An authentication key agreement method and system based on a puncturable pseudo-random function

Abstract

The application discloses an authentication key agreement method and system based on a penetrable pseudo-random function, and the method comprises the following steps: a server initializes a penetrable pseudo-random function master key, a counter and an asymmetric key pair for a user terminal; the user terminal sends an encrypted request by splicing an identity and the counter, simultaneously obtains a temporary session key by evaluating the master key and the counter, and updates the master key by penetrating the counter; the server decrypts the request, finds the corresponding master key according to the identity, evaluates the same counter, and if successful, the master key is taken as a session key and is updated by penetrating, and if failed, the request is rejected. The single evaluation characteristic of the penetrable pseudo-random function is used to realize lightweight and forward secure authentication key agreement, and complex state synchronization is not needed.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, specifically to an authentication key negotiation method and system based on a puncturable pseudo-random function. Background Technology

[0002] With the deepening development of the Internet of Things and edge computing technologies, massive heterogeneous terminals frequently initiate session requests in untrusted networks, placing extremely stringent requirements on the Authentication Key Agreement (AKA) protocol in terms of interaction efficiency, security strength, and server scalability. An ideal AKA protocol should not only provide two-way authentication of communicating entities and secure session key generation, but also possess forward security to address long-term key leakage threats and resist replay attacks. However, in practical deployments, traditional solutions often face severe challenges: public-key cryptography and symmetric-based systems have high computational overhead and numerous handshake rounds; symmetric-key-based systems suffer from key distribution and management bottlenecks, making it difficult to achieve an effective balance between lightweight, high concurrency, and strong security.

[0003] Traditional authentication key agreement protocols (such as TLS) typically require multiple interactions, rely on public key infrastructure, or suffer from insufficient forward security. In recent years, Puncture Pseudorandom Functions (PPRFs) have been proposed and used to build forward-secure cryptographic schemes. However, existing research based on PPRFs mainly focuses on forward-secure encryption and key evolution, with little application to authentication key agreement protocols. Existing protocols cannot simultaneously support high concurrency and user anonymity. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes an authentication key negotiation method and system based on a puncturable pseudo-random function. By combining a puncturable pseudo-random function (PPRF) with a monotonically increasing counter and asymmetric encryption, the client and server calculate the value based on the same counter and immediately puncture and delete the used key information. This achieves lightweight, forward-secure, and replay-resistant single-use valid session key negotiation, while avoiding the server from maintaining complex session states.

[0005] On the one hand, an authentication key negotiation method based on a puncturable pseudo-random function includes:

[0006] S1, the server initializes a master key with a puncturable pseudo-random function for each user terminal, and distributes the master key and a counter with an initial value of zero to each user terminal through a secure channel; the server also generates a private key and a corresponding public key for asymmetric decryption, publishes the public key, and keeps the private key secret.

[0007] S2, after each user terminal saves its corresponding master key, counter and public key, the server stores the identity identifier and corresponding master key of each user terminal in the database;

[0008] S3: The client that needs to establish a session reads the current counter value, concatenates its own identity with the current counter value, encrypts it using the public key to generate ciphertext, and sends the ciphertext to the server.

[0009] S4, the client that needs to establish a session uses the master key and the current counter value to evaluate the puncturable pseudo-random function to obtain the temporary key for this session, performs a puncture operation on the current counter value to update the local master key, and then increments the counter value;

[0010] S5, the server receives the ciphertext, decrypts it using the private key to obtain the client identity identifier and counter value for which a session needs to be established, and then searches for the corresponding master key in the database based on the identity identifier.

[0011] S6. The server uses the found master key and the decrypted counter value to evaluate the puncturable pseudo-random function. If the evaluation fails, the request is rejected. If the evaluation succeeds, the evaluation result is used as the session key for this session, and a puncture operation is performed on the counter value to update the master key in the database. The server and client communicate through the session key.

[0012] Furthermore, the puncturable pseudo-random function includes an initialization subfunction, an evaluation subfunction, and a puncture subfunction:

[0013] The initialization subfunction is used to generate the master key for the puncturable pseudo-random function during the initialization phase;

[0014] The evaluation sub-function is used to receive the input master key and counter value during the session establishment process, and output the corresponding pseudo-random value as the session key;

[0015] The puncture sub-function receives the input master key and the used counter value, and outputs a new master key. This new master key retains the ability to evaluate all other points except the used counter value, and cannot recalculate the pseudo-random value corresponding to the used counter value.

[0016] Furthermore, the puncturable pseudo-random function is constructed using a GGM tree structure, with the master key corresponding to the root node key of the GGM tree and each counter value corresponding to a leaf node in the GGM tree.

[0017] Furthermore, the server-side database uses the user's identity identifier as an index to store the master key corresponding to that identity identifier, with each user having a different master key record.

[0018] Furthermore, the puncturable pseudo-random function is evaluated by deriving the pseudo-random value corresponding to the target leaf node from the root node along the path.

[0019] Furthermore, the puncture operation is specifically performed by deleting necessary nodes on the path from the leaf node to the root node corresponding to the target counter value, making the corresponding leaf node unreachable, while maintaining the reachability and evaluation capability of other leaf nodes.

[0020] Furthermore, if the evaluation fails, the request is rejected, specifically including:

[0021] When the server evaluates a counter value that has already been used, the key information corresponding to the counter value has been punctured and deleted after the first use. The evaluation sub-function cannot find the valid key corresponding to the counter value in the master key and returns an invalid flag. After receiving the invalid flag, the server directly terminates the current session establishment process.

[0022] Furthermore, the invalidation flag returned when the evaluation fails is a predefined special value. This special value is independent of the normal output value range of the puncturable pseudo-random function and serves as a fixed return value indicating evaluation failure. The server distinguishes between the two states of successful and failed evaluation by judging whether the return value of the puncturable pseudo-random function is this special value. If it is this special value, it is determined that the counter value of the current request has been used, and the current session establishment process is terminated immediately.

[0023] On the other hand, an authentication key negotiation system based on a puncturable pseudo-random function includes at least one server and several user terminals, wherein the server and user terminals are used to implement the authentication key negotiation method based on the puncturable pseudo-random function.

[0024] The present invention adopts the above technical solution and has the following beneficial effects:

[0025] (1) The present invention uses a monotonically increasing counter value for each session, and the puncturable pseudo-random function (PPRF) performs a puncture operation immediately after the counter is used, so that the key information corresponding to the counter is permanently deleted. The server fails to evaluate the counter value for repeated use and rejects the request, thereby preventing attackers from replaying old ciphertext to establish illegal sessions and ensuring that the session key negotiated each time is brand new and cannot be reused.

[0026] (2) The present invention deletes the necessary key information on the root path of the used counter node through the puncture operation. Even if the master key is accidentally leaked later, the attacker cannot recover any pseudo-random value corresponding to the previously used counter value, which ensures that the confidentiality of the historical session content is not affected by the current master key leakage and has strong forward security attributes.

[0027] (3) The user terminal of this invention only needs to store the master key and counter locally, and the server stores the master key with the user identity identifier as the index. During the negotiation process, the server does not need to maintain a complex session state table or synchronization counter. It can complete the evaluation and puncture update by relying only on the counter value in the request. The communication only uses asymmetric encryption to transmit the identity and counter once. The subsequent key generation is based on symmetric PRF calculation, which has low computational overhead and is particularly suitable for IoT or mobile terminal scenarios with limited computing and storage resources. Attached Figure Description

[0028] Figure 1 This is a flowchart of an authentication key negotiation method based on a puncturable pseudo-random function according to an embodiment of the present invention;

[0029] Figure 2 This is a schematic diagram of the protocol initialization process according to an embodiment of the present invention;

[0030] Figure 3 This is a schematic diagram of the authentication key negotiation protocol flow of the protocol in an embodiment of the present invention. Detailed Implementation

[0031] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0032] like Figure 1 As shown, the present invention provides an authentication key negotiation method based on a puncturable pseudo-random function, comprising:

[0033] S1, the server initializes a master key with a puncturable pseudo-random function for each user terminal, and distributes the master key and a counter with an initial value of zero to each user terminal through a secure channel; the server also generates a private key and a corresponding public key for asymmetric decryption, publishes the public key, and keeps the private key private.

[0034] Specifically, the puncturable pseudo-random function includes an initialization subfunction, an evaluation subfunction, and a puncture subfunction:

[0035] The initialization subfunction is used to generate the master key for the puncturable pseudo-random function during the initialization phase;

[0036] The evaluation sub-function is used to receive the input master key and counter value during the session establishment process, and output the corresponding pseudo-random value as the session key;

[0037] The puncture sub-function receives the input master key and the used counter value, and outputs a new master key. This new master key retains the ability to evaluate all other points except the used counter value, and cannot recalculate the pseudo-random value corresponding to the used counter value.

[0038] Specifically, the puncturable pseudo-random function is constructed using a GGM tree structure, with the master key corresponding to the root node key of the GGM tree and each counter value corresponding to a leaf node in the GGM tree.

[0039] Specifically, in this embodiment, the puncturable pseudo-random function is a family of keyed pseudo-random functions that additionally supports the "puncture" operation. It comprises the following three core algorithms (sub-functions):

[0040] - Initialize the algorithm (initialization sub-function), input security parameters. Output an initial master key. .

[0041] - Evaluation algorithm (evaluation sub-function), input master key and input point (Usually a positive integer or a counter value), output a pseudo-random value. in This is the output length.

[0042] - : Puncture algorithm (punch sub-function), input master key and input point Output a new master key Post-puncture Satisfy: For any , But for the point of puncture , No longer valid (output error flag) ).

[0043] PPRF security requirements: Even if an attacker gains access... It is also impossible to distinguish And a truly random value. The PPRF used in this invention can be constructed using standard methods in the prior art, including those based on GGM trees.

[0044] Specifically, during the initialization process, a family of puncturable pseudo-random functions (PPRF) is selected: ,in For safety parameters, This is the length of the output value.

[0045] The server generates a public / private key pair. This is used for asymmetric encryption; user U and server S pre-negotiate and jointly initialize a PPRF instance, each storing the same master key. The user saves the current counter. , The initial value is 0.

[0046] Among them: user save = 0; The server stores a record for user U in the database, containing the user's identity identifier. and corresponding Meanwhile, the server stores its own private key. .

[0047] S2: After each user terminal saves its corresponding master key, counter, and public key, the server stores the identity identifier and corresponding master key of each user terminal in the database.

[0048] Specifically, the server-side database uses the user's identity identifier as an index to store the master key corresponding to that identity identifier, with each user having a different master key record.

[0049] S3: The client that needs to establish a session reads the current counter value, concatenates its own identity with the current counter value, encrypts it using the public key to generate ciphertext, and sends the ciphertext to the server.

[0050] S4, the client that needs to establish a session uses the master key and the current counter value to evaluate the puncturable pseudo-random function to obtain the temporary key for this session, performs a puncture operation on the current counter value to update the local master key, and then increments the counter value;

[0051] S5, the server receives the ciphertext, decrypts it using the private key to obtain the client identity identifier and counter value for which a session needs to be established, and then searches for the corresponding master key in the database based on the identity identifier.

[0052] S6. The server uses the found master key and the decrypted counter value to evaluate the puncturable pseudo-random function. If the evaluation fails, the request is rejected. If the evaluation succeeds, the evaluation result is used as the session key for this session, and a puncture operation is performed on the counter value to update the master key in the database. The server and client communicate through the session key.

[0053] Specifically, the evaluation of the puncturable pseudo-random function is performed by: deriving the pseudo-random value corresponding to the target leaf node from the root node along the path;

[0054] Specifically, the puncture operation is performed by deleting necessary nodes on the path from the leaf node to the root node corresponding to the target counter value, making the corresponding leaf node unreachable, while maintaining the reachability and evaluation capability of other leaf nodes.

[0055] Specifically, if the evaluation fails, the request is rejected, including:

[0056] When the server evaluates a counter value that has already been used, the key information corresponding to the counter value has been punctured and deleted after the first use. The evaluation sub-function cannot find the valid key corresponding to the counter value in the master key and returns an invalid flag. After receiving the invalid flag, the server directly terminates the current session establishment process.

[0057] Specifically, when the evaluation fails, the invalidation flag returned is a predefined special value. This special value is independent of the normal output value range of the puncturable pseudo-random function and serves as a fixed return value indicating evaluation failure. The server distinguishes between the two states of successful and failed evaluation by judging whether the return value of the puncturable pseudo-random function is this special value. If it is this special value, it is determined that the counter value of the current request has been used, and the current session establishment process is terminated immediately.

[0058] Specifically, the evaluation result is used as the session key for this session because the counter values ​​input by both parties are the same and the calculation logic of the puncturable pseudo-random function is consistent. Therefore, the temporary key obtained by the user in step S3 is the same as the session key obtained by the server in step S6, and both parties can use this consistent key for subsequent communication.

[0059] Specifically, in this embodiment, the process of user U establishing a session key with server S is divided into the following four steps:

[0060] Step 1: User generates encrypted data:

[0061] User retrieves the current counter value Use the server's public key encryption ( (It is a connector symbol), to obtain the ciphertext. Users will Send to the server.

[0062] Step 2: User locally updates PPRF status:

[0063] Users utilize the current and counter Calculate PPRF output value Then, the counter... Perform a puncture operation to update the master key: Finally, the user increments the counter: Calculated This serves as the temporary session key for this session.

[0064] Step 3: Server decrypts and verifies

[0065] The server received Then, use your own private key. Decryption .according to Search the database for the PPRF master key corresponding to this user. The server attempts to calculate. :if The counter is still retained in the middle. The corresponding key information (i.e., the key information) If it has not been used before, the calculation is successful and you will get... If the If the counter has already been used (i.e., the counter value has been used previously), then An invalid flag will be returned. The server directly rejected this authentication request.

[0066] like Calculation successful, server updates counter Perform puncture: Then the updated Write back to the database. The server will This serves as the session key for this session. Since both parties input the same information and the PPRF is deterministic, there must be... .

[0067] Step 4: Session complete

[0068] User and server use It is used as a session key for subsequent communication.

[0069] Specifically, the concurrency of the protocol corresponding to this method stems from the inherent nature of PPRF: the user end only needs to maintain a monotonically increasing counter. And each session only uses the specific count value for that particular use. implement and In this operation, the key materials corresponding to different counter values ​​are independent of each other in the PPRF master key (the puncture operation only removes the computing power of a specific point and does not affect other points). Therefore, the client can immediately initiate a new authentication session without waiting for the previous session to complete: it only needs to obtain the current... The value is incremented to allocate an unused value for a new session. and complete independently and Due to the different sessions using They are all different, and the PPRF master key update (puncture) is only for the specific one used by each user. There is no state coupling or resource conflict between sessions. Therefore, this protocol inherently supports any number of concurrent authentication requests.

[0070] Specifically, the protocol corresponding to this method has made improvements in security, including anonymity: user identity verification. With counter They are transmitted together using the server's public key, and are used in each session. Since they are all different, attackers cannot distinguish between different users or different sessions of the same user from the ciphertext, thus achieving user anonymity. Forward security: After each session ends, both the user and the server update the counter used for that session. The puncture procedure has been performed and is about to begin. Chinese correspondence The location's key information is permanently deleted. Even if an attacker gains access to the current location in the future... It is also impossible to recover any PPRF output values ​​from previous sessions. Therefore, it is impossible to decrypt the content of historical conversations. Furthermore, due to... Strictly incremental and never repeating, already used It will not be reused, further ensuring forward security. Replay attack resistance: Due to the penetrating nature of PPRF, the server will not reuse counters that have already been used. Re-execution of Eval will fail immediately, so replaying the old ciphertext will not pass authentication, and there is no need to maintain the state table separately.

[0071] Specifically, in this embodiment, a PPRF constructed using a GGM tree is selected, with security parameters... Output length The public key encryption uses ECIES (Elliptic Curve Integrated Encryption Scheme), with the secp256k1 curve selected, and the following verification was performed.

[0072] like Figure 2 As shown, the system initialization is as follows:

[0073] 1. The server generates ECIES public and private key pairs. .

[0074] 2. User Alice agrees on an initial master key with the server. Initial counter Alice saves and Server database storage .

[0075] like Figure 3 As shown, the authentication key negotiation protocol process is as follows:

[0076] 1. Alice gets the current ,use Encrypted string Obtain the ciphertext Send it to the server.

[0077] 2. Alice calculates ,Then , . Used as a session key.

[0078] 3. The server received Use later Decryption and The server retrieves the corresponding Alice from the database. Try to calculate Because of this Unused, calculation successful. Then the server executes. Update the database . Used as a session key.

[0079] 4. Both parties use session keys. To conduct encrypted communication.

[0080] Specifically, this embodiment also discloses an authentication key negotiation system based on a puncturable pseudo-random function, including at least one server and several user terminals, wherein the server and user terminals are used to implement the aforementioned authentication key negotiation method based on a puncturable pseudo-random function.

[0081] A specific implementation of an authentication key negotiation system based on a puncturable pseudo-random function is described in this embodiment, which is the same authentication key negotiation method based on a puncturable pseudo-random function.

[0082] Although the invention has been specifically shown and described in conjunction with preferred embodiments, those skilled in the art should understand that various changes in form and detail may be made to the invention without departing from the spirit and scope of the invention as defined in the appended claims, all of which shall be within the scope of protection of the invention.

Claims

1. An authentication key negotiation method based on a puncturable pseudo-random function, characterized in that, Includes the following steps: S1, the server initializes a master key with a puncturable pseudo-random function for each user terminal, and distributes the master key and a counter with an initial value of zero to each user terminal through a secure channel; the server also generates a private key and a corresponding public key for asymmetric decryption, publishes the public key, and keeps the private key secret. S2, after each user terminal saves its corresponding master key, counter and public key, the server stores the identity identifier and corresponding master key of each user terminal in the database; S3: The client that needs to establish a session reads the current counter value, concatenates its own identity with the current counter value, encrypts it using the public key to generate ciphertext, and sends the ciphertext to the server. S4, the client that needs to establish a session uses the master key and the current counter value to evaluate the puncturable pseudo-random function to obtain the temporary key for this session, performs a puncture operation on the current counter value to update the local master key, and then increments the counter value; S5, the server receives the ciphertext, decrypts it using the private key to obtain the client identity identifier and counter value for which a session needs to be established, and then searches for the corresponding master key in the database based on the identity identifier. S6. The server uses the found master key and the decrypted counter value to evaluate the puncturable pseudo-random function. If the evaluation fails, the request is rejected. If the evaluation succeeds, the evaluation result is used as the session key for this session, and a puncture operation is performed on the counter value to update the master key in the database. The server and client communicate through the session key.

2. The authentication key negotiation method based on a puncturable pseudo-random function according to claim 1, characterized in that, In S1, the puncture-capable pseudo-random function includes an initialization sub-function, an evaluation sub-function, and a puncture sub-function: The initialization subfunction is used to generate the master key for the puncturable pseudo-random function during the initialization phase; The evaluation sub-function is used to receive the input master key and counter value during the session establishment process, and output the corresponding pseudo-random value as the session key; The puncture sub-function receives the input master key and the used counter value, and outputs a new master key. This new master key retains the ability to evaluate all other points except the used counter value, and cannot recalculate the pseudo-random value corresponding to the used counter value.

3. The authentication key negotiation method based on a puncturable pseudo-random function according to claim 1, characterized in that, In S1, the puncturable pseudo-random function is constructed using a GGM tree structure, with the master key corresponding to the root node key of the GGM tree and each counter value corresponding to a leaf node in the GGM tree.

4. The authentication key negotiation method based on a puncturable pseudo-random function according to claim 1, characterized in that, In S2, the server-side database uses the user's identity identifier as an index to store the master key corresponding to that identity identifier, and each user has a different master key record.

5. The authentication key negotiation method based on a puncturable pseudo-random function according to claim 4, characterized in that, In S6, the evaluation of the puncturable pseudo-random function is performed by deriving the pseudo-random value corresponding to the target leaf node from the root node along the path.

6. The authentication key negotiation method based on a puncturable pseudo-random function according to claim 4, characterized in that, In S6, the puncture operation is specifically performed by deleting necessary nodes on the path from the leaf node to the root node corresponding to the target counter value, making the corresponding leaf node unreachable, while maintaining the reachability and evaluation capability of other leaf nodes.

7. The authentication key negotiation method based on a puncturable pseudo-random function according to claim 1, characterized in that, In S6, if the evaluation fails, the request is rejected, specifically including: When the server evaluates a counter value that has already been used, the key information corresponding to the counter value has been punctured and deleted after the first use. The evaluation sub-function cannot find the valid key corresponding to the counter value in the master key and returns an invalid flag. After receiving the invalid flag, the server directly terminates the current session establishment process.

8. The authentication key negotiation method based on a puncturable pseudo-random function according to claim 7, characterized in that, When evaluation fails, the invalidation flag returned is a predefined special value. This special value is independent of the normal output value range of the puncturable pseudo-random function and serves as a fixed return value indicating evaluation failure. The server distinguishes between successful and failed evaluation by judging whether the return value of the puncturable pseudo-random function is this special value. If it is this special value, it is determined that the counter value requested at the moment has been used, and the session establishment process is terminated immediately.

9. An authentication key negotiation system based on a puncturable pseudo-random function, characterized in that, It includes at least one server and several user terminals, wherein the server and user terminals are used to implement the authentication key negotiation method based on a puncturable pseudo-random function as described in any one of claims 1 to 8.

Images