Password group authentication key agreement method against key leakage impersonation attack

Abstract

The application provides a password group authentication key agreement method against key leakage impersonation attack, and belongs to the field of information security. First, in the password file generation stage, each participant uses a shared password to simulate a key distribution center locally, derives a secret value bound to the identity and stores it in the password file, so that even if an attacker obtains the password file, he can only impersonate a specific participant and cannot directly impersonate other honest members in the group. Secondly, in the group authentication key agreement stage, the temporary public key is protected by symmetric encryption, so that only the legitimate participants can decrypt and participate in the negotiation, and an explicit key confirmation is provided in the third round of communication to ensure that all members obtain consistent session keys. In addition, the password file of each participant is bound to its identity through the identity binding technology, effectively resisting key leakage impersonation attack, while realizing lightweight group authentication and key agreement, significantly improving the security of group communication in unmanned scenarios.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a password group authentication key negotiation method that resists key leakage spoofing attacks. Background Technology

[0002] In modern network environments, secure group communication has become a fundamental requirement for a wide range of applications, including collaborative platforms, distributed systems, the Internet of Things (IoT), and drone services. A key component of this type of secure communication is group authentication key negotiation, which allows a group of participants to authenticate each other and establish a shared session key over an insecure network. This session key can then be used to ensure the integrity and confidentiality of group communication data.

[0003] Depending on the authentication factor, group authentication key negotiation protocols are mainly divided into public key infrastructure (PKI) based group authentication key negotiation and password-based group authentication key negotiation. In PKI-based group authentication key negotiation, each participant possesses a private key and a public key certified by the PKI. All participants perform a certified Diffie-Hellman key exchange based on these certified keys to jointly derive the session key. This process requires the issuance and distribution of certificates, increasing operational complexity. In contrast, password-based group authentication key negotiation allows participants to complete authentication and session key negotiation using only low-entropy passwords, thus providing a lightweight and easy-to-use alternative.

[0004] However, existing password-based group authentication key negotiation protocols are vulnerable to key leak spoofing attacks. Specifically, these protocols require participants to provide passwords during authentication and key negotiation. In unmanned scenarios (such as involving a group of drones or IoT devices), these devices must store the same password in the absence of interactive human input. Once an attacker compromises one device, they can immediately impersonate any other legitimate device. Summary of the Invention

[0005] The purpose of this invention is to provide a password group authentication key negotiation method that resists key leakage spoofing attacks. The method binds the password file of each participant to its identity, so that after an attacker compromises a participant, they can only impersonate that specific participant and cannot directly impersonate other honest members. This resists key leakage spoofing attacks and solves the technical problem in the prior art where attackers can immediately impersonate other honest members in the group after compromising a participant.

[0006] To solve the above-mentioned technical problems, the specific technical solution of the present invention is as follows:

[0007] A method for password group authentication key negotiation that resists key leakage spoofing attacks, the method comprising the following steps:

[0008] Step S1: Initialization Steps: Determine the system common parameters based on the security parameters. The system common parameters include the cyclic group and its generator, the symmetric encryption and decryption algorithms, and three hash functions; agree on the static session identifier, shared password, and specific session identifier;

[0009] Step S2: Password file generation steps: Each participant randomly selects a secret value to generate a public element, calculates a password-derived element based on the static session identifier and the shared password, and calculates an identity-bound secret value based on the identity identifier; the identity identifier, public element, password-derived element, and identity-bound secret value together constitute the password file and are stored locally;

[0010] Step S3: Group Authentication Key Negotiation Step: All participants use their respective password files to complete mutual authentication and session key negotiation through three rounds of message broadcasting, and obtain the session key.

[0011] Further, step S2 includes the following steps:

[0012] Step S21: Each participant randomly selects a secret value and calculates the public element in conjunction with the generator;

[0013] Step S22: Each participant calculates the password derivation secret and password derivation element based on the static session identifier and shared password;

[0014] Step S23: Each participant calculates the identity binding coefficient and the identity binding secret value based on the static session identifier, identity identifier, and public elements;

[0015] Step S24: The identity identifiers, public elements, password-derived elements, and identity-bound secret values ​​of each participant together constitute a password file, which is stored locally.

[0016] Furthermore, in step S21, the calculation method for the public element is as follows:

[0017]

[0018] in, Indicates the first Each participating party discloses elements; Indicates the first The secret value of each participant; Represents the cyclic group The generator.

[0019] Furthermore, in step S22, the password-derived secret is calculated as follows:

[0020]

[0021] in, Indicates the first Each participant's password is used to derive a secret; Indicates a static session identifier; Indicates shared password; Indicates the first hash function;

[0022] The calculation method for password-derived elements is as follows:

[0023]

[0024] in, Indicates the first Each participant's password-derived element.

[0025] Furthermore, in step S23, the identity binding coefficient is calculated as follows:

[0026]

[0027] in, Indicates the first The binding coefficient of each participant's identity; Indicates the first Each participant's identity identifier;

[0028] The identity binding secret value is calculated as follows:

[0029]

[0030] in, Indicates the first Each participant's identity is bound to a secret value.

[0031] Further, step S3 includes the following steps:

[0032] Step S31: In the first round of message broadcasting, each participant selects a temporary random number and calculates a temporary public key. They then use the symmetric key derived from the password file to encrypt the temporary public key to obtain the ciphertext. Subsequently, they broadcast the identity identifier, the public elements in the password file, and the ciphertext.

[0033] Step S32: In the second round of message broadcasting, each participant receives the broadcast messages from its left and right neighbors, decrypts them to obtain the neighbors' temporary public keys, calculates the two intermediate elements in conjunction with its own password file, and broadcasts them.

[0034] Step S33: In the third round of message broadcasting, each participant calculates two shared secrets based on all intermediate elements, generates and broadcasts tags for explicit key confirmation, and after verifying that all tags pass, derives the final session key.

[0035] Furthermore, in step S31, the temporary public key is calculated as follows:

[0036]

[0037] in, Indicates the first Temporary public keys of each participant; Indicates the first Temporary random numbers for each participant;

[0038] No. Each participating party The symmetric key is calculated based on the password file, as follows:

[0039]

[0040] in, Indicates the first Symmetric keys for each participant; It is the second hash function; Indicates a specific session identifier;

[0041] No. Each participating party Using symmetric keys Encrypting temporary public keys The ciphertext is obtained, and the calculation method is as follows:

[0042]

[0043] in, Indicates the first Each participant's encrypted message, This indicates the encryption algorithm.

[0044] Furthermore, in step S32, the first Each participating party The symmetric keys of the left and right neighbors are calculated as follows:

[0045]

[0046]

[0047] in, Indicates the first The symmetric key of the left neighbor of each participant; Indicates the first The symmetric key of the right neighbor of each participant; Indicates the first The identification of the left neighbor of each participating party; Indicates the first The identification identifier of the right neighbor of each participating party;

[0048] No. Each participating party Decrypt the ciphertext of the left / right neighbor to obtain the temporary public key of the left / right neighbor. The calculation method is as follows:

[0049]

[0050]

[0051] in, Indicates the first The temporary public key of the left neighbor of each participating party; Indicates the first The temporary public key of the right neighbor of each participating party; Indicates the decryption algorithm; Indicates the first The ciphertext of the left neighbor of each participating party; Indicates the first The encrypted message of the right neighbor of each participating party;

[0052] No. Each participating party The identity binding coefficient is calculated as follows:

[0053]

[0054]

[0055] in, Indicates the first The identity binding coefficient of the left neighbor of each participating party; Indicates the first The identity binding coefficient of the right neighbor of each participating party; Indicates the first The public elements of the left neighbor of each participating party; Indicates the first The public element of the right neighbor of each participant;

[0056] No. Each participating party The two intermediate elements are calculated as follows:

[0057]

[0058]

[0059] in, Indicates the first The first intermediate element of each participant; Indicates the first The second intermediate element of each participant.

[0060] Furthermore, in step S33, the first Each participating party The calculation method for two shared secrets is as follows:

[0061]

[0062]

[0063] in, Indicates the first The first shared secret among all participating parties; Indicates the first The second shared secret among the participating parties; Indicates the number of members participating in the group;

[0064] No. Each participating party The tags are calculated and broadcast as follows:

[0065] in, Indicates the first Tags for each participant; It is the third hash function; Indicates the first The identity identifier of each participating party; Indicates the first Each participant's encrypted message; Indicates the first The first intermediate element of each participant; Indicates the first The second intermediate element of each participant;

[0066] No. Each participating party The session key is generated and calculated as follows:

[0067]

[0068] in, Indicates the first Session keys for each participant.

[0069] Compared with the prior art, the present invention has the following beneficial technical effects:

[0070] 1) The method proposed in this invention binds each participant's password file to their identity, preventing attackers from directly impersonating other honest members of the group even if they obtain the password file by compromising one participant, thus effectively resisting key leakage spoofing attacks. Simultaneously, symmetric encryption is used to protect the temporary public key, ensuring that only legitimate participants with the correct password file can decrypt and participate in key negotiation. Furthermore, the third-round explicit key verification mechanism allows participants to verify that all members have correctly obtained the secrets required to derive the session key, guaranteeing the consistency of key negotiation.

[0071] 2) Based on identity binding technology, a password group authentication key negotiation method that resists key leakage and spoofing attacks is proposed, which effectively prevents attackers from impersonating other members in the group after the participants are compromised, and significantly improves the security of group communication in unmanned scenarios.

[0072] 3) Lightweight group authentication and key negotiation are achieved without the need for public key infrastructure. By using symmetric encryption and identity-bound password files, it balances ease of use and security strength, and provides explicit key confirmation to ensure the consistency of session keys. Attached Figure Description

[0073] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0074] Figure 1 This is a schematic diagram of the password group authentication key negotiation method for resisting key leakage spoofing attacks according to the present invention. Detailed Implementation

[0075] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0076] To combat key leakage spoofing attacks, this invention proposes an identity-bound password group authentication key negotiation method. This invention employs an identity-based cryptography system, binding each participant's password file to a specific identity. Unlike traditional identity-based key negotiation, this method does not rely on a key distribution center to distribute identity-bound key materials. Instead, each participant uses a shared password to locally simulate the role of a key distribution center. Specifically, the password-derived secret serves as the master key for the key distribution center, and each participant derives its identity-bound key materials from this secret, storing them along with their own identity in a password file for subsequent authentication and key negotiation. In this way, even if an attacker compromises a participant and obtains their password file, the attacker can only impersonate that specific participant. Because of the binding relationship between identity and password file, directly impersonating other participants is not feasible. Therefore, this invention effectively resists key leakage spoofing attacks. It should be noted that under the password group authentication key negotiation setting, the password is a unique shared secret; once a participant is compromised, offline dictionary guessing attacks are unavoidable. The optimal security guarantee achievable at this point is to prevent an attacker from impersonating other honest members after compromising one participant, provided that the attacker has not performed an offline dictionary guessing attack. This is precisely the security objective achieved by the method of this invention.

[0077] In the method of this invention, the group is composed of The system comprises several participants arranged in a circular topology. In the first round, each participant broadcasts two Diffie-Hellman public keys: one retrieved from a password file and the other a temporary public key customized for the current session. In the second round, each participant computes two intermediate elements based on messages received from its left and right neighbors, in a manner similar to a Diffie-Hellman exchange. These intermediate elements are broadcast, enabling all members to generate two shared secrets for deriving the session key. For enhanced security, this invention requires that the temporary public key be transmitted in ciphertext after symmetric encryption, where the symmetric key is irreversibly derived from the master key of the simulated key distribution center. Thus, only legitimate participants can decrypt and complete the protocol. Furthermore, the method provides explicit key verification through a third round of communication: each participant computes a tag using the two shared secrets and a copy of the entire exchange message, which other participants can verify to confirm that the participant has indeed obtained the corresponding secret for deriving the session key.

[0078] The password group authentication key negotiation method proposed in this invention is resistant to key leakage spoofing attacks, such as... Figure 1 As shown, the method includes the following steps:

[0079] Step S1: Initialization Steps: Determine system common parameters based on security parameters. System common parameters include cyclic groups and their generators, symmetric encryption and decryption algorithms, and multiple hash functions; agree on static session identifiers. Shared password and specific session identifier .

[0080] Specifically, based on safety parameters Determine system common parameters ,in, It is the order. Is the order as cyclic group It is a cyclic group Generators; It is a secure pair of symmetric encryption and decryption algorithms; It is the first hash function, which maps any bit string to a modulo 1. Multiplication group Elements in; It is the second hash function, which maps any bit string to a symmetric key space; It is the third hash function, which maps any bit string to a hash function of length . The bit string.

[0081] The system also defines static session identifiers. and specific session identifier Static session identifier Identify a shared password The group, the same static session identifier All participants use the same password Generate password file; specific session identifier Identifies a specific authentication and key negotiation session.

[0082] Step S2: Password file generation steps: Each participant randomly selects a secret value to generate a public element, calculates a password-derived element based on the static session identifier and the shared password, and calculates an identity-bound secret value based on the identity identifier; the identity identifier, public element, password-derived element and identity-bound secret value together constitute the password file and are stored locally.

[0083] Specifically, the group consists of It consists of several participants arranged in a circular topology. The identity identifier is... Participants ( , The number of group members is represented by the modulo of the number of subsequent indices. The password file is generated as follows (the operation is performed):

[0084] Step S21: Each participant randomly selects a secret value and calculates the public element in conjunction with the generator.

[0085] Specifically, no. Each participating party Randomly select the first Secret value of each participant The calculation method for generating public elements by combining secret values ​​and generators is as follows:

[0086]

[0087] in, Indicates the first Each participating party discloses elements.

[0088] Step S22: Each participant calculates the password derivation secret and password derivation element based on the static session identifier and shared password.

[0089] Specifically, no. Each participating party Based on static session identifiers and shared password The password derivation secret is calculated using the first hash function, as follows:

[0090]

[0091] in, Indicates the first Each participating party generates a password-derived secret. This password-derived secret is then used as the master key for the key distribution center.

[0092] No. Each participating party Secret derived from password The password-derived elements are calculated as follows:

[0093]

[0094] in, Indicates the first Each participant's password-derived element.

[0095] All participating parties are based on static session identifiers. and shared password The first hash function is used to calculate the password-derived secret, and the password-derived element is calculated in the same way based on the password-derived secret. Therefore, the password-derived secret and password-derived element calculated by all participants are the same.

[0096] Step S23: Each participant calculates the identity binding coefficient and the identity binding secret value based on the static session identifier, identity identifier and public element.

[0097] Specifically, no. Each participating party Based on static session identifiers Identity identification and public elements The identity binding coefficient is calculated using the first hash function, as follows:

[0098]

[0099] in, Indicates the first The binding coefficient of each participant's identity; It is the first hash function.

[0100] No. Each participating party Based on secret value Password Derivation Secret and identity binding coefficient Generate an identity-bound secret value, calculated as follows:

[0101]

[0102] in, Indicates the first Each participant's identity is bound to a secret value.

[0103] Step S24: The identity identifiers, public elements, password-derived elements, and identity-bound secret values ​​of each participant together constitute a password file, which is stored locally.

[0104] Specifically, no. Each participating party Identity identifier Public elements Password-derived elements and identity binding secret value Together they form a password file Password file Securely stored locally.

[0105] Step S3: Group Authentication Key Negotiation Step: All participants use their respective password files to complete mutual authentication and session key negotiation through three rounds of message broadcasting, and obtain the session key.

[0106] Each participant ( Using their respective password files, they conduct three rounds of broadcasting according to a ring topology to complete authentication and key negotiation.

[0107] Step S31: In the first round of message broadcasting, each participant selects a temporary random number and calculates a temporary public key. They then use the symmetric key derived from the password file to encrypt the temporary public key to obtain ciphertext. Subsequently, they broadcast the identity identifier, the public elements in the password file, and the ciphertext.

[0108] Specifically, no. Each participating party Select the first Temporary random number for each participant The temporary public key is calculated based on the generator, as follows:

[0109]

[0110] in, Indicates the first Each participant's temporary public key.

[0111] No. Each participating party The symmetric key is calculated based on the password file, as follows:

[0112]

[0113] in, Indicates the first Symmetric keys for each participant; It is the second hash function.

[0114] No. Each participating party Using symmetric keys Encrypting temporary public keys The ciphertext is obtained, and the calculation method is as follows:

[0115]

[0116] in, Indicates the first Each participant's encrypted message, This indicates the encryption algorithm.

[0117] No. Each participating party Broadcast identity identifier Public elements in password files and ciphertext That is, broadcast messages are .

[0118] Step S32: In the second round of message broadcasting, each participant receives the broadcast messages from its left and right neighbors, decrypts them to obtain the neighbors' temporary public keys, calculates the two intermediate elements in conjunction with its own password file, and broadcasts them.

[0119] Specifically, no. Each participating party Received a broadcast message from the left neighbor. The right neighbor ;in, Indicates the first The identification of each participating party's left neighbor. Indicates the first The public elements of each participant's left neighbor, Indicates the first The ciphertext of the left neighbor of each participating party, Indicates the first The identification of the right neighbor of each participating party Indicates the first The public elements of each participant's right neighbor. Indicates the first The encrypted message of the right neighbor of each participant.

[0120] No. Each participating party The symmetric keys of the left and right neighbors are calculated as follows:

[0121]

[0122]

[0123] in, Indicates the first The symmetric key of the left neighbor of each participant; Indicates the first The symmetric key of the right neighbor of each participant.

[0124] No. Each participating party Decrypt the ciphertext of the left / right neighbor to obtain the temporary public key of the left / right neighbor. The calculation method is as follows:

[0125]

[0126]

[0127] in, Indicates the first The temporary public key of the left neighbor of each participating party; Indicates the first The temporary public key of the right neighbor of each participating party; This indicates the decryption algorithm.

[0128] No. Each participating party Based on static session identifiers The identity identifiers of the left / right neighbors and their public elements are used to calculate the identity binding coefficient of the left / right neighbors using the first hash function, as follows:

[0129]

[0130]

[0131] in, Indicates the first The identity binding coefficient of the left neighbor of each participating party; Indicates the first The identity binding coefficient of the right neighbor of each participating party.

[0132] No. Each participating party Based on the temporary public key of the left / right neighbors, the public elements of the left / right neighbors, the identity binding coefficient of the left / right neighbors, and the first... Each participating party Temporary random number and identity binding secret value To calculate the two intermediate elements, the following method is used:

[0133]

[0134]

[0135] in, Indicates the first The first intermediate element of each participant; Indicates the first The second intermediate element of each participant; Indicates the first Temporary random numbers for each participant.

[0136] No. Each participating party First intermediate element of broadcasting and the second intermediate element That is, broadcast messages are .

[0137] Step S33: In the third round of message broadcasting, each participant calculates two shared secrets based on all intermediate elements, generates and broadcasts tags for explicit key confirmation, and after verifying that all tags pass, derives the final session key.

[0138] Specifically, no. Each participating party The calculation method for two shared secrets is as follows:

[0139]

[0140]

[0141] in, Indicates the first The first shared secret among all participating parties; Indicates the first The second shared secret among the participating parties.

[0142] No. Each participating party The tags are calculated and broadcast as follows:

[0143] in, Indicates the first Tags for each participant; It is the third hash function; Indicates the first The identity identifier of each participating party; Indicates the first Each participant's encrypted message; Indicates the first The first intermediate element of each participant; Indicates the first The second intermediate element of each participant.

[0144] No. Each participating party Broadcast Tag That is, broadcast messages are .

[0145] No. Each participating party For each not equal to Participant ID Verify the first Tags of each participant Is it equal to If verification fails, the group authentication key negotiation will be terminated.

[0146] After all tags have passed verification, the first Each participating party The session key is generated and calculated as follows:

[0147]

[0148] in, Indicates the first Session keys for each participant.

[0149] All participants use a shared session key to encrypt transmitted messages, effectively ensuring the confidentiality of group communication.

[0150] In practical applications, group members in unmanned scenarios (such as drone swarms or IoT device swarms) authenticate their identities and negotiate session keys by sharing passwords. Once a participant is compromised, attackers can use the leaked password to impersonate other members, making them vulnerable to key leakage spoofing attacks. This invention proposes an identity-bound password group authentication key negotiation method. By binding the password file to the participant's identity, the impersonation capability after key leakage is limited to the compromised member, effectively resisting key leakage spoofing attacks.

[0151] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for password group authentication key negotiation that resists key leakage spoofing attacks, characterized in that, The method includes the following steps: Step S1: Initialization Steps: Determine the system common parameters based on the security parameters. The system common parameters include the cyclic group and its generator, the symmetric encryption and decryption algorithms, and three hash functions; agree on the static session identifier, shared password, and specific session identifier; Step S2: Password file generation steps: Each participant randomly selects a secret value to generate a public element, calculates a password-derived element based on the static session identifier and the shared password, and calculates an identity-bound secret value based on the identity identifier. The password file is composed of identity identifiers, public elements, password-derived elements, and identity-bound secret values, and is stored locally. Step S3: Group Authentication Key Negotiation Step: All participants use their respective password files to complete mutual authentication and session key negotiation through three rounds of message broadcasting, and obtain the session key.

2. The password group authentication key negotiation method against key leakage spoofing attacks according to claim 1, characterized in that, Step S2 includes the following steps: Step S21: Each participant randomly selects a secret value and calculates the public element in conjunction with the generator; Step S22: Each participant calculates the password derivation secret and password derivation element based on the static session identifier and shared password; Step S23: Each participant calculates the identity binding coefficient and the identity binding secret value based on the static session identifier, identity identifier, and public elements; Step S24: The identity identifiers, public elements, password-derived elements, and identity-bound secret values ​​of each participant together constitute a password file, which is stored locally.

3. The password group authentication key negotiation method against key leakage spoofing attacks according to claim 2, characterized in that, In step S21, the calculation method for the public element is as follows: in, Indicates the first Each participating party discloses elements; Indicates the first The secret value of each participant; Represents the cyclic group The generator.

4. The password group authentication key negotiation method against key leakage spoofing attacks according to claim 3, characterized in that, In step S22, the password-derived secret is calculated as follows: in, Indicates the first Each participant's password is used to derive a secret; Indicates a static session identifier; Indicates shared password; Indicates the first hash function; The calculation method for password-derived elements is as follows: in, Indicates the first Each participant's password-derived element.

5. The password group authentication key negotiation method against key leakage spoofing attacks according to claim 4, characterized in that, In step S23, the identity binding coefficient is calculated as follows: in, Indicates the first The binding coefficient of each participant's identity; Indicates the first Each participant's identity identifier; The identity binding secret value is calculated as follows: in, Indicates the first Each participant's identity is bound to a secret value.

6. The password group authentication key negotiation method against key leakage spoofing attacks according to claim 5, characterized in that, Step S3 includes the following steps: Step S31: In the first round of message broadcasting, each participant selects a temporary random number and calculates a temporary public key. They then use the symmetric key derived from the password file to encrypt the temporary public key to obtain the ciphertext. Subsequently, they broadcast the identity identifier, the public elements in the password file, and the ciphertext. Step S32: In the second round of message broadcasting, each participant receives the broadcast messages from its left and right neighbors, decrypts them to obtain the neighbors' temporary public keys, calculates the two intermediate elements in conjunction with its own password file, and broadcasts them. Step S33: In the third round of message broadcasting, each participant calculates two shared secrets based on all intermediate elements, generates and broadcasts tags for explicit key confirmation, and after verifying that all tags pass, derives the final session key.

7. The password group authentication key negotiation method against key leakage spoofing attacks according to claim 6, characterized in that, In step S31, the temporary public key is calculated as follows: in, Indicates the first Temporary public keys of each participant; Indicates the first Temporary random numbers for each participant; No. Each participating party The symmetric key is calculated based on the password file, as follows: in, Indicates the first Symmetric keys for each participant; It is the second hash function; Indicates a specific session identifier; No. Each participating party Using symmetric keys Encrypting temporary public keys The ciphertext is obtained, and the calculation method is as follows: in, Indicates the first Each participant's encrypted message, This indicates the encryption algorithm.

8. The password group authentication key negotiation method against key leakage spoofing attacks according to claim 7, characterized in that, In step S32, the first Each participating party The symmetric keys of the left and right neighbors are calculated as follows: in, Indicates the first The symmetric key of the left neighbor of each participant; Indicates the first The symmetric key of the right neighbor of each participant; Indicates the first The identification of the left neighbor of each participating party; Indicates the first The identification identifier of the right neighbor of each participating party; No. Each participating party Decrypt the ciphertext of the left / right neighbor to obtain the temporary public key of the left / right neighbor. The calculation method is as follows: in, Indicates the first The temporary public key of the left neighbor of each participating party; Indicates the first The temporary public key of the right neighbor of each participating party; Indicates the decryption algorithm; Indicates the first The ciphertext of the left neighbor of each participating party; Indicates the first The encrypted message of the right neighbor of each participating party; No. Each participating party The identity binding coefficient is calculated as follows: in, Indicates the first The identity binding coefficient of the left neighbor of each participating party; Indicates the first The identity binding coefficient of the right neighbor of each participating party; Indicates the first The public elements of the left neighbor of each participating party; Indicates the first The public element of the right neighbor of each participant; No. Each participating party The two intermediate elements are calculated as follows: in, Indicates the first The first intermediate element of each participant; Indicates the first The second intermediate element of each participant.

9. The password group authentication key negotiation method against key leakage spoofing attacks according to claim 8, characterized in that, In step S33, the first Each participating party The calculation method for two shared secrets is as follows: in, Indicates the first The first shared secret among all participating parties; Indicates the first The second shared secret among the participating parties; Indicates the number of members participating in the group; No. Each participating party The tags are calculated and broadcast as follows: in, Indicates the first Tags for each participant; It is the third hash function; Indicates the first The identity identifier of each participating party; Indicates the first Each participant's encrypted message; Indicates the first The first intermediate element of each participant; Indicates the first The second intermediate element of each participant; No. Each participating party The session key is generated and calculated as follows: in, Indicates the first Session keys for each participant.

Images