementation of this application, a second public-private key pair corresponding to a campus user is generated through a key generation center and distributed to the campus user's terminal, specifically including:

[0028] The key generation center determines the first and second cyclic groups of a preset order.

[0029] Based on the first cyclic group and the second cyclic group, determine the corresponding first generator, second generator and bilinear mapping relationship, and determine the second hash function corresponding to the first cyclic group;

[0030] Public system parameters are generated based on the first cyclic group, the second cyclic group, the first generator, the second generator, the bilinear mapping relationship, and the second hash function; the public system parameters are used to generate the user verification digital signature and to verify the user verification digital signature.

[0031] Based on the multiplication group corresponding to the preset order, determine the corresponding random number;

[0032] Based on the random number and the second generator, a second public key is generated, the random number is used as the second private key, and a public processing operation is performed on the second public key in the smart park system.

[0033] In one implementation of this application, the user verification digital signature is verified based on the second public key in the corresponding second public-private key pair, specifically including:

[0034] Based on the second public key, the user verification digital signature, and the public system parameters, calculate the first bilinear mapping value and the second bilinear mapping value, and compare them.

[0035] The user verification digital signature is verified based on the first comparison result between the first bilinear mapping value and the second bilinear mapping value.

[0036] If the first comparison result is consistent, the user verification digital signature verification is successful; otherwise, the verification fails.

[0037] In one implementation of this application, the method further includes:

[0038] When multiple user verification digital signatures from different users in different parks are received within a preset time period, a corresponding set of digital signatures is generated.

[0039] Generate multiple random coefficients with the same number of elements as the digital signature set, and generate an aggregated user digital signature based on each of the random coefficients and each of the user-verified digital signatures;

[0040] Based on the random coefficients, the user verification digital signatures, and the aggregated user digital signatures, the corresponding third bilinear mapping value and fourth bilinear mapping value are calculated and compared to perform batch verification of multiple user verification digital signatures according to the corresponding second comparison results.

[0041] In one implementation of this application, the method further includes:

[0042] Accumulate the usage duration and number of times the first private key is used;

[0043] In a case where the use duration reaches a preset key update period and / or the use frequency is greater than a preset use threshold, a system initialization operation is re-executed to update the first public-private key pair.

[0044] In a second aspect, the embodiments of the present application further provide a one-way quantum attack resistant identity authentication device for a smart park, the device comprising:

[0045] at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the identity authentication method for a smart park one-way quantum attack resistant as described above.

[0046] In a third aspect, the embodiments of the present application further provide a non-volatile computer storage medium storing computer executable instructions, and the computer executable instructions are capable of performing the identity authentication method for a smart park one-way quantum attack resistant as described above.

[0047] Compared with the prior art, the present application has the following significant effects:

[0048] Through the above-mentioned scheme, the present application can generate a digital signature resistant to quantum security level, effectively resist external quantum attacks, and greatly improve the security level of the smart park system. At the same time, an interactive mode capable of ensuring mutual authentication between the system administrator and the park user is designed, and two digital signature technologies are combined to ensure the legality verification of the communication parties on the premise of efficient identity authentication and avoiding waste of computing resources, thereby avoiding man-in-the-middle attacks. The present application can ensure that the smart park can safely, stably and efficiently run in the era of quantum computing, protect the privacy information of users from being leaked, thereby effectively resisting quantum attacks by external enemies, and adapting to the complex and diverse device environment in the smart park, providing effective protection for the privacy and security of users. BRIEF DESCRIPTION OF DRAWINGS

[0049] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate embodiments of the present application and a description thereof, and do not constitute an improper limitation to the present application. In the drawings:

[0050] Figure 1 FIG. 1 is a flowchart of a method for one-way quantum attack resistant identity authentication in a smart park according to an embodiment of the present application;

[0051] Figure 2 FIG. 1 is a flowchart of a method for one-way quantum attack resistant identity authentication in a smart park according to an embodiment of the present application; DETAILED DESCRIPTION

[0052] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below in combination with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work belong to the scope of protection of the present application.

[0053] Most mainstream identity authentication relies on public key cryptography based on mathematical difficult problems. However, the rapid development of quantum computing technology has brought an unprecedented impact on traditional identity authentication systems. In the face of the powerful computing power of quantum computers, traditional identity authentication algorithms based on mathematical difficult problems face the risk of being cracked quickly, which will lead to the loss of security of traditional identity authentication mechanisms relying on these difficult problems, and will cause the smart park system to face serious threats such as system being broken and user privacy being leaked, and will cause the user to have a crisis of confidence in the privacy and security of the smart park.

[0054] Based on this, the embodiments of the present application provide a one-way quantum attack resistant identity authentication method, device and medium for a smart park, to ensure that the smart park can safely, stably and efficiently run in the quantum computing era, protect the user's private information from being leaked, thereby effectively resisting quantum attacks by external enemies, and adapt to the complex and diverse device environment in the smart park, and provide effective protection for the privacy and security of the user.

[0055] The various embodiments of the present application will be described in detail below in combination with the drawings.

[0056] The embodiments of the present application provide a one-way quantum attack resistant identity authentication method for a smart park, as shown in Figure 1 The method can include steps S101-S104:

[0057] S101, the server generates a first public-private key pair corresponding to the system administrator based on the system administrator performing a system initialization operation.

[0058] The first public-private key pair includes a first public key and a first private key.

[0059] It should be noted that the server as the execution subject of the one-way quantum attack resistant identity authentication method for a smart park only exists as an example, and the execution subject is not limited to the server, and the present application does not make a specific limitation thereon.

[0060] The system administrator corresponds to the administrator role in the smart park. The smart park system in the present application generally includes an administrator, a park user, and in addition, a key generation center for generating keys for the park user.

[0061] In the embodiment of the present application, the system initialization operation based on the system administrator is executed to generate the first public-private key pair corresponding to the system administrator, specifically comprising:

[0062] The first random seed, the second random seed and the third random seed are generated through the randomly selected 256-bit random number. The corresponding random matrix is generated according to the first random seed, and the first private key vector and the second private key vector are generated according to the second random seed. The random vector is generated according to the random matrix, the first private key vector and the second private key vector. The random vector is decomposed into vectors to obtain the corresponding first decomposition vector and second decomposition vector. The first decomposition vector corresponds to the high-bit part of the random vector, and the second decomposition vector corresponds to the low-bit part of the random vector. The first hash value is generated based on the first preset hash function, the first random seed and the first decomposition vector. The first public key is generated according to the first random seed and the first decomposition vector, and the first private key is generated according to the first random seed, the third random seed, the first hash value, the first private key vector, the second private key vector and the second decomposition vector, so as to generate the first public-private key pair according to the first public key and the first private key, and the first public key is executed in the smart park system. Public processing operation.

[0063] That is, the system administrator can actively trigger the system initialization operation, or set a certain trigger condition to make the system execute the system initialization operation when a certain trigger condition is met, which is not limited in the present application. The purpose of the system initialization operation is to generate a key corresponding to the system administrator, so as to be used for bidirectional identity authentication with the park user. In the process of generating the first public-private key pair, the following operations are specifically implemented: for the role of the system administrator, three 256-bit random numbers are randomly selected to generate the first random seed , the second random seed and the third random seed . Then, the random matrix A is constructed through the first random seed, the first private key vector and the second private key vector are generated through the second random seed. The random vector is constructed through the random matrix A, the first private key vector and the second private key vector . Then, the high-low bit decomposition of the random vector is performed through the Power2Round technology to obtain the high-bit part first decomposition vector and the low-bit part second decomposition vector , the first hash value is generated through the pre-selected first preset hash function , and then the first public key and the second private key are constructed. At the same time, the first public key is also made public.

[0064] Through the above operation, the application can generate a key for subsequent anti-quantum characteristics, which is not easy to be quantum decomposed, and the system administrator's private key is still safe under quantum attack and is not threatened by quantum computing.

[0065] S102, the server generates a second public-private key pair corresponding to the park user through a key generation center and distributes it to the park user terminal.

[0066] The second public-private key pair includes a second public key and a second private key.

[0067] The park user can apply for a key from the key generation center, or the system administrator can operate the key generation center to generate a public-private key pair for a specified park user, which is not specifically limited in the application. In the embodiment of the application, the generation of the second public-private key pair corresponding to the park user through the key generation center and the distribution to the park user terminal specifically include:

[0068] Through the key generation center, a first cyclic group and a second cyclic group of a preset order are determined. According to the first cyclic group and the second cyclic group, a corresponding first generator, a second generator and a bilinear mapping relationship are determined, and a second hash function corresponding to the first cyclic group is determined. According to the first cyclic group, the second cyclic group, the first generator, the second generator, the bilinear mapping relationship and the second hash function, a public system parameter is generated. The public system parameter is used to generate a user verification digital signature and verify the user verification digital signature. Based on the multiplication group corresponding to the preset order, a corresponding random number is determined. According to the random number and the second generator, a second public key is generated, the random number is taken as a second private key, and a public processing operation is performed on the second public key in the smart park system.

[0069] That is, the application can generate a public key and a private key for the park user by the key generation center, and the key generation center generates a public-private key pair for the park user. On the one hand, the participation of the key generation center can make the key managed by a unified role without the need for multiple parties to participate; on the other hand, considering the occupation of computing resources of the park user terminal, the identity authentication against quantum attack can be realized by using less computing resources of the park user terminal, and the park user terminal with older version or hardware is supported, without the need for the park user to replace the terminal device, thereby reducing the implementation and use cost of the application.

[0070] Specifically, the key generation center selects a cyclic group of order p 、 , the p is a prime number, determines the generator of the first cyclic group , the generator of the second cyclic group , and defines a bilinear mapping relationship , , Subsequently, a second hash function is selected through the key generation center. Public system parameters ( Subsequently, from the multiplication group of the preset order p... Select random number The preset order p is to treat the order p of the cyclic group as the multiplicative group simultaneously. The modulus p. Then, using a random number and a second generator, a second public key is generated. and random number As a second private key And then make the second public key public.

[0071] The above scheme enables key generation for the user terminal without requiring the user terminal to use complex quantum-resistant algorithms. It also reduces terminal power consumption by designing a lightweight, one-way quantum-resistant authentication scheme.

[0072] S103, in response to an access request from a user terminal in the park, the server generates a quantum-resistant digital signature corresponding to the access request based on the preset quantum-resistant signature generation algorithm and the intermediate information of the system initialization operation, and sends it to the user terminal in the park.

[0073] Park users can submit access requests to the smart park system through park user terminals equipped with a second public-private key pair. This second public-private key pair can be stored digitally on the park user terminal. The park user terminal is not limited to a single hardware device belonging to a park user; for example, a park user can log into their park user account using different park user terminals, and after device authentication, these terminals will be used as the park user terminals assigned the second public-private key pair. This application does not specifically limit this. Device authentication includes, but is not limited to, facial recognition authentication, password authentication, and SMS verification code authentication.

[0074] In this embodiment of the application, the above-mentioned generation of a quantum-resistant digital signature corresponding to an access request based on the intermediate information of the preset quantum-resistant signature generation algorithm and system initialization operation specifically includes:

[0075] The received access request and the first hash value are used as inputs to a preset quantum-resistant signature generation algorithm to calculate the corresponding second hash value. Based on the second hash value, the third random seed, the random matrix, the first decomposition vector, and the second decomposition vector, rejection sampling is performed using the preset quantum-resistant signature generation algorithm to generate a quantum-resistant digital signature.

[0076] In other words, this application can execute a preset quantum-resistant signature generation algorithm, and combine it with the intermediate information obtained from the above execution to achieve quantum-resistant digital signature generation. Specifically, when the system administrator receives an access request m sent by a user terminal in the park, it uses the aforementioned first hash value... Calculate the second hash value with access request m. The second hash value is calculated using the first preset hash function. Then, the variable k is initialized to 0, and the tuple is... Initialize to ,when Then, repeat the quantum-resistant digital signature generation steps and increment the counter k until a valid quantum-resistant digital signature is generated. Further, a third random seed is used... Second hash value Using counter k, generate a polynomial vector y, and calculate based on the random matrix. Extracted using the Highbits algorithm The higher-order part of the vector is used to obtain the fourth decomposition vector. Calculate the third hash value Then, the verification vector is calculated based on the first decomposition vector, the polynomial vector, and the third hash value. Then, the Decompose algorithm is used to... Decompose into the fifth decomposition vector of the higher digits. and the sixth decomposition vector of the lower digit And based on the verification vector Fifth decomposition vector and the sixth decomposition vector The process involves rejecting sampling and performing high / low bit verification. After successful verification, a hint bit is generated using the MakeHint algorithm. , will check vector As the first element, the prompt bit As the second element, the third hash value As a third element, it generates quantum-resistant digital signatures. and the Send to users in the park.

[0077] The above rejection sampling and high / low bit verification are specifically used to determine whether the conditions are met. , Preset thresholds for developers or experts The upper bound of the vector norm of the second private key; determine whether it satisfies... , The sixth decomposition vector Maximum norm threshold; determine whether it satisfies If all of the above conditions are met, the verification passes and a corresponding quantum-resistant digital signature is generated; otherwise, the verification is terminated. A quantum-resistant digital signature is regenerated. This involves generating hint bits using the MakeHint hint bit generation algorithm. And after sparse verification, a complete quantum-resistant digital signature is constructed. The anti-counterfeiting property of the multiple verification strengthened signature is realized through the above scheme, and a quantum-resistant security level digital signature is obtained.

[0078] After obtaining the quantum-resistant digital signature, the quantum-resistant digital signature is sent to the park user terminal that sends the access request, so as to perform quantum-resistant digital signature verification and user verification digital signature generation.

[0079] In S104, after receiving the user verification digital signature from the park user terminal, the server verifies the user verification digital signature based on the second public key in the corresponding second public-private key pair, to determine whether to allow the park user terminal to access the corresponding smart park system according to the first verification result obtained by verification.

[0080] The user verification digital signature is generated after the park user terminal passes the quantum-resistant digital signature verification.

[0081] In the embodiments of the present application, after the park user terminal receives the quantum-resistant digital signature, the following embodiments will be specifically implemented. Specifically, based on the quantum-resistant digital signature verification of the park user terminal, the following steps are included:

[0082] The park user terminal receives the quantum-resistant digital signature and determines the random matrix through the first random seed in the first public key. The park user terminal determines the second hash value according to the first random seed, the access request and the first decomposition vector in the first public key. The park user terminal determines the third decomposition vector corresponding to the preset intermediate vector according to the second element in the quantum-resistant digital signature. The preset intermediate vector is determined based on the random matrix, the first element in the quantum-resistant digital signature, the third hash value and the first decomposition vector. The third hash value is obtained according to the second hash value and the fourth decomposition vector. The park user terminal verifies the third hash value, the first element and the second element based on the third decomposition vector, the preset first element coefficient interval and the preset second element verification condition. The park user terminal determines that the second verification result is passed when the third hash value, the first element and the second element are all verified, otherwise, the second verification result is not passed.

[0083] That is, after the park user terminal receives the quantum-resistant digital signature , the park user terminal determines the random matrix A through the first random seed in the first public key , and then determines the first decomposition vector V1 through the first random seed , the first decomposition vector V1 in the first public key and the access request m, and sequentially calculates the first hash value H1, the second hash value H2 . Then, the high bit part of the preset intermediate vector V is recovered by using the hint bit using algorithm UseHint through the hint bit in the quantum-resistant digital signature , to obtain the third decomposition vector Subsequently, the user terminal in the park verifies the first element. Whether the coefficient is within the preset first element coefficient range, and the third hash value Whether it is equal to the third decomposition vector and the second hash value Calculated prompt bit The second verification result is determined by checking if the number of 1s in the first element is greater than the constraint value in the preset second element verification condition. The preset first element coefficient range and the preset second element verification condition can be set based on actual usage scenarios and expert experience, and are not specifically limited here. If all three verification results pass, the second verification result is considered passed; otherwise, the second verification result is considered failed.

[0084] When the second verification result is successful, the user terminal in the park will generate a user verification digital signature using the access request and the second private key obtained above. and will Send to the system administrator.

[0085] Furthermore, in some embodiments of this application, when the system administrator corresponding to the server receives the user verification digital signature, it indicates that the campus user has successfully verified the system administrator's identity and is in a state capable of secure interaction. To explicitly verify the campus user's identity, further identity verification of the campus user will be performed at this time. This application verifies the user verification digital signature based on the second public key in the corresponding second public-private key pair, specifically including:

[0086] Based on the second public key, the user-verified digital signature, and the public system parameters, a first bilinear mapping value and a second bilinear mapping value are calculated and compared. The user-verified digital signature is then verified based on the first comparison result between the first and second bilinear mapping values. If the first comparison result is consistent, the user-verified digital signature verification passes; otherwise, verification fails.

[0087] In other words, the server can use the second public key. User verification digital signature and the publicly available system parameters Perform bilinear mapping verification and calculate the first bilinear mapping value. Second bilinear mapping value Compare whether the two satisfy the requirements. The system verifies the user's digital signature against the system's digital signature. If the two signatures are equal, the verification passes; otherwise, it fails. If the verification passes, it indicates that the system administrator has granted access to the smart park system to the user who issued the access request.

[0088] In actual use scenarios, there can be batch access to the smart park system, for example, a batch of park users collectively access the system, at this time, it is necessary to ensure access efficiency, and also to implement one-way quantum attack-resistant identity authentication to avoid attackers taking advantage of the situation. Therefore, the present application also provides the following embodiments, specifically including:

[0089] When a plurality of different park user respective user verification digital signatures are received within a preset time period, a corresponding digital signature set is generated. A plurality of random coefficients equal to the number of elements in the digital signature set are generated to generate an aggregated user digital signature according to each random coefficient and each user verification digital signature. According to each random coefficient, each user verification digital signature and the aggregated user digital signature, a corresponding third bilinear mapping value and a fourth bilinear mapping value are calculated and compared to batch verify a plurality of user verification digital signatures according to a corresponding second comparison result.

[0090] In other words, after the system administrator receives a plurality of (such as N, N is a natural number greater than 1) park user respective user verification digital signatures, denoted as , , the Nth access request corresponds to a user verification digital signature, the N user verification digital signatures are recorded to the digital signature set, and each access request corresponding thereto is retained. At the same time, the second public key corresponding to each park user is obtained , , the Nth access request corresponds to a second public key. Then, a number of random coefficients equal to the number of park user access requests are randomly selected, and the random coefficients are taken from the above multiplication group . At this time, the N random coefficients are multiplied and summed with the N user verification digital signatures to obtain an aggregated user digital signature . The N random coefficients are multiplied and summed with the N access request respective second hash calculation values to obtain , , the N random coefficients, , the Nth access request corresponds to a second hash calculation value. Then, a corresponding third bilinear mapping value is calculated, and a fourth bilinear mapping is calculated to , and is compared with , thereby implementing batch verification of the N access request park users, and batch allowing or not allowing access to the smart park system.

[0091] No separate multiple verification processes need to be performed, thereby realizing batch park user identity authentication. The above-mentioned preset time period is set based on actual use scenarios, and is not specifically limited here.

[0092] In addition, in order to keep the key fresh and further increase the system security, the method further includes:

[0093] The use duration and the use frequency of the first private key are accumulated. In a case where the use duration reaches a preset key update period and / or the use frequency is greater than a preset use threshold, a system initialization operation is re-executed to update the first public-private key pair.

[0094] That is, the preset key update period and the preset use threshold can be set to perform conditional verification on the use duration and the use frequency respectively, so as to determine whether the condition for regenerating the first public-private key pair is met. The preset key update period and the preset use threshold can be set by a system administrator or a developer based on expert experience, and are not specifically limited herein. The updated first public-private key pair is different from the updated first public-private key pair, and the system performs an invalidation operation on the updated first public-private key pair.

[0095] Further, after the first public-private key pair is updated, the application can screen the park user terminals that have been allowed to pass outside the predetermined interval, and perform an operation of prohibiting the park user terminals in the screening range from logging in to the system until the screened park user terminals reissue an access request and pass the verification. That is, the system administrator can select a certain screening range (all park user terminals can also be selected, which is not specifically limited herein) according to the actual scene, so that the park user terminals perform the verification process of S103-104 again through the updated first public-private key pair, thereby enhancing the security strength of identity authentication.

[0096] Through the above scheme, the application can generate a digital signature of a quantum-resistant security level, effectively resist external quantum attacks, and greatly improve the security level of the smart park system. At the same time, an interactive mode that can ensure mutual authentication between the system administrator and the park user is designed, and two digital signature technologies are combined to ensure the legality verification of the communication parties on the premise of efficient identity authentication and avoidance of waste of computing resources, thereby avoiding man-in-the-middle attacks. The application can ensure that the smart park can safely, stably and efficiently operate in the quantum computing era, protect the privacy information of users from being leaked, thereby effectively resisting quantum attacks by external enemies, and adapting to the complex and diverse device environment in the smart park to provide effective protection for the privacy and security of users.

[0097] Figure 2 A structure diagram of a smart park one-way quantum attack-resistant identity authentication device provided by an embodiment of the application is shown in FIG. 1. Figure 2 As shown in FIG. 1, the device includes:

[0098] at least one processor; and a memory connected with the at least one processor in communication. Wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:

[0099] Based on the system administrator performing the system initialization operation, a first public-private key pair corresponding to the system administrator is generated. The first public-private key pair includes a first public key and a first private key. Through a key generation center, a second public-private key pair corresponding to the park user is generated and distributed to the park user terminal. The second public-private key pair includes a second public key and a second private key. In response to an access request from the park user terminal, an anti-quantum digital signature corresponding to the access request is generated based on a preset anti-quantum signature generation algorithm and operation intermediate information of the system initialization operation, and is sent to the park user terminal. After receiving the user verification digital signature from the park user terminal, the user verification digital signature is verified based on the second public key in the corresponding second public-private key pair, to determine whether to allow the park user terminal to access the corresponding smart park system according to a first verification result obtained by the verification. Wherein the user verification digital signature is generated after the park user terminal verifies the anti-quantum digital signature and obtains a second verification result.

[0100] The embodiments of the present application also provide a non-volatile computer storage medium, which stores computer executable instructions, and the computer executable instructions are configured to:

[0101] Based on the system administrator performing the system initialization operation, a first public-private key pair corresponding to the system administrator is generated. The first public-private key pair includes a first public key and a first private key. Through a key generation center, a second public-private key pair corresponding to the park user is generated and distributed to the park user terminal. The second public-private key pair includes a second public key and a second private key. In response to an access request from the park user terminal, an anti-quantum digital signature corresponding to the access request is generated based on a preset anti-quantum signature generation algorithm and operation intermediate information of the system initialization operation, and is sent to the park user terminal. After receiving the user verification digital signature from the park user terminal, the user verification digital signature is verified based on the second public key in the corresponding second public-private key pair, to determine whether to allow the park user terminal to access the corresponding smart park system according to a first verification result obtained by the verification. Wherein the user verification digital signature is generated after the park user terminal verifies the anti-quantum digital signature and obtains a second verification result.

[0102] Each of the embodiments in the present application is described in a progressive manner, and the same or similar parts of each of the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. Especially, the device and medium embodiments are basically similar to the method embodiments, so the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0103] The device and medium provided by the embodiments of the present application are one-to-one corresponding, and therefore the device and medium also have similar beneficial technical effects to the corresponding method. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the device and medium will not be described here again.

[0104] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a list of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent in such a process, method, article or device. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or device that includes the element.

[0105] The above only describes the embodiments of the present application and is not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A one-way quantum-resistant authentication method for smart parks, characterized in that, The method includes: The server generates a first public-private key pair corresponding to the system administrator based on the system initialization operation performed by the system administrator. The first public-private key pair includes a first public key and a first private key, wherein the process includes: generating a first random seed, a second random seed, and a third random seed using randomly selected 256-bit random numbers; generating a corresponding random matrix based on the first random seed, and generating a first private key vector and a second private key vector based on the second random seed; generating a random vector based on the random matrix, the first private key vector, and the second private key vector; performing vector decomposition on the random vector to obtain a corresponding first decomposition vector and a second decomposition vector; wherein the first decomposition vector corresponds to the high-order part of the random vector, and the second decomposition vector corresponds to the low-order part of the random vector; and generating a first hash value based on a first preset hash function, the first random seed, and the first decomposition vector. The server generates a second public-private key pair corresponding to each user in the park through the key generation center and distributes it to the user's terminal; the second public-private key pair includes a second public key and a second private key. In response to an access request from a user terminal in the park, the server generates a quantum-resistant digital signature corresponding to the access request based on a preset quantum-resistant signature generation algorithm and intermediate information from the system initialization operation, and sends it to the user terminal. Specifically, this includes: using the received access request and the first hash value as input to the preset quantum-resistant signature generation algorithm to calculate a corresponding second hash value; and performing rejection sampling processing using the preset quantum-resistant signature generation algorithm based on the second hash value, the third random seed, the random matrix, the first decomposition vector, and the second decomposition vector to generate the quantum-resistant digital signature. After receiving the user verification digital signature from the user terminal in the park, the server verifies the user verification digital signature based on the second public key in the corresponding second public-private key pair, and determines whether to allow the user terminal to access the corresponding smart park system based on the first verification result obtained; wherein, the user verification digital signature is generated after the user terminal in the park verifies the quantum-resistant digital signature and obtains a second verification result of passing.

2. The one-way quantum-resistant identity authentication method for smart parks according to claim 1, characterized in that, Based on the system initialization operation performed by the system administrator, a first public-private key pair corresponding to the system administrator is generated, specifically including: The first public key is generated based on the first random seed and the first decomposition vector, and the first private key is generated based on the first random seed, the third random seed, the first hash value, the first private key vector, the second private key vector, and the second decomposition vector. The first public-private key pair is generated based on the first public key and the first private key, and the first public key is publicly processed in the smart park system.

3. The one-way quantum-resistant identity authentication method for smart parks according to claim 2, characterized in that, The verification of the quantum-resistant digital signature based on the user terminal in the park specifically includes: The user terminal in the park receives the quantum-resistant digital signature and determines the random matrix using the first random seed in the first public key; The user terminal in the park determines the second hash value based on the first random seed, the access request, and the first decomposition vector in the first public key; The user terminal in the park determines a third decomposition vector corresponding to a preset intermediate vector based on the second element in the quantum-resistant digital signature; wherein, the preset intermediate vector is determined based on the random matrix, the first element in the quantum-resistant digital signature, the third hash value, and the first decomposition vector; the third hash value is obtained based on the second hash value and the fourth decomposition vector; The park user terminal verifies the third hash value, the first element, and the second element based on the third decomposition vector, the preset first element coefficient range, and the preset second element verification conditions, respectively. If the third hash value, the first element, and the second element are all verified successfully, the user terminal in the park determines that the second verification result is successful; otherwise, it is unsuccessful.

4. The one-way quantum-resistant identity authentication method for smart parks according to claim 1, characterized in that, Through the key generation center, a second public-private key pair corresponding to the park users is generated and distributed to the park user terminals, specifically including: The key generation center determines the first and second cyclic groups of a preset order. Based on the first cyclic group and the second cyclic group, determine the corresponding first generator, second generator and bilinear mapping relationship, and determine the second hash function corresponding to the first cyclic group; Public system parameters are generated based on the first cyclic group, the second cyclic group, the first generator, the second generator, the bilinear mapping relationship, and the second hash function; the public system parameters are used to generate the user verification digital signature and to verify the user verification digital signature. Based on the multiplication group corresponding to the preset order, determine the corresponding random number; Based on the random number and the second generator, a second public key is generated, the random number is used as the second private key, and a public processing operation is performed on the second public key in the smart park system.

5. The one-way quantum-resistant identity authentication method for smart parks according to claim 4, characterized in that, The user verification digital signature is verified based on the second public key in the corresponding second public-private key pair, specifically including: Based on the second public key, the user verification digital signature, and the public system parameters, calculate the first bilinear mapping value and the second bilinear mapping value, and compare them. The user verification digital signature is verified based on the first comparison result between the first bilinear mapping value and the second bilinear mapping value. If the first comparison result is consistent, the user verification digital signature verification is successful; otherwise, the verification fails.

6. The one-way quantum-resistant identity authentication method for smart parks according to claim 5, characterized in that, The method further includes: When multiple user verification digital signatures from different users in different parks are received within a preset time period, a corresponding set of digital signatures is generated. Generate multiple random coefficients with the same number of elements as the digital signature set, and generate an aggregated user digital signature based on each of the random coefficients and each of the user-verified digital signatures; Based on the random coefficients, the user verification digital signatures, and the aggregated user digital signatures, the corresponding third bilinear mapping value and fourth bilinear mapping value are calculated and compared to perform batch verification of multiple user verification digital signatures according to the corresponding second comparison results.

7. The one-way quantum-resistant identity authentication method for smart parks according to claim 2, characterized in that, The method further includes: Accumulate the usage duration and number of times the first private key is used; If the usage duration reaches the preset key update cycle and / or the number of uses exceeds the preset usage threshold, the system initialization operation is re-executed to update the first public-private key pair.

8. A smart park one-way quantum attack resistant identity authentication device, characterized in that, The device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the one-way quantum-resistant identity authentication method for smart parks as described in any one of claims 1-7.

9. A non-volatile computer storage medium storing computer-executable instructions, characterized in that, The computer-executable instructions are capable of executing the one-way quantum attack resistant identity authentication method for smart parks as described in any one of claims 1-7.

Images