CN115811395A

CN115811395A - Shared key generation method and device, electronic equipment and readable storage medium

Info

Publication number: CN115811395A
Application number: CN202211440732.3A
Authority: CN
Inventors: 陈世武; 李雪莹; 王炜; 江军; 杨渝
Original assignee: Beijing Topsec Technology Co Ltd; Beijing Topsec Network Security Technology Co Ltd; Beijing Topsec Software Co Ltd
Current assignee: Beijing Topsec Technology Co Ltd; Beijing Topsec Network Security Technology Co Ltd; Beijing Topsec Software Co Ltd
Priority date: 2022-11-17
Filing date: 2022-11-17
Publication date: 2023-03-17

Abstract

The application provides a shared key generation method, a device, an electronic device and a readable storage medium, wherein the method is applied to a first network node and comprises the following steps: receiving system parameters sent by a key generation center and node parameters of each network node; the system parameters include a key computation function for computing a shared key, the node parameters include: an identifier, the node parameter being formed when each of the network nodes registers at the key generation center; aiming at a second network node, acquiring a public key of the second network node in historical transaction data of the second network node; and calculating a shared secret key of two parties communicating with the second network node according to the secret key calculation function, the secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node.

Description

Shared key generation method and device, electronic equipment and readable storage medium

Technical Field

The present application relates to the technical field of computer communication security, and in particular, to a method and an apparatus for generating a shared key, an electronic device, and a readable storage medium.

Background

Key agreement refers to the agreement of two or more computer nodes to establish a shared key in a public network environment. The determined shared secret may be used for secure communications between two or more parties. The shared secret needs to be generated by the co-action of each user's openly accessible information.

In the current block chain-based shared key negotiation mode, in the key negotiation process, a large amount of information is uplink-stored, and a large amount of block chain downlink information interaction exists, so that the possibility of discovering the key negotiation process is increased, and the concealment requirement of the key negotiation is not met.

Disclosure of Invention

The application aims to provide a shared key generation method, a device, electronic equipment and a readable storage medium, which can improve the concealment and the security of a shared key negotiation process.

In a first aspect, an embodiment of the present application provides a method for generating a shared key, where the method is applied to a first network node, and the method includes: receiving system parameters sent by a key generation center and node parameters of each network node; the system parameters include a key computation function for computing a shared key, and the node parameters include: an identifier, the node parameter being formed when each of the network nodes registers at the key generation center; for a second network node, obtaining a public key of the second network node in historical transaction data of the second network node; calculating a two-party shared key for communicating with the second network node based on the key calculation function, a secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node.

By the method, the shared key negotiation process can be realized under the condition of reducing the information transmission quantity among the network nodes, the security of two-party shared key negotiation among the network nodes is improved, the possibility of discovering the shared key negotiation process is reduced, and the security of the whole key negotiation process is improved.

In an optional implementation manner, the node parameter further includes: a partial private key; prior to said computing a shared secret key for two parties communicating with the second network node from the key computation function, a secret value of the first network node, the identifier and the public key of the second network node, the method further comprising: performing identity verification on the second network node according to the identifier, the public key, a part of private keys and the system parameters of the second network node; after the authentication is passed, the step of calculating a shared key of two parties communicating with the second network node according to the key calculation function, the secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node is executed.

In the above embodiment, before determining to calculate the shared key, the identity of each network node may be verified, and shared key negotiation between communication participants with trusted identities is ensured, so as to improve the security and reliability of shared key calculation between each network node.

In an optional embodiment, the second network node is configured to perform the authentication according to the identifier, the public key, the partial private key and the system parameter of the second network nodeThe node performs identity verification through the following formula: e (pk, P) ₀ )＝e(ID _j ，g)；e(d _j ，g)＝e(q _j ，P ₀ )＝e(H ₁ (ID _j ||p _k )，P ₀ )；

Wherein pk represents a public key of the second network node; p ₀ A public key representing a system in which the second network node is located; ID _j An identifier representing the second network node; g represents a generator of the addition cycle group; d is a radical of _j A partial private key representing the second network node; q. q of _j Representing a value determined from an identifier and a public key of the second network node; e () represents a symmetric bilinear map; h ₁ () Representing a first hash function; and if the two formulas are both true, the authentication of the second network node is successful.

In an optional implementation manner, the key calculation function further includes: a first hash function, a second hash function and a symmetric bilinear mapping; the computing a two-party shared key for communicating with the second network node from the key computation function, a secret value of the first network node, the identifier and the public key of the second network node, comprising: calculating to obtain an initial shared key according to a secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node by using the first hash function and the symmetric bilinear mapping; and processing the initial shared key by using the second hash function to obtain a two-party shared key which is communicated with the second network node.

In an optional implementation, the computing, using the first hash function and the symmetric bilinear mapping, obtains an initial shared key according to a secret value of the first network node, the identifier and the public key of the first network node, and an identifier and the public key of the second network node, and is obtained by the following formula: key _i，j ＝e(s _i (q _i +q _j )，ID _j )；

The initial shared secret key is processed by using the second hash function, and is obtained by calculating according to the following formula: key _i→j ＝H ₂ (key _i，j ||r ₀ )；

Wherein, key _i，j Representing an initial shared key; e () represents a symmetric bilinear map; s _i A secret value representing the first network node; q. q.s _i Representing a value determined from an identifier of the first network node and a public key; q. q.s _j Representing a value determined from an identifier and a public key of the second network node; ID _j An identifier representing the second network node; r is a radical of hydrogen ₀ A third random number representing the system parameter; h ₂ () Representing the second hash function; key _i→j Representing a shared secret key for both parties communicating with the second network node.

In an optional implementation manner, the receiving the system parameters sent by the key generation center and the node parameters of each network node includes: and receiving system parameters sent by the key generation center and node parameters of each network node by establishing a secure channel with the key generation center.

In the above embodiment, the data generated by the key generation center is transmitted through the secure channel, and the synchronization process of the system parameters and the node parameters is completed before the key agreement is performed, so that block chain storage on the system parameters and the node parameters can be avoided, thereby reducing the risk of exposing the system parameters and the node parameters and improving the security of the shared key agreement process.

In an optional embodiment, the method further comprises: and generating a transaction address according to the two-party shared key, wherein the transaction address is used as a sending address or a receiving address when communicating with the second network node.

In the above embodiment, the exclusive transaction address can be determined according to the negotiated two-party shared key, so that the efficiency of transaction data screening is improved, and meanwhile, because the exclusive transaction address is not directly associated with the two communication parties, the security of communication between the two network nodes can be improved.

In an optional embodiment, the node parameter further includes: a secret share; the system parameters further comprise: a first random number, a second random number, and a third random number; the calculating a group key according to the two-party shared key comprises: calculating a group key secret share for the first network node from the first random number and the secret share for the first network node; acquiring a group key secret share transmitted by other network nodes in the group after being encrypted according to the two-party shared key; restoring a target polynomial according to the group key secret share of each network node and the identifier of each network node; and calculating the group key of the group according to the target polynomial, the second random number and the third random number.

In the above embodiment, when the whole group needs to communicate, the group key of the group may be constructed in the above manner, so that the communication complexity is reduced and the communication efficiency is improved while the group communication security is ensured. Therefore, the scheme in the application can meet the safety communication requirement in two-party communication and multi-party communication at the same time.

In an optional embodiment, the system parameters further include: a target hash value; before the calculating a group key of the group according to the target polynomial, the second random number and the third random number, the method further includes: calculating the hash value of the target polynomial to obtain a polynomial hash value; verifying whether the polynomial hash value is equal to the target hash value or not, and if so, passing the verification; and after the verification is passed, the step of calculating the group key of the group according to the target polynomial, the second random number and the third random number is executed.

In the above embodiment, by verifying the hash value of the polynomial, it is possible to discover in time the potentially malicious network node may have a destructive behavior on the key agreement process, and ensure the credibility and reliability of the calculated group key.

In an optional embodiment, the calculating the group key secret share of the first network node according to the first random number and the secret share of the first network node is performed by the following formula: CSh (common channel of China) _i ＝F(ID _i ，α)mod p；

Wherein, CSh _i A group key secret share representing the first network node; ID _i An identifier representing the first network node; a represents a first random number in the system parameters; p represents a prime number;

recovering a target polynomial according to the group key secret share of each network node and the identifier of each network node, and calculating by using the following formula:

wherein F (x, α) represents a target polynomial; m represents the number of network nodes included in the group; ID (identity) _i An identifier representing one network node in the group;

the group key of the group is obtained by calculation according to the target polynomial, the second random number and the third random number, and is obtained by calculation according to the following formula: s ₀ ＝(F(α，β)+r ₀ mod p；

Wherein s is ₀ A group key representing the group; β represents a second random number in the system parameter; r is ₀ Representing the third random number in the system parameter.

In an optional embodiment, the method further comprises: acquiring the secret share of the group key of the new network node; recovering a target polynomial based on the group key secret shares of the group and the new network node and the identifier of each network node; and calculating to obtain a new group key according to the target polynomial and the second random number and the fourth random number in the system parameters.

In the above embodiment, new network nodes may be added to the group as needed to meet the security communication requirements in different scenarios, and the applicability of the shared key negotiation process is improved.

In a second aspect, an embodiment of the present application provides a shared key generation apparatus, which is applied to a first network node, and includes: the receiving module is used for receiving the system parameters sent by the key generation center and the node parameters of each network node; the system parameters include a key computation function for computing a shared key, and the node parameters include: an identifier, the node parameter being formed when each of the network nodes registers at the key generation center; the system comprises a first acquisition module, a second acquisition module and a third acquisition module, wherein the first acquisition module is used for acquiring a public key of a second network node in historical transaction data of the second network node aiming at the second network node; a first calculating module, configured to calculate, according to the key calculation function, a secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node, a shared key of two parties communicating with the second network node, and calculate, according to actual communication needs, a group key according to the shared key of the two parties.

In a third aspect, an embodiment of the present application provides an electronic device, including: a processor, a memory storing machine-readable instructions executable by the processor, the machine-readable instructions being executable by the processor to perform the steps of the method described above when the electronic device is run.

In a fourth aspect, the present application provides a computer-readable storage medium, on which a computer program is stored, and the computer program is executed by a processor to perform the steps of the method described above.

Drawings

To more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and those skilled in the art can also obtain other related drawings based on the drawings without inventive efforts.

Fig. 1 is a schematic diagram of an operating environment of a shared key generation method provided in an embodiment of the present application;

fig. 2 is a block diagram of an electronic device according to an embodiment of the present disclosure;

fig. 3 is a flowchart of a shared key generation method provided in an embodiment of the present application;

fig. 4 is another flowchart of a shared key generation method provided in an embodiment of the present application;

FIG. 5 is an alternative flowchart of step 350 of a shared key generation method provided by an embodiment of the present application;

FIG. 6 is a flowchart of a shared key generation method according to an embodiment of the present application;

fig. 7 is a partial flowchart of a shared key generation method provided in an embodiment of the present application;

fig. 8 is a partial flowchart of a shared key generation method according to an embodiment of the present application;

fig. 9 is a schematic functional block diagram of a shared key generation apparatus according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures. Meanwhile, in the description of the present application, the terms "first", "second", and the like are used only for distinguishing the description, and are not construed as indicating or implying relative importance.

A shared secret may be used for secure communication between two or more communicating parties, and the shared secret needs to be generated by the co-action of openably accessible information of each communicating party.

Under the application scenario with higher security requirement, the communication participants do not want the shared key agreement process to be perceived by potential adversaries, so a variety of non-interactive key agreement methods are proposed. Compared with an interactive key agreement protocol, the non-interactive key agreement protocol omits the interactive process of information transmission between communication participants, reduces the communication traffic between the communication participants and improves the efficiency of the protocol. In the disturbed channel, by reducing the communication interaction between the communication participants, the leakage possibility of private information of the communication participants can be greatly reduced, thereby improving the communication security.

Currently, the existing non-interactive key agreement includes the following: (1) The Diffie-Hellman (DH for short) key agreement scheme is the initial form of the non-interactive key agreement scheme, but the scheme cannot resist the attack of a man-in-the-middle due to the lack of identity authentication, is limited to the key agreement between two communication participants, and has limited practical application scenes; (2) A certificate is issued to a user by a Certificate Authority (CA) based on a Public Key Infrastructure (PKI) non-interactive Key agreement protocol, and a Key of the user is ensured by a Public Key certificate. Because a trusted authentication center provides trust guarantee, the scheme has the advantages that a higher trust level can be achieved, and has the defects of high calculation cost and the problems of certificate management and certificate storage; (3) In the identity-based hierarchical non-interactive Key agreement protocol, the public Key of a user is the identity information of the user, and the Private Key is generated by a Private Key Generator (PKG). Since the PKG possesses the private keys of all communication participants, it can impersonate any communication participant without being discovered, and thus there are problems of security of key escrow, key leakage, and the like.

Based on the defects in the above scheme, the present application provides a shared key generation method, apparatus, electronic device, and computer-readable storage medium. The method further enhances the concealment of the key negotiation process on the basis of the block chain, and can realize the concealed negotiation of the shared key and the group key of two parties.

To facilitate understanding of the present embodiment, a detailed description is first given of an operating environment for executing a shared key generation method disclosed in the embodiments of the present application.

Fig. 1 shows an operating environment of a shared key generation method according to an embodiment of the present application. As shown in fig. 1, the Key Generator Center (KGC) 110 is communicatively coupled to two or more network nodes 120 via a network for data communication or interaction. The key generation center 110 may be a web server, a database server, or the like. The key generation center 110 may be constituted by a server group including a plurality of servers. The network node 120 may be a network server, a database server, or a Personal Computer (PC), a tablet computer, a smart phone, a Personal Digital Assistant (PDA), etc.

The key generation center 110 may establish a secure channel with each network node 120 over which the key generation center 110 and each network node 120 may communicate.

In this embodiment, each network node 120 may be registered in the key generation center 110, and the key generation center 110 may generate information such as an identifier, a partial private key, a secret share, and the like for each network node 120.

As shown in fig. 2, a block diagram of an electronic device 200 is shown. Each device in key generation center 110 shown in fig. 1, or alternatively, each network node 120 may comprise a component of electronic device 200 shown in fig. 2. Illustratively, the electronic device 200 may include a memory 211, a processor 213. It will be understood by those of ordinary skill in the art that the structure shown in fig. 2 is merely an illustration and is not intended to limit the structure of the electronic device 200. For example, electronic device 200 may also include more or fewer components than shown in FIG. 2, or have a different configuration than shown in FIG. 2.

The above-mentioned elements of the memory 211 and the processor 213 are directly or indirectly electrically connected to each other to realize data transmission or interaction. For example, the components may be electrically connected to each other via one or more communication buses or signal lines. The processor 213 described above is used to execute the executable modules stored in the memory.

The Memory 211 may be, but is not limited to, a Random Access Memory (RAM), a Read Only Memory (ROM), a Programmable Read-Only Memory (PROM), an Erasable Read-Only Memory (EPROM), an electrically Erasable Read-Only Memory (EEPROM), and the like. The memory 211 is configured to store a program, and the processor 213 executes the program after receiving an execution instruction, and the method executed by the electronic device 200 according to the process definition disclosed in any embodiment of the present application may be applied to the processor 213, or implemented by the processor 213.

The processor 213 may be an integrated circuit chip having signal processing capability. The Processor 213 may be a general-purpose Processor, and includes a Central Processing Unit (CPU), a Network Processor (NP), and the like; the Integrated Circuit may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The various methods, steps, and logic blocks disclosed in the embodiments of the present application may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The electronic device 200 in this embodiment may be configured to perform each step in each method provided in this embodiment. The following describes in detail the implementation of the shared key generation method by several embodiments.

Please refer to fig. 3, which is a flowchart of a method for generating a shared key according to an embodiment of the present application. The method in this embodiment may be applied to one of the network nodes in the above block chain, and the first network node is taken as an example to be described below. The specific flow shown in fig. 3 will be described in detail below.

And step 310, receiving the system parameters sent by the key generation center and the node parameters of each network node.

Illustratively, the system parameters include a key computation function for computing the shared key, the node parameters including: an identifier, a partial private key, the node parameters being formed when each of the network nodes registers at the key generation center.

The system parameter may be a data basis for enabling two network nodes or a plurality of network nodes to negotiate a shared key. The system parameters may be generated by a key generation center.

Optionally, the system parameters sent by the key generation center and the node parameters of each network node are received by establishing a secure channel with the key generation center.

The key generation center may perform system initialization work to generate system parameters required for calculating the shared key before each network node calculates the shared key.

The system parameters may include a prime number p, a positive number

The master private key of the system is shared as the entire network node, wherein,

is a finite field

A non-zero subset of elements. Illustratively, the prime number p and the positive number s are stored locally at the key generation center.

The key generation center may also determine a security parameter λ for controlling the security level of the entire system. For example, the security parameter λ may take a fixed value for defining the length of the subsequently generated shared secret key. For example, the safety parameter λ may be 128, 256 equivalents.

The key generation center may also determine a predetermined polynomial F (x, y), which may be a symmetric bivariate polynomial. Wherein the predetermined polynomial satisfies F (x, y) = F (y, x).

The system parameters may include information such as a partial random number, a key calculation function, etc.

Exemplary system parameters may include: params = (G) ₁ ，G ₂ ，e，p，p ₀ ，H ₁ ，H ₂ ，α，β，r ₀ ，H ₀ )。

Wherein, G ₁ To be defined in a finite field

Addition loop group with upper order large prime number p, G ₂ A multiplication loop group of order p; e: g ₁ ×G ₁ →G ₂ A symmetric bilinear map is formed; the addition cycle group G is denoted by G ₁ The generator of (2) can be, for example, a base point on an elliptic curve used by the blockchain, and the public key of the whole sharing system is P ₀ ＝sg；

Is two secure hash functions, where H ₁ Can be expressed as a first hash function, this H ₂ May be expressed as a second hash function that,

is G ₁ A non-zero subset of elements of (a);

α, β and r ₀ Are not equal to each other, the symbol ∈ _R "denotes uniform random selection from the set to the right of the symbol, where α can be represented as a first random number, β can be represented as a second random number, r ₀ May be expressed as a third random number; h ₀ ＝H ₂ (F (α, β)) used for verifying the validity of the group key when performing group key agreement.

In this embodiment, before each network node joins the blockchain network, the key generation center may synchronize the system parameter params to each network node through the secure channel.

Before generating the shared key of each network node, each network node may be registered in the key generation center to generate the node parameter of each network node.

Taking the first network node i as an example, the first network node may randomly select a secret value before registering with the key generation center

A partial public key pk of the first network node can then be calculated from the secret value _i ＝s _i g. Its unique identifier ID _i ＝s _i P ₀ 。

The first network node i may then share its part of the public key pk _i And identifier ID _i Sending to a key generation center, which may generate a partial private key d for the first network node _i ＝sq _i ＝sH ₁ (ID _i ||pk _i ) Wherein "|" is a join operator, indicating that two strings are joined. The complete private key of the first network node i may be denoted SK _i ＝(s _i ，d _i )。

For the key generation center, the key generation center can only know a partial private key of the first network node i generated by the key generation center, and cannot know a complete private key of the first network node i. Thus, the complete private key of the first network node i is also in a secret state.

The identifier ID of the first network node i _i And part of the private key d _i As a public parameter, all network nodes needing key agreement are synchronized through the key generation center. Alternatively, the key generation center may synchronize to all network nodes that need to perform shared key agreement through a secure channel.

The key generation center may determine a secret share for each network node that requires shared key agreement. Take the first network node i as an example, its secret share is Sh _i ＝F(ID _i Y) mod p. The secret share can also be passed through a secure channel by the key generation centerThe channel is passed to each network node.

Step 330, for a second network node, obtaining a public key of the second network node in the historical transaction data of the second network node.

In this embodiment, after the key generation center completes parameter initialization and the network nodes complete registration in the key generation center, each network node joins the blockchain network and may broadcast transaction data through the blockchain network. Take a first network node i and a second network node j as an example. Since the transaction data includes the public key information of each network node, when the first network node i needs to communicate with the second network node j, the first network node i may extract the public key pk from the transaction data.

Step 350, calculating a shared secret key for two parties communicating with the second network node based on the secret calculation function, the secret value of the first network node, the identifier and the public key of the second network node.

In this embodiment, when group communication is required, the group key may be calculated according to the shared key of the two parties. The group may be a group of network nodes including the first network node.

In the method provided by the embodiment of the application, the shared key negotiation process can be realized under the condition of reducing the information transmission quantity among all the network nodes, the security of carrying out two-party shared key negotiation among all the network nodes is improved, the possibility of discovering the shared key negotiation process is reduced, and the security of the whole key negotiation process is improved.

In order to improve the security and reliability of the shared key agreement, the network node identity may also be verified before the two-party shared key agreement is performed through step 350. Thus, as shown in fig. 4, prior to step 350, the method may further comprise: step 340, performing identity verification on the second network node according to the identifier, the public key, a part of private key and the system parameter of the second network node.

After the verification passes in step 340, step 350 is performed.

Alternatively, verification can be done by the following formula: e (pk, P) ₀ )＝e(ID _j ，g)；

e(d _j ，g)＝e(q _j ，P ₀ )＝e(H ₁ (ID _j ||p _k )，P ₀ )；

Wherein pk represents the public key of the second network node; p is ₀ A public key representing a system in which the second network node is located; ID (identity) _j An identifier representing the second network node; g represents a generator of the addition cycle group; d is a radical of _j A partial private key representing the second network node; q. q.s _j Representing a value determined from the identifier and the public key of the second network node; e () represents a symmetric bilinear map; h ₁ () Representing a first hash function;

if both the above formulas are true, it means that the obtained public key belongs to the second network node j, pk = pk _j Thus, the authentication of the second network node j is realized, which indicates that the authentication of the second network node is successful.

It will be appreciated that the second network node may also authenticate the first network node in the manner described above. Of course, if more than two network nodes participate in the shared key agreement, any one network node may authenticate another network node in the manner described above.

In this embodiment, the key calculation function further includes: a second hash function. As shown in fig. 5, the step 350 may include: step 351 and step 352.

Step 351, using the first hash function and the symmetric bilinear mapping, calculating to obtain an initial shared key according to the secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node.

Step 352, using the second hash function, processes the initial shared key to obtain a two-party shared key for communicating with the second network node.

Illustratively, the initial shared key may be calculated by the following formula:

key _i，j ＝(s _i (q _i +q _j )，ID _j )；

the second hash function is used to process the initial shared secret key, and the initial shared secret key is obtained by the following formula: key _i→j ＝H ₂ (key _i，j ||r ₀ )；

Wherein, key _i，j Representing an initial shared key; e () represents a symmetric bilinear map; s is _i A secret value representing the first network node; q. q.s _i Representing a value determined from the identifier of the first network node and the public key; q. q of _j Representing a value determined from the identifier and the public key of the second network node; ID _j An identifier representing the second network node; r is ₀ A third random number representing the system parameter; h ₂ () Representing a second hash function; key _i→j Representing a shared key for both parties communicating with the second network node.

In this embodiment, e(s) _i (q _i +q _j )，ID _j )＝s _i s _j ·e(H ₁ (ID _i ||pk _i )+H ₁ (ID _j ||pk _j )，P ₀ ) And e(s) _j (q _j +q _i )，ID _i )＝s _j s _i ·e(H ₁ (ID _j ||pk _j )+H ₁ (ID _i ||pk _i )，P ₀ ) From this, a key can be determined _i，j ＝key _j，i It may be determined that the initial shared secret calculated by the first network node is the same value as the initial shared secret calculated by the second network node.

It can thus be determined that the shared key calculated by the first network node is equal to the shared key calculated by the second network node, i.e. it is determined that

The device is

Can be used as a first netThe two parties between network node i and second network node j share a secret key that can be used for subsequent operations, such as covert communication based on block chaining.

In order to further improve the communication efficiency between the network nodes, a dedicated transaction address can be established for covert communication performed by the network nodes by using the shared secret key. Therefore, as shown in fig. 6, the shared key generation method may further include: a transaction address is generated based on the shared key 360.

The transaction address may be used as a sending address or a receiving address when communicating with the second network node.

The transaction address may be set as a sending address when communicating with the second network node according to actual requirements, or may be set as a receiving address when communicating with the second network node. For example, the transaction address may be set as a sending address when communicating with the second network node, and a receiving address when communicating with the second network node may be randomly generated; for another example, the transaction address may be set as a receiving address when communicating with the second network node, and a sending address when communicating with the second network node may be randomly generated.

Illustratively, the group G of rounds of addition may be based on the shared key and system parameters ₁ Is represented as the address coordinates of the points on the elliptic curve used by the generator g to generate the blockchain

And then generating an address private key of the special transaction address between the first network node i and the second network node j according to the address coordinates.

For example, the coordinates of a point on the elliptic curve may be represented as T = (x, y), and | x | = | y |, i.e., the representation of abscissa x and ordinate y under the same scale is of equal length. Get

As a result of generating the first network node i andprivate address key at a special transaction address between second network nodes j, wherein the symbol

Representing an exclusive or operation.

Then, the corresponding special address Addr is generated through the block chain address generation rule _special The special address Addr _special The transaction address can be used as a transaction address, which can be used as a sending address when a transaction is performed between the first network node i and the second network node j, and can also be used as a receiving address when a transaction is performed between the first network node i and the second network node j, and the sending address is used for marking a special transaction between the first network node i and the second network node j.

After determining the transaction address and the two-party shared key, the first network node i and the second network node j can share the key through the two parties

Encrypting the hidden information and passing it through the address Addr _special And constructing special transaction containing hidden information, and realizing hidden communication based on a block chain.

Through the steps, the shared key can be negotiated between the two network nodes, and the shared key can be negotiated under the condition of no information interaction.

In other scenarios, when more than two network nodes need to build a shared key, a group key may also be built between multiple network nodes. The node parameters received in step 310 may further include: a secret share; the system parameters also comprise: a first random number, a second random number, and a third random number.

Wherein the group key may be constructed on the basis of the two-party shared key, therefore, after step 350, as shown in fig. 7, the shared key generation method may further include steps 371 to 374.

Step 371 calculates a group key secret share for the first network node based on the first random number and the secret share of the first network node.

Illustratively, the secret share of the first network node may be in a pending polynomial, and the group key secret share of the first network node may be obtained by substituting the first random number into the pending polynomial.

And 372, acquiring a group key secret share transmitted by other network nodes in the group after the other network nodes are encrypted according to the two-party shared key.

The group is a group of network nodes including a first network node. Any two network nodes in the group negotiate the two parties' shared key and transaction address by using the steps 310 to 360.

Optionally, each network node in the group computes a group key secret share locally to it. And then synchronizes its group key secret share to other network nodes in the group.

In this embodiment, the group key secret shares between any two network nodes in the group are synchronized, and may be encrypted by using a shared key of the two parties, and transmitted after being marked by using a transaction address as a special transaction tag.

Step 373 recovers the target polynomial based on the group key secret shares of the respective network nodes and the identifiers of the respective network nodes.

Step 374, calculating a group key of the group according to the target polynomial, the second random number and the third random number.

In order to improve the credibility and reliability of the calculated shared secret key, the determined target polynomial can be verified. Therefore, the system parameters further include: before step 374, the group key generation method may further include: calculating the hash value of the target polynomial to obtain a polynomial hash value; verifying whether the polynomial hash value and the target hash value are equal.

Illustratively, each network node needs to verify whether its computed polynomial hash value is equal to the target hash value received from the key generation center.

If the two are equal, the verification is passed; after the verification is passed, step 374 is performed.

Illustratively, the above step 371 may be calculated by the following formula:

CSh _i ＝F(ID _i ，α)mod p；

wherein, CSH _i A group key secret share representing the first network node; ID _i An identifier representing the first network node; a represents a first random number in the system parameter; p represents a prime number;

illustratively, the above step 373 can be calculated by the following formula:

wherein F (x, α) represents a target polynomial; m represents the number of network nodes included in the group; ID (identity) _i An identifier representing one network node in the group.

After the target polynomial is determined, a second random number may be substituted into the target polynomial to yield F (β, α). In one example, the polynomial is a symmetric polynomial, and F (β, α) = F (α, β) may be determined.

The hash value can be calculated by the second hash function, i.e. H' = H ₂ (F(α，β))。

Network node verification in a group H' = H ₀ And if yes, the verification is passed.

Illustratively, the above step 374 can be calculated by the following formula:

s ₀ ＝(F(α，β)+r ₀ )mod p；

wherein s is ₀ A group key representing the group; beta represents a second random number in the system parameter; r is ₀ A third random number representing the system parameter.

It is inevitable that after a group has constructed a group key, new network nodes may also be added to form a new group. Therefore, after the above steps, as shown in fig. 8, the group key generation may further include the following steps 381 to 383.

Step 381 obtains the secret share of the group key for the new network node.

Exemplarily, the new network node may be denoted as k, and the identifier of the new network node k may be denoted as ID _k The secret share of the group key of the new network node k may be denoted as CSh _k ＝F(ID _k ，α)mod p。

Then, a fourth random number is determined from the third random number.

Optionally, before step 381, a new network node and two parties sharing keys and transaction addresses with each network node in the group may be constructed in the manner of steps 310 to 350.

When the new network node synchronizes the secret group key share to each network node in the group, the new network node may encrypt the secret group key share by using the determined shared key of the two parties, mark the secret group key share by using the determined transaction address as a special transaction tag, and transmit the secret group key share of the new network node to each network node in the group. By transmitting the secret share of the group key in the above manner, the security and the concealment of data transmission can be improved.

The target polynomial is recovered 382 based on the group key secret shares of the group and the new network node and the identifiers of the respective network nodes.

This step 382 may be similar to the above step 373, except that the number of network nodes involved in the calculation of step 382 is one more than the number of network nodes involved in step 373.

And 383, calculating to obtain a new group key according to the target polynomial and the second random number and the fourth random number in the system parameter.

OptionallyAlternatively, a fourth random number may be determined from the third random number, which may be represented as r, for example ₁ ＝H ₂ (r ₀ )。

And then, calculating to obtain a new group key according to the target polynomial and the second random number and the fourth random number in the system parameters.

Illustratively, this may be represented by the following formula: s ₁ ＝(F(α，β)+r ₁ )mod p。

Before step 383, the target polynomial may also be verified, and x = β may be substituted into the target polynomial calculated in step 382 to obtain F (β, α) = F (α, β), and its hash value H = H is calculated ₂ (F (. Alpha.,. Beta.)). Each network node verifies whether the calculated hash value meets the formula H' = H ₀ If both are satisfied, the verification is passed.

In each method provided by the embodiment of the application, before a network node joins a block chain network, system parameter synchronization and a registration process of the network node in a key generation center are completed through a down-link secure channel, and the system parameter and node information obtained by network node registration are not stored in an uplink, so that the concealment of shared key negotiation based on the block chain can be ensured, the system parameter synchronization, the node registration and the key negotiation process are separated, the on-link information synchronization in the key negotiation process is avoided, and the security of the key negotiation is improved.

Furthermore, in the two-party shared key negotiation stage of the two network nodes, by using the key generation idea of a certificateless public key system for reference, a part of private keys generated by a key generation center for the network nodes are used as public parameters, public key information is obtained by scanning transaction data, and the identity verification process is completed, so that the key negotiation process is ensured to be carried out between credible network nodes; in the group key negotiation stage, the group key secret share of each network node is synchronized through special transaction by the constructed two-party shared key and the transaction address, and the concealment of shared key negotiation based on the block chain is further ensured, so that the concealment of information interaction in the key negotiation process is realized based on the block chain.

Further, the method provided by the embodiment of the present application is not oriented to any specific block chain, and is applicable to various block chain networks including public chains, so as to solve the problem of applicability of the technical scheme to the block chain.

Based on the same application concept, a shared key generation device corresponding to the shared key generation method is further provided in the embodiments of the present application, and since the principle of solving the problem of the device in the embodiments of the present application is similar to that in the embodiments of the shared key generation method, the implementation of the device in the embodiments of the present application may refer to the description in the embodiments of the method, and repeated details are omitted.

Please refer to fig. 9, which is a schematic diagram of functional modules of a shared key generating apparatus according to an embodiment of the present application. Each module in the shared key generation apparatus in this embodiment is configured to execute each step in the above-described method embodiment. The shared key generation device includes: a receiving module 410, a first obtaining module 420 and a first calculating module 430; the contents of each module are as follows:

a receiving module 410, configured to receive system parameters sent by the key generation center and node parameters of each network node; the system parameters include a key computation function for computing a shared key, the node parameters include: an identifier, the node parameter being formed when each of the network nodes registers at the key generation center;

a first obtaining module 420, configured to obtain, for a second network node, a public key of the second network node in historical transaction data of the second network node;

a first calculation module 430, configured to calculate a two-party shared key for communicating with the second network node according to the key calculation function, the secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node.

In one possible embodiment, the system parameters further include a partial private key;

the shared key generating apparatus provided in this embodiment may further include: the first verification module is used for verifying the identity of the second network node according to the identifier, the public key, a part of private key and the system parameter of the second network node;

after the verification is passed, the first calculation module 430 is executed.

In one possible embodiment, the first verification module verifies through the following formula:

e(p _k ，P ₀ )＝e(ID _j ，g)；e(d _j ，g)＝e(q _j ，P ₀ )＝e(H ₁ (ID _j ||p _k )，P ₀ )；

wherein pk represents a public key of the second network node; p ₀ A public key representing a system in which the second network node is located; ID _j An identifier representing the second network node; g represents a generator of the addition cyclic group; d _j A partial private key representing the second network node; q. q of _j Representing a value determined from the identifier of the second network node and the public key; e () represents a symmetric bilinear map; h ₁ () Representing a first hash function;

and if the two formulas are both established, the authentication of the second network node is successful.

In one possible implementation, the key calculation function further includes: a second hash function;

the first calculating module 430 includes a first calculating unit and a second calculating unit;

a first calculating unit, configured to calculate, using the first hash function and the symmetric bilinear mapping, an initial shared key according to the secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node;

and the second calculation unit is used for processing the initial shared key by using the second hash function to obtain a two-party shared key which is communicated with the second network node.

In one possible embodiment, the first calculating unit is calculated by the following formula:

key _i，j ＝e(s _i (q _i +q _j )，ID _j )；

the second calculation unit is calculated by the following formula: key _i→j ＝H ₂ (key _i，j ||r ₀ )；

Wherein, key _i，j Representing an initial shared key; e () represents a symmetric bilinear map; s _i A secret value representing the first network node; q. q of _i Representing a value determined from the identifier and the public key of the first network node; q. q.s _j Representing a value determined from the identifier of the second network node and the public key; ID _j An identifier representing the second network node; r is a radical of hydrogen ₀ A third random number representing the system parameter; h ₂ () Representing a second hash function; key _i→j Representing a shared key for both parties communicating with the second network node.

In a possible implementation, the receiving module 410 is configured to receive the system parameters sent by the key generation center and the node parameters of each network node by establishing a secure channel with the key generation center.

In a possible implementation manner, the shared key generating apparatus provided in this embodiment may further include: and the generating module is used for generating a transaction address according to the two-party shared key, and the transaction address is used as a sending address or a receiving address when the transaction address is communicated with the second network node.

In a possible implementation, the node parameter further includes: a secret share; the system parameters also comprise: a first random number, a second random number, and a third random number;

the shared key generation apparatus provided in this embodiment may further include:

a second calculation module, configured to calculate a group key secret share of the first network node according to the first random number and the secret share of the first network node;

a first obtaining module 420, configured to obtain a secret share of a group key transmitted by other network nodes in a group after being encrypted according to the shared key of the two parties, where the group is a group of network nodes that includes the first network node;

a first generation module, configured to recover a target polynomial according to the group key secret share of each network node and the identifier of each network node;

and the third calculation module is used for calculating the group key of the group according to the target polynomial, the second random number and the third random number.

In a possible implementation manner, the system parameter further includes a target hash value; the shared key generation apparatus provided in this embodiment may further include:

a fourth calculating module, configured to calculate a hash value of the target polynomial to obtain a polynomial hash value;

the second verification module is used for verifying whether the polynomial hash value is equal to the target hash value or not, and if so, the verification is passed;

and after the second verification module passes the verification, executing the third calculation module.

In a possible implementation manner, the second calculating module is calculated by the following formula:

CSh _i ＝F(ID _i ，α)mod p；

the first substituting module is calculated by the following formula:

wherein F (x, α) represents a target polynomial; m represents the number of network nodes included in the group; ID _i An identifier representing one network node in the group;

the third calculation module is calculated by the following formula: s ₀ ＝(F(α，β)+r ₀ )mod p；

In a possible implementation manner, the shared key generating apparatus provided in this embodiment may further include:

the second obtaining module is used for obtaining the secret share of the group key of the new network node;

a second substitution module, configured to recover the target polynomial again according to the group key secret shares of the group and the new network node and identifiers of the respective network nodes;

and the fourth calculation module is used for calculating to obtain a new group key according to the target polynomial and the second random number and the fourth random number in the system parameters.

Furthermore, an embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the computer program performs the steps of the shared key generation method in the foregoing method embodiment.

The computer program product of the shared key generation method provided in the embodiment of the present application includes a computer-readable storage medium storing a program code, where instructions included in the program code may be used to execute the steps of the shared key generation method described in the above method embodiment, which may be specifically referred to in the above method embodiment, and are not described herein again.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other ways. The apparatus embodiments described above are merely illustrative, and for example, the flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In addition, functional modules in the embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

The functions may be stored in a computer-readable storage medium if they are implemented in the form of software functional modules and sold or used as separate products. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk, and various media capable of storing program codes. It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrases "comprising 8230; \8230;" 8230; "does not exclude the presence of additional like elements in a process, method, article, or apparatus that comprises the element.

The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made to the present application by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.

The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A method of shared key generation, applied to a first network node, the method comprising:

receiving system parameters sent by a key generation center and node parameters of each network node; the system parameters include a key computation function for computing a shared key, and the node parameters include: an identifier, the node parameter being formed when each of the network nodes registers at the key generation center;

aiming at a second network node, acquiring a public key of the second network node in historical transaction data of the second network node;

calculating a two-party shared key for communicating with the second network node based on the key calculation function, a secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node.

2. The method of claim 1, wherein the node parameters further comprise: a partial private key;

prior to said computing a shared secret key for two parties communicating with the second network node from the key computation function, a secret value of the first network node, the identifier and the public key of the second network node, the method further comprising:

performing identity verification on the second network node according to the identifier, the public key, a part of private keys and the system parameters of the second network node;

after the authentication is passed, the step of computing a shared key for both parties communicating with the second network node based on the key computation function, the secret value of the first network node, the identifier and the public key of the second network node is performed.

3. The method of claim 2, wherein the second network node is authenticated according to the identifier, public key, partial private key, and system parameters of the second network node, and wherein the authentication is performed according to the following formula:

e(pk，P ₀ )＝e(ID _j ，g)；

e(d _j ，g)＝e(q _j ，P ₀ )＝e(H ₁ (ID _j ||pk)，P ₀ )；

wherein pk represents a public key of the second network node; p is ₀ A public key representing a system in which the second network node is located; ID _j Represents the secondAn identifier of the network node; g represents a generator of the addition cyclic group; d _j A partial private key representing the second network node; q. q.s _j Representing a value determined from an identifier and a public key of the second network node; e () represents a symmetric bilinear map; h ₁ () Representing a first hash function;

4. The method of claim 1, wherein the key computation function further comprises: a first hash function, a second hash function and a symmetric bilinear mapping;

the computing a two-party shared key for communicating with the second network node based on the key computation function, a secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node, comprising:

calculating to obtain an initial shared key according to a secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node by using a first hash function and the symmetric bilinear mapping;

and processing the initial shared key by using the second hash function to obtain a two-party shared key which is communicated with the second network node.

5. The method of claim 4, wherein the initial shared key is calculated from the secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node using the first hash function and the symmetric bilinear mapping, and is calculated by the following formula:

key _i，j ＝e(s _i (q _i +q _j )，ID _j )；

the second hash function is used for processing the initial shared secret key, and the initial shared secret key is obtained by calculating according to the following formula:

key _i→j ＝H ₂ (key _i，j ||r ₀ )；

wherein, key _i，j Representing an initial shared key; e () represents a symmetric bilinear map; s _i A secret value representing the first network node; q. q.s _i Representing a value determined from an identifier of the first network node and a public key; q. q of _j Representing a value determined from an identifier and a public key of the second network node; ID (identity) _j An identifier representing the second network node; r is ₀ A third random number representing the system parameter; h ₂ () Representing the second hash function; key _i→j Representing a shared key for both parties communicating with the second network node.

6. The method of claim 1, wherein receiving the system parameters sent by the key generation center and the node parameters of each network node comprises:

and receiving system parameters sent by the key generation center and node parameters of each network node by establishing a secure channel with the key generation center.

7. The method of claim 1, further comprising:

and generating a transaction address according to the two-party shared key, wherein the transaction address is used as a sending address or a receiving address when communicating with the second network node.

8. The method of claim 1, wherein the node parameters further comprise: a secret share; the system parameters further comprise: a first random number, a second random number, and a third random number;

the method further comprises the following steps:

calculating a group key secret share of the first network node from the first random number and the secret share of the first network node;

acquiring secret shares of the group key transmitted by other network nodes in the group after encryption according to the shared key of the two parties;

restoring a target polynomial according to the group key secret share of each network node and the identifier of each network node;

and calculating the group key of the group according to the target polynomial, the second random number and the third random number.

9. The method of claim 8, wherein the system parameters further comprise: a target hash value;

before the calculating a group key of the group according to the target polynomial, the second random number and the third random number, the method further includes:

calculating the hash value of the target polynomial to obtain a polynomial hash value;

verifying whether the polynomial hash value is equal to the target hash value or not, and if so, passing the verification;

and after the verification is passed, the step of calculating the group key of the group according to the target polynomial, the second random number and the third random number is executed.

10. The method of claim 8, wherein the calculating the group key secret share of the first network node from the first random number and the secret share of the first network node is performed by the following formula:

CSh _i ＝F(ID _i ，α)mod p；

wherein, CSh _i A group key secret share representing the first network node; ID (identity) _i An identifier representing the first network node; a represents a first random number in the system parameters; p represents a prime number;

and recovering a target polynomial according to the group key secret shares of the network nodes and the identifiers of the network nodes, and calculating by using the following formula:

the group key of the group is obtained by calculation according to the target polynomial, the second random number and the third random number, and is obtained by calculation according to the following formula:

s ₀ ＝(F(α，β)+r ₀ )mod p；

wherein s is ₀ A group key representing the group; β represents the second random number in the system parameter; r is ₀ Representing the third random number in the system parameter.

11. The method of claim 8, further comprising:

acquiring the secret share of the group key of a new network node;

restoring a target polynomial according to the group key secret shares of the group and the new network node and the identifier of each network node;

and calculating to obtain a new group key according to the target polynomial and the second random number and the fourth random number in the system parameters.

12. A shared key generation apparatus, for application to a first network node, the apparatus comprising:

the receiving module is used for receiving the system parameters sent by the key generation center and the node parameters of each network node; the system parameters include a key computation function for computing a shared key, and the node parameters include: an identifier, the node parameter being formed when each of the network nodes registers at the key generation center;

the system comprises a first acquisition module, a second acquisition module and a first processing module, wherein the first acquisition module is used for acquiring a public key of a second network node in historical transaction data of the second network node aiming at the second network node;

a first computing module to compute a two-party shared key for communication with the second network node based on the key computation function, a secret value of the first network node, the identifier and the public key of the first network node, and the identifier and the public key of the second network node.

13. An electronic device, comprising: a processor, a memory storing machine-readable instructions executable by the processor, the machine-readable instructions when executed by the processor performing the steps of the method of any one of claims 1 to 11 when the electronic device is run.

14. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, which computer program, when being executed by a processor, performs the steps of the method according to any one of claims 1 to 11.