A SM2-based encryption authentication method, device, equipment and storage medium

Abstract

The application discloses an encryption authentication method and device based on SM2, equipment and a storage medium, relates to the technical field of information security, and comprises the following steps: receiving system parameters, generating the device identifier of a terminal device; the system parameters are SM2 elliptic curve parameters; generating a registration request based on the device identifier and sending the registration request to a server; sending the device identifier and a local public key to the server by using a client, receiving the declaration signature public key and private key fragment sent by the server, and generating a signature private key based on the system parameters, the local private key and the private key fragment; sending the device identifier and the declaration signature public key to the server by using the client, receiving the declaration encryption public key and encryption private key ciphertext sent by the server, and obtaining the encryption private key by decrypting the encryption private key ciphertext; performing data signature authentication based on the declaration signature public key and the signature private key, and performing data encryption and decryption based on the declaration encryption public key and the encryption private key. The application can construct an encryption authentication mechanism supporting multi-terminal interaction.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an encryption authentication method, apparatus, device and storage medium based on SM2. Background Technology

[0002] With the rapid development of the Internet of Things (IoT), the Internet of Vehicles (IoV), and the Industrial Internet, the number of devices is surging, and most terminals are resource-constrained, making the need for encrypted authentication for secure communication between devices increasingly urgent. Traditional PKI (Public Key Infrastructure) systems based on X.509 certificates rely on certificate authorities to manage certificates. Verification also requires building a certificate chain and querying certificate status, which not only increases storage and transmission overhead but also complicates the certificate management process, making it difficult to adapt to lightweight terminal scenarios.

[0003] While existing certificate-free encryption authentication schemes avoid reliance on certificates, they still have shortcomings: First, some systems lack sufficient randomness in key generation and are difficult to update, making them unsuitable for scenarios with dynamically expanding devices; second, some systems have key escrow risks, and once the private key of the key center is leaked, users' private keys will be completely threatened; third, some systems do not use algorithms that comply with commercial cryptography standards, making it difficult to guarantee security and compliance, and failing to meet the requirements of cryptographic assessment and information security compliance.

[0004] Meanwhile, in multi-terminal interactions, the efficiency of signature verification and the security of key transmission further limit the practicality of the encryption authentication system. In conclusion, how to construct an encryption authentication mechanism that can efficiently support multi-terminal interactions is a pressing technical problem that needs to be solved. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide an SM2-based encryption authentication method, apparatus, device, and storage medium, capable of constructing an efficient encryption authentication mechanism that supports multi-terminal interaction and improving the security of application systems. The specific solution is as follows:

[0006] Firstly, this application provides an SM2-based encryption authentication method, applicable to any terminal device running a client application system, comprising:

[0007] The system receives system parameters generated by the server and generates a device identifier corresponding to the terminal device through the client; the system parameters are SM2 elliptic curve parameters.

[0008] A registration request is generated based on the device identifier, and the registration request is sent to the server so that the server can register the client based on the registration request;

[0009] The client generates a local public key and a local private key, and sends the device identifier and the local public key to the server. It then receives a declaration signing public key and a private key fragment from the server and generates a signing private key based on the system parameters, the local private key, and the private key fragment. The declaration signing public key is a signing public key generated by the server based on the device identifier and the local public key, and declared externally by the client of any terminal device. The private key fragment is a key fragment generated by the server based on the device identifier and the local public key.

[0010] The client sends the device identifier and the declared signature public key to the server, and receives the declared encryption public key and encrypted private key ciphertext sent by the server. Based on the signature private key, the client decrypts the encrypted private key ciphertext to obtain the encrypted private key. The declared encryption public key is an encryption public key generated by the server based on the device identifier and the system parameters, and declared externally by the client of any terminal device. The encrypted private key ciphertext is the ciphertext obtained by the server encrypting the encrypted private key based on the declared signature public key. The encrypted private key is a private key generated by the server based on the device identifier and the system parameters.

[0011] The client performs data signature authentication based on the declared signing public key and the declared signing private key, and performs data encryption and decryption operations based on the declared encryption public key and the declared encryption private key.

[0012] Optionally, the step of generating a local public key and a local private key using the client, sending the device identifier and the local public key to the server, receiving a declaration signing public key and private key fragment sent by the server, and generating a signing private key based on the system parameters, the local private key, and the private key fragment includes:

[0013] The client generates the local public key and the local private key, and sends the device identifier and the local public key to the server, so that the server can determine the registration result of the client based on the device identifier. If the registration result indicates that the client has been registered, the server generates the declaration signing public key and the private key fragment based on the device identifier and the local public key, and sends the declaration signing public key and the private key fragment to the client.

[0014] The client receives the declaration signing public key and the private key fragment sent by the server, and generates the signing private key based on the system parameters, the local private key, and the private key fragment;

[0015] The client verifies whether the declared signing public key and the signing private key match. If they match, the client stores the declared signing public key and the signing private key, and generates the actual signing public key corresponding to the terminal device based on the declared signing public key, the device identifier, and the system parameters, so as to perform the data signature authentication based on the declared signing public key, the actual signing public key, and the signing private key.

[0016] Optionally, sending the device identifier and the claim signing public key to the server using the client includes:

[0017] The client sends the device identifier and the declaration signing public key to the server, so that the server can determine the registration result of the client based on the device identifier. If the registration result indicates that the client has been registered, the server generates the declaration encryption public key and the encryption private key based on the device identifier and the system parameters, and encrypts the encryption private key based on the declaration signing public key to obtain the encryption private key ciphertext. The server then sends the declaration encryption public key and the encryption private key ciphertext to the client.

[0018] Accordingly, after decrypting the encrypted private key ciphertext based on the signing private key to obtain the encrypted private key, the process further includes:

[0019] The client verifies whether the declared encryption public key and the encryption private key match. If they match, the client stores the declared encryption public key and the encryption private key, and generates the actual encryption public key corresponding to the terminal device based on the declared encryption public key, the device identifier, and the system parameters, so as to perform the data encryption and decryption operations based on the declared encryption public key, the actual encryption public key, and the encryption private key.

[0020] Optionally, the terminal device connected to the server includes a first terminal device and a second terminal device, wherein the first terminal device runs a first client of the target application system, and the second terminal device runs a second client of the target application system;

[0021] Accordingly, the data signature authentication based on the declared signing public key and the signing private key includes:

[0022] The first client signs the message to be signed based on the system parameters and the signing private key of the first terminal device to obtain a signature value, and sends the device identifier of the first terminal device, the declaration signing public key of the first terminal device, and the signature value to the second client.

[0023] The second client determines the actual signature public key corresponding to the first terminal device based on the declared signature public key of the first terminal device, the device identifier of the first terminal device, and the system parameters. It then uses the actual signature public key to verify the signature value to obtain a verification result and sends the verification result to the first client to complete the data signature authentication.

[0024] Optionally, the data encryption / decryption operation based on the declared public key and the private key includes:

[0025] The device identifier of the second terminal device and the public key for the declaration of the second terminal device are sent to the first client through the second client;

[0026] The first client determines the actual encryption public key corresponding to the second terminal device based on the declared encryption public key of the second terminal device, the device identifier of the second terminal device, and the system parameters. It then uses the actual encryption public key corresponding to the second terminal device to encrypt the target message to be encrypted to obtain the target ciphertext and sends the target ciphertext to the second client.

[0027] The target message is obtained by decrypting the target ciphertext using the encryption private key of the second terminal device by the second client, thereby completing the data encryption and decryption operation.

[0028] Secondly, this application provides an SM2-based encryption authentication method applied to a server where a target application system is deployed, comprising:

[0029] Generate system parameters and send the system parameters to the client of the terminal device; the system parameters are SM2 elliptic curve parameters;

[0030] The system receives a registration request from the client and registers the client based on the registration request; the registration request is a request generated by the client based on the device identifier corresponding to the terminal device.

[0031] The system receives a device identifier and a local public key sent by the client, and generates a declaration signing public key and a private key fragment based on the device identifier and the local public key. The declaration signing public key and the private key fragment are then sent to the client so that the client can generate a signing private key based on the system parameters, the local private key, and the private key fragment. The declaration signing public key is a signing public key declared externally by the client of any terminal device.

[0032] The system receives the device identifier and the declaration signing public key sent by the client, generates a declaration encryption public key and an encryption private key based on the device identifier and the system parameters, and encrypts the encryption private key based on the declaration signing public key to obtain the encryption private key ciphertext; the declaration encryption public key is the encryption public key declared externally by the client of any terminal device.

[0033] The declared public key and the encrypted private key are sent to the client so that the client can decrypt the encrypted private key based on the signing private key to obtain the encrypted private key, perform data signature authentication based on the declared public key and the signing private key, and perform data encryption and decryption operations based on the declared public key and the encrypted private key.

[0034] Optionally, the server includes a key management center;

[0035] Accordingly, the generated system parameters include:

[0036] The key management center is initialized using the encryption authentication server, and the system parameters are generated using the initialized key management center.

[0037] Thirdly, this application provides an SM2-based encryption authentication device, applicable to any terminal device running a client application system, comprising:

[0038] The device identifier generation module is used to receive system parameters generated by the server and generate a device identifier corresponding to the terminal device through the client; the system parameters are SM2 elliptic curve parameters.

[0039] A registration request sending module is used to generate a registration request based on the device identifier and send the registration request to the server so that the server can register the client based on the registration request;

[0040] The signature private key generation module is used to generate a local public key and a local private key using the client, and send the device identifier and the local public key to the server. It also receives a declaration signature public key and private key fragment sent by the server, and generates a signature private key based on the system parameters, the local private key, and the private key fragment. The declaration signature public key is a signature public key generated by the server based on the device identifier and the local public key, and declared externally by the client of any terminal device. The private key fragment is a key fragment generated by the server based on the device identifier and the local public key.

[0041] The encrypted private key generation module is used to send the device identifier and the declared signature public key to the server using the client, and to receive the declared encrypted public key and encrypted private key ciphertext sent by the server, and to decrypt the encrypted private key ciphertext based on the signature private key to obtain the encrypted private key; the declared encrypted public key is an encrypted public key generated by the server based on the device identifier and the system parameters and declared externally by the client of any terminal device; the encrypted private key ciphertext is the ciphertext obtained by the server encrypting the encrypted private key based on the declared signature public key; and the encrypted private key is a private key generated by the server based on the device identifier and the system parameters.

[0042] The encryption authentication module is used by the client to perform data signature authentication based on the declared signing public key and the signing private key, and to perform data encryption and decryption operations based on the declared encryption public key and the encryption private key.

[0043] Fourthly, this application provides an electronic device, comprising:

[0044] Memory, used to store computer programs;

[0045] A processor is used to execute the computer program to implement the aforementioned SM2-based encryption authentication method.

[0046] Fifthly, this application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned SM2-based encryption authentication method.

[0047] In this application, for any terminal device running a client with a target application system, the system parameters generated by the server are first received, and a device identifier corresponding to the terminal device is generated by the client; the system parameters are SM2 elliptic curve parameters; then, a registration request is generated based on the device identifier, and the registration request is sent to the server so that the server can register the client based on the registration request; subsequently, the client generates a local public key and a local private key, and sends the device identifier and the local public key to the server, receives a declaration signature public key and a private key fragment sent by the server, and generates a signature private key based on the system parameters, the local private key, and the private key fragment; the declaration signature public key is a signature public key generated by the server based on the device identifier and the local public key and declared externally by the client of any terminal device, and the private key fragment is the server's signature public key. The server generates a key fragment based on the device identifier and the local public key; then, the client sends the device identifier and the declared signing public key to the server, and receives the declared encryption public key and encrypted private key ciphertext sent by the server. Based on the signing private key, the client decrypts the encrypted private key ciphertext to obtain the encrypted private key. The declared encryption public key is an encryption public key generated by the server based on the device identifier and the system parameters, and declared externally by the client of any terminal device. The encrypted private key ciphertext is the ciphertext obtained by the server encrypting the encrypted private key based on the declared signing public key. The encrypted private key is a private key generated by the server based on the device identifier and the system parameters. Finally, the client performs data signature authentication based on the declared signing public key and the signing private key, and performs data encryption and decryption operations based on the declared encryption public key and the encrypted private key. As can be seen from the above, this application combines device identification with key management to manage system parameters, declared signature public keys, and declared encryption public keys, providing full lifecycle management of keys and solving problems such as insufficient randomness in key generation and difficulty in key updates. This can meet the needs of application systems that dynamically expand their device coverage. Furthermore, this application uses the SM2 standard algorithm, which complies with commercial cryptography specifications, ensuring security and compliance of interactive data security. This meets the requirements of application system security assessment and information security compliance, thus improving the security of the application system. In this way, the certificate-free encryption authentication technology employed in this application solves the problems of relying on certificate chains and certificate status queries during encryption authentication, as well as the complexity of certificate management and the high overhead of communication and storage resources. This improves the deployment and maintenance efficiency of the application system and reduces costs. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0049] Figure 1 A schematic diagram of the system framework applicable to the SM2-based encryption authentication scheme disclosed in this application;

[0050] Figure 2 A flowchart of an SM2-based encryption authentication method provided for this application;

[0051] Figure 3 This application provides a specific system initialization flowchart;

[0052] Figure 4 A specific flowchart for generating signature key pairs is provided for this application;

[0053] Figure 5 A specific flowchart for generating encryption key pairs is provided for this application;

[0054] Figure 6 This application provides a specific data signature authentication flowchart;

[0055] Figure 7 This application provides a specific data encryption / decryption flowchart;

[0056] Figure 8 A flowchart illustrating a specific SM2-based encryption authentication method provided in this application;

[0057] Figure 9 A schematic diagram of an SM2-based encryption authentication device provided for this application;

[0058] Figure 10 A schematic diagram of an SM2-based encryption authentication device provided for this application;

[0059] Figure 11 This application provides a structural diagram of an electronic device. Detailed Implementation

[0060] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0061] With the rapid development of the Internet of Things (IoT), the Internet of Vehicles (IoV), and the Industrial Internet, the number of devices is surging, and most terminals are resource-constrained, making the need for encrypted authentication for secure communication between devices increasingly urgent. Traditional PKI systems based on X.509 certificates rely on certificate authorities to manage certificates, and verification requires building a certificate chain and querying certificate status, increasing storage and transmission overhead and complicating certificate management processes, making them unsuitable for lightweight terminal scenarios. While existing certificate-free encryption authentication schemes avoid certificate dependence, they still have shortcomings. Furthermore, in multi-terminal interactions, the efficiency of signature and verification, and the security of key transmission, further limit the practicality of encrypted authentication systems. Therefore, this application provides an SM2-based encrypted authentication scheme that can build an efficient encrypted authentication mechanism supporting multi-terminal interactions, improving the security of application systems.

[0062] The specific system framework used in the SM2-based encryption authentication scheme of this application can be found in [link to relevant documentation]. Figure 1 As shown, it can specifically include: a client and a server. The client is a client on any terminal device running the target application system, and the server is deployed on the server of the target application system.

[0063] It should be noted that the client includes three modules: a client registration module, a local key management module, and an encryption authentication module. The client registration module collects terminal device information and user information to generate a device identifier and the terminal device's SM2 local public key data. It can initiate a registration request to the server via network to obtain declared public and private key fragments, and generate the final actual public and complete private keys on the local client. The local key management module uses the cryptographic devices / modules on the terminal device to generate keys, import / export keys, negotiate keys, etc., ensuring the secure storage of keys on the terminal side. The encryption authentication module uses the cryptographic devices / modules on the terminal device to generate random numbers, perform SM2 signature verification, and perform cryptographic operations such as SM2 encryption / decryption, SM3 hashing, and SM4 encryption / decryption, providing encryption authentication functions for the application system. The server includes a client management module and a key management center module. The client management module responds to registration requests initiated by the client, passing the client's device identifier and local public key to the key management center module. The key management center module generates and returns the corresponding declared public and private key fragments to the client, sending them to the client via the network channel. The key management center module uses cryptographic devices on the server to generate the system master key pair and system parameters. Based on the client's device identifier and local public key, it generates public and private key fragments, providing full lifecycle management of keys, including key creation, destruction, update, storage, and distribution.

[0064] See Figure 2As shown, this embodiment of the invention discloses an SM2-based encryption authentication method, applicable to any terminal device running a client application system, and may include:

[0065] Step S11: Receive system parameters generated by the server and generate a device identifier corresponding to the terminal device through the client; the system parameters are SM2 elliptic curve parameters.

[0066] This embodiment requires an initialization operation; see the detailed procedure below. Figure 3 As shown: First, the server initializes the key management center, generating system parameters PubPara, the system master public key MPuk, and the system master private key MPrk. Then, the server publishes the system parameters PubPara and the system master public key MPuk. Subsequently, the user obtains and pre-installs the system parameters PubPara and the system master public key MPuk on their client through their terminal device, and generates a unique device identifier ID in the system using the user's email address, ID card number, phone number, device serial number, etc. The system master public key and system master private key are the system master keys, located at the top level of the SM2 certificateless cryptographic key hierarchy. The system master public key is public, while the system master private key is encrypted and stored by the server's key management center.

[0067] It should be noted that the system parameters are SM2 elliptic curve parameters, including those in the finite field. model ,when In addition, it also includes the identifier of the element representation and the reduced polynomial. In this embodiment, an elliptic curve is defined. The two elements of the equation, , base point , The order n and other optional parameters, such as the cofactor of n, are used; the hash algorithm used in the system is the SM3 algorithm. For client A, there is a length of Bit device identifier ,remember It is by The resulting two bytes. The data types of the coordinates xG, yG of the elliptic curve equation parameters a, b, and G, and the coordinates xPub, yPub of Ppub, are converted into bit strings. Then, the hash value HA corresponding to client A can be calculated using the following formula to determine client A's key:

[0068] .

[0069] Step S12: Generate a registration request based on the device identifier and send the registration request to the server so that the server can register the client based on the registration request.

[0070] See Figure 3 As shown, in this embodiment, information such as device ID and user name can be encapsulated into registration request data (Data) for the client. Then, the registration request data (Data) can be sent to the server via a network channel. Subsequently, the server parses the registration request data (Data), executes the client registration operation through the client management module, and returns the registration operation result data (Result) to the client, thus completing the initialization.

[0071] Step S13: Generate a local public key and a local private key using the client, and send the device identifier and the local public key to the server. Receive a declaration signing public key and private key fragment sent by the server, and generate a signing private key based on the system parameters, the local private key, and the private key fragment. The declaration signing public key is a signing public key generated by the server based on the device identifier and the local public key, and declared externally by the client of any terminal device. The private key fragment is a key fragment generated by the server based on the device identifier and the local public key.

[0072] In this embodiment, see Figure 4 As shown, a signature key pair corresponding to the client can be generated. First, the client generates a local public key and a local private key, and sends the device identifier and the local public key to the server. The server then determines the client's registration result based on the device identifier. If the registration result indicates successful registration, a declaration signature public key and private key fragment are generated based on the device identifier and the local public key, and sent to the client. Next, the client receives the declaration signature public key and private key fragment sent by the server and generates a signature private key based on system parameters, the local private key, and the private key fragment. Finally, the client verifies whether the declaration signature public key and the signature private key match. If they match, the declaration signature public key and the signature private key are stored, and an actual signature public key corresponding to the terminal device is generated based on the declaration signature public key, the device identifier, and system parameters. This allows for data signature authentication based on the declaration signature public key, the actual signature public key, and the signature private key. The local public key is temporary public data related to the public key generated by the client. It is used, along with the device identifier, to generate the corresponding declaration signing public key and private key fragment by the key management center. The private key fragment is user private key fragment data generated by the key management center. It is used, along with the local public key, to calculate the complete signing private key on the client side. The specific process is as follows:

[0073] (1) The client generates a temporary key pair on the local terminal device, which are denoted as the local public key Ppuk and the local private key Pprk respectively;

[0074] (2) Send the device identifier ID and local public key Ppuk to the server through the network channel;

[0075] (3) The server checks whether the received device identifier ID has been registered through the client management module;

[0076] (4) If registered, the server uses the device identifier ID and local public key Ppuk through the key management center to generate the client's declaration signing public key Puk_s and private key fragment Pprk_s;

[0077] (5) The server sends the public key Puk_s and the private key fragment Pprk_s to the client via the network channel;

[0078] (6) The client combines the system parameters, the local private key Pprk, and the private key fragment Pprk_s to calculate the complete signing private key Prk_s;

[0079] (7) The client verifies whether the public key Puk_s for signing and the private key Prk_s for signing match. If they do not match, step (2) is executed again.

[0080] (8) If a match is found, the local key management module in the client is used to securely store the declaration signing public key Puk_s and signing private key Prk_s in the local cryptographic device / module.

[0081] In this way, the client's declared signing public key and signing private key can be determined through the above steps. Then, the declared signing public key, along with system parameters, the system master public key, and the device identifier, can be used to calculate the actual signing public key, verifying the binding relationship between the identity and the public key.

[0082] Step S14: The client sends the device identifier and the declaration signing public key to the server, and receives the declaration encryption public key and encryption private key ciphertext sent by the server. Based on the signing private key, the client decrypts the encryption private key ciphertext to obtain the encryption private key. The declaration encryption public key is an encryption public key generated by the server based on the device identifier and the system parameters and declared externally by the client of any terminal device. The encryption private key ciphertext is the ciphertext obtained by the server encrypting the encryption private key based on the declaration signing public key. The encryption private key is a private key generated by the server based on the device identifier and the system parameters.

[0083] In this embodiment, see Figure 5As shown, a corresponding encryption key pair can be generated for the client. First, the client sends its device identifier and declaration signing public key to the server. The server then determines the client's registration result based on the device identifier. If the registration result indicates successful registration, a declaration encryption public key and encryption private key are generated based on the device identifier and system parameters. The encryption private key is then encrypted using the declaration signing public key to obtain ciphertext, which is sent to the client. Next, the client verifies whether the declaration encryption public key and encryption private key match. If they match, the declaration encryption public key and encryption private key are stored. Based on the declaration encryption public key, device identifier, and system parameters, an actual encryption public key corresponding to the terminal device is generated for data encryption and decryption operations using the declaration encryption public key, the actual encryption key, and the encryption private key. The specific process is as follows:

[0084] (1) The client sends the device identifier ID and the declaration signing public key Puk_s to the server through the network channel;

[0085] (2) The server checks whether the received device identifier ID has been registered through the client management module;

[0086] (3) If registered, the server generates the client’s encryption key pair through the key management center module, combined with the device ID and system parameters, which are denoted as the declared encryption public key Puk_e and encryption private key Prk_e;

[0087] (4) The server uses the public key Puk_s to encrypt and protect the private key Prk_e, and obtains the ciphertext Prk_ec.

[0088] (5) The server will declare the public key Puk_e and the private key Prk_ec and send them to the client through the network channel;

[0089] (6) The client uses the signing private key Prk_s to decrypt the encrypted private key ciphertext Prk_ec to obtain the encrypted private key Prk_e;

[0090] (7) The client verifies whether the declared public key Puk_e and the private key Prk_e match. If they do not match, step (1) is repeated.

[0091] (8) If a match is found, the local key management module in the client is used to securely store the declared encrypted public key Puk_e and encrypted private key Prk_e in the local cryptographic device / module.

[0092] In this way, the client's declared encryption public key and encryption private key can be determined through the above steps. Then, the declared encryption public key, along with system parameters, the system master public key, and the device identifier, can be used to calculate the actual encryption public key, verifying the binding relationship between the identity and the public key.

[0093] Step S15: Through the client, perform data signature authentication based on the declared signing public key and the signing private key, and perform data encryption and decryption operations based on the declared encryption public key and the encryption private key.

[0094] In this embodiment, the terminal devices connected to the server include a first terminal device and a second terminal device. The first terminal device runs a first client of the target application system, and the second terminal device runs a second client of the target application system.

[0095] In this way, see Figure 6 As shown, the data signature authentication based on the declared signature public key and the signature private key can include: First, through a first client, the message to be signed is signed using system parameters and the signature private key of the first terminal device to obtain a signature value, and the device identifier of the first terminal device, the declared signature public key of the first terminal device, and the signature value are sent to a second client; then, through the second client, the actual signature public key corresponding to the first terminal device is determined based on the declared signature public key of the first terminal device, the device identifier of the first terminal device, and the system parameters, and the signature value is verified using the actual signature public key corresponding to the first terminal device to obtain a verification result, which is then sent to the first client to complete the data signature authentication. Specifically, the first terminal device is set as the signer A, and the second terminal device is set as the verifier B. The specific data signing and verification process is as follows:

[0096] (1) Signer A signs the message M to be signed through the first client using the system parameter PubPara and the signing private key Prk_s of the first terminal device, and obtains the signature value SignData.

[0097] (2) Signer A sends the device identifier ID_A of the first terminal device, the declaration signature public key Puk_s_A of the first terminal device, and the signature value SignData to signer B through the network channel;

[0098] (3) Verifier B, through the second client, calculates the actual signature public key Rpuk_s_A corresponding to signer A by combining the declared signature public key Puk_s_A of the first terminal device, the device identifier ID_A of the first terminal device, and the system parameters;

[0099] (4) Verifier B uses the actual signature public key Rpuk_s_A to verify the signature value SignData and obtains the verification result Result;

[0100] (5) Verifier B sends the verification result Result to signer A through the network channel to complete the data signature authentication.

[0101] It should be noted that, see Figure 7 As shown, the data encryption and decryption operation based on the declared encryption public key and the declared encryption private key can include: First, the device identifier of the second terminal device and the declared encryption public key of the second terminal device are sent to the first client through the second client; then, the actual encryption public key corresponding to the second terminal device is determined by the first client based on the declared encryption public key, the device identifier, and system parameters of the second terminal device; the target message to be encrypted is encrypted using the actual encryption public key corresponding to the second terminal device to obtain the target ciphertext, and the target ciphertext is sent to the second client; finally, the target ciphertext is decrypted by the second client based on the encryption private key of the second terminal device to obtain the target message, thus completing the data encryption and decryption operation. Specifically, the first terminal device is set as the encryptor A, and the second terminal device is set as the decryptor B. The specific data encryption and decryption process is as follows:

[0102] (1) Decryptor B sends the device identifier ID_B of the second terminal device and the public key of the declaration encryption of the second terminal device, Puk_e_B, to encryptor A through the network channel via the second client;

[0103] (2) The encryptor A, through the first client, combined with the declared encryption public key Puk_e_B of the second terminal device, the device identifier ID_B of the second terminal device, and the system parameters, calculates the actual encryption public key Rpuk_e_B corresponding to the decryptor B;

[0104] (3) Encryptor A uses the actual encryption public key Rpuk_e_B to encrypt the target message M to be encrypted, and obtains the corresponding ciphertext C;

[0105] (4) Encryptor A sends ciphertext C to decryptor B through a network channel;

[0106] (5) Decryptor B uses the encryption private key Prk_e_B of the second terminal device to decrypt the ciphertext C and obtain the plaintext of the target message. Complete the data encryption and decryption operations.

[0107] As can be seen from the above, in this embodiment, for any terminal device running a client with a target application system, the system parameters generated by the server are first received, and a device identifier corresponding to the terminal device is generated by the client; the system parameters are SM2 elliptic curve parameters; then, a registration request is generated based on the device identifier, and the registration request is sent to the server so that the server can register the client based on the registration request; subsequently, the client generates a local public key and a local private key, and sends the device identifier and the local public key to the server, receives a declaration signature public key and a private key fragment sent by the server, and generates a signature private key based on the system parameters, the local private key, and the private key fragment; the declaration signature public key is a signature public key generated by the server based on the device identifier and the local public key and declared externally by the client of any terminal device, and the private key fragment is... The server generates a key fragment based on the device identifier and the local public key. Then, the client sends the device identifier and the declared signing public key to the server, and receives the declared encryption public key and encrypted private key ciphertext sent by the server. Based on the signing private key, the client decrypts the encrypted private key ciphertext to obtain the encrypted private key. The declared encryption public key is an encryption public key generated by the server based on the device identifier and the system parameters, and declared externally by the client of any terminal device. The encrypted private key ciphertext is the ciphertext obtained by the server encrypting the encrypted private key based on the declared signing public key. The encrypted private key is a private key generated by the server based on the device identifier and the system parameters. Finally, the client performs data signature authentication based on the declared signing public key and the signing private key, and performs data encryption and decryption operations based on the declared encryption public key and the encrypted private key. As can be seen from the above, this embodiment combines device identifiers with key management, managing system parameters, declared signing public keys, and declared encryption public keys, providing full lifecycle management of keys, solving problems such as insufficient randomness in key generation and difficulty in key updates, and meeting the needs of application systems with dynamically expanding device scenarios. Meanwhile, this embodiment employs the SM2 standard algorithm, which complies with commercial cryptography specifications, ensuring security and compliance of interactive data security. This meets the application system's security assessment and compliance requirements, thereby enhancing the application system's security. Furthermore, this embodiment utilizes certificate-free encryption authentication technology, resolving issues such as reliance on certificate chains and certificate status queries during encryption authentication, as well as complex certificate management and high communication and storage resource overhead. This improves the deployment and maintenance efficiency of the application system and reduces costs.

[0108] See Figure 8 As shown, this embodiment of the invention further discloses an SM2-based encryption authentication method, applied to a server deploying a target application system, which may include:

[0109] Step S21: Generate system parameters and send the system parameters to the client of the terminal device; the system parameters are SM2 elliptic curve parameters.

[0110] It should be noted that the server includes a key management center. In this embodiment, the key management center can be initialized using the encryption and authentication server, and the system parameters can be generated using the initialized key management center.

[0111] Step S22: Receive the registration request sent by the client, and register the client based on the registration request; the registration request is a request generated by the client based on the device identifier corresponding to the terminal device.

[0112] Step S23: Receive the device identifier and local public key sent by the client, and generate a declaration signing public key and private key fragment based on the device identifier and the local public key. Send the declaration signing public key and the private key fragment to the client so that the client can generate a signing private key based on the system parameters, the local private key and the private key fragment. The declaration signing public key is a signing public key declared externally by the client of any terminal device.

[0113] Step S24: Receive the device identifier and the declaration signing public key sent by the client, and generate a declaration encryption public key and an encryption private key based on the device identifier and the system parameters, and encrypt the encryption private key based on the declaration signing public key to obtain the encryption private key ciphertext; the declaration encryption public key is the encryption public key declared externally by the client of any terminal device.

[0114] Step S25: Send the declared encryption public key and the encrypted private key ciphertext to the client, so that the client can decrypt the encrypted private key ciphertext based on the signing private key to obtain the encrypted private key, and perform data signature authentication based on the declared signing public key and the signing private key, and perform data encryption and decryption operations based on the declared encryption public key and the encrypted private key.

[0115] For more detailed processing procedures of steps S22 to S25, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0116] As can be seen from the above, this embodiment achieves secure connection between terminal devices and servers through standardized parameter interaction and key generation mechanisms. This not only ensures the security of key generation and transmission, but also provides reliable encryption and authentication support for secure data interaction between terminal devices. It effectively adapts to the encryption and authentication requirements based on the SM2 algorithm, thereby improving the security and practicality of the system.

[0117] Accordingly, see Figure 9As shown, this application embodiment also provides an SM2-based encryption authentication device, applicable to any terminal device running a client application system, and may include:

[0118] Device identifier generation module 11 is used to receive system parameters generated by the server and generate a device identifier corresponding to the terminal device through the client; the system parameters are SM2 elliptic curve parameters;

[0119] The registration request sending module 12 is used to generate a registration request based on the device identifier and send the registration request to the server so that the server can register the client based on the registration request;

[0120] The signature private key generation module 13 is used to generate a local public key and a local private key using the client, and send the device identifier and the local public key to the server, receive a declaration signature public key and private key fragment sent by the server, and generate a signature private key based on the system parameters, the local private key, and the private key fragment; the declaration signature public key is a signature public key generated by the server based on the device identifier and the local public key and declared externally by the client of any terminal device, and the private key fragment is a key fragment generated by the server based on the device identifier and the local public key;

[0121] The encryption private key generation module 14 is used to send the device identifier and the declaration signing public key to the server using the client, and to receive the declaration encryption public key and encryption private key ciphertext sent by the server, and to decrypt the encryption private key ciphertext based on the signing private key to obtain the encryption private key; the declaration encryption public key is an encryption public key generated by the server based on the device identifier and the system parameters and declared externally by the client of any terminal device; the encryption private key ciphertext is the ciphertext obtained by the server encrypting the encryption private key based on the declaration signing public key; and the encryption private key is a private key generated by the server based on the device identifier and the system parameters.

[0122] The encryption authentication module 15 is used to perform data signature authentication based on the declared signature public key and the signature private key through the client, and to perform data encryption and decryption operations based on the declared encryption public key and the encryption private key.

[0123] In some specific embodiments, the signature private key generation module 13 may include:

[0124] A local public key generation unit is used to generate a local public key and a local private key using the client, and send the device identifier and the local public key to the server, so that the server can determine the registration result of the client based on the device identifier. If the registration result indicates that the client has been registered, the server can generate the declaration signing public key and the private key fragment based on the device identifier and the local public key, and send the declaration signing public key and the private key fragment to the client.

[0125] The signature private key generation unit is used to receive the declared signature public key and the private key fragment sent by the server from the client, and generate the signature private key based on the system parameters, the local private key and the private key fragment;

[0126] The actual signature public key generation unit is used to verify whether the declared signature public key and the signature private key match using the client. If they match, the declared signature public key and the signature private key are stored, and an actual signature public key corresponding to the terminal device is generated based on the declared signature public key, the device identifier, and the system parameters, so as to perform the data signature authentication based on the declared signature public key, the actual signature public key, and the signature private key.

[0127] In some specific embodiments, the encrypted private key generation module 14 may include:

[0128] The device identifier sending unit is used to send the device identifier and the declaration signature public key to the server using the client, so that the server can determine the registration result of the client based on the device identifier. If the registration result indicates that the client has been registered, the server generates the declaration encryption public key and the encryption private key based on the device identifier and the system parameters, encrypts the encryption private key based on the declaration signature public key to obtain the encryption private key ciphertext, and sends the declaration encryption public key and the encryption private key ciphertext to the client.

[0129] Accordingly, the SM2-based encryption authentication device may further include:

[0130] The actual encryption public key generation unit is used to verify whether the declared encryption public key and the encryption private key match using the client. If they match, the declared encryption public key and the encryption private key are stored, and an actual encryption public key corresponding to the terminal device is generated based on the declared encryption public key, the device identifier, and the system parameters, so that the data encryption and decryption operations can be performed based on the declared encryption public key, the actual encryption public key, and the encryption private key.

[0131] In some specific embodiments, the terminal device connected to the server includes a first terminal device and a second terminal device, wherein the first terminal device runs a first client of the target application system, and the second terminal device runs a second client of the target application system;

[0132] Accordingly, the encryption authentication module 15 may include:

[0133] The signature value determination unit is used to sign the message to be signed based on the system parameters and the signature private key of the first terminal device through the first client to obtain a signature value, and send the device identifier of the first terminal device, the declared signature public key of the first terminal device, and the signature value to the second client.

[0134] The data signature authentication unit is configured to, through the second client, determine the actual signature public key corresponding to the first terminal device based on the declared signature public key of the first terminal device, the device identifier of the first terminal device, and the system parameters, verify the signature value using the actual signature public key corresponding to the first terminal device to obtain a verification result, and send the verification result to the first client to complete the data signature authentication.

[0135] In some specific embodiments, the encryption authentication module 15 may include:

[0136] A public key declaration sending unit is configured to send the device identifier of the second terminal device and the public key declaration of the second terminal device to the first client via the second client;

[0137] The target ciphertext determination unit is configured to determine the actual encryption public key corresponding to the second terminal device through the first client based on the declared encryption public key of the second terminal device, the device identifier of the second terminal device, and the system parameters; encrypt the target message to be encrypted using the actual encryption public key corresponding to the second terminal device to obtain the target ciphertext; and send the target ciphertext to the second client.

[0138] The data encryption / decryption unit is used to decrypt the target ciphertext using the encryption private key of the second client based on the second terminal device to obtain the target message, thereby completing the data encryption / decryption operation.

[0139] Accordingly, see Figure 10 As shown in the illustration, this application also provides an SM2-based encryption authentication device, applied to a server where a target application system is deployed, which may include:

[0140] The system parameter generation module 21 is used to generate system parameters and send the system parameters to the client of the terminal device; the system parameters are SM2 elliptic curve parameters.

[0141] The registration request receiving module 22 is used to receive the registration request sent by the client and register the client based on the registration request; the registration request is a request generated by the client based on the device identifier corresponding to the terminal device;

[0142] The declaration signature public key generation module 23 is used to receive the device identifier and local public key sent by the client, generate a declaration signature public key and private key fragment based on the device identifier and local public key, and send the declaration signature public key and the private key fragment to the client so that the client can generate a signature private key based on the system parameters, the local private key and the private key fragment; the declaration signature public key is a signature public key declared externally by the client of any terminal device;

[0143] The public key declaration generation module 24 is used to receive the device identifier and the public key declaration signature sent by the client, generate a public key declaration encryption and a private key encryption based on the device identifier and the system parameters, and encrypt the private key encryption based on the public key declaration signature to obtain the ciphertext of the private key encryption; the public key declaration encryption is a public key encryption declared by the client of any terminal device.

[0144] The encrypted private key ciphertext sending module 25 is used to send the declared encrypted public key and the encrypted private key ciphertext to the client, so that the client can decrypt the encrypted private key ciphertext based on the signing private key to obtain the encrypted private key, perform data signature authentication based on the declared signing public key and the signing private key, and perform data encryption and decryption operations based on the declared encrypted public key and the encrypted private key.

[0145] In some specific implementations, the server includes a key management center;

[0146] Accordingly, the system parameter generation module 21 includes:

[0147] The system parameter generation unit is used to initialize the key management center using the encryption authentication server, and to generate the system parameters using the initialized key management center.

[0148] Furthermore, embodiments of this application also disclose an electronic device, Figure 11This is a structural diagram of an electronic device 30 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. Specifically, the electronic device 30 may include: at least one processor 31, at least one memory 32, a power supply 33, a communication interface 34, an input / output interface 35, and a communication bus 36. The memory 32 stores a computer program, which is loaded and executed by the processor 31 to implement the relevant steps in the SM2-based encryption authentication method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 30 in this embodiment may specifically be an electronic computer.

[0149] In this embodiment, the power supply 33 is used to provide operating voltage for each hardware device on the electronic device 30; the communication interface 34 can create a data transmission channel between the electronic device 30 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 35 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0150] In addition, the memory 32, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 321, computer program 322, etc., and the storage method can be temporary storage or permanent storage.

[0151] The operating system 321 is used to manage and control the various hardware devices on the electronic device 30 and the computer program 322, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the SM2-based encryption authentication method executed by the electronic device 30 as disclosed in any of the foregoing embodiments, the computer program 322 may further include computer programs capable of performing other specific tasks.

[0152] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned SM2-based encryption authentication method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0153] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0154] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0155] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0156] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0157] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An SM2-based encryption authentication method, characterized in that, Any terminal device used to run a client application system, including: The system receives system parameters generated by the server and generates a device identifier corresponding to the terminal device through the client; the system parameters are SM2 elliptic curve parameters. A registration request is generated based on the device identifier, and the registration request is sent to the server so that the server can register the client based on the registration request; The client generates a local public key and a local private key, and sends the device identifier and the local public key to the server. It then receives a declaration signing public key and a private key fragment from the server and generates a signing private key based on the system parameters, the local private key, and the private key fragment. The declaration signing public key is a signing public key generated by the server based on the device identifier and the local public key, and declared externally by the client of any terminal device. The private key fragment is a key fragment generated by the server based on the device identifier and the local public key. The client sends the device identifier and the declared signature public key to the server, and receives the declared encryption public key and encrypted private key ciphertext sent by the server. Based on the signature private key, the client decrypts the encrypted private key ciphertext to obtain the encrypted private key. The declared encryption public key is an encryption public key generated by the server based on the device identifier and the system parameters, and declared externally by the client of any terminal device. The encrypted private key ciphertext is the ciphertext obtained by the server encrypting the encrypted private key based on the declared signature public key. The encrypted private key is a private key generated by the server based on the device identifier and the system parameters. The client performs data signature authentication based on the declared signing public key and the declared signing private key, and performs data encryption and decryption operations based on the declared encryption public key and the declared encryption private key.

2. The SM2-based encryption authentication method according to claim 1, characterized in that, The process of generating a local public key and a local private key using the client, sending the device identifier and the local public key to the server, receiving a declaration signing public key and private key fragment sent by the server, and generating a signing private key based on the system parameters, the local private key, and the private key fragment includes: The client generates the local public key and the local private key, and sends the device identifier and the local public key to the server, so that the server can determine the registration result of the client based on the device identifier. If the registration result indicates that the client has been registered, the server generates the declaration signing public key and the private key fragment based on the device identifier and the local public key, and sends the declaration signing public key and the private key fragment to the client. The client receives the declaration signing public key and the private key fragment sent by the server, and generates the signing private key based on the system parameters, the local private key, and the private key fragment; The client verifies whether the declared signing public key and the signing private key match. If they match, the client stores the declared signing public key and the signing private key, and generates the actual signing public key corresponding to the terminal device based on the declared signing public key, the device identifier, and the system parameters, so as to perform the data signature authentication based on the declared signing public key, the actual signing public key, and the signing private key.

3. The SM2-based encryption authentication method according to claim 1, characterized in that, The step of sending the device identifier and the claim signing public key to the server using the client includes: The client sends the device identifier and the declaration signing public key to the server, so that the server can determine the registration result of the client based on the device identifier. If the registration result indicates that the client has been registered, the server generates the declaration encryption public key and the encryption private key based on the device identifier and the system parameters, and encrypts the encryption private key based on the declaration signing public key to obtain the encryption private key ciphertext. The server then sends the declaration encryption public key and the encryption private key ciphertext to the client. Accordingly, after decrypting the encrypted private key ciphertext based on the signing private key to obtain the encrypted private key, the process further includes: The client verifies whether the declared encryption public key and the encryption private key match. If they match, the client stores the declared encryption public key and the encryption private key, and generates the actual encryption public key corresponding to the terminal device based on the declared encryption public key, the device identifier, and the system parameters, so as to perform the data encryption and decryption operations based on the declared encryption public key, the actual encryption public key, and the encryption private key.

4. The SM2-based encryption authentication method according to any one of claims 1 to 3, characterized in that, The terminal devices connected to the server include a first terminal device and a second terminal device. The first terminal device runs a first client of the target application system, and the second terminal device runs a second client of the target application system. Accordingly, the data signature authentication based on the declared signing public key and the signing private key includes: The first client signs the message to be signed based on the system parameters and the signing private key of the first terminal device to obtain a signature value, and sends the device identifier of the first terminal device, the declaration signing public key of the first terminal device, and the signature value to the second client. The second client determines the actual signature public key corresponding to the first terminal device based on the declared signature public key of the first terminal device, the device identifier of the first terminal device, and the system parameters. It then uses the actual signature public key to verify the signature value to obtain a verification result and sends the verification result to the first client to complete the data signature authentication.

5. The SM2-based encryption authentication method according to claim 4, characterized in that, The data encryption and decryption operations based on the declared public key and the declared private key include: The device identifier of the second terminal device and the public key for the declaration of the second terminal device are sent to the first client through the second client; The first client determines the actual encryption public key corresponding to the second terminal device based on the declared encryption public key of the second terminal device, the device identifier of the second terminal device, and the system parameters. It then uses the actual encryption public key corresponding to the second terminal device to encrypt the target message to be encrypted to obtain the target ciphertext and sends the target ciphertext to the second client. The target message is obtained by decrypting the target ciphertext using the encryption private key of the second terminal device by the second client, thereby completing the data encryption and decryption operation.

6. An SM2-based encryption authentication method, characterized in that, Servers used to deploy the target application system include: Generate system parameters and send the system parameters to the client of the terminal device; the system parameters are SM2 elliptic curve parameters; The system receives a registration request from the client and registers the client based on the registration request; the registration request is a request generated by the client based on the device identifier corresponding to the terminal device. The system receives a device identifier and a local public key sent by the client, and generates a declaration signing public key and a private key fragment based on the device identifier and the local public key. The declaration signing public key and the private key fragment are then sent to the client so that the client can generate a signing private key based on the system parameters, the local private key, and the private key fragment. The declaration signing public key is a signing public key declared externally by the client of any terminal device. The system receives the device identifier and the declaration signing public key sent by the client, generates a declaration encryption public key and an encryption private key based on the device identifier and the system parameters, and encrypts the encryption private key based on the declaration signing public key to obtain the encryption private key ciphertext; the declaration encryption public key is the encryption public key declared externally by the client of any terminal device. The declared public key and the encrypted private key are sent to the client so that the client can decrypt the encrypted private key based on the signing private key to obtain the encrypted private key, perform data signature authentication based on the declared public key and the signing private key, and perform data encryption and decryption operations based on the declared public key and the encrypted private key.

7. The SM2-based encryption authentication method according to claim 6, characterized in that, The server includes a key management center; Accordingly, the generated system parameters include: The key management center is initialized using the encryption authentication server, and the system parameters are generated using the initialized key management center.

8. An SM2-based encryption authentication device, characterized in that, Any terminal device used to run a client application system, including: The device identifier generation module is used to receive system parameters generated by the server and generate a device identifier corresponding to the terminal device through the client; the system parameters are SM2 elliptic curve parameters. A registration request sending module is used to generate a registration request based on the device identifier and send the registration request to the server so that the server can register the client based on the registration request; The signature private key generation module is used to generate a local public key and a local private key using the client, and send the device identifier and the local public key to the server. It also receives a declaration signature public key and private key fragment sent by the server, and generates a signature private key based on the system parameters, the local private key, and the private key fragment. The declaration signature public key is a signature public key generated by the server based on the device identifier and the local public key, and declared externally by the client of any terminal device. The private key fragment is a key fragment generated by the server based on the device identifier and the local public key. The encrypted private key generation module is used to send the device identifier and the declared signature public key to the server using the client, and to receive the declared encrypted public key and encrypted private key ciphertext sent by the server, and to decrypt the encrypted private key ciphertext based on the signature private key to obtain the encrypted private key; the declared encrypted public key is an encrypted public key generated by the server based on the device identifier and the system parameters and declared externally by the client of any terminal device; the encrypted private key ciphertext is the ciphertext obtained by the server encrypting the encrypted private key based on the declared signature public key; and the encrypted private key is a private key generated by the server based on the device identifier and the system parameters. The encryption authentication module is used by the client to perform data signature authentication based on the declared signing public key and the signing private key, and to perform data encryption and decryption operations based on the declared encryption public key and the encryption private key.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the SM2-based encryption authentication method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, implements the SM2-based encryption authentication method as described in any one of claims 1 to 7.

Images