A two-way authentication method and system based on ECC algorithm

Abstract

This invention provides a two-way authentication method and system based on the ECC algorithm. Belonging to the field of network security technology, this method involves initial authentication between the client and server based on a message authentication code to ensure the integrity of transmitted certificates and random numbers. Subsequently, both parties independently generate identical session keys using each other's certificate information and their own private keys, based on elliptic curve cryptography. Mutual authentication is completed by comparing key consistency, and finally, authentication success messages are exchanged. This scheme effectively prevents man-in-the-middle attacks and data tampering, enhancing identity authenticity and communication security. Simultaneously, it utilizes the ECC algorithm to achieve high-strength protection with short keys, reducing computational overhead and improving authentication efficiency.

Description

Technical Field

[0001] This invention belongs to the field of network security technology and relates to a two-way authentication method and system based on the ECC algorithm. Background Technology

[0002] With the rapid development of network communication technology, secure interaction between users and servers has become a core element in ensuring information system security. Existing technologies widely employ protocols such as TLS / SSL for authentication and key exchange, typically using RSA or ECC algorithms for encrypted transmission. Among these, elliptic curve cryptography (ECC)-based key exchange mechanisms are increasingly popular due to their shorter key length and higher security. Typical implementations include client and server exchanging certificates, generating random numbers, negotiating a shared key using the ECDH algorithm, and combining this with digital signatures for authentication.

[0003] However, traditional authentication mechanisms still have security vulnerabilities in practical applications: on the one hand, the initial communication phase lacks effective protection for the integrity of certificates and random numbers, making them susceptible to man-in-the-middle attacks or data tampering; on the other hand, one-way authentication cannot ensure the authenticity of both parties' identities, potentially leading to server impersonation or unauthorized client access. Furthermore, some solutions rely on complex Public Key Infrastructure (PKI) support, increasing system deployment costs and computational overhead. Therefore, there is an urgent need for a lightweight, efficient, and strongly mutually recognized two-way authentication method to improve the credibility of the identities and data security of both communicating parties. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a two-way authentication method and system based on the ECC algorithm to solve the problems that may exist in the traditional authentication methods in the prior art, such as passwords being easily cracked and verification codes being easily bypassed.

[0005] To achieve the above objectives, the present invention employs the following technical solution: A two-way authentication method based on the ECC algorithm includes the following steps: The client interacts with the server to perform initial authentication; Both parties use each other's certificate information and their own private key to independently generate a shared session key based on elliptic curve cryptography; by verifying whether the independently generated shared session keys are consistent, the server-side authentication of the client and the client-side authentication of the server are completed. Both parties send a message indicating successful authentication.

[0006] A further improvement of the present invention is that: Preferably, the initial authentication is based on the message authentication code to authenticate the transmitted certificate and random number.

[0007] Preferably, the initial authentication process includes the following steps: The client sends a first authentication message to the server, the first authentication message containing at least the client certificate. First random number and verification code ; Server-side comparison authentication code and verification code If the comparison matches, the verification passes; otherwise, the authentication is terminated.

[0008] Preferably, the authentication code For the client to generate random numbers Client Certificate and client identity Perform MAC operations and use a shared key Obtained through encryption; The authentication code For the server to receive the client certificate Client identity and the first random number Perform MAC operations and use a shared key Obtained through encryption.

[0009] Preferably, before the initial authentication, the client sends a communication request, client cipher suite, and client identity to the end. The server stores and receives the client cipher suite and client identity sent by the client, and sends a server communication request, server cipher suite, and server identity to the client.

[0010] Preferably, both parties independently generate a shared session key using each other's certificate information and their own private key, based on elliptic curve cryptography. The process of server-side authentication of the client and client-side authentication of the server is completed by verifying whether the independently generated shared session keys are consistent. Based on client certificates, the server uses elliptic curve cryptography to generate the interaction key. and combined with random numbers MAC operations are performed using the server certificate and server identity, combined with the shared key. Generate verification code The interaction key, server certificate, and random number will be used. and verification code Send it to the client together; The client receives the server certificate, interaction key, and random number. Perform MAC operations, combined with the shared key. Encryption-generated verification code ,Compare and If the authentication process is successful, continue; otherwise, exit the authentication process. Based on the server certificate, the client generates the interaction key using elliptic curve cryptography. Compare interactive keys and the received interaction key The received interaction key The interaction key generated by the server and received by the client. If the server verifies the authentication, the authentication process will be terminated; otherwise, the authentication will be terminated.

[0011] Preferably, the server uses elliptic curve cryptography to generate the interaction key. The process is as follows: perform a hash operation on the client certificate to obtain the client's public key. Based on client public key Generate key ; The client uses elliptic curve cryptography to generate the interaction key. The process involves hashing the server certificate to obtain the server's public key. Based on the server public key generate .

[0012] A two-way authentication device based on the ECC algorithm includes: The initial authentication unit is used for initial authentication between the client and the server. The ECC authentication unit is used by both parties to independently generate a shared session key based on elliptic curve cryptography, using each other's certificate information and their own private key. By verifying whether the independently generated shared session keys are consistent, the server-side authentication of the client and the client-side authentication of the server are completed. The authentication confirmation unit is used by both parties to send an authentication success message.

[0013] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when executing the computer program, implements a two-way authentication method based on the ECC algorithm as described in any of the preceding claims.

[0014] A computer-readable storage medium storing a computer program that, when executed by a processor, implements a two-way authentication method based on an ECC algorithm as described in any of the preceding claims.

[0015] Compared with the prior art, the present invention has the following beneficial effects: This application provides a two-way authentication method based on the ECC algorithm. Since the client and server verify the integrity and authenticity of the transmitted data through the MAC mechanism in the initial stage, and independently generate a shared session key based on the ECC algorithm in the core authentication stage and complete two-way identity authentication through consistency comparison, it solves the problems of identity being easily impersonated and communication data being easily tampered with in traditional authentication, and improves the system's anti-attack capability and security. At the same time, the ECC algorithm has the advantages of short key and fast operation, which reduces the consumption of computing resources in the encryption and decryption process and improves authentication efficiency. Attached Figure Description

[0016] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0017] Hereinafter, the terms "first," "second," "third," and "fourth" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first," "second," "third," or "fourth" may explicitly or implicitly include one or more of that feature.

[0018] The synchronization method provided in this application can be applied to mobile phones, tablets, wearable devices, in-vehicle devices, augmented reality (AR) / virtual reality (VR) devices, laptops, and ultra-mobile personal computers. In this application, the specific type of terminal device is not limited to terminal devices such as mobile personal computers (UMPCs), netbooks, and personal digital assistants (PDAs).

[0019] It should be noted that the terms "first," "second," etc., used in the specification and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0020] The first aspect of this invention discloses a two-way authentication method based on the ECC algorithm, comprising the following steps: S1, the client interacts with the server to perform initial authentication; S2, both parties use each other's certificate information and their own private keys to independently generate a shared session key based on elliptic curve cryptography; by verifying whether the independently generated shared session keys are consistent, the server-side authentication of the client and the client-side authentication of the server are completed. S3, both parties send an authentication success message.

[0021] In step S1 of this invention, a preliminary identity verification mechanism is established before communication to prevent unauthorized entities from accessing the subsequent key negotiation process. The initial authentication process is achieved by exchanging digital certificates, random numbers, and a Message Authentication Code (MAC) based on a shared key. This mechanism effectively defends against message forgery and replay attacks because a fresh random number is introduced with each authentication. This ensures the uniqueness of each session.

[0022] In S2 of this invention, based on the Elliptic Curve Diffie-Hellman (ECDH) key exchange principle, a highly secure session key negotiation is achieved without requiring the transmission of the key itself. After initial authentication, the server parses the client certificate. Extract the public key parameter and combine it with your own private key. Calculate the shared session key ,in From The client's public key point is derived from the server certificate. Similarly, the client uses the server certificate. Extract server public key and using its own private key calculate Due to the mathematical properties of elliptic curve scalar multiplication, when both parties use the same elliptic curve parameters and base points... In theory, the same shared key should be generated at that time. Since the shared key is never transmitted over the network and consensus is reached solely through independent computation, the risk of key interception is fundamentally eliminated. Furthermore, combining it with certificate-bound public keys avoids the man-in-the-middle attack vulnerability inherent in anonymous ECDH.

[0023] This step formally declares the completion of two-way authentication. After successful key consistency verification, the client sends a "finished" message to the server, indicating that the entire authentication process has been completed. Upon receiving this message, the server replies with a corresponding "finished" response, marking the end of the entire two-way authentication process. This message may contain a digest checksum (such as a PRF output) to verify the integrity of all previous handshake messages, further enhancing tamper resistance.

[0024] Through the above-described steps, this application implements an efficient and secure two-way authentication mechanism based on elliptic curve cryptography. By employing the ESS key exchange concept, both communicating parties can independently generate identical session keys without directly transmitting sensitive information, solving the technical challenges of key exposure and identity forgery in traditional authentication. Combined with MAC authentication and random number challenges in the initial stage, it effectively prevents replay attacks and message tampering. Furthermore, by closing the entire process through the final authentication confirmation message, the robustness and reliability of the system are improved. Therefore, this application not only enhances the credibility of identity in network communication but also significantly reduces computational overhead, making it suitable for various high-security scenarios such as the Internet of Vehicles, the Industrial Internet, and telemedicine.

[0025] In some embodiments of the present invention, the initial authentication is performed on the transmitted certificate and random number based on a message authentication code. The message authentication code is a cryptographic hash function output based on a symmetric key, the generation of which depends on the input data and a pre-shared secret key. In this embodiment, the MAC operation is applied to the concatenated data block. This involves concatenating the client certificate, client identity, and a random number generated in the current session to generate a fixed-length authentication tag. This tag is sent to the server along with the original data as proof of its integrity and authenticity.

[0026] Among them, client certificates It is a digital certificate issued by a trusted third-party certification authority, containing the client's public key and related identity information, used for public key extraction during subsequent ECC key negotiation; client identity It is a string or code that can uniquely identify the user, such as username, device ID, etc.; the first random number This is a one-time-use random value, typically generated by a cryptographically secure pseudo-random number generator (CSPRNG) to prevent replay attacks and ensure the uniqueness of each authentication process. Shared key It is a symmetric key that is pre-set during the system initialization phase or distributed through a secure channel, and is only jointly held by legitimate clients and servers.

[0027] In some embodiments of the present invention, the initial authentication process includes the following steps: The client sends a first authentication message to the server, the first authentication message containing at least the client certificate. First random number and verification code ; Server-side comparison authentication code and verification code If the comparison matches, the verification passes; otherwise, the authentication is terminated.

[0028] The first random number is a one-time random value generated by the client, typically a high-entropy bit string, the length of which can be set according to security requirements (e.g., 128 bits, 256 bits). Its main function is to prevent attackers from gaining unauthorized access by replaying historical communication data. It can be generated by a cryptographically secure pseudo-random number generator (CSPRNG) and used uniquely in a single session.

[0029] In some embodiments of the present invention, the authentication code For the client to generate random numbers Client Certificate and client identity Perform MAC operations and use a shared key Encryption processing The authentication code For the server to receive the client certificate Client identity and the first random number Perform MAC operations and use a shared key Obtained through encryption.

[0030] The authentication code The process of obtaining the authentication code is as follows: The server first parses the client certificate copy, client identity identifier and first random number from the first authentication message, and then performs MAC calculation to obtain the local authentication code.

[0031] This invention implements an automated verification mechanism for the authenticity of client identities by the server. By employing a MAC comparison logic based on a shared key, it solves the problem of lacking two-way trust support in traditional single-factor authentication, avoiding the risk of impersonation based solely on credentials. Simultaneously, combined with a random number challenge mechanism, it effectively defends against common network layer replay attacks and man-in-the-middle forgery, thus significantly improving the overall security strength of the initial authentication phase.

[0032] In some embodiments of the present invention, prior to the initial authentication, the client sends a communication request, a client cipher suite, and the client identity to the server; The server stores and receives the client cipher suite and client identity sent by the client, and sends a server communication request, server cipher suite, and server identity to the client.

[0033] The communication request is used to trigger the handshake process, indicating that the client intends to establish a secure session. The client cipher suite is an ordered list of cryptographic components, which typically includes key exchange algorithms (such as ECDHE), authentication algorithms (such as ECDSA), symmetric encryption algorithms (such as AES-128-GCM), and hash algorithms (such as SHA-256), to express the range of security capabilities supported by the client. The client identity is in the form of a username, device ID, or certificate identifier, which is used by the server for access control judgment or user tracking.

[0034] In some embodiments of the present invention, the two parties independently generate a shared session key based on elliptic curve cryptography using each other's certificate information and their own private key; the process of server-side authentication of the client and client-side authentication of the server is completed by verifying whether the independently generated shared session keys are consistent. S21, based on the client certificate, the server uses elliptic curve cryptography to generate the interaction key. and combined with random numbers MAC operations are performed using the server certificate and server identity, combined with the shared key. Generate verification code The interaction key, server certificate, and random number will be used. and verification code Send it to the client together; S22, the client receives the server certificate, interaction key, and random number. Perform MAC operations, combined with the shared key. Encryption-generated verification code ,Compare and If the authentication process is successful, continue; otherwise, exit the authentication process. S23, based on the server certificate, the client uses elliptic curve cryptography to generate the interaction key. Compare interactive keys and the received interaction key The received interaction key The interaction key generated by the server and received by the client. If the server approves the authentication, the authentication process will be terminated; otherwise, the authentication will be terminated.

[0035] Specifically, in S21, the server first checks the client certificate... Perform hash operations to generate intermediate values This leads to the deduction of the client's public key. ,in, These are the registration parameters; subsequently, the server performs a dot product operation between its private key and the client's public key to generate an interaction key. ,in For the server's private key, For the client's private key, As a base point generator, this process establishes the basis for symmetrically generating the same key as the client side; the server generates random numbers. Regarding one's own certificate , and Perform MAC operations and use a shared key Encryption generation Server sends , , and To the client (User); the MAC algorithm can adopt standard schemes such as HMAC-SHA256, using a pre-shared key K as the key source to generate a fixed-length authentication tag. The "||" symbol here indicates a data concatenation operation. The purpose of this MAC value is to ensure the integrity and authenticity of subsequently transmitted data, preventing man-in-the-middle tampering or forgery of responses.

[0036] In S22, after receiving the response message from the server, the client parses out the server certificate, interaction key, and random number. The client then uses the locally stored shared key K to recalculate the authentication code using the same MAC algorithm as the server. The regenerated authentication code is then compared with the received authentication code. If they match perfectly, it indicates that the message sent by the server has not been tampered with and that the server possesses the correct shared key K, thus initially proving its legitimacy. This step effectively defends against attacks such as message tampering, man-in-the-middle injection, and certificate replacement. This MAC verification occurs before the client's local key regeneration, constituting a "prior integrity check" mechanism to avoid performing subsequent high-cost cryptographic operations on untrusted data. Only after passing this verification will the client proceed to the next step of the key consistency comparison process.

[0037] In S23, the client uses the locally calculated interaction key. Interaction key received from server message Perform a bit-by-bit comparison. If they match, it means the server does indeed possess the private key corresponding to its certificate. This completes the authentication of the server. This "local regeneration + comparison" mechanism does not rely on real-time verification by a third-party certificate authority, has offline verifiability, and avoids the risk of directly exposing long-term private keys.

[0038] This process requires not only that both communicating parties be able to decrypt or sign, but also that they be able to independently derive the same shared key based on the other party's public key information, thereby proving that they possess the corresponding private key. This design significantly enhances the security strength of identity authentication, and is particularly suitable for resource-constrained but security-critical scenarios such as the Internet of Things and edge computing.

[0039] In some embodiments of the present invention, the server uses elliptic curve cryptography to generate the interaction key. The process is as follows: perform a hash operation on the client certificate to obtain the client's public key. Based on client public key Generate key ; The client uses elliptic curve cryptography to generate the interaction key. The process involves hashing the server certificate to obtain the server's public key. Based on the server public key generate .

[0040] The method of the present invention will be described below with reference to a specific embodiment.

[0041] This invention discloses a two-way authentication method based on the ECC algorithm, comprising the following steps: (1) Client User sends cipher suite and one's own identity To the server; (2) The server saves the received information and sends it to the client. cipher suite and one's own identity ; (3) User generates random numbers on the client side Regarding one's own certificate , and Perform MAC operations and use a shared key Encryption generation ,send , and To the server; (4) The server checks the received client certificate. Client identity and Perform MAC operations and use a shared key Encryption generation , and received If the comparison is successful, the client User is authenticated and step (5) is executed; otherwise, authentication is exited.

[0042] (5) Server to Generate by performing hash operations Client public key ,in The server generates an interaction key for the registration parameters. ,in For the server's private key, For the client's private key, As a base point generator, the server generates random numbers. Regarding one's own certificate , and Perform MAC operations and use a shared key Encryption generation Server sends , , and To the client User; (6) The client User receives , and Perform MAC operations and use a shared key Encryption generation , and received Compare the results; if they match, proceed to step (7); otherwise, exit the authentication process.

[0043] (7) Client User Generate by performing hash operations Server public key ,in For registration parameters, the client User generates an interaction key. ,in For the client's private key, For the server's private key, As a base point generator, it generates its own base point. With received If the comparison is successful, the server passes the authentication and proceeds to step (8); otherwise, the authentication process is terminated.

[0044] (8) The client User sends the message "finished" to the server Server; (9) The server sends the message "finished" to the client user to complete the authentication.

[0045] A second aspect of the present invention discloses a two-way authentication device based on the ECC algorithm, comprising: The initial authentication unit is used for initial authentication between the client and the server. The ECC authentication unit is used by both parties to independently generate a shared session key based on elliptic curve cryptography, using each other's certificate information and their own private key. By verifying whether the independently generated shared session keys are consistent, the server-side authentication of the client and the client-side authentication of the server are completed. The authentication confirmation unit is used by both parties to send an authentication success message.

[0046] This step establishes a preliminary identity verification mechanism before communication, preventing unauthorized entities from accessing the subsequent key negotiation process. The initial authentication process is achieved by exchanging digital certificates, random numbers, and a Message Authentication Code (MAC) based on a shared key.

[0047] A third aspect of the present invention discloses a computer device, the computer terminal device including a processor and a memory, the memory being used to store a computer program, the computer program including program instructions, and the processor being used to execute the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to achieve corresponding method flows or functions. The processor described in this embodiment can be used to implement a two-way authentication method based on the ECC algorithm, including the following steps: S1, the client and server interact for initial authentication; S2, both parties independently generate a shared session key based on elliptic curve cryptography using each other's certificate information and their own private key; by verifying whether the independently generated shared session keys are consistent, the server authenticates the client, and the client authenticates the server; S3, both parties send authentication success messages.

[0048] A fourth aspect of this invention discloses a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a terminal device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and extended storage media supported by the terminal device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor, which can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. One or more instructions stored in a computer-readable storage medium can be loaded and executed by a processor to implement a two-way authentication method based on the ECC algorithm in the above embodiments, including the following steps: S1, the client and the server interact to perform initial authentication; S2, both parties use each other's certificate information and their own private keys to independently generate a shared session key based on elliptic curve cryptography; by verifying whether the independently generated shared session keys are consistent, the server authenticates the client, and the client authenticates the server; S3, both parties send authentication success messages.

[0049] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0050] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0051] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0052] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A two-way authentication method based on the ECC algorithm, characterized in that, Includes the following steps: The client interacts with the server to perform initial authentication; Both parties use each other's certificate information and their own private key to independently generate a shared session key based on elliptic curve cryptography; By verifying whether the independently generated shared session keys are consistent, the server-side authentication of the client and the client-side authentication of the server are completed. Both parties send a message indicating successful authentication.

2. The two-way authentication method based on the ECC algorithm according to claim 1, characterized in that, The initial authentication is based on the message authentication code, which authenticates the transmitted certificate and random number.

3. The two-way authentication method based on the ECC algorithm according to claim 2, characterized in that, The initial authentication process includes the following steps: The client sends a first authentication message to the server, the first authentication message containing at least the client certificate. First random number and verification code ; Server-side comparison authentication code and verification code If the comparison matches, the verification passes; otherwise, the authentication is terminated.

4. The two-way authentication method based on the ECC algorithm according to claim 3, characterized in that, The authentication code For the client to generate random numbers Client Certificate and client identity Perform MAC operations and use a shared key Obtained through encryption; The authentication code For the server to receive the client certificate Client identity and the first random number Perform MAC operations and use a shared key Obtained through encryption.

5. The two-way authentication method based on the ECC algorithm according to claim 2, characterized in that, Before the initial authentication, the client sends a communication request, client cipher suite, and client identity to the server; The server stores and receives the client cipher suite and client identity sent by the client, and sends a server communication request, server cipher suite, and server identity to the client.

6. The two-way authentication method based on the ECC algorithm according to claim 1, characterized in that, Both parties independently generate a shared session key using each other's certificate information and their own private key, based on elliptic curve cryptography. The process of server-side authentication of the client and client-side authentication of the server is completed by verifying the consistency of the independently generated shared session keys. Based on client certificates, the server uses elliptic curve cryptography to generate the interaction key. and combined with random numbers MAC operations are performed using the server certificate and server identity, combined with the shared key. Generate verification code The interaction key, server certificate, and random number will be used. and verification code Send it to the client together; The client receives the server certificate, interaction key, and random number. Perform MAC operations, combined with the shared key. Encryption-generated verification code ,Compare and If the authentication process is successful, continue; otherwise, exit the authentication process. Based on the server certificate, the client generates the interaction key using elliptic curve cryptography. Compare interactive keys and the received interaction key The received interaction key The interaction key generated by the server and received by the client. If the server verifies the authentication, the authentication process will be terminated; otherwise, the authentication will be terminated.

7. The two-way authentication method based on the ECC algorithm according to claim 6, characterized in that, The server uses elliptic curve cryptography to generate interaction keys for students. The process is as follows: perform a hash operation on the client certificate to obtain the client's public key. Based on client public key Generate key ; The client uses elliptic curve cryptography to generate the interaction key. The process involves hashing the server certificate to obtain the server's public key. Based on the server public key generate .

8. A two-way authentication device based on the ECC algorithm, characterized in that, include: The initial authentication unit is used for initial authentication between the client and the server. ECC Authentication Unit is used by both parties to independently generate a shared session key based on elliptic curve cryptography, using each other's certificate information and their own private key. By verifying whether the independently generated shared session keys are consistent, the server-side authentication of the client and the client-side authentication of the server are completed. The authentication confirmation unit is used by both parties to send an authentication success message.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a two-way authentication method based on the ECC algorithm as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements a two-way authentication method based on the ECC algorithm as described in any one of claims 1 to 7.

Images