CN108737100A - 基于标识的证书认证体制fxb - Google Patents

基于标识的证书认证体制fxb Download PDF

Info

Publication number
CN108737100A
CN108737100A CN201710259223.3A CN201710259223A CN108737100A CN 108737100 A CN108737100 A CN 108737100A CN 201710259223 A CN201710259223 A CN 201710259223A CN 108737100 A CN108737100 A CN 108737100A
Authority
CN
China
Prior art keywords
sign
fxb
rapk
user
key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201710259223.3A
Other languages
English (en)
Other versions
CN108737100B (zh
Inventor
范修斌
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Qingdao Bowen Guangcheng Information Safe Technology Ltd
Original Assignee
Qingdao Bowen Guangcheng Information Safe Technology Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Qingdao Bowen Guangcheng Information Safe Technology Ltd filed Critical Qingdao Bowen Guangcheng Information Safe Technology Ltd
Priority to CN201710259223.3A priority Critical patent/CN108737100B/zh
Publication of CN108737100A publication Critical patent/CN108737100A/zh
Application granted granted Critical
Publication of CN108737100B publication Critical patent/CN108737100B/zh
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Algebra (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Physics (AREA)
  • Pure & Applied Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本发明基于标识的证书认证体制FXB，属于信息安全技术领域，涉及密钥认证体制。随着网络规模的急剧扩张，证书认证越来越难以满足高速度、低消耗的需求。标识认证也存在着不能保护用户个人隐私的缺点。鉴于上述两种认证体制的不足，我们发明了基于标识的证书认证体制FXB。基于标识的证书认证体制FXB理论上是可证明安全的、应用中是满足统计零知识交互的、可满足自认证，其扩展证书可以防止重放攻击。

Description

基于标识的证书认证体制FXB
技术领域
本发明属于信息安全技术领域，涉及密钥认证体制。
背景技术
当前的正在应用的认证体制主要有PKI、IBC认证体制。PKI是证书认证体制，IBC是标识认证体制。
证书认证中，用户的工作公钥PK与用户标识ID无关。要把用户标识ID与工作公钥PK绑定，需由可信第三方(如认证中心CA)签名的证书给予证明。可信第三方签名的证书的申请、签发、验证、废止、更新等环节需要多层次的认证中心和巨大的计算资源的支持。随着网络规模的急剧扩张，证书认证越来越难以满足高速度、低消耗的需求。
标识认证中，用户标识ID和工作公钥PK是一体化的。用户标识ID自身或它的函数就是工作公钥PK。密钥管理中心KMC掌控的系统主密钥MSK。KMC以标识ID和主密钥MSK为函数的自变量，计算出用户的私钥SK。因此，用户对私钥没有完全的私有权。而在开放的网络中，用户对私钥的私有权有强烈的需求，这是现有标识认证难以满足的。
鉴于上述两种认证体制的不足，我们发明了基于标识的证书认证体制FXB。
发明内容
本发明目的是给出一种新的基于标识的证书认证体制FXB。本发明的目的是提供一种安全度高、认证速度快、计算资源消耗低、能保护用户私密的认证体制。本体制混合使用证书认证和标识认证体制，其基础密钥对，由标识密钥对和随机密钥对组成，以用户的标识密钥对为证书签名和验证密钥对，为用户自主生成的随机密钥对提供证书的签名与验证，形成了一种具有自认证功能的证书认证体制，整个验证过程无需可信第三方的介入。
设安全椭圆曲线为E，其周期为素数P，基点为G。密钥管理中心KMC的主密钥为r，其对应的公钥为r·G＝P，并发布。
基于标识的证书认证体制FXB包括步骤：
(1)用户生成自己真实的标识ID；
(2)用户生成一组随机的公钥私钥密钥对(RAPK，RASK)，其中
为剩余类环；
(3)用户利用安全椭圆曲线E签名算法SIGN，对ID进行签名，即计算
sign1＝SIGNRASK(ID||RAPK)；
并将IDu＝ID||RAPK||sign1提交给密钥管理中心KMC；
(4)KMC审查用户提交的IDu，并验证sign1，且确保ID的真实性和唯一性；
(5)将ID||RAPK输入Hash函数H，得h＝H(ID||RAPK)；
(6)计算r+h为该用户的FXB证书签名私钥，生成标识私钥IDSK；
(7)用户FXB证书的签名公钥为(r+h)·G＝P+h·G；
(8)以IDSK为密钥，对ID||RAPK||IKMC||T进行签名，计算
sign2＝SIGNIDSK(ID||RAPK||IKMC||T)，
其中，IKMC为密钥管理中心的信息，T为发证时间；
(9)将该用户的FXB证书ID||RAPK||sign1||IKMC||T||sign2颁发给用户；
(10)用户在使用FXB证书时，使用RASK，对ID||RAPK||IKMC||T||TS进行签名，得sign3，其中TS为时间戳，生成扩展证书ID||RAPK||sign1||IKMC||T||sign2||TS||sign3；
(11)公众方利用RAPK验证sign1；
(12)公众方将ID||RAPK输入H，得h；
(13)根据h，生成标识公钥IDPK＝P+h·G；
(14)以IDPK作为验证算法的公钥，验证sign2；
(15)以RAPK验证sign3。
基于标识的证书认证体制FXB安全性分析：
命题1 基于标识的证书认证体制FXB理论上是可证明安全的。
命题2 FXB证书在应用中是满足统计零知识交互的。
命题3 基于标识的证书认证体制FXB可满足自认证，即验证方在验证FXB证书时，可以自主生成该用户的标识公钥IDPK＝P+h·G。
命题4 FXB扩展证书可以保证证书在应用中的新鲜性，从而可以防止重放攻击。

Claims (4)

1.一种基于标识的证书认证方法，其特征在于包括：
基于标识的证书认证体制FXB包括步骤：
(1)用户生成自己真实的标识ID；
(2)用户生成一组随机的公钥私钥密钥对(RAPK，RASK)，其中
为剩余类环；
(3)用户利用安全椭圆曲线E签名算法SIGN，对ID进行签名，即计算
sign1＝SIGNRASK(ID||RAPK)；
并将IDu＝ID||RAPK||sign1提交给密钥管理中心KMC；
(4)KMC审查用户提交的IDu，并验证sign1，且确保ID的真实性和唯一性；
(5)将ID||RAPK输入Hash函数H，得h＝H(ID||RAPK)；
(6)计算r+h为该用户的FXB证书签名私钥，生成标识私钥IDSK；
(7)用户FXB证书的签名公钥为(r+h)·G＝P+h·G；
(8)以IDSK为密钥，对ID||RAPK||IKMC||T进行签名，计算
sign2＝SIGNIDSK(ID||RAPK||IKMC||T)，
其中，IKMC为密钥管理中心的信息，T为发证时间；
(9)将该用户的FXB证书ID||RAPK||sign1||IKMC||T||sign2颁发给用户；
(10)用户在使用FXB证书时，使用RASK，对ID||RAPK||IKMC||T||TS进行签名，得sign3，其中TS为时间戳，生成扩展证书ID||RAPK||sign1||IKMC||T||sign2||TS||sign3；
(11)公众方利用RAPK验证sign1；
(12)公众方将ID||RAPK输入H，得h；
(13)根据h，生成标识公钥IDPK＝P+h·G；
(14)以IDPK作为验证算法的公钥，验证sign2；
(15)以RAPK验证sign3。
2.根据权利要求1所述的方法，其特征在于：公众方也可以生成用户证书的签名公钥，即用户的标识ID||RAPK可生成用户FXB证书签名公钥，即FXB证书含有标识认证的属性。
3.根据权利要求1所述的方法，其特征在于：用户方在被认证时，需要应用FXB证书，即FXB认证技术含有证书认证的属性。
4.根据权利要求1所述的方法，其特征在于：用户方在使用FXB证书时，使用了含时间戳的扩展的动态FXB证书。
CN201710259223.3A 2017-04-20 2017-04-20 基于标识的证书认证体制fxb Active CN108737100B (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710259223.3A CN108737100B (zh) 2017-04-20 2017-04-20 基于标识的证书认证体制fxb

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710259223.3A CN108737100B (zh) 2017-04-20 2017-04-20 基于标识的证书认证体制fxb

Publications (2)

Publication Number Publication Date
CN108737100A true CN108737100A (zh) 2018-11-02
CN108737100B CN108737100B (zh) 2021-06-18

Family

ID=63924675

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710259223.3A Active CN108737100B (zh) 2017-04-20 2017-04-20 基于标识的证书认证体制fxb

Country Status (1)

Country Link
CN (1) CN108737100B (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101420300A (zh) * 2008-05-28 2009-04-29 北京易恒信认证科技有限公司 双因子组合公钥生成和认证方法
US20100257358A1 (en) * 2009-04-07 2010-10-07 Garret Grajek Identity-based certificate management
CN102215111A (zh) * 2011-07-06 2011-10-12 北京中兴通数码科技有限公司 一种结合标识密码体制和传统公钥密码体制的方法
CN102891856A (zh) * 2012-10-18 2013-01-23 中国科学院信息工程研究所 一种多元实体与多元实体身份依赖方之间的安全访问方法
CN102957536A (zh) * 2011-08-29 2013-03-06 陈华平 基于标识的证书认证体制cfl

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101420300A (zh) * 2008-05-28 2009-04-29 北京易恒信认证科技有限公司 双因子组合公钥生成和认证方法
US20100257358A1 (en) * 2009-04-07 2010-10-07 Garret Grajek Identity-based certificate management
CN102215111A (zh) * 2011-07-06 2011-10-12 北京中兴通数码科技有限公司 一种结合标识密码体制和传统公钥密码体制的方法
CN102957536A (zh) * 2011-08-29 2013-03-06 陈华平 基于标识的证书认证体制cfl
CN102891856A (zh) * 2012-10-18 2013-01-23 中国科学院信息工程研究所 一种多元实体与多元实体身份依赖方之间的安全访问方法

Also Published As

Publication number Publication date
CN108737100B (zh) 2021-06-18

Similar Documents

Publication Publication Date Title
CN107579819B (zh) 一种sm9数字签名生成方法及系统
US10944575B2 (en) Implicitly certified digital signatures
Li et al. Cryptanalysis and improvement of certificateless aggregate signature with conditional privacy-preserving for vehicular sensor networks
CN103490901B (zh) 基于组合密钥体系的密钥生成和发放方法
US10148422B2 (en) Implicitly certified public keys
CN107483191B (zh) 一种sm2算法密钥分割签名系统及方法
CN101212293B (zh) 一种身份认证方法及系统
CN103546567A (zh) 一种可信云计算环境中无证书跨域认证方法
CN107493165B (zh) 一种具有强匿名性的车联网认证及密钥协商方法
CN106341232A (zh) 一种基于口令的匿名实体鉴别方法
CN110581768A (zh) 一种基于区块链零知识证明的注册登录系统及应用
CN110034936B (zh) 一种可刺穿的数字签名方法
CN108390866A (zh) 基于双代理双向匿名认证的可信远程证明方法
Tanwar et al. A proposed scheme for remedy of man-in-the-middle attack on certificate authority
CN105187208B (zh) 非授权的基于无证书的强指定验证者签名体制
CN101447873A (zh) 一种安全的认证和加密通信方法
Jiang et al. An anonymous communication scheme based on ring signature in VANETs
CN110661816A (zh) 一种基于区块链的跨域认证方法与电子设备
CN108737100A (zh) 基于标识的证书认证体制fxb
CN107438001B (zh) 动态cfl证书认证方法
CN106789010B (zh) Cfl去中心化应用方法
Lee et al. Formally verifiable features in embedded vehicular security systems
CN117278330B (zh) 一种电力物联网设备网络的轻量级组网与安全通信方法
CN107438000B (zh) Cfl虎符认证方法
Chen et al. Analysis and improvement of identity-based designated verifier signature scheme

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant