A cross-platform identity mutual recognition method and device based on a lightweight national secret certificate chain

Abstract

The application discloses a cross-platform identity mutual recognition method and device based on a lightweight national secret certificate chain. The method first constructs a dynamic security level index, generates key pairs of a root certificate center, an intermediate certificate node and an edge certificate node through a national secret SM2 algorithm, and completes certificate issuing and verification step by step to realize multi-level identity authentication. In the cross-platform communication process, the certificate chain depth, signature strength and session key length are adaptively selected according to the dynamic security level index, and the security distribution of the session key and the signature, encryption transmission and decryption of the business data are completed. The method realizes efficient communication under different computing power and security requirements while guaranteeing data integrity and identity credibility, and has the advantages of high security, strong adaptability and low computing cost.

Description

Technical Field

[0001] This invention relates to the field of information security and cross-platform identity authentication technology, specifically to a cross-platform identity mutual recognition method and device based on a lightweight national cryptographic certificate chain, which is suitable for achieving high-security and high-efficiency data transmission and identity authentication in multi-platform environments such as vehicle networking platforms and power load management systems. Background Technology

[0002] With the rapid development of the Internet of Vehicles (IoV), the power Internet of Things, and new energy infrastructure, the demand for cross-platform data interaction and collaborative control is increasing. In practical applications, IoV platforms and power load management systems need to frequently conduct highly secure data communication to support various critical business scenarios such as vehicle charging scheduling, load balancing control, power forecasting, and grid security operation. However, existing technologies still have many shortcomings in cross-platform identity authentication and secure data transmission, limiting the efficiency and security of multi-platform collaboration.

[0003] In traditional multi-platform collaborative systems, vehicle-to-everything (V2X) platforms and power load management systems typically rely on their own independent authentication mechanisms. The lack of a unified root of trust between different platforms leads to differences in certificate systems, key management, and encryption algorithms, making it impossible to effectively establish cross-platform mutual trust. This architecture results in inefficient mutual recognition between devices and services during the access process, easily causing authentication delays or even failures, thus affecting system stability and availability.

[0004] Most current mainstream cross-platform authentication mechanisms are based on the internationally accepted Public Key Infrastructure (PKI) architecture, employing algorithms such as RSA and ECC for certificate issuance and verification. However, PKI suffers from significant performance bottlenecks in high-concurrency, low-latency IoT applications: issues such as fixed certificate chain hierarchy, high computational complexity, and long verification times are particularly prominent. For in-vehicle terminals or edge devices with limited computing power, traditional PKI leads to a significant decrease in authentication efficiency, making it difficult to guarantee real-time performance and impacting the overall system response performance.

[0005] Regarding key negotiation and update mechanisms, existing technologies mostly employ fixed parameters, static keys, or single-handshake mechanisms, lacking flexibility and adaptability. Because key parameters cannot be dynamically adjusted based on device computing power, communication bandwidth, and security level, key distribution and management are inefficient in large-scale, multi-node interconnected scenarios, easily leading to issues such as key expiration, invalidation, or synchronization failure. This not only increases system security risks but also affects the stability of communication between platforms.

[0006] In terms of data security, vehicle-to-everything (V2X) and power load management systems need to transmit a large amount of highly sensitive information, including charging strategies, power data, and dispatch instructions. Existing technologies generally rely on traditional symmetric encryption or static digital signature mechanisms for data protection, but lack the ability to negotiate encryption based on dynamic security strategies. When the system encounters security threats such as man-in-the-middle attacks, certificate forgery, or data tampering, existing solutions lack real-time defense mechanisms and rapid verification methods, resulting in insufficient guarantee of communication security and significant potential risks.

[0007] More and more vehicle-to-everything (V2X) and power systems are migrating to Chinese cryptographic algorithm systems (such as SM2, SM3, and SM4). However, existing international standard protocols such as PKI and TLS have insufficient compatibility with these Chinese cryptographic algorithms, resulting in low computational efficiency, high resource consumption, and limited overall system performance in cross-platform scenarios requiring compatibility with these algorithms. Furthermore, the lack of unified implementation standards for these algorithms across different platforms leads to poor cross-platform interoperability, further limiting the feasibility of large-scale applications.

[0008] In practical applications, vehicle-to-everything (V2X) platforms often need to interact simultaneously with a large number of charging facilities, user equipment, power dispatching platforms, and power grid monitoring systems, forming large-scale collaborative control scenarios. However, most existing cross-platform authentication and data security technologies rely on static configuration and fixed architecture, lacking dynamic adaptability and elastic scalability. When faced with high-concurrency access requests from thousands or even tens of thousands of terminal devices, existing solutions are prone to processing bottlenecks, significantly increasing authentication latency and reducing communication link efficiency, making it difficult to meet the application needs of future ultra-large-scale IoT collaboration.

[0009] In summary, existing cross-platform identity authentication and secure data transmission technologies still have significant shortcomings in areas such as unified trust management, authentication efficiency, dynamic key negotiation, transmission security, compatibility with national cryptographic algorithms, and large-scale scalability. These technical deficiencies are particularly prominent in application scenarios integrating vehicle-to-everything (V2X) and power load management systems, causing problems such as difficulty in device access, high authentication latency, and insufficient data communication security. This hinders the promotion and implementation of multi-platform collaborative applications, necessitating the development of a novel technical solution that combines high security, high efficiency, and high scalability to address these existing issues. Summary of the Invention

[0010] To address the aforementioned problems in the existing technology, this invention proposes a cross-platform identity recognition method based on a lightweight national cryptographic certificate chain, characterized in that: Includes the following steps: Step 1: Construct dynamic security level indicators, and generate the root certificate center master key pair, intermediate certificate node key pair, and edge certificate node key pair respectively using the national cryptographic algorithm according to the indicators; Step 2: The root certificate authority uses its master private key to sign the intermediate certificate node's public key to generate an intermediate node certificate, and uses the root certificate authority's master public key to verify the validity of the intermediate node certificate. If the verification is valid, the intermediate certificate node is recognized as a legitimate and trusted node and has the authority to issue certificates to its subordinate edge certificate nodes. If the verification fails, the establishment of a trust relationship for the intermediate node is refused. Step 3: The intermediate certificate node uses its intermediate private key to sign the edge certificate node's public key to generate an edge certificate, and uses the root certificate center's master public key, the intermediate node certificate, and the edge certificate to complete the authentication of the edge certificate node; when the authentication is successful, the two parties in the cross-platform communication establish a trust relationship; if the authentication fails, the edge node is denied access. Step 4: When the first platform establishes cross-platform communication with the second platform, the certificate chain depth, signature strength and session key length are selected according to the dynamic security level indicators. The first platform generates a session key and encrypts it with the public key of the second platform according to the national cryptographic algorithm and sends it to the second platform. The second platform uses its private key to decrypt and obtain the session key. Step 5: The first platform uses its own private key to digitally sign the data to be transmitted, and uses the second platform's public key to encrypt the data and signature before sending them to the second platform. The second platform uses its private key to decrypt the data and uses the first platform's public key to verify the validity of the signature. Step 6: During the certificate issuance, certificate verification, and session key negotiation processes, the certificate chain depth, signature strength, and session key length are adaptively adjusted based on the dynamic security level index.

[0011] Step 1 further includes: When the method is started, the root certificate authority generates system public parameters based on the system's preset security parameters λ. The system public parameters include the equation of the elliptic curve, its base points, and its order. During the generation of the system's public parameters, a dynamic security level indicator is introduced. This dynamic security level indicator predefines multiple encryption strength modes, each of which corresponds to a different key length and signature algorithm. Based on the dynamic security level indicators, the root certificate center generates the root certificate center master key pair, intermediate certificate node key pair, and edge certificate node key pair respectively using the national cryptographic SM2 algorithm.

[0012] Step 2 further includes: After the dynamic certificate chain is generated, the intermediate certificate nodes submit a certificate application request containing the public key to the root certificate authority. The root certificate authority selects signature algorithm parameters based on dynamic security level indicators and uses its master private key to digitally sign the public key of the intermediate certificate node to generate an intermediate node certificate. The integrity of the intermediate node certificate is guaranteed by the signature result and is registered in the system certificate chain; The intermediate node certificate is verified using the root certificate authority's master public key. If the verification is successful, it is confirmed that the intermediate node has the authority to issue certificates to lower-level edge certificate nodes.

[0013] Step 3 further includes: After the intermediate certificate node completes identity authentication, the edge certificate node submits a certificate application request containing the public key to the intermediate certificate node; The intermediate certificate node determines the signature algorithm parameters and key length according to the dynamic security level index, and uses its intermediate private key to digitally sign the edge node public key to generate an edge node certificate. The edge node certificate is returned to the edge device, and its integrity is guaranteed by the signature result.

[0014] Step 4 further includes: After completing the identity authentication of the root certificate center, intermediate certificate nodes and edge certificate nodes, the first platform establishes a cross-platform communication connection with the second platform; The first platform determines the session key length and certificate chain depth based on dynamic security level indicators, and generates a one-time session key; The first platform uses the public key of the second platform to encrypt the session key using the SM2 algorithm and then sends it to the second platform; The second platform uses its private key to decrypt the encrypted data using SM2 and recover the session key to achieve secure cross-platform communication.

[0015] Step 5 further includes: After the first platform and the second platform complete the session key negotiation and establish a secure communication channel, the first platform selects the signature algorithm parameters according to the dynamic security level index and uses its own private key to generate a digital signature for the data to be transmitted. The first platform uses the public key of the second platform to encrypt the data and the signature using SM2, forming ciphertext, and sends it to the second platform; The second platform uses its private key to decrypt the ciphertext, recover the data and the signature, and uses the first platform's public key to verify the signature.

[0016] Step 6 further includes: After the first platform and the second platform complete the session key negotiation, both parties share the session key; The first platform determines the symmetric encryption algorithm parameters and key length based on the dynamic security level index, and uses the session key to perform symmetric encryption on the business data, generating ciphertext and sending it to the second platform; The second platform uses the session key to perform symmetric decryption of the ciphertext, recover the original data, and performs integrity verification on the decryption result to ensure the security of cross-platform data transmission.

[0017] During the certificate issuance, verification, and session key negotiation processes, the certificate chain depth, signature algorithm strength, and session key length are dynamically adjusted based on dynamic security level indicators. The method defines minimum sufficient safety constraints. : ,in Indicates the degree of safety risk. Indicates link jitter. Indicates the depth of the certificate chain. Indicates signature strength. Indicates the session key length, when If ≥0, it is considered that the safety requirements are met. If <0, then increase sequentially. Until the conditions are met; An elliptic curve optimization mechanism based on the national cryptographic SM2 algorithm is introduced at the protocol layer, based on performance index. The parameter set of the candidate curve is calculated and the parameter set with the largest performance index is selected as the running parameters to reduce computational complexity and ensure safety.

[0018] The minimum sufficient safety constraint for:

[0019] in, This represents the maximum signature strength level supported by the system. This serves as a baseline value for the session key length. As a safety baseline threshold, This represents the jitter sensitivity coefficient.

[0020] The elliptic curve performance index The quantitative selection of the best candidate curve among multiple candidate curve parameter sets is expressed as follows:

[0021] in, The subgroup order bit length of the candidate curve. Remainder factor, Indicates side-channel susceptibility. This represents the unit signature / verification latency under current hardware and algorithm implementation conditions. Time-sensitive weights.

[0022] On the other hand, the present invention also proposes an apparatus for implementing the cross-platform identity mutual recognition method based on a lightweight national cryptographic certificate chain, the apparatus comprising: The certificate management module is used to generate key pairs for the root certificate center, intermediate certificate nodes, and edge certificate nodes based on security parameters and dynamic security level indicators, and to complete the issuance and verification of certificates. The session negotiation module is used to select the certificate chain depth, signature strength and session key length according to the dynamic security level index when establishing a communication connection between the first platform and the second platform, and to complete the generation, encryption and distribution of the session key; The data security module is used to encrypt and transmit business data between the first platform and the second platform based on the session key, and to complete the data trustworthiness verification through signing and decryption.

[0023] On the other hand, the present invention also proposes a computer device, characterized in that it includes: one or more processors; The one or more processors are used to execute a program stored in memory, which, when executed, implements the cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described above.

[0024] On the other hand, a computer-readable storage medium is characterized in that it stores a computer program thereon, which, when executed by a processor, implements the cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described above.

[0025] Based on the same inventive concept, this application also provides a readable storage medium having an executable program stored thereon, wherein when the executable program is executed, it implements the aforementioned cross-platform identity mutual recognition method based on a lightweight national cryptographic certificate chain.

[0026] Beneficial effects: This invention achieves adaptive optimization of cross-platform identity authentication and data transmission by introducing a lightweight national cryptographic certificate chain and dynamic security level indicators. In low-computing-power scenarios, the certificate chain depth and signature strength can be reduced to decrease computational burden; in high-security scenarios, the key length and full-chain verification are automatically increased to ensure the security of sensitive data. This method effectively improves communication efficiency, reduces computational overhead, and enhances the system's adaptability and scalability in multi-platform collaborative environments such as vehicle networking and power load management, while ensuring identity trustworthiness and data integrity. Attached Figure Description

[0027] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to unduly limit the scope of the invention. In the drawings: Figure 1The overall flowchart of the cross-platform identity recognition method based on the lightweight national cryptographic certificate chain of the present invention is shown. Detailed Implementation

[0028] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. The illustrative embodiments and descriptions are only used to explain the present invention and are not intended to limit the present invention.

[0029] Figure 1 This is a flowchart illustrating a cross-platform identity recognition method based on a lightweight national cryptographic certificate chain, as shown in Embodiment 1 of the present invention.

[0030] In this embodiment, the method is applied to cross-platform identity authentication and secure data communication between a vehicle network platform and a power load management system. It aims to address the problems of lack of cross-platform mutual trust, low certificate chain verification efficiency, insufficient key negotiation flexibility, and poor adaptability of dynamic security policies in existing technologies. By introducing dynamic security level indicators, this invention achieves adaptive configuration of certificate chain depth, signature algorithm strength, and session key length, significantly improving the security and real-time performance of cross-platform authentication and data transmission.

[0031] like Figure 1 As shown, the cross-platform identity recognition method based on a lightweight national cryptographic certificate chain in this embodiment includes the following steps: Step S1: Generation of Dynamic National Cryptographic Certificate Chain Upon method initiation, the root certificate center first constructs the system public parameters for a lightweight national cryptographic certificate chain based on the system's preset security parameters λ. Unlike traditional fixed-parameter schemes, this embodiment introduces dynamic security level indicators during the generation of system public parameters, predefining multiple encryption strength modes, each corresponding to a different key length and signature algorithm. Based on these dynamic security level indicators, the root certificate center's master key pair, intermediate certificate node key pairs, and edge certificate node key pairs are generated using the national cryptographic SM2 algorithm. This design enables flexible configuration of the certificate chain and is suitable for heterogeneous computing environments with multiple platforms and devices.

[0032] Step S2: Intermediate Certificate Node Authentication After generating the dynamic certificate chain, the root certificate authority uses its master private key to sign the public keys of the intermediate certificate nodes, thereby generating intermediate node certificates. The system then uses the root certificate authority's master public key to verify the validity of these intermediate node certificates. This step ensures that the intermediate certificate nodes acquire legitimate identities, thus providing secure support for subsequent edge node authentication.

[0033] Step S3: Edge Certificate Node Authentication After completing its own authentication, the intermediate certificate node uses its intermediate private key to sign the public key of the edge certificate node, generating an edge node certificate. Edge certificate nodes, along with in-vehicle devices in the vehicle-to-everything (V2X) platform and terminal devices in the power load management system, all fall into this category. Any device or terminal can use the root certificate center's master public key, intermediate node certificates, and edge node certificates to complete mutual identity verification. This mechanism achieves cross-platform, multi-level, highly reliable device authentication, avoiding access conflicts and failures caused by inconsistent multi-platform policies in traditional authentication methods.

[0034] Step S4: Adaptive Session Key Security Negotiation After identity authentication is completed, when the first platform (vehicle networking platform) and the second platform (power load management system) establish a cross-platform communication connection, the first platform selects an appropriate session key length and certificate chain depth based on the current terminal computing power, network bandwidth, and preset dynamic security level indicators to balance computing performance and security strength. Subsequently, the first platform generates a session key and encrypts it using the second platform's public key via the national cryptographic algorithm SM2, then sends the encrypted session key to the second platform. The second platform uses its private key to decrypt the key and recover the original session key. This scheme, through dynamic parameter adjustment, solves the performance bottleneck problem of existing fixed-length keys on different computing devices, achieving efficient and secure cross-platform key distribution. At this point, after the session key negotiation is completed, the sender encrypts the original data using SM4-CBC mode to generate ciphertext; simultaneously, it uses the receiver's SM2 public key to encrypt the session key, forming a digital envelope. The receiver decrypts the envelope using its SM2 private key to obtain the session key, and then decrypts the data using SM4.

[0035] Step S5: Dynamic Data Signature and Encrypted Transmission Before sending business data, the first platform selects an appropriate signature algorithm strength based on dynamic security level indicators and digitally signs the data to be transmitted using its own private key. Then, it encrypts the data and signature result using the second platform's public key, generating ciphertext which is then sent to the second platform. Upon receiving the ciphertext, the second platform first decrypts it using its own private key, and then verifies the validity of the signature using the first platform's public key, ensuring the data source is trustworthy and the data content is intact. This step effectively defends against man-in-the-middle attacks and data tampering risks, improving the trustworthiness of cross-platform transmission. The process involves generating a data digest using the SM3 algorithm, then performing an SM2 signature using the edge node's private key to create a non-repudiable signature value. The data and signature are then encrypted using the SM4 algorithm, followed by a second encryption using the recipient's public key, thus constructing a dual-layer security protection system.

[0036] Step S6: Adaptive Encrypted Data Transmission and Decryption During the business communication phase, the first platform uses the session key to perform symmetric encryption on the transmitted data based on the dynamic security level index to generate ciphertext, and then transmits the ciphertext to the second platform.

[0037] The second platform uses the same session key to decrypt the ciphertext and recover the original data, thus completing the secure transmission of data across platforms. By introducing dynamic security level indicators, the computational complexity and security strength of symmetric encryption algorithms can be adjusted according to actual application scenarios, achieving bidirectional optimization of low-power devices and high-security services. During data transmission, each relay node needs to verify the validity of the upstream node's certificate chain, including root certificate signature verification, intermediate node certificate status check, and edge node certificate validity period verification, to form an end-to-end trusted transmission channel.

[0038] Step S7: Dynamic Security Strategy and Lightweight Optimization Throughout the certificate issuance, verification, and session key negotiation process, this embodiment employs a dynamic security policy management mechanism to automatically adjust the certificate chain depth, signature algorithm strength, and session key length based on platform computing power and communication requirements. In low-computing-power scenarios, it reduces the signature complexity of edge nodes, retaining only intermediate node signatures, thereby alleviating terminal computational pressure. In high-security scenarios, it enables full-chain signature authentication combined with high-strength key combinations to ensure the security of sensitive data communication. Simultaneously, this embodiment introduces elliptic curve optimization technology based on national cryptographic algorithms at the protocol layer, effectively reducing computational overhead and achieving a lightweight design for cross-platform identity authentication and data interaction, ensuring high-performance system operation in resource-constrained environments.

[0039] Through the above embodiments, the cross-platform identity mutual recognition method based on lightweight national cryptographic certificate chain proposed in this invention takes into account security, computing performance and system scalability, and can meet the technical requirements of high security, low latency and large-scale device collaborative access between vehicle network platforms and power load management systems.

[0040] The specific implementation plan for each step is as follows: In step S1, upon method startup, the root certificate authority first initializes the system's core security configuration based on the system's preset security parameter λ. The security parameter λ serves as a fundamental parameter for controlling the system's security level, defining the security strength of key generation, signature algorithms, and the certificate chain structure. Based on this parameter, the root certificate authority generates a set of publicly available system parameters para, which include the equation of the elliptic curve, the base point G, and the order n of the base point. These parameters will serve as the basis for subsequent key generation and signing using the national cryptographic algorithm SM2. In this step, the certificate configurations of all platforms, nodes, and devices rely on the publicly available parameters initialized by the root certificate authority to ensure the security consistency of the entire system during cross-platform interoperability.

[0041] In generating the system's public parameters, this embodiment introduces the concept of a dynamic security level indicator. This dynamic security level indicator is predefined by the root certificate authority and includes several encryption strength modes, typically categorized into low-security, medium-security, and high-security modes. Each mode corresponds to different key lengths, signature algorithms, and computational complexity. For example, in low-security mode, a 192-bit key length can be selected, suitable for edge devices with limited computing power; in medium-security mode, a 256-bit key can be used to meet the security requirements of typical business scenarios; and in high-security mode, the key length can be increased to 384 bits or higher to adapt to high-security communication and sensitive data transmission scenarios. By introducing this indicator into the public parameters, the system can dynamically allocate appropriate security levels and corresponding key policies to different platforms and devices during the initialization phase, based on their computing power.

[0042] After setting the dynamic security level indicators, the root certificate center generates three types of key pairs based on the national cryptographic algorithm SM2: the root certificate center's master key pair, intermediate certificate node key pairs, and edge certificate node key pairs. The SM2 algorithm, based on elliptic curve public-key cryptography, features high security and high computational efficiency, making it suitable for large-scale, multi-device, and multi-platform heterogeneous computing environments. For the root certificate center's master key pair, the generated master private key is used to sign the public keys of intermediate certificate nodes, ensuring the legitimacy of the intermediate node's identity. The intermediate certificate node key pairs are held by the certificate center or core management device of each platform and are used to issue certificates to their subordinate edge or terminal devices and establish a trust chain. The edge certificate node key pairs are held by the terminal devices or access controllers and are used to perform identity authentication and data encryption operations in cross-platform communication.

[0043] In practical applications, the system automatically selects different key lengths and algorithm parameters to generate the three types of key pairs based on the dynamic security level indicators. For example, in high-security mode, the root certificate authority uses a high-strength SM2 algorithm parameter set to generate longer keys to improve resistance to attacks; while in low-security mode, a lightweight SM2 parameter set is used to reduce computational complexity and power consumption of terminal devices. Throughout this process, all generated key pairs maintain consistency with the certificate chain structure, ensuring that the system can still achieve a unified cross-platform identity recognition mechanism under different security levels.

[0044] By introducing dynamic security level indicators and a flexible SM2 key generation mechanism in step S1, the root certificate center not only achieves configurable management of the system's certificate chain, but also flexibly adapts security policies according to the computing power and security requirements of different platforms and devices. This design ensures the scalability and security of the certificate chain across multiple platforms, devices, and application scenarios, providing a reliable security foundation for the identity authentication of subsequent intermediate and edge certificate nodes.

[0045] In step S2, after generating the dynamic certificate chain, the root certificate authority authenticates the intermediate certificate nodes to ensure their legitimacy in issuing and managing certificates for lower-level edge nodes within the certificate chain system. The core of this step lies in digitally signing the public key of the intermediate certificate node using the root certificate authority's master private key, thereby generating the intermediate node certificate.

[0046] In practice, the intermediate certificate node first needs to initiate a certificate application request to the root certificate authority. This request includes necessary parameters such as its public key, device identifier, platform information, and security level requirements. Upon receiving the request, the root certificate authority will select the appropriate signature algorithm parameter set and key length based on the dynamic security level index generated in step S1, combined with the computing power and security requirements of the requesting node's platform. For example, in high-security mode, the system will use longer SM2 curve parameters and a stronger signature algorithm to ensure the intermediate node certificate's resistance to attacks during subsequent data transmission and identity verification.

[0047] The root certificate authority (DCA) uses its master private key to digitally sign the public key of intermediate certificate nodes based on the selected signature parameters, generating a unique intermediate node certificate. This certificate contains information such as the intermediate node's public key, device identifier, certificate validity period, issuance time, and security level mode used, all bound together by the signature result to ensure the integrity and immutability of the certificate content. After signing, the DCA returns the intermediate node certificate to the intermediate certificate node and registers its information in the system's certificate trust chain for subsequent use in cross-platform authentication.

[0048] After the intermediate node certificate is generated, the system verifies the issued intermediate node certificate using the root certificate authority's master public key. The verification process includes steps such as signature value verification, certificate validity check, and dynamic security level matching verification. When the verification result shows that the signature is valid, the certificate has not expired, and the security level parameters are consistent, the intermediate certificate node is recognized as a legitimate and trusted node and has the authority to issue certificates to its subordinate edge certificate nodes. If the verification fails, a trust relationship is refused to be established for the intermediate node to prevent unauthorized nodes from impersonating authorized authorities.

[0049] In step S2, the system completes the authentication of the intermediate certificate nodes' identities based on the dynamic certificate chain, ensuring the unique trustworthiness of the intermediate nodes within the certificate system. This process ensures the legitimacy and security of the intermediate certificate nodes when issuing certificates, transmitting trust, and verifying identities to edge nodes, thus providing reliable security support for subsequent edge node authentication and cross-platform mutual trust establishment.

[0050] In step S3, after the intermediate certificate node completes its own identity authentication and obtains a valid certificate, it is authorized to issue certificates to its subordinate edge certificate nodes, thereby realizing the trusted identity identification of edge devices in cross-platform communication. The core of this step is that the intermediate certificate node uses its intermediate private key to perform a digital signature operation on the public key of the edge certificate node to generate an edge node certificate, and ensures that the edge device can be securely accessed and identified by other platforms through a multi-level certificate chain trust transfer mechanism.

[0051] In practice, the edge certificate node first sends a certificate request to its intermediate certificate node. This request contains key information such as the edge node's public key, unique device identifier, platform, and required security level. Upon receiving the request, the intermediate certificate node analyzes the security requirements of the edge device and the platform's computing power based on the dynamic security level indicators defined in step S1, selecting appropriate signature algorithm parameters and key length. For example, in low-power edge device scenarios with limited computing power, the intermediate certificate node can choose a low-complexity signature algorithm and a shorter key length to reduce computational overhead; in highly security-sensitive scenarios, a stronger signature algorithm and longer key parameters are used to ensure communication security and resistance to attacks.

[0052] After the security parameters are determined, the intermediate certificate node uses its private key to sign the edge node's public key, generating a unique edge node certificate. This certificate includes core fields such as the edge node's public key, device identifier, associated intermediate node information, certificate validity period, issuance time, and security level, all bound together by the signature result to ensure its integrity and immutability. The generated edge node certificate is returned to the corresponding edge device, which can store it in its local secure storage area for subsequent authentication and secure session establishment during cross-platform communication.

[0053] After edge node certificates are generated, any device or terminal can authenticate itself during cross-platform interaction using the root certificate authority's master public key, intermediate node certificates, and edge node certificates. The authentication process typically includes verifying the legitimacy of the intermediate node certificate chain, confirming the validity of the edge node signature, and checking the match between certificate validity and security level. When authentication succeeds, the two parties in the cross-platform communication establish a trust relationship, thereby enabling secure data exchange. If authentication fails, the edge node is denied access, preventing unauthorized or malicious devices from entering the system communication link.

[0054] Through this step, the system establishes a secure trust transfer mechanism between intermediate certificate nodes and edge nodes, achieving cross-platform, multi-level, highly reliable device identity authentication. Because the authentication process relies on the collaborative work of a three-layer certificate chain—root certificate center, intermediate certificate nodes, and edge certificate nodes—it effectively avoids problems such as access conflicts, authentication delays, and authentication failures caused by inconsistent multi-platform policies in traditional authentication methods. This enhances the system's security, scalability, and interoperability in large-scale vehicle-to-everything (V2X) and power load management scenarios.

[0055] In step S4, after completing the identity authentication of the root certificate center, intermediate certificate nodes, and edge certificate nodes, the first platform (vehicle networking platform) and the second platform (power load management system) begin to establish a cross-platform secure communication connection. During this process, this embodiment introduces an adaptive session key security negotiation mechanism. Through a dynamic parameter selection strategy, it automatically determines the optimal session key length and certificate chain depth based on device computing power, network bandwidth, and security level requirements, thereby achieving a balance between security and performance and ensuring that devices with different computing power platforms and different security requirements can efficiently access the system.

[0056] During the session key negotiation initialization phase, the first platform uses the dynamic security level indicator generated in step S1 to obtain the current terminal device's computing power, communication bandwidth status, and application service security requirements in real time. The dynamic security level indicator predefines the corresponding session key length range for different security modes. For example, low security mode corresponds to a 192-bit key, medium security mode corresponds to a 256-bit key, and high security mode can be configured to a 384-bit key or longer. The system automatically selects the optimal parameters based on the terminal's computing power and network performance, prioritizing reducing computational complexity on edge devices with limited computing power, while prioritizing increasing key strength and certificate chain integrity in high-security scenarios, thus balancing performance and security.

[0057] After determining the session key parameters, the first platform generates a one-time session key based on the selected security level. The session key generation relies on the random number generation mechanism of the SM2 algorithm, ensuring the key's uniqueness and unpredictability in each negotiation, thereby preventing replay attacks and key leakage risks. Subsequently, the first platform uses the second platform's public key to encrypt the generated session key using SM2, forming an encrypted session key data packet. SM2 is based on elliptic curve public-key cryptography, and its high security and low computational complexity make it highly adaptable to in-vehicle terminals and low-power edge devices.

[0058] The first platform sends the encrypted session key to the second platform via a secure communication channel. Upon receiving the encrypted data, the second platform uses its private key to perform SM2 decryption, recovers the original session key, and synchronizes the session parameters. At this point, both the first and second platforms possess the same one-time session key. All subsequent cross-platform communication can be based on this key for symmetric encryption and data signing, thereby significantly improving data transmission efficiency while ensuring security.

[0059] Through the adaptive session key security negotiation mechanism in this embodiment, the system dynamically adjusts the session key length and certificate chain depth according to different device environments and security requirements during cross-platform communication, achieving multi-level security level control. Compared with traditional fixed key length schemes, this embodiment effectively solves the problem of excessive computational latency on low-computing-power devices, while maintaining sufficient encryption strength and authentication integrity in high-security business scenarios, thus balancing security, real-time performance, and resource utilization, achieving efficient and secure key distribution across platforms.

[0060] In step S5, after the first platform (vehicle network platform) and the second platform (power load management system) complete session key negotiation and establish a secure communication channel, the first platform needs to select an appropriate digital signature algorithm strength according to the dynamic security level index set in step S1 before sending business data, to ensure the credibility and integrity of the data source. The dynamic security level index predefines multiple security modes based on different application scenarios and security requirements. Different modes correspond to different signature algorithm parameters and key lengths. For example, in a low security level mode, a shorter SM2 signature key can be selected to reduce computational overhead; while in a high security level mode, a longer SM2 signature key is selected and high-strength hash parameters are enabled to improve anti-attack capability and tamper resistance.

[0061] In its implementation, after determining the signature algorithm parameters, the first platform calls the SM2 digital signature algorithm to sign the data to be transmitted. During the signing process, a digest value (`digest`) is first calculated on the original data `m`. This digest calculation can be based on the national cryptographic SM3 hash algorithm to ensure the uniqueness and collision resistance of the digest. Then, the first platform uses its locally securely stored private key `sk_A` to perform a signature operation on the digest, generating a digital signature value `sig`. The generated `sig` and the original data `m` are packaged together for subsequent encryption and transmission. In this step, the purpose of the signature is to ensure the non-repudiation and integrity verification of the data during transmission.

[0062] After the digital signature is completed, the first platform uses the second platform's public key pk_B to encrypt the data m and the signature value sig. Encryption employs the SM2 public-key cryptography algorithm, encapsulating the data and signature together into encrypted ciphertext c. SM2 is based on elliptic curve public-key cryptography, offering high security and low computational overhead, enabling efficient operation in vehicle-mounted terminal devices with limited computing power. By encrypting the data and signature together, confidentiality is ensured during cross-platform transmission, preventing data from being stolen or tampered with by a man-in-the-middle.

[0063] After receiving the ciphertext 'c' sent by the first platform, the second platform first performs an SM2 decryption operation on the ciphertext using its own private key sk_B to recover the original data 'm' and the digital signature 'sig'. Subsequently, the second platform verifies the signature 'sig' using the first platform's public key pk_A. The verification process includes recalculating the digest ' of data 'm' using the same hash algorithm and comparing the digest with 'sig' using the SM2 signature verification algorithm. When the verification result is true, it indicates that the data has not been tampered with during transmission and is confirmed to have been issued by the first platform; if the verification fails, the system immediately rejects the data packet and issues a security alarm.

[0064] Through this step, the first and second platforms achieve dual security guarantees of data encryption, signing, and verification in cross-platform communication. Digital signatures ensure the authenticity and integrity of the data source, while encryption ensures the confidentiality of the data content. Since both the signature and encryption algorithms are selected based on dynamic security level indicators, the system can reduce computational complexity on low-power devices while providing stronger protection in high-security scenarios. This effectively resists man-in-the-middle attacks, data tampering, and forged requests, significantly improving the trustworthiness and security of cross-platform data transmission.

[0065] In step S6, after the first platform (vehicle networking platform) and the second platform (power load management system) complete the session key negotiation, both parties share the same set of secure session keys. This key is used for subsequent encryption and decryption of business data. During actual data communication, when the first platform is preparing to send business data to the second platform, it will automatically select appropriate symmetric encryption algorithm parameters and key length according to the dynamic security level indicators set in step S1, to ensure an optimal balance between security and computational performance in different application scenarios.

[0066] In this embodiment, symmetric encryption is based on a session key, and the algorithm can adopt the national standard SM4 encryption. The SM4 algorithm has high security and efficiency, and is suitable for resource-constrained vehicle terminals and edge devices. In low-security mode, the first platform can select a lower number of encryption rounds and a shorter key length to reduce encryption computational complexity and adapt to low-power, low-computing-power devices. In medium-security mode, the system automatically configures a standardized key length and a complete number of rounds to meet the security requirements of regular data communication. In high-security mode, the first platform will use high-strength encryption parameters, such as a higher number of rounds and a complete key length, to ensure the highest security level of sensitive business data during transmission.

[0067] After determining the encryption parameters, the first platform performs symmetric encryption on the original data *m* using the negotiated session key, generating encrypted ciphertext *c*. This encryption process includes round function calculation, key expansion, data grouping, and obfuscation operations. Through multiple rounds of key-driven substitution and permutation processes, the ciphertext is ensured to be highly unpredictable from the original data, thereby achieving data confidentiality and tamper-proofness. The generated ciphertext *c* is transmitted to the second platform via a secure communication link.

[0068] After receiving the encrypted ciphertext c, the second platform uses the session key to perform a symmetric decryption operation, gradually recovering the original data m according to the same encryption algorithm and round function sequence. During the decryption process, the system automatically verifies data integrity, for example, by comparing the transmitted checksum or adding a digest verification mechanism at the application layer, to ensure that the restored data has not been tampered with or destroyed during transmission. When both decryption and integrity verification are successful, the second platform obtains data consistent with that sent by the first platform.

[0069] By introducing dynamic security level indicators during encryption and decryption, this embodiment can dynamically adjust the computational complexity and security strength of the encryption algorithm according to different business needs and device computing power. In low-power edge devices, the amount of encryption computation can be reduced to improve energy efficiency; in high-security scenarios, high-strength parameter combinations are prioritized to enhance data protection capabilities. This adaptive encryption mechanism not only ensures the confidentiality, integrity, and availability of data transmission across platforms, but also significantly improves communication efficiency and system adaptability in resource-constrained IoT, IoV, and power system environments.

[0070] In step S7, throughout the entire process of cross-platform identity authentication and data transmission, including certificate issuance, certificate verification, and session key negotiation, this embodiment adaptively adjusts key security parameters through a dynamic security policy management mechanism to achieve a balance between performance and security in different application scenarios. This mechanism is based on the dynamic security level indicators preset in step S1, and combines the current platform's computing power, communication bandwidth status, link stability, and business security requirements to adjust the certificate chain depth. Signature algorithm strength and session key length Dynamic optimization configuration is performed, and elliptic curve optimization technology based on national cryptographic algorithms is introduced at the protocol layer to reduce overall computational overhead and ensure high-performance operation in resource-constrained environments.

[0071] In applications with low computing power or at the edge, dynamic security policies automatically reduce security parameter configurations based on real-time computing power information. For example, when the CPU computing power or memory resources of the edge device are limited, the system reduces the signature verification layers in the certificate chain, retaining only the intermediate node signature verification steps, instead of performing a complete full-chain signature verification. The core of this strategy is to avoid the high computational overhead of the terminal performing signature verification on both the root certificate and the edge certificate simultaneously, thereby effectively reducing the computational pressure on the device and ensuring that it can complete the authentication process and achieve normal communication under limited hardware resources.

[0072] In high-security scenarios, dynamic security policies prioritize increasing encryption strength and enabling full-chain signature authentication. The system automatically switches to high-security mode based on business needs, requiring verification of the complete certificate chain during authentication, including signatures from the root certificate center, intermediate certificate nodes, and edge nodes. Simultaneously, during session key negotiation, the system selects a stronger key length and uses higher-security signature algorithm parameters to ensure the confidentiality, integrity, and attack resistance of sensitive data during transmission. This mode switching ensures the highest level of security for cross-platform communication in high-risk applications such as vehicle-to-everything (V2X) charging control and grid dispatch command issuance.

[0073] In practical applications, the system first obtains a set of environmental parameters, including computing power margin, by monitoring the platform's real-time computing power, available bandwidth, business risk level, and link jitter status. Bandwidth margin Safety risk level and link jitter All normalized to The range. Based on these parameters, the dynamic security policy management module first generates candidate parameters. It then determines whether the current configuration meets the security requirements by calculating the minimum sufficient security constraints.

[0074] To prevent performance waste caused by excessively increasing security parameters in low-computing-power, low-risk scenarios, and insufficient security levels in high-risk scenarios, this embodiment defines minimum sufficient security constraints. :

[0075] in, This represents the maximum signature strength level supported by the system. This serves as a baseline value for the session key length. As a safety baseline threshold, This is the jitter sensitivity coefficient. When the calculation result... When this happens, the system will prioritize them. , , until satisfied Or it may reach the upper limit of resource constraints. Through this constraint, this embodiment can prioritize shorter keys and shallower certificate chains in low computing power environments, thereby reducing computational complexity, while in high-risk communication scenarios, it automatically enables full-chain signature verification and high-strength session keys to ensure the security of cross-platform communication.

[0076] Furthermore, in the process of session key distribution and signature verification, this embodiment introduces elliptic curve optimization technology based on the Chinese national cryptographic algorithm at the protocol layer. The Chinese national cryptographic algorithm SM2 is based on the elliptic curve public-key cryptosystem, and its security and computational efficiency are highly correlated with the curve parameters. By optimizing the selection of elliptic curve parameters, dot product operations, and modular inversion algorithms in the protocol implementation, the computational complexity of key generation, signing, and verification can be significantly reduced. For example, by selecting an efficient elliptic curve parameter set suitable for low-computing-power devices, the number of dot product operations can be reduced while ensuring security, thereby improving the processing speed of low-power terminals. At the same time, in high-security mode, the system can still enable larger key lengths and high-security curve parameters to achieve a balance between security level and computational performance.

[0077] In practical applications, after satisfying security constraints, the system enters the national standard elliptic curve optimization stage. Since the national standard SM2 algorithm is based on the elliptic curve public-key cryptosystem, its security and computational efficiency are highly correlated with the curve parameters. Therefore, this embodiment defines an elliptic curve performance index. Quantitative selection is performed among multiple candidate curve parameter sets:

[0078] in, The subgroup order bit length of the candidate curve. Remainder factor, Indicates side-channel susceptibility. This represents the unit signature / verification latency under current hardware and algorithm implementation conditions. Time-sensitive weights are used. The system satisfies minimum security constraints. Under the premise of calculating the performance index of all candidate curves , and select Largest set of curve parameters As the final operating parameters, this achieves an optimal trade-off between security, resistance to side-channel attacks, and computational performance.

[0079] Through the collaborative work of dynamic security strategy management and elliptic curve optimization, this embodiment achieves the following functions: In scenarios with low computing power or edge nodes, the system automatically reduces the certificate chain depth, retaining only intermediate node signature verification, reducing signature computation, and lowering device power consumption and latency; in high-security scenarios, the system automatically increases signature algorithm strength and session key length, and enables full-chain signature authentication to ensure the communication security of high-value sensitive data; simultaneously, based on The dynamic curve parameter selection technology performs computational optimization at the protocol layer, which significantly reduces the execution overhead of SM2 signature and verification operations.

[0080] Through this embodiment, the system can dynamically select the optimal combination of security parameters under different computing resource conditions, business security requirements, and communication environments, achieving a balance between performance and security. Ultimately, in cross-platform collaboration scenarios such as vehicle-to-everything (V2X) platforms and power load management systems, this method not only ensures high security for identity authentication and data transmission but also achieves lightweight, high-efficiency real-time communication capabilities, significantly improving the system's scalability and adaptability.

[0081] The above description is only a preferred embodiment of the present invention. Therefore, all equivalent changes or modifications made to the structure, features and principles described in the claims of this patent application are included in the scope of this patent application.

Claims

1. A cross-platform identity recognition method based on a lightweight national cryptographic certificate chain, characterized in that: Includes the following steps: Step 1: Construct dynamic security level indicators, and generate the root certificate center master key pair, intermediate certificate node key pair, and edge certificate node key pair respectively using the national cryptographic algorithm according to the indicators; Step 2: The root certificate authority uses its master private key to sign the public key of the intermediate certificate node to generate an intermediate node certificate, and uses the root certificate authority's master public key to verify the validity of the intermediate node certificate; if the verification is valid, the intermediate certificate node is recognized as a legitimate and trusted node, and has the authority to issue certificates to its subordinate edge certificate nodes. If the verification fails, the trust relationship for the intermediate node will not be established. Step 3: The intermediate certificate node uses its intermediate private key to sign the edge certificate node's public key to generate an edge certificate, and uses the root certificate center's master public key, the intermediate certificate, and the edge certificate to complete the authentication of the edge certificate node; when the authentication is successful, the two parties in the cross-platform communication establish a trust relationship; If the verification fails, the edge node is denied access. Step 4: When the first platform establishes cross-platform communication with the second platform, the certificate chain depth, signature strength and session key length are selected according to the dynamic security level indicators. The first platform generates a session key and encrypts it with the public key of the second platform according to the national cryptographic algorithm and sends it to the second platform. The second platform uses its private key to decrypt and obtain the session key. Step 5: The first platform uses its own private key to digitally sign the data to be transmitted, and uses the second platform's public key to encrypt the data and signature before sending them to the second platform. The second platform uses its private key to decrypt the data and uses the first platform's public key to verify the validity of the signature. Step 6: During the certificate issuance, certificate verification, and session key negotiation processes, the certificate chain depth, signature strength, and session key length are adaptively adjusted based on the dynamic security level index.

2. The cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described in claim 1, characterized in that: Step 1 further includes: When the method is started, the root certificate authority generates system public parameters based on the system's preset security parameters λ. The system public parameters include the equation of the elliptic curve, its base points, and its order. During the generation of the system's public parameters, a dynamic security level indicator is introduced. This dynamic security level indicator predefines multiple encryption strength modes, each of which corresponds to a different key length and signature algorithm. Based on the dynamic security level indicators, the root certificate center generates the root certificate center master key pair, intermediate certificate node key pair, and edge certificate node key pair respectively using the national cryptographic SM2 algorithm.

3. The cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described in claim 1, characterized in that: Step 2 further includes: After the dynamic certificate chain is generated, the intermediate certificate nodes submit a certificate application request containing the public key to the root certificate authority. The root certificate authority selects signature algorithm parameters based on dynamic security level indicators and uses its master private key to digitally sign the public key of the intermediate certificate node to generate an intermediate node certificate. The integrity of the intermediate node certificate is guaranteed by the signature result and is registered in the system certificate chain; The intermediate node certificate is verified using the root certificate center's master public key. If the verification is successful, it is confirmed that the intermediate node has the authority to issue certificates to lower-level edge certificate nodes. The digital signature uses the SM3 hash algorithm to generate a data digest and is signed using the SM2 private key; the encryption uses the SM4 symmetric algorithm to encrypt the business data, forming an encrypted data packet, and then performs secondary encryption on the data packet using the recipient's public key.

4. The cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described in claim 1, characterized in that: Step 3 further includes: After the intermediate certificate node completes identity authentication, the edge certificate node submits a certificate application request containing the public key to the intermediate certificate node; The intermediate certificate node determines the signature algorithm parameters and key length according to the dynamic security level index, and uses its intermediate private key to digitally sign the edge node public key to generate an edge node certificate. The edge node certificate is returned to the edge device, and its integrity is guaranteed by the signature result; Establish a multi-level certificate chain verification mechanism to verify the validity of certificates of the root certificate center, intermediate certificate nodes and edge certificate nodes at each level during data transmission, so as to ensure the trustworthiness of the identity of each node in the transmission link.

5. The cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described in claim 1, characterized in that: Step 4 further includes: After completing the identity authentication of the root certificate center, intermediate certificate nodes and edge certificate nodes, the first platform establishes a cross-platform communication connection with the second platform; The first platform determines the session key length and certificate chain depth based on dynamic security level indicators, and generates a one-time session key; The first platform uses the public key of the second platform to encrypt the session key using the SM2 algorithm and then sends it to the second platform; The second platform uses its private key to decrypt the encrypted data using SM2 and recover the session key to achieve secure cross-platform communication. After the session key is generated, the first platform uses the SM4 algorithm to encrypt the business data to generate a ciphertext data block, and uses the public key of the second platform to encrypt the session key using the SM2 algorithm to form a digital envelope; during data transmission, the ciphertext data block and the digital envelope are sent to the receiver simultaneously.

6. The cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described in claim 1, characterized in that: Step 5 further includes: After the first platform and the second platform complete the session key negotiation and establish a secure communication channel, the first platform selects the signature algorithm parameters according to the dynamic security level index and uses its own private key to generate a digital signature for the data to be transmitted. The first platform uses the public key of the second platform to encrypt the data and the signature using SM2, forming ciphertext, and sends it to the second platform; The second platform uses its private key to decrypt the ciphertext, recover the data and the signature, and uses the first platform's public key to verify the signature.

7. The cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described in claim 1, characterized in that: Step 6 further includes: After the first platform and the second platform complete the session key negotiation, both parties share the session key; The first platform determines the symmetric encryption algorithm parameters and key length based on the dynamic security level index, and uses the session key to perform symmetric encryption on the business data, generating ciphertext and sending it to the second platform; The second platform uses the session key to perform symmetric decryption of the ciphertext, recover the original data, and performs integrity verification on the decryption result to ensure the security of cross-platform data transmission.

8. The cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described in claim 1, characterized in that: During the certificate issuance, verification, and session key negotiation processes, the certificate chain depth, signature algorithm strength, and session key length are dynamically adjusted based on dynamic security level indicators. The method defines minimum sufficient safety constraints. : ,in Indicates the degree of security risk. Indicates link jitter. Indicates the depth of the certificate chain. Indicates signature strength. Indicates the session key length, when If ≥0, it is considered that the safety requirements are met. If <0, then increase sequentially. Until the conditions are met; An elliptic curve optimization mechanism based on the national cryptographic SM2 algorithm is introduced at the protocol layer, based on performance index. The parameter set of the candidate curve is calculated and the parameter set with the largest performance index is selected as the running parameters to reduce computational complexity and ensure safety.

9. The cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described in claim 8, characterized in that: The Minimum sufficient safety constraints for: in, This represents the maximum signature strength level supported by the system. This serves as a baseline value for the session key length. As a safety baseline threshold, This represents the jitter sensitivity coefficient.

10. The cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described in claim 1, characterized in that: The Elliptic curve performance index The quantitative selection of the best candidate curve among multiple candidate curve parameter sets is expressed as follows: in, The subgroup order bit length of the candidate curve. Remainder factor, Indicates side-channel susceptibility. This represents the unit signature / verification latency under current hardware and algorithm implementation conditions. Time-sensitive weights.

11. An apparatus for implementing the cross-platform identity recognition method based on a lightweight national cryptographic certificate chain as described in any one of claims 1 to 10, characterized in that, The device includes: The certificate management module is used to generate key pairs for the root certificate center, intermediate certificate nodes, and edge certificate nodes based on security parameters and dynamic security level indicators, and to complete the issuance and verification of certificates. The session negotiation module is used to select the certificate chain depth, signature strength and session key length according to the dynamic security level index when establishing a communication connection between the first platform and the second platform, and to complete the generation, encryption and distribution of the session key; The data security module is used to encrypt and transmit business data between the first platform and the second platform based on the session key, and to complete the data trustworthiness verification through signing and decryption.

12. A readable storage medium, characterized in that, It contains an executable program, which, when executed, implements the apparatus for cross-platform identity mutual recognition method based on lightweight national cryptographic certificate chain as described in any one of claims 1 to 10.

Images