Two-way authentication key exchange method and device, computer device and storage medium

Abstract

The application relates to a bidirectional authentication key exchange method and device, computer equipment and a storage medium. The method comprises the following steps: obtaining a first authentication message; sending the first authentication message to a second communication party, so that the second communication party generates a second authentication message according to a first public key in the first authentication message and a second public key of the second communication party; restoring a communication key seed of the second communication party according to the product of the second public key and a first private key of a first communication party; performing key derivation processing on the splicing result between the communication key seed of the second communication party and the communication key seed of the first communication party to obtain a reference communication key of the second communication party; sending the reference communication key to the second communication party, so that the second communication party verifies the correctness of the reference communication key according to a standard communication key of the second communication party; and completing the communication key exchange between the first communication party and the second communication party when a confirmation code sent by the second communication party is received. The method can improve security.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a two-way authentication key exchange method, apparatus, computer equipment, and storage medium. Background Technology

[0002] With the widespread adoption of cloud computing, the Internet of Things, and distributed systems, the scale and complexity of network security communications have increased dramatically. Authenticated Key Exchange (AKE) protocols, as a core infrastructure for ensuring network communication security, can establish secure session keys for communicating parties over public channels and provide two-way authentication. Their security is directly related to the security foundation of the entire information system.

[0003] Lattice-Shamir transform-based signature and AKE combination schemes combine lattice-based digital signatures with key encapsulation mechanisms to achieve authentication through signatures. However, their combination is often quite straightforward, lacking deep integration between underlying primitives, resulting in bloated protocol messages and high bandwidth overhead. Furthermore, their security proofs typically reduce AKE security, signature security, and key encapsulation mechanism (KEM) security as independent modules, with the final total loss factor being the product of the loss factors of each module, further deteriorating the reduction compactness. In addition, the signature verification process involves the calculation of large-norm polynomials and rejection sampling, increasing the protocol's computational latency and making it unsuitable for low-latency communication scenarios. Summary of the Invention

[0004] Therefore, it is necessary to provide a two-way authentication key exchange method, apparatus, computer equipment, and storage medium that can improve security in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a two-way authentication key exchange method, including:

[0006] Obtain the first authentication message; the first authentication message is used to enable the second communicating party to verify the identity information of the first communicating party, including the first communicating party's first public key;

[0007] A first authentication message is sent to a second communication party, so that the second communication party can generate a second authentication message based on the first public key in the first authentication message and the second public key of the second communication party; the second authentication message includes the second public key of the second communication party;

[0008] Based on the product between the second public key and the first private key of the first communicating party, the communication key seed of the second communicating party is restored;

[0009] The concatenation result between the communication key seed of the second communication party and the communication key seed of the first communication party is subjected to key derivation processing to obtain the reference communication key of the second communication party.

[0010] Send a reference communication key to the second communication party so that the second communication party can verify the correctness of the reference communication key based on its own standard communication key;

[0011] Upon receiving an acknowledgment code from the second communicating party, the exchange of communication keys between the first and second communicating parties is completed; the acknowledgment code is used to indicate that the reference communication key is correct.

[0012] In one embodiment, the second authentication message further includes a coordination signal from the second communicating party; and reconstructs the communication key seed of the second communicating party based on the product of the second public key and the first private key of the first communicating party, including:

[0013] The shared parameters between the first and second communicating parties are determined based on the product of the second public key and the first private key of the first communicating party.

[0014] Based on the shared parameters and coordination signals, the communication key seed of the second communicating party is restored;

[0015] The coordination signal is used to eliminate the shared parameter deviation between the first and second communication parties caused by noise.

[0016] In one embodiment, obtaining the first authentication message includes:

[0017] Obtain the public parameters sent by the trust center and the second public key sent by the second communication party; the public parameters are parameters that are common to the trust center, the first communication party, and the second communication party and remain unchanged;

[0018] Based on the public parameters, generate the first public key and the first private key of the first communicating party;

[0019] Based on the first public key, the first private key, and the coordination signal of the first communicating party, a first authentication message is generated and sent to the second communicating party.

[0020] Secondly, this application provides a two-way authentication key exchange method, including:

[0021] Obtain the second public key of the second communicating party and the first authentication message sent by the first communicating party; the first authentication message includes the first public key of the first communicating party;

[0022] The second authentication message is generated based on the product of the first public key and the second public key in the first authentication message;

[0023] Send a second authentication message to the first communication party so that the first communication party can generate a reference communication key for the second communication party based on the second public key in the second authentication message and the first private key of the first communication party;

[0024] Receive the reference communication key sent by the first communicating party, and determine the consistency between the reference communication key and the standard communication key of the second communicating party;

[0025] If the reference communication key matches the standard communication key, an acknowledgment code is sent to the first communicating party.

[0026] In one embodiment, the first authentication message further includes a coordination signal from the first communicating party; a second authentication message is generated based on the product of the first public key and the second public key in the first authentication message, including:

[0027] The shared parameters between the first and second communicating parties are determined based on the product of the first and second public keys.

[0028] Based on the shared parameters and the coordination signal of the first communicating party, the communication key seed of the first communicating party is restored;

[0029] The concatenation result of the communication key seed of the first communication party and the communication key seed of the second communication party is subjected to key derivation processing to obtain the reference communication key of the first communication party.

[0030] A second authentication message is generated based on the reference communication key of the first communicating party and the coordination signal of the second communicating party.

[0031] Thirdly, this application also provides a two-way authentication key exchange device, applied to a first communicating party, comprising:

[0032] The first acquisition module is used to acquire a first authentication message; the first authentication message is used to enable the second communication party to verify the identity information of the first communication party, including the first communication party's first public key.

[0033] The first transceiver module is used to send a first authentication message to the second communication party, so that the second communication party can generate a second authentication message based on the first public key in the first authentication message and the second public key of the second communication party; the second authentication message includes the second public key of the second communication party.

[0034] The first decryption module is used to restore the communication key seed of the second communication party based on the product between the second public key and the first private key of the first communication party; and to perform key derivation processing on the concatenation result between the communication key seed of the second communication party and the communication key seed of the first communication party to obtain the reference communication key of the second communication party.

[0035] The first transceiver module is also used to send a reference communication key to the second communication party so that the second communication party can verify the correctness of the reference communication key according to its own standard communication key; upon receiving the acknowledgment code sent by the second communication party, the communication key exchange between the first communication party and the second communication party is completed; the acknowledgment code is used to indicate that the reference communication key is correct.

[0036] Fourthly, this application also provides a two-way authentication key exchange device for use by a second communicating party, comprising:

[0037] The second acquisition module is used to acquire the second public key of the second communicating party and the first authentication message sent by the first communicating party; the first authentication message includes the first public key of the first communicating party.

[0038] The second decryption module is used to generate a second authentication message based on the product between the first public key and the second public key in the first authentication message;

[0039] The second transceiver module is used to send a second authentication message to the first communication party, so that the first communication party can generate a reference communication key for the second communication party based on the second public key in the second authentication message and the first private key of the first communication party; receive the reference communication key sent by the first communication party and determine the consistency between the reference communication key and the standard communication key of the second communication party; and send an acknowledgment code to the first communication party if the reference communication key is consistent with the standard communication key.

[0040] Fifthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0041] Obtain the first authentication message; the first authentication message is used to enable the second communicating party to verify the identity information of the first communicating party, including the first communicating party's first public key;

[0042] A first authentication message is sent to a second communication party, so that the second communication party can generate a second authentication message based on the first public key in the first authentication message and the second public key of the second communication party; the second authentication message includes the second public key of the second communication party;

[0043] Based on the product between the second public key and the first private key of the first communicating party, the communication key seed of the second communicating party is restored;

[0044] The concatenation result between the communication key seed of the second communication party and the communication key seed of the first communication party is subjected to key derivation processing to obtain the reference communication key of the second communication party.

[0045] Send a reference communication key to the second communication party so that the second communication party can verify the correctness of the reference communication key based on its own standard communication key;

[0046] Upon receiving an acknowledgment code from the second communicating party, the exchange of communication keys between the first and second communicating parties is completed; the acknowledgment code is used to indicate that the reference communication key is correct.

[0047] Sixthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0048] Obtain the second public key of the second communicating party and the first authentication message sent by the first communicating party; the first authentication message includes the first public key of the first communicating party;

[0049] The second authentication message is generated based on the product of the first public key and the second public key in the first authentication message;

[0050] Send a second authentication message to the first communication party so that the first communication party can generate a reference communication key for the second communication party based on the second public key in the second authentication message and the first private key of the first communication party;

[0051] Receive the reference communication key sent by the first communicating party, and determine the consistency between the reference communication key and the standard communication key of the second communicating party;

[0052] If the reference communication key matches the standard communication key, an acknowledgment code is sent to the first communicating party.

[0053] Seventhly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0054] Obtain the first authentication message; the first authentication message is used to enable the second communicating party to verify the identity information of the first communicating party, including the first communicating party's first public key;

[0055] A first authentication message is sent to a second communication party, so that the second communication party can generate a second authentication message based on the first public key in the first authentication message and the second public key of the second communication party; the second authentication message includes the second public key of the second communication party;

[0056] Based on the product between the second public key and the first private key of the first communicating party, the communication key seed of the second communicating party is restored;

[0057] The concatenation result between the communication key seed of the second communication party and the communication key seed of the first communication party is subjected to key derivation processing to obtain the reference communication key of the second communication party.

[0058] Send a reference communication key to the second communication party so that the second communication party can verify the correctness of the reference communication key based on its own standard communication key;

[0059] Upon receiving an acknowledgment code from the second communicating party, the exchange of communication keys between the first and second communicating parties is completed; the acknowledgment code is used to indicate that the reference communication key is correct.

[0060] Eighthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0061] Obtain the second public key of the second communicating party and the first authentication message sent by the first communicating party; the first authentication message includes the first public key of the first communicating party;

[0062] The second authentication message is generated based on the product of the first public key and the second public key in the first authentication message;

[0063] Send a second authentication message to the first communication party so that the first communication party can generate a reference communication key for the second communication party based on the second public key in the second authentication message and the first private key of the first communication party;

[0064] Receive the reference communication key sent by the first communicating party, and determine the consistency between the reference communication key and the standard communication key of the second communicating party;

[0065] If the reference communication key matches the standard communication key, an acknowledgment code is sent to the first communicating party.

[0066] Ninthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0067] Obtain the first authentication message; the first authentication message is used to enable the second communicating party to verify the identity information of the first communicating party, including the first communicating party's first public key;

[0068] A first authentication message is sent to a second communication party, so that the second communication party can generate a second authentication message based on the first public key in the first authentication message and the second public key of the second communication party; the second authentication message includes the second public key of the second communication party;

[0069] Based on the product between the second public key and the first private key of the first communicating party, the communication key seed of the second communicating party is restored;

[0070] The concatenation result between the communication key seed of the second communication party and the communication key seed of the first communication party is subjected to key derivation processing to obtain the reference communication key of the second communication party.

[0071] Send a reference communication key to the second communication party so that the second communication party can verify the correctness of the reference communication key based on its own standard communication key;

[0072] Upon receiving an acknowledgment code from the second communicating party, the exchange of communication keys between the first and second communicating parties is completed; the acknowledgment code is used to indicate that the reference communication key is correct.

[0073] In a tenth aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0074] Obtain the second public key of the second communicating party and the first authentication message sent by the first communicating party; the first authentication message includes the first public key of the first communicating party;

[0075] The second authentication message is generated based on the product of the first public key and the second public key in the first authentication message;

[0076] Send a second authentication message to the first communication party so that the first communication party can generate a reference communication key for the second communication party based on the second public key in the second authentication message and the first private key of the first communication party;

[0077] Receive the reference communication key sent by the first communicating party, and determine the consistency between the reference communication key and the standard communication key of the second communicating party;

[0078] If the reference communication key matches the standard communication key, an acknowledgment code is sent to the first communicating party.

[0079] The aforementioned two-way authentication key exchange method, apparatus, computer equipment, and storage medium achieve two-way authentication and secure restoration of the communication key seed by having the first communicating party actively initiate a public key-based identity authentication process and combining it with the second authentication message fed back by the second communicating party. The key seed is restored using the product of the second public key and the first private key, and further concatenation and key derivation processing of the key seeds from both parties significantly improves the randomness and anti-cracking capability of the communication key. Simultaneously, by sending a reference communication key for the second communicating party to verify its correctness and providing a confirmation code upon successful verification, strict numerical consistency of the communication key finally established by both parties is ensured, effectively preventing the risks of man-in-the-middle tampering and inconsistent key negotiations. Thus, while guaranteeing the reliability of two-way authentication, the security and stability of the key exchange process are significantly enhanced.

[0080] Furthermore, by having the second communicating party actively obtain and utilize the first public key from the first authentication message sent by the first communicating party, and multiply it with its own second public key to generate a second authentication message, implicit verification of the first communicating party's identity is achieved. A secure two-way authentication response mechanism is then built upon this. Further, by sending the second authentication message back to the first communicating party to trigger the generation of a reference communication key, and independently determining the consistency between this reference communication key and its own standard communication key locally, an acknowledgment code is sent to the first communicating party only when there is a perfect match. This ensures that both communicating parties can participate in identity authentication and key verification in an active and equal manner during key negotiation. The entire scheme effectively guarantees the numerical consistency and authentication integrity of the session key between the two parties, eliminates communication security risks caused by key discrepancies or identity forgery, and significantly improves the security and reliability of the key exchange process. Attached Figure Description

[0081] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0082] Figure 1 This embodiment provides an application environment diagram for a two-way authentication key exchange method.

[0083] Figure 2 This is a flowchart illustrating the first two-way authentication key exchange method provided in this embodiment;

[0084] Figure 3 This is a flowchart illustrating the second two-way authentication key exchange method provided in this embodiment;

[0085] Figure 4 This is a flowchart illustrating the third two-way authentication key exchange method provided in this embodiment;

[0086] Figure 5 This is a structural block diagram of the first type of two-way authentication key exchange device provided in this embodiment;

[0087] Figure 6 This is a structural block diagram of the second type of two-way authentication key exchange device provided in this embodiment;

[0088] Figure 7 This is an internal structural diagram of a computer device provided in this embodiment. Detailed Implementation

[0089] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0090] The two-way authentication key exchange method provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown. First communicating party 101 obtains a first authentication message; the first authentication message is used to enable the second communicating party to verify the identity information of the first communicating party, including the first public key of the first communicating party; the first communicating party 101 sends the first authentication message to the second communicating party 102, so that the second communicating party 102 can generate a second authentication message based on the first public key in the first authentication message and the second public key of the second communicating party 102; the second authentication message includes the second public key of the second communicating party 102; the first communicating party 101 restores the communication key seed of the second communicating party 102 based on the product between the second public key and the first private key of the first communicating party 101; performs key derivation processing on the concatenation result between the communication key seed of the second communicating party 102 and the communication key seed of the first communicating party 101 to obtain the reference communication key of the second communicating party 102; sends the reference communication key to the second communicating party 102, so that the second communicating party 102 can verify the correctness of the reference communication key based on its own standard communication key; upon receiving the confirmation code sent by the second communicating party 102, the communication key exchange between the first communicating party 101 and the second communicating party 102 is completed; the confirmation code is used to indicate that the reference communication key is correct.

[0091] In this context, the first communicating party refers to the entity that actively initiates the session in the Authentication Key Exchange (AKE) protocol. In the protocol's interaction sequence, it is the message initiator. It is responsible for generating and sending the first round of authentication messages (containing its own first public key), and upon receiving the response from the second communicating party, it completes the local calculation, consistency verification, and confirmation of the final session key. It is the party that drives the entire protocol process.

[0092] In this context, the second communicating party refers to the entity that responds and cooperates in completing authentication within the Authentication Key Exchange (AKE) protocol. In the protocol's interaction sequence, it is the message responder. It is responsible for receiving and verifying the authentication message initiated by the first communicating party, generating and returning a second-round authentication message (containing its own second public key) based on the received information, then independently verifying the consistency of the reference communication key calculated by the first communicating party, and returning the final confirmation code to complete the two-way authentication.

[0093] In one exemplary embodiment, such as Figure 2 As shown, a two-way authentication key exchange method is provided, which is applied to... Figure 1Taking the first communicating party as an example, the explanation includes the following steps S201 to S202. Wherein:

[0094] S201 obtains the first authentication message.

[0095] The first authentication message is used by the second communicating party to verify the identity information of the first communicating party, including the first communicating party's first public key. The first authentication message refers to the initial protocol data packet generated and sent by the first communicating party (initiator) to the second communicating party (responder) at the start of the protocol. It is the trigger message for the entire authentication key exchange process, carrying the first communicating party's identity credentials and key negotiation materials.

[0096] Here, the first public key refers to the public portion of an asymmetric key pair generated and published by the first communicating party or sent with the first authentication message. This public key and the first private key held by the first communicating party mathematically constitute a key pair, satisfying the basic operational relationships of public-key cryptography (such as multiplication, modular exponentiation, or linear operations on lattice).

[0097] In some optional embodiments, the first communicating party reads a pre-configured or real-time generated first authentication message from a local or associated storage unit. The first authentication message contains at least the first public key of the first communicating party, and in some embodiments may also contain a first coordination signal and / or a first digital signature. The first public key is public key material generated by performing corresponding operations on the modular business ring based on global public parameters obtained from the trust center and a first private key independently selected by the party. The first coordination signal is auxiliary correction data generated after error coordination quantization processing of the first original shared value. The first digital signature is an authentication credential obtained by performing a modular lattice signature operation on the concatenation result containing the first temporary public key, the first coordination signal, and the second long-term public key of the second communicating party using the first long-term private key. After the acquisition operation is completed, the first authentication message is encapsulated into a protocol data unit to be sent, ready to be sent to the second communicating party via the communication interface.

[0098] In some embodiments, the public parameters sent by the trust center and the second public key sent by the second communication party are obtained; based on the public parameters, a first public key and a first private key of the first communication party are generated; based on the first public key, the first private key, and the coordination signal of the first communication party, a first authentication message is generated to be sent to the second communication party.

[0099] Among them, the public parameters are parameters that are shared and fixed by the trust center, the first communicator, and the second communicator. The public parameters refer to a global set of data generated and publicly released by the trust center during the system initialization phase, which is known to all communicators within the entire cryptographic system and remains fixed. It constitutes the common foundational environment for the entire protocol's operation. It includes at least the following core elements: a public matrix (such as a uniform random matrix A on a module lattice), a modulus q, an error distribution χ (such as a discrete Gaussian distribution), and a hash function (such as a quantum-resistant hash function).

[0100] In this system, the Trust Center is a trusted third-party entity responsible for generating global public parameters and the system's master private key during the system initialization phase. It serves as the trust anchor for the entire cryptographic system, selecting security parameters and module dimensions based on a preset quantum-resistant security level, generating the modulus, error distribution, and hash function, and randomly and uniformly selecting the public matrix, master secret vector, and master error vector. The public parameters are distributed to all registered communication parties through secure channels. The system's master secret vector is stored in certified secure hardware (such as an HSM) and will never be leaked. The Trust Center only participates in system setup during the offline initialization phase and does not participate in any real-time computation during subsequent online key exchange. This design minimizes the Trust Center's permissions and real-time intervention requirements, effectively reducing the risk of single points of failure and internal attacks.

[0101] The first private key refers to the private portion of the first communication party that is independently generated and secretly stored, and which mathematically forms an asymmetric key pair with the first public key. This key is used for digital signature generation and shared secret computation during protocol execution.

[0102] In LWE / lattice cryptography-based key exchange, the coordination signal refers to auxiliary public information generated by one party locally when quantizing the raw shared value. This signal helps the other party eliminate minor deviations in the shared value caused by differences in error terms between the two parties, thereby correctly reconstructing a completely consistent session key seed.

[0103] For example, the first communicating party receives global public parameters broadcast or unicast from the trust center through a secure communication interface. These public parameters include at least the modulus, error distribution, hash function, and a uniformly randomly selected public matrix on the modulus quotient ring. Simultaneously, the first communicating party obtains the second public key publicly released by the second communicating party through a certificate or online query. After obtaining the above data, the first communicating party independently and randomly samples on the modulus quotient ring according to a discrete Gaussian distribution based on the public matrix and error distribution in the public parameters to generate a first private key. Based on this first private key and the public matrix, the first communicating party performs modular multiplication and noise addition operations to calculate the corresponding first public key. Subsequently, the first communicating party independently and randomly samples locally to generate a first temporary private key and a first temporary error. The first communication party takes a vector and multiplies it with the acquired second public key to obtain a first original shared value. Then, it applies an error coordination quantization function to this first original shared value and outputs a first coordination signal and a first temporary session key seed. Finally, the first communication party concatenates the first temporary public key, the first coordination signal, and the second long-term public key of the second communication party in a preset order. It then uses its own first long-term private key to execute a digital signature algorithm on the concatenation result to generate a first digital signature. Finally, it encapsulates the first temporary public key, the first coordination signal, and the first digital signature into a first authentication message, which is stored in a sending buffer awaiting transmission to the second communication party.

[0104] S202 sends a first authentication message to the second communication party, so that the second communication party can generate a second authentication message based on the first public key in the first authentication message and the second public key of the second communication party.

[0105] The second authentication message includes the second public key of the second communicating party.

[0106] In some embodiments, the first communicating party sends a pre-encapsulated first authentication message to the second communicating party via a network link in the form of protocol data units through its communication interface. This first authentication message contains at least the first public key of the first communicating party, and in embodiments including digital signatures, it also contains a first coordination signal and a first digital signature generated based on a first long-term private key. Upon receiving the first authentication message, the second communicating party parses the message and extracts the first public key, while simultaneously obtaining a second public key that is pre-stored locally or generated in real-time. Then, based on the extracted first public key and its own second public key, it performs a product operation on the modulo quotient ring to calculate shared parameters, and based on... The shared parameters and the first coordination signal extracted from the message (if present) are used to perform error coordination recovery to restore the communication key seed of the first communicating party. Then, the communication key seed generated independently is combined with the key derivation process to generate the session key. Finally, the second long-term private key is used to perform the digital signature algorithm on the module grid on the concatenation result containing the second temporary public key, the second coordination signal and the first long-term public key of the first communicating party to generate the second digital signature. The second temporary public key, the second coordination signal and the second digital signature are combined and encapsulated into the second authentication message. The second authentication message is then stored in the sending buffer of the second communicating party in preparation for being sent back to the first communicating party.

[0107] S203 restores the communication key seed of the second communication party based on the product between the second public key and the first private key of the first communication party.

[0108] In some embodiments, the product of the second public key and the first private key of the first communicating party is used as the communication key seed of the second communicating party.

[0109] In some embodiments, a shared parameter between the first and second communicating parties is determined based on the product of the second public key and the first private key of the first communicating party; and the communication key seed of the second communicating party is restored based on the shared parameter and the coordination signal.

[0110] The coordination signal is used to eliminate the shared parameter deviation between the first and second communication parties caused by noise.

[0111] For example, after receiving the second authentication message returned by the second communication party, the first communication party extracts the second temporary public key from the message and performs a multiplication operation on the modal quotient ring with the locally stored first temporary private key and the second temporary public key to calculate the third original shared value as a shared parameter between the first and second communication parties. Subsequently, the first communication party further extracts the second coordination signal from the second authentication message, inputs the third original shared value and the second coordination signal together into the error coordination recovery function, uses the quantization boundary information contained in the second coordination signal to perform coefficient-by-coefficient correction on the high-bit deviation caused by the error term in the third original shared value, calculates the recovery value through orthogonal complementary space projection and least squares approximation, and then performs a key derivation function on the recovery value to extract a fixed-length bit string, thereby restoring the second temporary session key seed independently generated by the second communication party in the second round of the protocol.

[0112] S204 performs key derivation processing on the concatenation result between the communication key seed of the second communication party and the communication key seed of the first communication party to obtain the reference communication key of the second communication party.

[0113] In some embodiments, the first communicating party extracts the restored second temporary session key seed of the second communicating party locally, as well as the first temporary session key seed generated and saved in the first round of protocol execution. The two seeds are then concatenated sequentially at the binary level according to a preset splicing order (e.g., first seed first then second seed, or second seed first then first seed) to form a continuous spliced ​​bit string. Subsequently, the spliced ​​bit string is fed as input data into the collision-resistant key derivation function (KDF). The key derivation function performs a standardized calculation process on the input, including hash iteration, pseudo-random expansion, or HMAC-based extract-expansion, to uniformly spread the entropy of the spliced ​​bit string and map it into a fixed-length pseudo-random output. This output is the reference communication key of the second communicating party. After the calculation is completed, the reference communication key is temporarily stored in local memory, ready to be sent to the second communicating party for consistency verification.

[0114] S205 sends a reference communication key to the second communication party so that the second communication party can verify the correctness of the reference communication key based on its own standard communication key.

[0115] In some embodiments, after calculating the reference communication key, the first communicating party encapsulates the reference communication key into a protocol data unit in plaintext or with integrity protection, and sends it to the second communicating party via the network link through the communication interface. After receiving the reference communication key, the second communicating party stores it in a local temporary buffer and reads the standard communication key that it has independently calculated and saved during the protocol execution process. Then, it compares the standard communication key with the received reference communication key bit by bit to determine whether the two are completely consistent. This comparison operation serves as the basis for verifying the correctness of the key calculated by the first communicating party.

[0116] S206 Upon receiving the confirmation code sent by the second communicating party, the communication key exchange between the first and second communicating parties is completed.

[0117] The confirmation code is used to verify the correctness of the reference communication key. It refers to the final protocol confirmation signal generated and returned by the second communicating party to the first communicating party after verifying the consistency between the reference communication key sent by the first communicating party and its own standard communication key, provided that the two are completely matched. It is the concluding message of the entire two-way authentication key exchange process.

[0118] In some embodiments, after sending a reference communication key to the second communication party, the first communication party starts a local timer and enters a waiting state to monitor whether the communication interface receives an acknowledgment code data packet from the second communication party. Upon receiving the acknowledgment code, the first communication party verifies the format and validity of the acknowledgment code (in embodiments containing dynamic authentication tags, the message authentication code in the acknowledgment code also needs to be recalculated and compared using the local session key or shared materials). After the verification is successful, the first communication party transfers the session key calculated in this session from the temporary calculation buffer to the formal session key storage area and marks the session status as "authenticated" or "established". At the same time, it records the relevant context information of this session (such as session ID, communication peer identity, key lifecycle start time, etc.). After that, the first communication party stops all waiting operations in this key exchange protocol process, confirms that the two-way authentication key exchange with the second communication party has been completed, and the communication link enters the secure data communication stage.

[0119] The aforementioned two-way authentication key exchange method achieves two-way authentication and secure restoration of the communication key seed by having the first communicating party proactively initiate a public key-based authentication process and combining it with the second authentication message returned by the second communicating party. The key seed is restored using the product of the second public key and the first private key, and further concatenation and key derivation processing of both parties' key seeds significantly improves the randomness and anti-cracking capability of the communication key. Simultaneously, by sending a reference communication key for the second communicating party to verify its correctness and returning a confirmation code upon successful verification, the method ensures strict numerical consistency of the final communication key established by both parties, effectively preventing the risks of man-in-the-middle tampering and inconsistent key negotiations. Thus, while ensuring the reliability of two-way authentication, the method significantly enhances the security and stability of the key exchange process.

[0120] In one exemplary embodiment, such as Figure 3 As shown, a two-way authentication key exchange method is provided, which is applied to... Figure 1 Taking the first communicating party as an example, the explanation includes the following steps S301 to S302. Wherein:

[0121] S301 Obtains the second public key of the second communicating party and the first authentication message sent by the first communicating party.

[0122] The first authentication message includes the first public key of the first communicating party; the first authentication message also includes the coordination signal of the first communicating party.

[0123] In some embodiments, the second communicating party obtains its second public key through local storage or online certificate lookup, and simultaneously listens for and receives the first authentication message data packet sent by the first communicating party via the communication interface. Upon receiving the data packet, the second communicating party parses the first authentication message according to a preset protocol data format, extracting the first temporary public key, the first coordination signal, and the first digital signature (if present) of the first communicating party in sequence, and storing each extracted field into the corresponding local variable, while recording the message source address and receiving timestamp. Subsequently, the second communicating party temporarily stores the extracted first temporary public key together with the second public key pre-obtained locally in the context of this session, ready for use in subsequent shared parameter calculation and signature verification processes.

[0124] S302 generates a second authentication message based on the product of the first public key and the second public key in the first authentication message.

[0125] In some optional embodiments, after the second communicating party extracts the first temporary public key from the first authentication message, it performs a multiplication operation on the modular quotient ring with the first temporary public key and the locally stored second temporary private key to calculate the second original shared value as a shared parameter. Subsequently, the second communicating party independently and randomly samples according to the error distribution in the public parameter to generate the second temporary private key and the second temporary error vector, and performs modular multiplication and noise addition operations on the second temporary private key and the public matrix to generate the second temporary public key. Next, the second communicating party inputs the calculated second original shared value into the error coordination quantization function, and outputs the second coordination signal and the second temporary session key seed. After that, the second communicating party uses the first coordination signal extracted from the first authentication message and its own calculated value to obtain the second temporary shared value. The second original shared value is used to restore the first temporary session key seed of the first communicating party through the error coordination and recovery function. The first temporary session key seed is then concatenated with the second temporary session key seed generated by the first communicating party in a preset order and input into the key derivation function to calculate the first session key. Based on this, the second communicating party concatenates the second temporary public key, the second coordination signal, the first temporary public key, and the first long-term public key of the first communicating party in a preset order, and uses its own second long-term private key to perform the digital signature algorithm on the module grid to generate the second digital signature. Finally, the second communicating party encapsulates the second temporary public key, the second coordination signal, and the second digital signature into a second authentication message and stores it in the sending buffer to prepare for sending to the first communicating party.

[0126] In some embodiments, a shared parameter between the first and second communicating parties is determined based on the product of the first and second public keys; the communication key seed of the first communicating party is restored based on the shared parameter and the coordination signal of the first communicating party; a key derivation process is performed on the concatenation result of the communication key seed of the first and second communicating parties to obtain a reference communication key of the first communicating party; and a second authentication message is generated based on the reference communication key of the first communicating party and the coordination signal of the second communicating party.

[0127] For example, the second communicating party extracts a first temporary public key and a first coordination signal from the received first authentication message, and performs a multiplication operation on the first temporary public key and a locally generated second temporary private key on a modular quotient ring to calculate a second original shared value as a shared parameter. Subsequently, the second communicating party independently and randomly samples and generates a second temporary private key and a second temporary error vector based on the error distribution in the public parameters, and performs modular multiplication and noise addition operations on the second temporary private key and the public matrix to generate a second temporary public key. At the same time, the second original shared value is input into an error coordination quantization function to output a second coordination signal and a second temporary session key seed. Then, the second communicating party inputs the first coordination signal and the second original shared value together into an error coordination recovery function, and uses the quantization boundary information in the first coordination signal to adjust the second original shared value. Deviation correction is performed to restore the first temporary session key seed of the first communicating party. Then, the second communicating party concatenates the restored first temporary session key seed with its own generated second temporary session key seed in a preset order, and inputs the concatenation result into a key derivation function for pseudo-random expansion to calculate the reference communication key of the first communicating party. Based on this, the second communicating party concatenates the second temporary public key, the second coordination signal, the first temporary public key, and the first long-term public key of the first communicating party in a preset order, and uses its own second long-term private key to execute the digital signature algorithm on the module grid to generate a second digital signature. Finally, the second communicating party encapsulates the second temporary public key, the second coordination signal, and the second digital signature into a second authentication message, stores it in the sending buffer, and prepares to send it to the first communicating party.

[0128] S303 sends a second authentication message to the first communication party, so that the first communication party can generate a reference communication key for the second communication party based on the second public key in the second authentication message and the first private key of the first communication party.

[0129] In some embodiments, after the second communication party completes the encapsulation of the second authentication message, it sends the second authentication message to the first communication party via a network link in the form of protocol data units through its communication interface. The second authentication message contains at least the second temporary public key, the second coordination signal, and the second digital signature generated based on the second long-term private key of the second communication party. After receiving the second authentication message, the first communication party parses the message and extracts the second temporary public key, the second coordination signal, and the second digital signature. Then, it uses the second long-term public key obtained locally to verify the legitimacy of the second digital signature. After the verification is successful, it performs a multiplication operation on the modal quotient ring with the extracted second temporary public key and the first temporary private key stored locally to calculate the third original shared value. Then, it inputs the third original shared value and the extracted second coordination signal into the error coordination recovery function to restore the second temporary session key seed of the second communication party. Finally, it concatenates the second temporary session key seed with the first temporary session key seed generated and stored in the first round in a preset order and inputs it into the key derivation function to calculate the reference communication key of the second communication party.

[0130] S304 receives the reference communication key sent by the first communicating party and determines the consistency between the reference communication key and the standard communication key of the second communicating party.

[0131] In some embodiments, after sending a second authentication message to the first communication party, the second communication party starts a local timer and enters a waiting state to monitor whether the communication interface receives a reference communication key data packet sent by the first communication party. After receiving the data packet, the second communication party stores it in a local temporary buffer and reads the standard communication key that it has independently calculated and saved during the protocol execution process. Then, it compares the standard communication key with the received reference communication key bit by bit to determine whether the two are completely consistent. After the verification is completed, the second communication party generates a corresponding status flag based on the comparison result. If the two are consistent, it prepares to return an acknowledgment code to the first communication party. If they are inconsistent, it determines that the key exchange has failed and discards all temporary key materials for this session.

[0132] S305 sends an acknowledgment code to the first communicating party if the reference communication key matches the standard communication key.

[0133] In some embodiments, after the second communicating party completes the bit-by-bit consistency verification of the received reference communication key and its own standard communication key, if it determines that the two are completely consistent, it generates an acknowledgment code according to a preset rule. In one embodiment, it directly reads a fixed preset status value (such as a specific string or status code), while in another embodiment, it dynamically calculates and generates an authentication tag based on the agreed session key or shared materials through hash operation or message authentication code algorithm. Subsequently, the second communicating party encapsulates the acknowledgment code into a protocol data unit, sends it to the first communicating party through the communication interface via the network link, and after sending, it securely clears the temporary key materials of this session (including temporary private key, original shared value, etc.) from memory, and marks the session status as "authenticated" to complete its own protocol process.

[0134] The aforementioned two-way authentication key exchange method involves the second communicating party actively obtaining and utilizing the first public key from the first authentication message sent by the first communicating party, and multiplying it with its own second public key to generate a second authentication message. This implicitly verifies the identity of the first communicating party and builds a secure two-way authentication response mechanism. Furthermore, by sending the second authentication message back to the first communicating party to trigger the other party to generate a reference communication key, and independently determining the consistency between the reference communication key and its own standard communication key locally, the method sends an acknowledgment code to the first communicating party only when there is a perfect match. This ensures that both communicating parties can participate in identity authentication and key verification in an active and equal manner during the key negotiation process. The entire scheme effectively guarantees the numerical consistency and authentication integrity of the session key between the two parties, eliminates communication security risks caused by key discrepancies or identity forgery, and significantly improves the security and reliability of the key exchange process.

[0135] In one embodiment, this embodiment provides an optional method for two-way authentication key exchange, using the application of this method to a server as an example for illustration. For example... Figure 4 As shown, the method includes the following steps:

[0136] S401 The first communicating party obtains the public parameters sent by the trust center and the second public key sent by the second communicating party;

[0137] S402 The first communicating party generates its first public key and first private key based on the public parameters;

[0138] S403 The first communicating party generates a first authentication message to be sent to the second communicating party based on the first public key, the first private key, and the coordination signal of the first communicating party;

[0139] S404 The first communication party sends a first authentication message to the second communication party;

[0140] S405 The second communicating party obtains the second public key of the second communicating party and the first authentication message sent by the first communicating party;

[0141] S406 The second communicating party generates a second authentication message based on the product between the first public key and the second public key in the first authentication message;

[0142] S407 The second communication direction sends a second authentication message to the first communication party;

[0143] S408 The first communicating party determines the shared parameters between the first communicating party and the second communicating party based on the product between the second public key and the first private key of the first communicating party;

[0144] S409 The first communicating party restores the communication key seed of the second communicating party based on the shared parameters and coordination signals;

[0145] S410 The first communication party performs key derivation processing on the concatenation result between the communication key seed of the second communication party and the communication key seed of the first communication party to obtain the reference communication key of the second communication party.

[0146] S411 The first communication party sends a reference communication key to the second communication party;

[0147] S412 The second communication party receives the reference communication key sent by the first communication party and determines the consistency between the reference communication key and the standard communication key of the second communication party.

[0148] S413 The second communicating party sends an acknowledgment code to the first communicating party if the reference communication key is consistent with the standard communication key;

[0149] S414 Upon receiving the confirmation code sent by the second communication party, the first communication party completes the exchange of communication keys between the first and second communication parties.

[0150] It should be noted that in this embodiment, the trusted center selects security parameters and module dimensions according to the preset quantum security level, and generates the modulus, error distribution and hash function; based on the difficulty assumption of the learning problem with error on the module lattice, the public matrix, master secret vector and master error vector are randomly and uniformly selected; the public matrix, the modulus, the error distribution and the hash function are used as global public parameters, and the master secret vector is used as the system master private key.

[0151] In some embodiments, by building the system master private key, public matrix, and error vector all on a module lattice and randomly generating them based on the decisional difficulty assumption of the learning with error (LWE) problem, the security of the entire protocol is reduced to the quantum computing difficulty problem at the underlying level. Quantum algorithms (such as Shor's algorithm) cannot effectively crack this structure, thus ensuring the consistency of the long-term key and the post-quantum security level. The trusted center uniformly selects security parameters, module dimensions, and modulus according to a preset quantum security level (such as AES-128 / 192 / 256 equivalent strength), so that the global public parameters can cover the security requirements of different application scenarios. The selection of error distribution and hash function is linked to the module dimension to ensure the inherent consistency and scalability of the parameter set, facilitating deployment in different device or network environments. The master secret vector is independently sampled on the module quotient ring according to the error distribution, rather than being directly and uniformly selected, resulting in high conditional entropy and a compact structure (only a one-dimensional array). Under the same security level, the storage space required is much smaller than that of traditional schemes based on integer lattices or ideal lattices, while maintaining a sufficiently large private key space to resist exhaustive and side-channel attacks. The Trusted Center is only responsible for generating the global public parameters and the system master private key once. All subsequent long-term key pairs and temporary keys for all communicating parties are generated independently by each party, without the center's involvement in online key negotiation. This minimizes the Trusted Center's authority and real-time intervention requirements, reducing single points of failure and the risk of internal attacks. The generation methods of the public matrix, master secret, and master error are perfectly matched to the public-private key structure of the subsequent key encapsulation scheme. This enables the establishment of compact reductions (with a constant loss factor) in subsequent protocols that are independent of the number of sessions, avoiding the linear increase in reduction loss with the number of sessions in traditional protocols. This significantly improves the efficiency and reliability of formal security proofs.

[0152] For example, a cryptographic infrastructure needs to deploy a quantum-resistant authentication key exchange protocol, targeting a security level equivalent to AES-256. The trusted center chooses an algebraic number field order d = 1024, a module rank m = 3, and a modulus... (An NTT-friendly prime number), discrete Gaussian distribution with standard deviation σ = 3.2, hash function chosen is SHA-384. The center of trust is located in the model quotient ring O. K A 1 × 3 matrix is ​​randomly and uniformly generated on / q. Each of them All are 1024-dimensional vectors on the ring (each component is uniformly randomized between 0 and q-1), and the generated matrix A serves as the core part of the global common parameters. The trust center samples the master secret vector of length 3. and a principal error vector of length 1 Each of them and Each coefficient is independently drawn from a discrete Gaussian distribution with a standard deviation of 3.2. The sampling results are as follows: The coefficients are mostly small integers (e.g., -3, -1, 2, 0, 1, etc.) and the overall norm is much smaller than q. The Trust Center encapsulates (A, q, σ=3.2, Hash=SHA-384) as a globally public parameter and distributes it securely to all organizations that need to communicate (e.g., branch organizations A and B). Simultaneously, the master secret vector s is stored in a certified hardware cryptographic machine, ensuring it is never leaked. Subsequently, branch organizations A and B will independently generate their own long-term key pairs based on the same A and q, without the Trust Center's involvement again. Even if an attacker possesses a large-scale quantum computer in the future, because A is uniformly random and s and e follow a low-norm distribution, they cannot effectively recover s from (A, A·s + e) ​​(i.e., the difficulty of searching the LWE problem). Furthermore, due to the compactness and high entropy of s, any brute-force guessing of the master private key faces a 2... 256 The above search space ensures an absolutely secure foundation for system initialization.

[0153] In an alternative approach, randomly and uniformly selecting the common matrix, master secret vector, and master error vector based on the difficulty assumption of the error-laden learning problem on the modular lattice further includes:

[0154] The core algebraic parameters of the module lattice are determined according to the preset quantum security level. The algebraic integer ring of the core algebraic parameters is selected and the corresponding module quotient ring is constructed. The core algebraic parameters include the degree of the algebraic number field, the module rank, the modulus, and the boundary parameter of the error distribution.

[0155] A two-dimensional array is randomly selected in a uniform distribution on the modulus ring as a common matrix; wherein, each element in the common matrix is ​​a uniformly random element in the modulus ring.

[0156] According to the error distribution, a one-dimensional array is randomly selected on the model quotient ring as the master secret vector, and each component of the master secret vector independently follows the error distribution;

[0157] According to the error distribution, another one-dimensional array is independently and randomly selected on the model quotient ring as the master error vector. Each component of the master error vector independently follows the error distribution and is independent of the selection of the master secret vector.

[0158] In some embodiments, each element of the common matrix is ​​independently and uniformly selected within the modular quotient ring, such that the overall statistical minimum entropy of the matrix is ​​achieved. This approach minimizes the structural redundancy of the common matrix, forcing attackers to rely solely on the general solution algorithm of LWE (Limited Layer Weaponization), preventing them from exploiting algebraic shortcuts within the matrix. The master secret vector and master error vector are sampled independently and both follow the same discrete Gaussian distribution. This ensures that the norms of both are strictly controlled within preset limits (ensuring decryption / decapsulation correctness) and eliminates statistical correlation between the secret and error vectors through independence, preventing attackers from using correlation for joint inference attacks. The uniformity of the common matrix and the independent Gaussianity of the secret and error vectors directly match the standard assumptions of the decisional mLWE (Limited Layer Weaponization) problem, eliminating the need for any heuristic adjustments to the initial distribution during the subsequent compact security reduction process. The reduction process is completely transparent and formally verifiable.

[0159] For example, an IoT security platform needs to deploy the above protocol, aiming for a quantum security level of 128 bits. After consulting the difficulty table, the Trust Center determined the number field degree d = 512 (dimension 512), module rank m = 2, n = 2, modulus q = 12289 (12-bit prime), and error distribution standard deviation σ = 2.5. The parameter estimates provide approximately 128 bits of quantum security. The chosen cycloid number field K = Q( (512th circumradical region), whose algebraic integer ring O K = Z[ ], construct the model quotient ring R q = Z[ ] / (q), where each element is a polynomial of degree ≤ 511 with coefficients between 0 and 12288. Generate a 2 × 2 matrix A with the following four positions:

[0160]

[0161] Each coefficient is drawn independently and uniformly from 0 to 12288, generating a secret vector of length 2. .for From Gaussian distribution 512 coefficients were independently extracted from the sample; for example, most coefficients fell within the range {-3, -2, -1, 0, 1, 2, 3}, with a few falling within ±4. Similarly, [the following was generated]. The final overall Euclidean norm of s is approximately ≈ 56.6. Generate an error vector of length 2. Similarly from Independent sampling is performed, and it is guaranteed that all random number generator seeds are different from the seed used when generating s. and The norm is also controlled to be on a similar order of magnitude. The public matrix A is written into the firmware of all IoT devices as a global parameter, and the master secret vector s is stored in the platform's root of trust (such as HSM), used only during system initialization to generate the master public vector A·s + e (e is destroyed immediately after calculation). Subsequently, any two IoT devices can exchange secure authentication keys based on the same A and their respective independent keys without relying on a trusted center again. Since A has 2×2×512 = 2048 independent uniform coefficients (total entropy approximately...), the system can effectively achieve this. (bits), making it impossible for attackers to obtain useful information through enumeration or structured prediction. Meanwhile, the low norm properties of s and e ensure that the difference between the original shared values ​​calculated by both parties in subsequent key coordination is sufficiently small (typically norm difference < q / 4), making the probability of successful coordination close to 1-2. {-128} .

[0162] In some embodiments, the first communicating party and the second communicating party obtain the global public parameters from the trusted center respectively; the first communicating party randomly selects a first long-term private key and a first-party error vector according to the public matrix and the error distribution; the second communicating party randomly selects a second long-term private key and a second-party error vector according to the public matrix and the error distribution; the first communicating party stores the first long-term private key and the first long-term public key as its own long-term key pair; the second communicating party stores the second long-term private key and the second long-term public key as its own long-term key pair.

[0163] In some embodiments, each communicating party independently selects its own long-term private key and error vector, without the need for a trusted center to participate in online generation or distribution. This eliminates the real-time dependence on a trusted center during the key generation phase. Even if the trusted center is subsequently compromised, the generated long-term key pairs remain secure, effectively controlling the risk of single points of failure. Each party's long-term private key and error vector are independently sampled on the same modular quotient ring according to the same discrete Gaussian distribution, with the generation of private keys and errors being independent of each other. This ensures that the statistical distribution of keys is completely consistent across all communicating parties, avoiding distinguishable attacks due to individual differences, while also enabling security reduction to uniformly handle all long-term keys. The long-term public key is defined as inheriting the randomness of the public matrix and the low-norm properties of the error distribution, guaranteeing the pseudo-randomness of the public key (under the decisional LWE assumption). This makes it impossible for attackers to distinguish valid key pairs from uniformly random data from the public key, providing a solid and difficult foundation for authentication and key negotiation.

[0164] In some embodiments, the first communicating party obtains the second long-term public key and randomly selects a first temporary private key and a first temporary error vector according to the public matrix; wherein, the first communicating party generates a first digital signature based on the module grid and combines it into a first round authentication message, which is sent to the second communicating party; after receiving the first round authentication message, the second communicating party generates a second digital signature based on the module grid and combines it into a second round authentication message, which is sent to the first communicating party.

[0165] In some embodiments, modular lattice-based digital signatures are embedded in both rounds of messages (signed by the first communicating party in the first round and by the second communicating party in the second round). The authentication and exchange of session key materials between the communicating parties are atomically completed within the same protocol stream. Attackers cannot separate the authentication process from the key negotiation process, preventing combined attacks such as man-in-the-middle attacks that tamper with and replay the authentication and key materials separately. In each round of the session, both the first and second communicating parties independently and randomly select a temporary private key and a temporary error vector. The temporary key and the long-term key are structurally completely decoupled. Even if the long-term private key is compromised in the future, the key materials from previous sessions cannot be recovered (perfect forward security) because the temporary private key is destroyed after the session ends and has no derivation relationship with the long-term private key. While verifying the first digital signature, the second communicating party can simultaneously perform its own temporary key selection and the calculation of the second original shared value, allowing verification delays and calculation delays to mask each other, significantly reducing the total execution latency of the protocol without increasing security risks.

[0166] In one optional manner, the first communicating party generates a first digital signature based on the module grid and combines it into a first-round authentication message, which is then sent to the second communicating party; the second communicating party, after receiving the first-round authentication message, generates a second digital signature based on the module grid and combines it into a second-round authentication message, which is then sent to the first communicating party, further comprising:

[0167] The first communicating party uses the first temporary private key and the second long-term public key to calculate the first original shared value and obtain the first coordination signal and the first temporary session key seed from the first original shared value; it uses the first long-term private key to generate a first digital signature based on the module grid by concatenating the first temporary public key, the first coordination signal and the second long-term public key; it combines the first temporary public key, the first coordination signal and the first digital signature into a first round of authentication message and sends it to the second communicating party;

[0168] After receiving the first round of authentication messages, the second communicating party extracts the first temporary public key, the first coordination signal, and the first digital signature; verifies the legality of the first digital signature using the first long-term public key; if the verification is successful, randomly selects a second temporary private key and a second temporary error vector based on the public matrix; calculates a second original shared value using the second temporary private key and the first temporary public key; recovers the first temporary session key seed based on the second original shared value and the first coordination signal, and simultaneously generates a second coordination signal and a second temporary session key seed; calculates a first session key using the first temporary session key seed and the second temporary session key seed; and generates a second digital signature based on the module grid by concatenating the second temporary public key, the second coordination signal, the first temporary public key, and the first long-term public key using the second long-term private key; and combines the second temporary public key, the second coordination signal, and the second digital signature into a second round of authentication messages and sends them to the first communicating party.

[0169] In some embodiments, the signing scope of the first digital signature includes a first temporary public key, a first coordination signal, and a second long-term public key, while the signing scope of the second digital signature includes a second temporary public key, a second coordination signal, a first temporary public key, and a first long-term public key. Including the temporary public key, coordination signal, and both parties' long-term public keys in the signature protection ensures that any tampering with the message fields will result in signature verification failure. Simultaneously, embedding the peer's long-term public key in the signature forcibly binds this session to specific communicating parties, preventing identity confusion attacks. The first communicating party derives a first temporary session key seed from the first original shared value, and the second communicating party recovers the same first temporary session key seed through coordination. Simultaneously, the second communicating party independently generates a second temporary session key seed from the second original shared value and assists the first communicating party in recovering the second temporary session key seed through the second coordination signal. The final session key is calculated by combining the two seeds, making the security of the session key dependent on two independent original shared values. Even if one seed is partially leaked for some reason, an attacker still needs to break the other seed to recover the complete session key, achieving security redundancy. The second communicating party generates its own temporary key pair and calculates the second original shared value only after verifying the first digital signature. This avoids performing expensive lattice operations without authentication, thus defending against resource exhaustion denial-of-service attacks. Attackers cannot force the server to perform costly temporary key generation and coordination calculations by sending a large number of forged first-round messages. The coordination signal only contains quantized boundary information of the original shared value, and its information entropy is much lower than that of the complete original shared value. Even if an attacker intercepts the coordination signal, they cannot deduce the temporary private key or session key seed due to the lack of low-level details of the original shared value. Furthermore, the coordination signal does not participate in the direct key derivation of the signature content, further isolating the leakage surface.

[0170] In some embodiments, after receiving the second round of authentication messages, the first communicating party extracts the second temporary public key, the second coordination signal, and the second digital signature, and verifies the legality of the second digital signature using the second long-term public key; after successful verification, the first communicating party calculates the third original shared value using the first temporary private key and the second temporary public key; recovers the second temporary session key seed based on the third original shared value and the second coordination signal; calculates the second session key using the first temporary session key seed and the second temporary session key seed; after verifying that the second session key is numerically consistent with the first session key, the first communicating party stores the second session key as the session key, completing the key exchange for two-way authentication.

[0171] In some embodiments, the first communicating party calculates a third original shared value using its first temporary private key and second temporary public key, recovers a second temporary session key seed by combining it with a second coordination signal, and calculates a second session key by combining the first and second seeds. Since the second communicating party has already calculated the first session key using the same seed combination in the second round, the first communicating party verifies that the second session key is numerically consistent with the first session key, thus achieving implicit key confirmation without additional interaction and ensuring that both parties indeed derive the same session key. The third original shared value is calculated from the first temporary private key and the second temporary public key, and is different from both the first original shared value in the first round (calculated from the first temporary private key and the second long-term public key) and the second original shared value in the second round (calculated from the second temporary private key and the first temporary public key). Even if an attacker obtains one party's long-term private key, they cannot deduce the third original shared value of this session. The second coordination signal contains the quantized boundary information of the second communicating party's original shared value. The first communicating party uses this signal to correct the third original shared value, effectively offsetting minor deviations caused by differences in error terms between the two parties. This allows for the overwhelming recovery of a second temporary session key seed identical to that of the second communicating party. The recovery process does not rely on a reliable channel and is achieved entirely through the publicly available coordination signal. The second session key is derived jointly from the first and second temporary session key seeds, rather than relying solely on a single original shared value. This ensures that the entropy source of the session key comes from two independent temporary private keys and two sets of independent error vectors. Even if one seed is obtained by an attacker due to side-channel interference or partial state leakage, the overall security of the session key is still guaranteed by the other seed. Before using the second session key, the first communicating party actively verifies its consistency with the first session key. This allows for the detection of whether an attacker has tampered with the coordination signal or temporary public key during transmission, resulting in different keys being derived by both parties. If an inconsistency is detected, the protocol immediately terminates to prevent key degradation or splitting attacks.

[0172] In an alternative approach, recovering the second temporary session key seed based on the third original shared value and the second coordination signal further includes:

[0173] The third original shared value and the second coordination signal are input into the error coordination recovery function. The high-level deviation caused by the error term in the third original shared value is corrected by using the quantization boundary information contained in the second coordination signal, and the recovery value is calculated.

[0174] A key derivation function is executed on the recovered value to homogenize it and extract a fixed-length bit string as the second temporary session key seed.

[0175] In this embodiment, the recovered value itself may still carry some structural or weak entropy bias. Through subsequent key derivation function (KDF) processing, the recovered value can be compressed and expanded into a fixed-length pseudo-random bit string, making it statistically close to a uniform distribution. This prevents bias attacks on the session key seed caused by the leakage of partial grid coordinate information, enhancing the unpredictability of the final session key. The recovery process is entirely based on the temporary parameters of this session (the third original shared value and the second coordination signal), without relying on any historical session state or additional random numbers. Therefore, it is naturally resistant to state reuse attacks, and the reduction loss does not increase with the number of sessions, which meets the design goal of the protocol's compact security reduction.

[0176] In one alternative approach, the iterative expression formula for recovering the session key seed based on the recovered value is:

[0177]

[0178] in, For the orthogonal complement space projection operator of the module lattice; The optimal shared recovery value after lattice projection and iterative correction; This is the third original shared value calculated locally by the communicating party; It is an exponential dynamic quantification compensation coefficient; For algebraic number fields arrive The field norm mapping; For algebraic number fields arrive trace mapping; For number fields The Galois group; A quantum collision-resistant hash function; This is the session identity verification feature vector extracted from the module's digital signature; The module-based digital signature result sent by the communicating party; To coordinate the bit length of the signal quantization; For automorphic embedding maps in Galois groups; Derived function for collision-resistant key; These are the long-term public keys of the first and second communicating parties, respectively. The target output bit length for the session key seed; This is a bitwise XOR operation; It is an intermediate algebraic element in the field norm and trace mapping operations.

[0179] In some embodiments, the orthogonal complement space projection operator is used. By forcibly projecting the recovered value onto the orthogonal complement space of the modular lattice, the algebraic structure of the modular lattice is fully utilized. This systematically eliminates error components remaining in non-critical lattice directions, ensuring that the corrected value achieves the optimal distance from the theoretical expected value geometrically in the least-squares sense, reducing the recovery error probability by several orders of magnitude. When noise increases... It exhibits exponential decay, automatically reducing the compensation amplitude to avoid overcorrection and the introduction of new biases; when the noise is low... near Maintaining high quantization resolution ensures optimal recovery success rates across different security levels without manual parameter tuning. Compressing high-dimensional algebraic field elements into single scalar values ​​in the rational number field significantly reduces the bit length of the KDF input to a constant level. Furthermore, leveraging the multiplicative homomorphic property of the field norm, any minute differences in the recovered values ​​are amplified at the norm level, achieving error propagation at the KDF input stage and enhancing the final seed's sensitivity to single-component errors.

[0180] In some embodiments, after the protocol is executed, the first communicating party and the second communicating party each destroy the first temporary private key, the second temporary private key, the first original shared value, the second original shared value, and the third original shared value used in this session; establish a compact security reduction with difficulty of the error learning problem on the module lattice, and use a one-way security key encapsulation mechanism resistant to checked-chooses ciphertext attacks as the underlying primitive; wherein, the public key of the key encapsulation mechanism is the public matrix and the master public vector, and the private key of the key encapsulation mechanism is the master secret vector.

[0181] In some embodiments, all temporary private keys (first / second temporary private keys) and original shared values ​​(first / second / third original shared values) are destroyed immediately after the protocol execution is complete. This ensures that even if an attacker breaks the long-term private key or the system master private key of the communicating party in the future, they cannot recover the key material of any completed historical session. This provides strict forward security for the protocol, ensuring that the leakage of temporary keys in a single session will not affect other sessions. The security of the protocol is compactly reduced to the decisional difficulty of a learning problem with errors on a module lattice, with a reduction loss factor that is an absolute constant and does not accumulate with the increase in the number of sessions executing the protocol. Even if an attacker observes a large amount of interaction data from legitimate sessions, their advantage in breaking the protocol will not be more than a constant multiple than the advantage in solving a single mLWE instance, thus theoretically guaranteeing that the security of the protocol will not degrade under long-term multi-session deployments. By treating the key encapsulation scheme as an independent underlying primitive, KEM can be used independently in other scenarios requiring key encapsulation (such as key exchange in secure transport layer protocols) without repeatedly implementing lattice-based encryption logic, improving code reusability and the feasibility of formal verification.

[0182] In one alternative approach, a compact security reduction with difficulty in learning the error on the module lattice is established, further comprising a one-way secure key encapsulation mechanism resistant to checked-choice ciphertext attacks as an underlying primitive, including:

[0183] The Trust Center constructs a key encapsulation scheme based on the decisional difficulty assumption of the learning problem with error on the module lattice; wherein, the key encapsulation scheme includes a key generation algorithm, an encapsulation algorithm, and a decapsulation algorithm; the public key of the key generation algorithm is a public matrix and a master public vector, and the private key of the key generation algorithm is a master secret vector;

[0184] The Trust Center establishes a reduction relationship from the point where any attacker breaks the one-way security of the key encapsulation scheme to the attacker's decisional version of solving the error-laden learning problem on the module lattice, using the key encapsulation scheme as the underlying primitive of the authentication key exchange protocol; wherein, the reduction relationship is implemented by simulating the encapsulation and decapsulation queries of the key encapsulation scheme, so that each query by the attacker introduces at most a preset constant multiple of the loss factor, thus not depending on the number of protocol sessions and module dimensions.

[0185] In some embodiments, the constructed Key Encapsulation Scheme (KEM) possesses one-way security (IND-CCA2) against chosen-ciphertext attacks based on the decisional hardness of the mLWE problem. Even if an attacker can adaptively obtain the decryption result of any ciphertext (through decapsulation queries), the KEM still guarantees the indistinguishability of the encapsulated key, and its security is directly reduced to the low-level lattice hardness problem. Reducing the security of the Authentication Key Exchange (AKE) protocol to a single KEM primitive allows the security proof of the entire protocol to be performed in layers. First, the IND-CCA2 security of the KEM is proven independently (based on the mLWE assumption). Then, it is proven that the AKE protocol satisfies the expected security properties given that the KEM is a secure primitive. This simplifies the complexity of formal verification and reduces the risk of logical vulnerabilities in the proof. The reduction algorithm perfectly simulates the real protocol environment when simulating encapsulation and decapsulation queries. Attackers cannot distinguish whether their interaction is with a real protocol instance or a simulated instance constructed by the reduction algorithm, making the reduction more reliable. Even if the attacker has enormous computing power, the simulation will not expose any reduction traces.

[0186] In one alternative approach, the constraint formula for optimal equalization sampling of the master key, common matrix, and error distribution in the module lattice error learning problem is as follows:

[0187]

[0188] in, For high-dimensional modular lattice common matrix The lower bound of the statistical minimum entropy; For algebraic number fields Relative to the field of rational numbers The number of expansions; It is an m-dimensional modular rank; For module grid volume; For the discriminant of the number field; The master secret vector on the lattice With the main error vector The sampling distribution; The modulus matrix is ​​a uniform random sampling distribution; To adaptively optimize the Gaussian standard deviation; It is the lattice Euclidean norm; For model business environment On 3D matrix space; The upper bound of the statistically tolerable error probability is preset for the protocol; Discrete Gaussian distribution The minimum entropy; For algebraic number fields The corresponding algebraic ring of integers; Ring of Integers Regarding the modulus The business cycle; For safety parameters This is a negligible function of the index; This is the system's master secret vector; This is the system's main error vector; This is the global common matrix.

[0189] In some embodiments, the public matrix The lower bound of statistical minimum entropy Its value is determined by the size of the modulus ring. The product of the minimum entropy of the error distribution and the module rank and the number of expansions determines the difficulty for attackers to guess the effective information of the common matrix through exhaustive search or information theory. This provides a calculable margin of resistance to attacks for parameter selection and avoids security blind spots that rely on experience or heuristic estimation. It is guaranteed that under the selected parameters, the noise amplitude of the LWE instance will be overwhelmingly (1− The noise level is controlled within a preset threshold; even in the worst-case scenario, the probability of noise exceeding the threshold varies with the safety parameter. The super polynomial decay ensures that the protocol's decapsulation failure rate is negligible.

[0190] In one alternative approach, the quantization formula for the compact security reduction is:

[0191]

[0192] in, For attackers in security parameters Number of sessions The advantages of selective ciphertext attacks on authentication key exchange protocols; The reduction loss factor is of the absolute constant order. For reduction algorithm Find the minimum success advantage lower bound for solving the decision module LWE hard problem; For safety parameters A negligible function of superpolynomial order 1; For arbitrary probabilistic polynomial-time attackers targeting authentication key exchange protocols; For attackers Constructed modular LWE problem-solving algorithm; Pre-set quantum-resistant security parameters for the system; Number of sessions; The range of possible values ​​for the number of sessions; For protocol modulus; For algebraic number fields Relative to the field of rational numbers The number of expansions; To adaptively optimize the Gaussian standard deviation; For module grid volume; It is an m-dimensional modular rank.

[0193] In some embodiments, That is, the reduction loss factor It is an absolute constant, and does not increase at all with the increase of the number of protocol execution sessions N, even if an attacker observes a massive number (such as 2^N). 60 The advantage of breaking the protocol for the interaction data of a legitimate session (times) is no more than a fixed constant multiple than the advantage of solving a single underlying mLWE instance. This fundamentally avoids the catastrophic degradation of the loss factor in reduction as the number of queries increases exponentially or polynomially, achieving theoretically optimal compactness. It is entirely determined by publicly verifiable system parameters (number of domain expansions, modulus, Gaussian standard deviation, and module lattice volume). Security auditors can independently calculate the security margin of the protocol without relying on black-box or heuristic security estimates, enhancing the protocol's credibility and standardization potential. We present a minimum success advantage lower bound for the reduction algorithm in solving the decisional mLWE problem. This lower bound decays exponentially with the security parameter, matching the best known result in lattice theory regarding the difficulty of the LWE problem, thus providing a solid and provable security foundation for the protocol. Furthermore, this lower bound is independent of the attacker's specific strategy, guaranteeing the universality of the reduction algorithm against all probabilistic multinomial-time attackers.

[0194] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0195] Based on the same inventive concept, this application also provides a two-way authentication key exchange apparatus for implementing the two-way authentication key exchange method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the two-way authentication key exchange apparatus provided below can be found in the limitations of the two-way authentication key exchange method described above, and will not be repeated here.

[0196] In one exemplary embodiment, such as Figure 5 As shown, a two-way authentication key exchange device is provided, comprising: a first acquisition module 501, a first transceiver module 502, and a first decryption module 503, wherein:

[0197] The first acquisition module 501 is used to acquire a first authentication message; the first authentication message is used to enable the second communication party to verify the identity information of the first communication party, including the first communication party's first public key.

[0198] The first transceiver module 502 is used to send a first authentication message to the second communication party, so that the second communication party can generate a second authentication message based on the first public key in the first authentication message and the second public key of the second communication party; the second authentication message includes the second public key of the second communication party;

[0199] The first decryption module 503 is used to restore the communication key seed of the second communication party based on the product between the second public key and the first private key of the first communication party; and to perform key derivation processing on the concatenation result between the communication key seed of the second communication party and the communication key seed of the first communication party to obtain the reference communication key of the second communication party.

[0200] The first transceiver module 502 is also used to send a reference communication key to the second communication party so that the second communication party can verify the correctness of the reference communication key according to its own standard communication key; upon receiving an acknowledgment code sent by the second communication party, the communication key exchange between the first communication party and the second communication party is completed; the acknowledgment code is used to indicate that the reference communication key is correct.

[0201] In some embodiments, the first decryption module 503 is further configured to determine the shared parameters between the first communication party and the second communication party based on the product between the second public key and the first private key of the first communication party; and to restore the communication key seed of the second communication party based on the shared parameters and the coordination signal; wherein the coordination signal is used to eliminate the deviation of the shared parameters between the first communication party and the second communication party due to noise.

[0202] In some embodiments, the first acquisition module 501 is further configured to acquire public parameters sent by the trust center and a second public key sent by the second communication party; the public parameters are parameters that are common to the trust center, the first communication party, and the second communication party and are fixed; based on the public parameters, a first public key and a first private key of the first communication party are generated; based on the first public key, the first private key, and the coordination signal of the first communication party, a first authentication message is generated to be sent to the second communication party.

[0203] In one exemplary embodiment, such as Figure 6As shown, a two-way authentication key exchange device is provided, including: a second acquisition module 601, a second decryption module 602, and a second transceiver module 603, wherein:

[0204] The second acquisition module 601 is used to acquire the second public key of the second communicating party and the first authentication message sent by the first communicating party; the first authentication message includes the first public key of the first communicating party.

[0205] The second decryption module 602 is used to generate a second authentication message based on the product between the first public key and the second public key in the first authentication message;

[0206] The second transceiver module 603 is used to send a second authentication message to the first communication party, so that the first communication party can generate a reference communication key for the second communication party based on the second public key and the first private key in the second authentication message; receive the reference communication key sent by the first communication party and determine the consistency between the reference communication key and the standard communication key of the second communication party; and send an acknowledgment code to the first communication party if the reference communication key is consistent with the standard communication key.

[0207] In some embodiments, the second decryption module 602 is further configured to: determine the shared parameters between the first and second communicating parties based on the product of the first and second public keys; restore the communication key seed of the first communicating party based on the shared parameters and the coordination signal of the first communicating party; perform key derivation processing on the concatenation result of the communication key seed of the first and second communicating parties to obtain the reference communication key of the first communicating party; and generate a second authentication message based on the reference communication key of the first communicating party and the coordination signal of the second communicating party.

[0208] Each module in the aforementioned two-way authentication key exchange device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0209] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a two-way authentication key exchange method.

[0210] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0211] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0212] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0213] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0214] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0215] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0216] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0217] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A two-way authentication key exchange method, characterized in that, Applied to the first communicating party, the method includes: Obtain a first authentication message; the first authentication message is used to enable the second communicating party to verify the identity information of the first communicating party, including the first public key of the first communicating party; The first authentication message is sent to the second communication party, so that the second communication party can generate a second authentication message based on the first public key in the first authentication message and the second public key of the second communication party; the second authentication message includes the second public key of the second communication party. Based on the product between the second public key and the first private key of the first communicating party, the communication key seed of the second communicating party is restored; The concatenation result between the communication key seed of the second communication party and the communication key seed of the first communication party is subjected to key derivation processing to obtain the reference communication key of the second communication party. The reference communication key is sent to the second communication party so that the second communication party can verify the correctness of the reference communication key based on its own standard communication key; Upon receiving an acknowledgment code sent by the second communicating party, the communication key exchange between the first and second communicating parties is completed; the acknowledgment code is used to indicate that the reference communication key is correct.

2. The method according to claim 1, characterized in that, The second authentication message also includes a coordination signal from the second communicating party; the step of restoring the communication key seed of the second communicating party based on the product of the second public key and the first private key of the first communicating party includes: The shared parameters between the first and second communicating parties are determined based on the product of the second public key and the first private key of the first communicating party. Based on the shared parameters and the coordination signal, the communication key seed of the second communicating party is restored; The coordination signal is used to eliminate the shared parameter deviation between the first communication party and the second communication party caused by noise.

3. The method according to claim 1, characterized in that, The process of obtaining the first authentication message includes: Obtain the public parameters sent by the trust center and the second public key sent by the second communication party; the public parameters are parameters that are common to the trust center, the first communication party, and the second communication party and remain unchanged. Based on the public parameters, generate the first public key and the first private key of the first communicating party; Based on the first public key, the first private key, and the coordination signal of the first communicating party, a first authentication message is generated and sent to the second communicating party.

4. A two-way authentication key exchange method, characterized in that, Applied to a second communicating party, the method includes: Obtain the second public key of the second communicating party and the first authentication message sent by the first communicating party; the first authentication message includes the first public key of the first communicating party. A second authentication message is generated based on the product of the first public key and the second public key in the first authentication message; Send the second authentication message to the first communication party so that the first communication party can generate a reference communication key for the second communication party based on the second public key in the second authentication message and the first private key of the first communication party; Receive the reference communication key sent by the first communicating party, and determine the consistency between the reference communication key and the standard communication key of the second communicating party; If the reference communication key matches the standard communication key, an acknowledgment code is sent to the first communicating party.

5. The method according to claim 4, characterized in that, The first authentication message also includes a coordination signal from the first communicating party; the step of generating a second authentication message based on the product of the first public key and the second public key in the first authentication message includes: Based on the product of the first public key and the second public key, the shared parameters between the first communicating party and the second communicating party are determined; Based on the shared parameters and the coordination signal of the first communicating party, the communication key seed of the first communicating party is restored; The concatenation result of the communication key seed of the first communication party and the communication key seed of the second communication party is subjected to key derivation processing to obtain the reference communication key of the first communication party. A second authentication message is generated based on the reference communication key of the first communicating party and the coordination signal of the second communicating party.

6. A two-way authentication key exchange device, characterized in that, Applied to the first communication party, the device includes: The first acquisition module is used to acquire a first authentication message; the first authentication message is used to enable the second communication party to verify the identity information of the first communication party, including the first communication party's first public key. The first transceiver module is configured to send the first authentication message to the second communication party, so that the second communication party can generate a second authentication message based on the first public key in the first authentication message and the second public key of the second communication party; the second authentication message includes the second public key of the second communication party. The first decryption module is used to restore the communication key seed of the second communication party based on the product between the second public key and the first private key of the first communication party; and to perform key derivation processing on the concatenation result between the communication key seed of the second communication party and the communication key seed of the first communication party to obtain the reference communication key of the second communication party. The first transceiver module is further configured to send the reference communication key to the second communication party, so that the second communication party can verify the correctness of the reference communication key according to its own standard communication key; upon receiving an acknowledgment code sent by the second communication party, the first communication party and the second communication party complete the exchange of communication keys; the acknowledgment code is used to indicate that the reference communication key is correct.

7. A two-way authentication key exchange device, characterized in that, Applied to a second communication party, the device includes: The second acquisition module is used to acquire the second public key of the second communicating party and the first authentication message sent by the first communicating party; the first authentication message includes the first public key of the first communicating party. The second decryption module is used to generate a second authentication message based on the product between the first public key and the second public key in the first authentication message; The second transceiver module is configured to send the second authentication message to the first communication party, so that the first communication party can generate a reference communication key for the second communication party based on the second public key in the second authentication message and the first private key of the first communication party; receive the reference communication key sent by the first communication party and determine the consistency between the reference communication key and the standard communication key of the second communication party; and send an acknowledgment code to the first communication party if the reference communication key is consistent with the standard communication key.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images