CN108768632A - A kind of AKA identity authorization systems and method based on pool of symmetric keys and trunking traffic - Google Patents
A kind of AKA identity authorization systems and method based on pool of symmetric keys and trunking traffic Download PDFInfo
- Publication number
- CN108768632A CN108768632A CN201810529942.7A CN201810529942A CN108768632A CN 108768632 A CN108768632 A CN 108768632A CN 201810529942 A CN201810529942 A CN 201810529942A CN 108768632 A CN108768632 A CN 108768632A
- Authority
- CN
- China
- Prior art keywords
- key
- relaying
- authentication
- server
- message
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
- H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
- H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
- H04L9/0844—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0852—Quantum cryptography
- H04L9/0855—Quantum cryptography involving additional nodes, e.g. quantum relays, repeaters, intermediate nodes or remote nodes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- Electromagnetism (AREA)
- Theoretical Computer Science (AREA)
- Mobile Radio Communication Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a kind of AKA identity authorization systems and method based on pool of symmetric keys and trunking traffic, AKA identity authorization systems include member, relaying and the server for participating in AKA authentications, the member, relaying and server three are shared to have group key pond, member and relaying to be utilized respectively the arranging key that the key seed from group key pond is calculated in conjunction with random number parameter between member and relaying in AKA authentication procedures；The wherein described random number parameter is accordingly obtained in group key pond using pointer address A, in AKA authentication procedures, relaying obtains the pointer address A by server, member obtains the parameter for generating the pointer address A via relaying from server, then generates the pointer address A by the parameter.The present invention can further improve the safety of communication.
Description
Technical field
The present invention relates to safety communication technology fields, and in particular to secret authentication based on group data network and close
Key is negotiated.
Background technology
Authentication, i.e. authentication are to realize the basic fundamental of information security, and system is confirmed by examining the identity of user
Whether the user there is access to certain resource and access right, the identity that can also equally carry out between system and system to recognize
Card.
With the development of quantum computer, classical rivest, shamir, adelman will be no longer safe, and either certification still adds solution
Close field, symmetric key algorithm will propagate its belief on a large scale.Such as it is more commonly used based on symmetric key calculation in mobile communication field at present
The AKA mechanism of one of the method for authenticating of method.AKA full name " Authentication and KeyAgreement " authenticate and close
Key is negotiated.As its name suggests, AKA mechanism while authentication and has carried out the negotiation of key, is carried for the encryption of subsequent communications
Key guarantee is supplied.
As the scheme of security upgrade, the mode of pool of symmetric keys will a kind of ensure that the important aspect of key safety is
To mainstream scheme.Storage can be encrypted to all or part of content in pool of symmetric keys simultaneously, encryption key can be deposited
In the safety insulating device for storing up pool of symmetric keys host.When subsequently carrying out cipher key operation to pool of symmetric keys, need by safety
It is used after isolating device decryption.Related pool of symmetric keys can be found in Publication No. CN105337726A, entitled " based on amount
The patent of invention document of the end-to-end handheld device encryption method and system of sub- password " discloses a kind of based on quantum cryptography
End-to-end handheld device encryption method between two cipher key distribution systems of quantum communications, is formd a pair of symmetrical by QKD
Key, the user for QKD both sides carry out quantum encryption communication.
In the multicast network of a part of unit composition, group member encrypts transmission number by the encrypted mode of group key
According to.Currently, generally taking two group conversation key generating modes in cluster conversation field：Group key distributes and group key
Negotiate.The advantages of group key distributes is simply, and only needs less calculation amount and the traffic.But this key is built
Vertical mode needs a believable third party as encryption key distribution person.This condition is difficult to realize under real network environment.
In the agreement of group key agreement, all participants provide secret information as defined in agreement, establish session key jointly.Although group
Group cipher key negotiation protocol needs to consume more calculation amounts and the traffic compared with group key distribution protocol, but does not need credible
Third-party participation.This advantage makes group key agreement become the research hotspot that current group key is established in agreement.
Problem of the existing technology：
1. in group communication, the key seed involved by group key agreement usually only 1 or a small amount of can not
It keeps freshness or the variable range of key seed smaller, is easy to be cracked.
2. realizing that the cipher mode between member and relaying relies primarily on group key and is encrypted in current group, both sides
Between the key for individually communicating, the transmission of important information be not relatively not safe enough.Once group key is cracked, own
Information can all reveal.
Random number parameter during key generates in 3.AKA mechanism is in exposed state, can increase arranging key and be cracked
Risk.
4. the transmitting-receiving of message mostly uses greatly the cipher mode that plaintext version is sent or confidentiality is not strong and carries out in authentication
Encryption is easy to reveal key message in this way, reduces the safety of authentication.
Invention content
The present invention provides a kind of AKA identity authorization systems based on pool of symmetric keys, can further improve the safety of communication
Property.
A kind of AKA identity authorization systems based on pool of symmetric keys and trunking traffic, including participate in AKA authentications at
Member, relaying and server generate arranging key so that encryption between the two is logical between member and relaying by AKA authentications
Believe, the generating mode of the arranging key between member and relaying is：
The member, relaying and server three are shared to have group key pond, member and relaying to be utilized respectively from group
The arranging key between member and relaying is calculated in conjunction with random number parameter for the key seed of pool of keys；
The wherein described random number parameter is accordingly obtained in group key pond using pointer address A, in AKA authentications
In the process, relaying obtains the pointer address A by server, and member obtains with generating the pointer via relaying from server
The parameter of location A, then the pointer address A is generated by the parameter.
In the present invention, arranging key is shared by AKA authentications between member and relaying, in communication process later
In, arranging key can be used in cipher mode when the two individually communicates, other members can not know content, even if group key pond
Itself is cracked, but arranging key still can further ensure the safety of its communication.
It is member, which further to be improved in the present invention, relaying and server (i.e. Key Management server) three share has
Group key pond, preferably true random number in group key pond, and the size of key provided is larger, can guarantee in conjunction with more new strategy
The freshness of key seed is or, be more not easy to be cracked.
The random number parameter used when further improvement is generation arranging key in the present invention is not straight in a network
Transmission is connect, but transmits pointer address A or generates the parameter of the pointer address A, member and relaying are according to the pointer possessed
Address A or the parameter for generating the pointer address A can just generate random number parameter in conjunction with local group key pond, into one
Step improves security level.
In order to ensure the safety of AKA authentication procedures, between member and relaying, and lead between relaying and server
When letter, it is all made of coded communication.
Preferably, carry out utilizing the coded communication of group key pond in AKA authentication procedures between member and relaying, in
After the arranging key coded communication shared in advance using the two between server, specifically include：
Member sends authentication request to relaying；
Relaying obtains corresponding Ciphering Key in response to the authentication request and from server, and the Ciphering Key includes
It states pointer address A and generates the parameter of the pointer address A；
It relays to send to member and puts question to message, and in the enquirement message comprising the generation pointer from Ciphering Key
The parameter of location A；
Member sends corresponding authentication responses in response to the enquirement message to relaying；
After relaying verifies the authentication responses, authenticating result is sent so that member carries out confirmation completion to member
AKA authentications.
Member to relaying send authentication request, relay to member send put question to message, member to relaying send authentication answer
It answers and relays during member sends authenticating result, the communication between member and relaying is related to, since the two shares group
Group key pond, therefore using the coded communication of group key pond.
Preferably, when member is with trunking traffic, masters generate the negotiation code of random number form, logical using the negotiation code
It crosses specified pointer address algorithm and obtains pointer address, the random of designated length is taken out from group key pond according to the pointer address
Number, recycles specified key schedule and the generating random number group chat confidentiality key and group chat Integrity Key of taking-up；
Group chat Integrity Key is used to that Content of Communication to be combined to generate and verify corresponding identifying code；
Group chat confidentiality key is for being encrypted and decrypting in conjunction with Content of Communication.
Similarly, when relaying obtains Ciphering Key from server, including relaying sends Ciphering Key request to server, and
Server sends Ciphering Key feedback, the communication being directed between relaying and server, since the two is total in advance to relaying
Arranging key is enjoyed, therefore using the shared key coded communication between relaying and server.
Relay server between shared arranging key can be generated according to the prior art, in addition relaying and server it
Between can share private cipher key pond, therefore relaying the arranging key shared between server can utilize private cipher key pond to give birth to
At further increasing safety.
Preferably, member and relaying also have private cipher key pond, member and relaying mutually independent total with server respectively
Its private cipher key pond is enjoyed to generate authentication key；
The pointer address A is that the authentication key between random number A binding members and server is corresponding by assignment algorithm
It obtains, the random number A is generated by server.
Include pointer address A and random number A in the Ciphering Key, since pointer address A is that random number A is combined into
Authentication key between member and server generates, therefore relays and need to directly acquire pointer address A from Ciphering Key, and member
Only need to obtain random number A in conjunction with locally authentication key can voluntarily generate pointer address A accordingly.
Existing means can be used in the authentication key generated between the two using private cipher key pond between member and server, together
The authentication key of private cipher key pond generation between the two can also be utilized between reason relaying and server as needed.
Preferably, the key seed is accordingly obtained from group key pond using pointer address B, pointer address B is
It is accordingly obtained by assignment algorithm using random number B, the random number B is generated by relaying and given by the enquirement message distribution
Member.
Other than possessing group key pond, the acquisition of key seed also needs to corresponding pointer address B, and random number B is in
After generation, pointer address B is obtained in conjunction with pointer address algorithm, safety can be further increased in this way,
The present invention is used to generate the information of arranging key, can be key seed, random number parameter or for generating the former
Pointer address A, random number A, pointer address B, random number B, respective algorithms and algorithm ID etc., Ciphering Key and enquirement disappear
Breath includes at least part information above so that member and relaying finally obtain all conditions for generating arranging key.
Preferably, in Ciphering Key also include with the relevant sequence number SQN of member, sequence number SQN is also by enquirement
Message is sent to member, and member puts question to message using sequence number SQN verifications.
Preferably, sequence number SQN in Ciphering Key is encrypted using Anonymity Key, the Anonymity Key using member and
Authentication key and random number A between server generate.
Preferably, also including certification response in Ciphering Key, which utilizes the mirror between member and server
It weighs key and random number A is generated；
Relaying directly acquires certification response in Ciphering Key, and member, which receives to put question to message and verify sequence number SQN, to be passed through
Afterwards, message authentication code is generated in the way of corresponding with certification response is generated, and by message authentication code in a manner of authentication responses
It is sent to relaying, response and the comparison certification of message authentication code are authenticated for relaying.
Preferably, the AKA identity authorization systems are implemented based on wireless multi-hop network, going back for AKA authentications is participated in
It is included in several communication nodes of transparent transmission message between member and relaying.
Each communication node can be considered as a wherein member, suitable if not having other communication nodes between member and relaying
In the two and direct communication, if there is other communication nodes, the transmission of the message between member and relaying is needed by successively
Forwarding, but the communication node forwarded is not involved in encryption and decryption to the message.It is only directed to each member and is required for reception
Group message, then group group member the message can be decrypted.
Participate in the servers of AKA authentications at least there are two, one of them is and the belonged to first server of relaying,
The second server that other in which is belonged to by member, and to possess group close for one of first server and second server
Key pond；
After first server receives the Ciphering Key request from relaying, Ciphering Key request is transmitted to second service
Corresponding Ciphering Key is asked in response to the Ciphering Key and generated to device, second server, then the shape fed back with Ciphering Key
The Ciphering Key is sent to relaying by formula via first server.
Relaying ownership first server, it will be appreciated that the two can secure communication, i.e. shared arranging key, and shared private in advance
There is pool of keys.
Member belongs to second server, it will be appreciated that and the two shares authentication key and shared private cipher key pond, and in addition second
Server also prestores and the relevant information of member, which can be sent to member with Ciphering Key and enquirement message, for member
To puing question to message to be authenticated.
The present invention also provides a kind of AKA identity identifying methods based on pool of symmetric keys and trunking traffic, including：
Step S1, member send authentication request to relaying；
Step S2, relaying obtain corresponding Ciphering Key, and the Ciphering Key in response to the authentication request and from server
Include pointer address A and random number A；
The pointer address A is that the authentication key between random number A binding members and server is corresponding by assignment algorithm
It obtains, the random number A is generated by server；
The member, relaying and server three are shared group key pond, and relaying is by pointer address A in group key
Random number parameter is accordingly obtained in pond, and the negotiation between member and relaying is calculated in conjunction with the key seed in group key pond
Key；
Step S3 is relayed to send to member and is putd question to message, and includes the random number from Ciphering Key in the enquirement message
A；
Member receives the enquirement message, generates pointer address A by random number A, then close in group by pointer address A
Random number parameter is accordingly obtained in key pond, and the association between member and relaying is calculated in conjunction with the key seed in group key pond
Quotient's key；
Step S4, member send corresponding authentication responses to relaying；
After relaying verifies the authentication responses, authenticating result is sent so that member carries out really to member by step S5
Recognize and completes AKA authentications.
The relevant operation of each step can also be in conjunction with the present invention in relation to the associated description in AKA identity authorization systems, no longer
It repeats.
The present invention improves the capacity and convertibility of key seed in terms of group key agreement, while also assuring close
Key generates the truly random property and safety of required random number, largely improves the high confidentiality of group chat information.In identity
In terms of certification and key agreement, the present invention realizes crowd group member and relays bipartite independent authentication.Arranging key
Key seed can not calculate acquisition outside group, and the random number parameter of arranging key can not calculate acquisition, therefore institute in group
The key of negotiation has high security.Meanwhile the authentication key used in the authentication system can regularly replace, and reduce mirror
The risk that power key is cracked.Meanwhile Key Management server is in quantum communication network, the transmission between each server is equal
Using the encrypted transmission of QKD modes, it is ensured that the safety of the message transmission of cross-server.
Description of the drawings
Fig. 1 is the scene graph of embodiment 1；
The partial parameters schematic diagram that Fig. 2 is possessed respectively by member C, R and S in embodiment 1；
Fig. 3 is the authorizing procedure figure (dotted line message transfer process additional when being the update of authentication key group) of embodiment 1；
Fig. 4 is the scene graph of embodiment 2；
The partial parameters schematic diagram that Fig. 5 is possessed respectively by member C, R, S1 and S2 in embodiment 2；
Fig. 6 is the authorizing procedure figure (dotted line message transfer process additional when being the update of authentication key group) of embodiment 2；
Fig. 7 is the derivative scene graph of embodiment 2.
Specific implementation mode
Embodiment 1
System explanation
The scene of the present embodiment is as shown in Figure 1, in this figure, member R, member A0, member A1 member A2, member A3, member
A4 and member C is the member of same group, and member R is relaying unit.
The masters that authentication is participated in this figure are C, contain private cipher key pond KCWith group key pond KG；It is passive to participate in authentication
Side is R, contains private cipher key pond KRWith group key pond KG。
Pool of symmetric keys of the private cipher key pond between member and server-side, and group key pond is each in group
Pool of symmetric keys between member.
Member S is Key Management server, also makees server-side, member C and member R all belong to S, contain all members'
Private cipher key pond and group key pond KG。
Member R has carried out authentication and key agreement, therefore between R and S as communication relay with member S
Communication has been carried out symmetric cryptography, the arranging key CK of the sides RRAnd IKRIt indicates, the arranging key CK of the sides SR' and IKR' table
Show.
As shown in Fig. 2, the identity code of member C, member R and member S are respectively ID=IDC, ID=IDRAnd ID=
IDS, while member C and member R record the identity code PID, the i.e. ID of member S for having ownership Key Management server ---
IDS.C, the cryptography module of R and S holds corresponding pool of keys (including private cipher key pond and group key pond), all kinds of calculations
Method and authentication key group.Authentication key group length is 2, and first is history key, and second is, using key, what is belonged to is close
Key management server possesses corresponding authentication key group.Authentication key group is realized based on private cipher key pond.Each key
Symbolic formulation refers to Fig. 2.
In the present embodiment, member C, member R have safety insulating device to store pool of keys.In the present embodiment member C and
The key finally negotiated after member's R authentications is that Message Encryption key CK (i.e. confidentiality key) and message authentication key IK is (i.e. complete
Whole property key).The present embodiment is likely to be at wireless multi-hop network, then may be not between member C and member R directly logical
Letter.In Fig. 1, between member C and member R the transmission of message need the forwarding by member A1.Wherein member A1 is not involved in pair
The encryption and decryption of the message.If the group message of the message transmitted by group member, group group member can disappear to this
Breath is decrypted.
The alpha codes such as suffix A, B of noun in the present invention, the serial numbers such as the digital numbers such as suffix 1,2, prefix first, second
Only for distinguishing and being convenient for description, not to as the restriction to noun meaning itself.
In communicating pair, the corresponding key of content, identifying code etc. are in order to distinguish the unusual by upper angle of holder
Mark ' it distinguishes, such as member generates RAND1 and issues relaying, relaying is held and is known as random parameter RAND 1 ' when using the random number,
But the two content is identical.
Process description
The authentication message flow diagram of the present embodiment can refer to Fig. 3, and the message that solid line indicates is the authentication of the present embodiment
And key agreement part.Detailed description are as follows for the present embodiment：
Step 1：Member C initiates authentication request to relaying R
1.1, group cipher generates：Member C is as needed, generates a random parameter RAND 1, and random parameter RAND 1 is preferably measured
The quantum random number that sub- real random number generator generates can both be generated in advance to improve safety and be stored for calling,
It can be generated according to the needs for sending group chat message.It is input to RAND1 as parameter in pointer address algorithm.According to obtaining
Pointer address from group key pond KGTake out the random number of designated length.It is given birth to using key schedule and the random number of taking-up
At group chat confidentiality ciphering key KGWith group chat Integrity Key IKG。
1.2, authentication request is generated：By the identity code ID of the member C Key Management servers belonged toSAnd authentication request
Key message splicing and group chat Integrity Key IKGIt is input in message authentication algorithm together as parameter, generates message and recognize
Demonstrate,prove code MAC1.The affix message authentication code MAC1 and group chat confidentiality ciphering key K after the above-mentioned key message splicedGOne
It rises and generates ciphertext M1 as parameter input message encryption algorithm.Authentication request includes member C (the i.e. authentication actives of plaintext version
Identity code ID just)C, trunk members R (authenticating passive side) identity code IDRWith random parameter RAND 1 and ciphertext
M1。
1.3, authentication request is sent：Member C sends authentication request, and authentication request may be to be sent directly to relaying R, also may be used
Relaying R can be sent to by the transmission mode of multihop network.It is appointed as ID according to recipient in messageR.Other group members are not
It can decrypt and parse the request message.
Step 2：It relays R and receives authentication request, authentication request is forwarded to server-side
2.1, relaying R identifies message, splits parsing message：After relaying R receives the authentication request from member C, parsing
Request message obtains the status identifier ID of authentication request mastersC', the identification of authentication request passive side (relaying R)
Accord with IDR' and random parameter RAND 1 ' and ciphertext M1 '.It relays R and verifies IDR' compared with one's own side's identity code, match laggard
Row is in next step.
2.2, R decrypted authentication message is relayed：RAND1 ' is input to as parameter in specified pointer address algorithm.According to
Obtained pointer address is from group key pond KGTake out the random number of designated length.Utilize specified key schedule and taking-up
Generating random number group chat confidentiality ciphering key KG' and group chat Integrity Key IKG'.Utilize group chat confidentiality ciphering key KG' and it is right
Ciphertext M1 ' decryption is obtained the key message and message authentication code MAC1 ' of authentication request by the message decipherment algorithm answered.Utilize group chat
Integrity Key IKG' and corresponding message authentication algorithm key message is calculated, obtain message authentication code MAC2.It will
MAC2 and MAC1 ' are compared, if equal, description messages are not tampered with；Otherwise, the request is invalid.
2.3, relaying R generates Ciphering Key request：Relay identity code IDs of the R according to member CC' and member's C ownership
The identity code ID of Key Management serverS' generate the request of Ciphering Key to Key Management server S.Utilize relaying R
With the Integrity Key IK of the arranging key of Key Management server SRAnd corresponding message authentication algorithm generates message authentication code
The confidentiality ciphering key K of arranging key is reinstated in Ciphering Key request and MAC3 mono- by MAC3RIt is encrypted with message encryption algorithm
Obtain ciphertext M2.
2.4, relaying R sends Ciphering Key request：R is relayed by own identification identifier IDRWith Key Management server S's
Status identifier IDSAnd ciphertext M2 breaks into the message package of corresponding format.Relaying R sends the request to S.
Step 3：Server-side receives Ciphering Key request, generates Ciphering Key
3.1, server-side receives request message, the decrypted authentication message：Key Management server S is received from relaying R's
The request of Ciphering Key.Parsing obtains ciphertext M2 '.Server-side S utilizes the arranging key CK with relaying RR' and IKR' to ciphertext M2 '
It is decrypted and message authentication.The detailed process of decryption and message authentication can refer to the corresponding portion of above-mentioned steps 2.2.
3.2, server-side S generates Ciphering Key：Key Management server S is according to the ID in requestC" and IDS" find it is specified
Authentication key group is taken out and uses key KIC2' make the computation key of Ciphering Key.It is related that Key Management server S generates member C
Sequence number SQN, and generate random parameter RAND 2, random parameter RAND 2 be preferably the quantum that generates of quantum real random number generator with
Machine number can both be generated in advance to improve safety and be stored for calling, can also be generated according to the needs of server-side.
The authentication module of SQN sequence numbers can refer to the authentications of the AKA in existing 3GPP standards.Server-side S will also generate a parameter AMF,
Slightly different for the effect of AMF and existing AKA technologies, than the AMF long of existing AKA in parameter length.AMF contains follow-up number
According to the life cycle of message encryption algorithm ID and message authentication algorithm ID and timestamp and CK and IK that encryption uses.More than
AMF relevant informations are the information for including in the Ciphering Key request for relay R.If group key pond KGTotal amount of data be PATool
The calculation formula of body is following (⊕ indicates step-by-step exclusive or, | | indicate concatenation)：
Calculate message authentication code (MAC4)：MAC4=f1 (KIC2',SQN||RAND2||AMF)；
Calculate desired certification response (XRES)：XRES=f2 (KIC2',RAND2)；
Calculate the pointer address (P of CKC)：PC=f3 (KIC2’,RAND2,PA)；
Calculate the pointer address (P of IKI)：PI=f4 (KIC2’,RAND2,PA)；
Calculate Anonymity Key (AK)：AK=f5 (KIC2',RAND2)；
Network authentication token (AUTN)：AUTN=SQN ⊕ AK | | AMF | | MAC4；
Ciphering Key (AV)：AV=RAND2 | | XRES | | PC||PI||AUTN；
(note：Algorithm f1 and f2 are the message authentication algorithm specified, and f3 and f4 are the pointer address algorithm specified, and f5 is to refer to
Fixed Anonymity Key generating algorithm.)
3.3, server-side S sends Ciphering Key to relaying R：Key Management server method described above generate the certification of n groups to
Amount, and utilize the arranging key CK with RR' and IKR' relaying R is sent to after encryption.The flow of encryption and message authentication can refer to
State step 2.3.
Step 4：It relays R and receives message, calculate arranging key and initiate to put question to C
4.1, relaying R receives message, and the decrypted authentication message：Relaying R receives the encryption information from server-side S,
Utilize the arranging key CK with server-side SRAnd IKRMessage is decrypted and message authentication, detailed process can refer to above-mentioned steps
2.2 corresponding portion.
4.2, relaying R generates arranging key：R is relayed in n group Ciphering Key, takes one group of Ciphering Key AV of serial number 0
(0).And a random parameter RAND 3 is generated, random parameter RAND 3 is preferably that the quantum of quantum real random number generator generation is random
Number, to improve safety, can both be generated in advance and be stored for calling, and can also be generated according to the needs of relaying R, at random
Number RAND3 may be the random parameter RAND 2 ' in Ciphering Key AV (0).Utilize random parameter RAND 3 and specified pointer address
Pointer address is calculated in algorithm.The random number of designated length is taken out as CK and IK from group key pond according to pointer address
Key seed, be set as K.And according to the pointer address P in Ciphering Key AV (0)C' and PI' from group key pond KGMiddle taking-up refers to
The random number N 1 and N2 of measured length.The calculation formula of CK and IK is as follows
Computational security key (CK)：CK=f6 (K, N1)；
Calculation of integrity key (IK)：IK=f7 (K, N2)；
(key schedule that f6 and f7 are respectively specified)
4.3, relaying R sends to member C and puts question to message：RAND3 is added in enquirement message in relaying R | | RAND2 ' | |
AUTN'.It relays R and generates a random parameter RAND 4, random parameter RAND 4 is preferably the quantum that quantum real random number generator generates
Random number can both be generated in advance to improve safety and be stored for calling, and can also be generated according to the needs of relaying R.
R is relayed in such a way that group message is encrypted to puing question to message encryption to be sent to member C.Specific encryption flow can refer to above-mentioned step
Rapid 1 corresponding portion, wherein RAND4 purposes are equal to RAND1.
Step 5：Message is putd question in member's C verifications, and returns to authentication responses
5.1, member C receives message, and decrypted authentication puts question to message：Member C is according to random parameter RAND 4 ' and respective algorithms
To puing question to message to be decrypted and message authentication.Detailed process can refer to above-mentioned steps 2.2.Decryption obtains RAND3 ', RAND2 "
And AUTN ".
5.2, the enquirement message of member C parsings verification relaying R：Member C splits into AUTN " (SQN ⊕ AK) ', AMF ' and
MAC4'.Member C takes out KI from authentication key groupC2And RAND2 " is inputted as parameter, utilizes f5 ' algorithm meters corresponding with f5
Calculation obtains AK '.(SQN ⊕ AK) ' and AK ' exclusive or are obtained SQN ' by the ends A.Member C is by SQN ', RAND2 " and AMF ' it is serially connected in one
It rises, with key KIC2XMAC is calculated in f1 ' algorithms corresponding with f1.The obtained MAC4 ' of XMAC and parsing message is compared
Compared with if it is not the same, then relaying R authentications failure.Failure cause may be that message is tampered or relays R identity and leaves a question open
Deng.If consistent, the success of member's C authentication relay R identity.
Following member C verifies SQN ', checks that the freshness for puing question to message, the verification of SQN ' can refer to 3GPP marks
AKA technologies in standard.If SQN ' by verification, is carried out in next step.If SQN ' does not meet check results, AUTS is returned
Again authentication request is carried out to relaying R.The abnormal conditions of the above SQN ' refer to the AKA technologies of 3GPP standards.
5.3, member C generates arranging key CK and IK and generates response message：After SQN is by verification, member C is utilized
RAND2 " and KIC2By the way that pointer address P is calculated with identical algorithm in server-side SC" and PI" (it can refer to step 3.2
Corresponding portion).Recycle RAND3 ' and pointer address PC”、PI" by with relaying R in operation obtain arranging key CK '
And IK ' (corresponding portion that can refer to step 4.2).Obtained in AMF ' life cycle of CK ' and IK ' and following data plus
Close algorithm is also parsed from AMF.Member C will
RAND2 " and KIC2By algorithm corresponding with f2 carry out that message authentication code RES is calculated.
5.4, member C returns to response message：Message authentication code RES is encrypted hair by member C in such a way that group message is encrypted
Relaying R is given, specific encryption flow can refer to the corresponding portion of above-mentioned steps 1, can be continuing with RAND1 or generate again newly
Random number substitutes RAND1.
Step 6：It relays R and verifies member's C identity, return to authenticating result
6.1, R authentication answer messages are relayed：After relaying R receives the response message at the ends A, with the mode of group message decryption
It to response message decrypted authentication and parses and obtains RES ', specific decryption and message authentication flow can refer to above-mentioned steps 2.2
Corresponding portion.XRES ' in RES ' and Ciphering Key AV (0) is compared, if the two is identical, relays R certification members C
Identity success, if the two is different, authentication failure.
6.2, R return authentication results are relayed：It relays R and authentication result is returned into member C, authentication result is also with group
The mode of message encryption (refers to the corresponding portion of above-mentioned steps 4.3, can be continuing with RAND4 or generate new random number again
Substitute RAND4) it is encrypted and is sent to member C, generation and the encryption of message authentication code can refer to above-mentioned steps 1.If it is at
Work(, then retain CK and IK that this authentication generates；If it is failure, then CK and IK that this authentication generates are removed.
Step 7：Member C receives authentication verification result
Member C receive relaying R return message, by group message decryption in the way of to relaying R return the result into
Row decrypted authentication.Member C parses authentication result, judges whether this authentication succeeds.If it fails, then being re-initiated
Authentication request；If it succeeds, next message transmission can carry out encryption and decryption.
The update of authentication key
In the present invention, the authentication key between member and server can be updated according to demand, such as according to setting
Update cycle, or the update request etc. in response to upper layer application.
The update method of authentication key is similar to the generation method of CK and IK in above-mentioned method for authenticating, specific message flow
It can refer to the solid line and dotted portion in Fig. 3.The pointer address of authentication key is generated using algorithm f3 or f4, according to pointer
The random number of designated length is taken out in location from the private cipher key pond corresponding to member C, with authentication key KIC2' generated using key
New authentication key is calculated in algorithm.In first time, acquiescence is close as authenticating using the random number of private cipher key pond beginning
Key.When carrying out authentication key update, the existing authentication key used is covered into previous authentication key group, synchronous authentication is close
Key group covers the key group now used, and the update of authentication key is as shown in Figure 3.
Authentication and authentication key more Combination nova
When authentication key update need with authentication bind when, member C can be stated in the authentication request of step 1, such as
Identifier is set in authentication request.The newer mode of authentication key can refer to " update of authentication key " of the present embodiment.
Authenticate abnormal processing
The message of transmitting-receiving between member C and server-side S may be authentication request, Ciphering Key request, Ciphering Key it is anti-
Message, authentication responses or authenticating result are putd question in feedback.In conjunction with Fig. 3, authentication request, Ciphering Key are asked, Ciphering Key is fed back,
Put question to message, authentication responses or authenticating result difference abbreviation message 1.~message 6..If occurred in message transmitting procedure light
Degree packet loss does not influence the transmitting-receiving of message under normal circumstances by respective signaling retransmission mechanism.Such as member C is sent to relaying R
It can not receive the enquirement message from relaying R after authentication request, request message can be regenerated and be sent to relaying R, until reaching
The maximum number of times of transmission of request；Relaying R can not receive response message after sending enquirement message, can equally resend to maximum transmission
Number.
If there is a situation where the even suspensions of severe packet loss, authentication process to terminate, wait under lower application layer in authentication process
The request once authenticated.The processing of all kinds of abnormal conditions is as follows：
If 1. process only carry out authentication and key agreement, no matter message 1., 2., 3., 4., 5., 6. any one
Loss will not all impact private cipher key pond and authentication key group.It is unique to influence to be exactly failed authentication and key agreement
Failure, can re-start authentication according to the request of application layer.
2. if it is the update of authentication key, the packet loss of message 1., 2., 3., 4. does not influence the synchronization of authentication key group.
When message 5., 6. or after the message packet loss of dotted portion, member C can not receive the return message from relaying R, then illustrate this
The update of secondary authentication key fails.Member C can carry out initiation request again, and state last authentication key update failure.Clothes
After business end S receives update request, it is close using authenticating to judge that whether the newer message of authentication key is received according to last time update
First in key group or second key calculate Ciphering Key.If last time update receives, authentication key is newer to disappear
Breath, then mean that server-side S has completed to update, but member C does not update, then server-side S uses the in authentication key group
One key calculates Ciphering Key.If last time update does not receive the newer message of authentication key, mean to service
End S and member C does not update, then server-side S calculates Ciphering Key using second key in authentication key group.
3. be applied in combination if it is authentication and authentication key update, processing mode can be with the exception in reference case 2
Reason.
Embodiment 2
System explanation
As shown in figure 4, identity authorization system of the present invention may include multiple Key Management servers, different key management clothes
Business device is in different quantum network service stations.Each quantum network service station is in quantum communication network, therefore quantum
It can be by quantum key between the shared station of QKD modes, to ensure the highly safe of information between network service station.
Such as Fig. 4, in this figure, member R, member A0, member A1, member A2, member A3, member A4 and member C are same
The member of group, member R are relaying unit.The masters for participating in authentication are C, contain private cipher key pond KCWith group key pond KG；
It is R to participate in authentication passive side, contains private cipher key pond KRWith group key pond KG；Member S1 and S2 are Key Management server,
Making server-side, member R belongs to S1, and member C belongs to S2, and Key Management server contains the private cipher key pond of accredited members,
Wherein Key Management server S1 is member C and relays the group key pond K of RGThe side of issuing, equally have group key pond KG。
Or such as Fig. 7, the group key pond K of member C and relaying RGThe side of issuing be Key Management server S2, have group
Group key pond KG, and S1 does not have group key pond KG.Member R as communication relay, carried out with member S1 authentication with
Key agreement, therefore the communication between R and S has been carried out symmetric cryptography, the arranging key CK of the sides RRAnd IKRIt indicates, the sides S1
Arranging key CKR' and IKR' indicate.
As shown in figure 5, member C, member R, member S1 and member S2 identity code be respectively ID=IDC, ID=IDR、
ID=IDS1And ID=IDS2, while member C and member R record the identity code PID for having ownership Key Management server,
That is the PID of member C is IDS2, the PID of member R is IDS1.C, the cryptography module of R, S1 and S2 hold corresponding pool of keys
(including private cipher key pond and group key pond), all kinds of algorithms and authentication key group.Authentication key group length is 2, and first is
History key, second is, using key, the Key Management server belonged to possesses corresponding authentication key group.Authentication key
Group is realized based on private cipher key pond.The symbolic formulation of each key refers to Fig. 5.
In the present embodiment, member C, member R have safety insulating device to store pool of keys.In the present embodiment member C and
The key finally negotiated after member's R authentications is that Message Encryption key CK (i.e. confidentiality key) and message authentication key IK is (i.e. complete
Whole property key).
The present embodiment is likely to be at wireless multi-hop network, then may be not between member C and member R directly logical
Letter.In Fig. 1, between member C and member R the transmission of message need the forwarding by member A1.Wherein member A1 is not involved in pair
The encryption and decryption of the message.If the group message of the message transmitted by group member, group group member can disappear to this
Breath is decrypted.
Process description
The authentication message flow diagram of the present embodiment can refer to Fig. 6, and the message that solid line indicates is the authentication of the present embodiment
And key agreement part.Detailed description are as follows for the present embodiment：
Step 1：Member C initiates authentication request to relaying R
This step can refer to the step 1 in embodiment 1.
Step 2：It relays R and receives authentication request, authentication request is forwarded to server-side
This step can refer to the step 2 in embodiment 1.
Step 3：Server-side S1 forwarding Ciphering Key requests
Key Management server S1 receives the request of the Ciphering Key from relaying R.Utilize the arranging key with relaying R
CKR' and IKR' ciphertext in request is decrypted and message authentication.The detailed process of decryption and message authentication can refer to above-mentioned
Step 2.2 in embodiment 1.Key Management server S1 is according to relaying R status identifiers ID in messageRAnd Key Management server
The status identifier ID of S2S2By request by the Key Management server S2 in the specified sub- communication network of format vectors.In transmission,
Pass through the mode encrypted transmission of quantum key between the shared station of QKD modes between standing and standing.Quantum where Key Management server S1
Network service station may be adjacent station with quantum network service station where Key Management server S2, it is also possible in multiple
After being communicated.
Step 4：Server-side S2 receives Ciphering Key request, generates Ciphering Key
After Key Management server S2 receives the Ciphering Key request of Key Management server S1 forwarding, to the request into
Row decryption, certification and parsing.According to the relevant information of request, the Ciphering Key about member C of n groups is generated.Detailed process can
With reference to step 3 in above-described embodiment 1.N groups Ciphering Key is encrypted by quantum communication network and is sent by Key Management server S2
To Key Management server S1.
Step 5：Server-side S1 encryption forwarding Ciphering Key
Key Management server S1 receives the n group Ciphering Key from Key Management server S2.Cipher key management services
Device S1 utilizes the arranging key CK with relaying RR' and IKR' to Ciphering Key carry out message authentication code generation and message encryption simultaneously
It is sent to relaying R.The mode that specific encryption and message authentication code generate can refer to step 2.3 in above-described embodiment 1.
Step 6：It relays R and receives message, calculate arranging key and initiate to put question to message to C
This step can refer to the step 4 in embodiment 1.
Step 7：Message is putd question in member's C verifications, and returns to authentication responses
This step can refer to the step 5 in embodiment 1.
Step 8：It relays R and verifies member's C identity, return to authenticating result
This step can refer to the step 6 in embodiment 1.
Step 9：Member C receives authentication verification result
This step can refer to the step 7 in embodiment 1.
The update of authentication key
The update method of authentication key can refer to the authentication key update method in embodiment 1, and specific message flow can
With reference to the solid line and dotted portion in figure 6.
Authentication and authentication key more novel combined method
This combined method can be with the way of reference implementation example 1.The newer mode of authentication key can refer to the " mirror of the present embodiment
Weigh the update of key ".
Authenticate abnormal processing
Abnormality processing situation can refer to the processing in embodiment 1.When for authentication key update or have authentication key more
When new participation, if packet loss occurs in message transmitting procedure can refer to embodiment 1 extremely.After member C receives enquirement message, from
Member C is to cipher key management services in packet loss and embodiment 1 that message transmission between member C to Key Management server S2 occurs
Abnormality processing situation between device S is consistent；After Key Management server S2 more new authentication secret key groups, from Key Management server S2
Exception in the packet loss occurred to the message transmission between member C and embodiment 1 between Key Management server S to member C
It is consistent to manage situation.
The symbol of parameters merely for convenience of description, is not constituted the present invention any specifically limited in the present invention.
N can be once generated when generating Ciphering Key in the present invention, the size of n depends on the circumstances.Present invention can apply to a variety of nothings
Line multihop network, such as sensor network, data-link.
The authentication of the present invention and key agreement system and method are that group member and relaying have built a both sides
The channel of safety.The mechanism can guarantee that the high information of important level can only can be decrypted this message by specified user,
It ensure that safe transmission of the message in group.Group key pond reduces what session key (i.e. arranging key) was cracked simultaneously
Risk.
Disclosed above is only the embodiment of the present invention, but the present invention is not limited to this, those skilled in the art
Various changes and modifications can be made to the invention without departing from the spirit and scope of the present invention.These obvious modification and variations are equal
Should belong to the present invention claims protection domain protection in.In addition, although having used some specific terms in this specification, this
A little terms merely for convenience of description, are not constituted the present invention any specifically limited.
Claims (10)
1. a kind of AKA identity authorization systems based on pool of symmetric keys and trunking traffic, including participate in AKA authentications at
Member, relaying and server, which is characterized in that arranging key is generated for the two by AKA authentications between member and relaying
Between coded communication, the generating mode of arranging key between member and relaying is：
The member, relaying and server three are shared to have group key pond, member and relaying to be utilized respectively from group key
The arranging key between member and relaying is calculated in conjunction with random number parameter for the key seed in pond；
The wherein described random number parameter is accordingly obtained in group key pond using pointer address A, in AKA authentication procedures
In, relaying obtains the pointer address A by server, and member obtains from server via relaying and generates the pointer address A
Parameter, then pass through the parameter and generate the pointer address A.
2. the AKA identity authorization systems based on pool of symmetric keys and trunking traffic as described in claim 1, which is characterized in that
It carries out utilizing the coded communication of group key pond in AKA authentication procedures between member and relaying, profit between relaying and server
The arranging key coded communication shared in advance with the two, specifically includes：
Member sends authentication request to relaying；
Relaying obtains corresponding Ciphering Key in response to the authentication request and from server, and the Ciphering Key includes the finger
Needle address A and the parameter for generating the pointer address A；
It relays to send to member and puts question to message, and include the generation pointer address A from Ciphering Key in the enquirement message
Parameter；
Member sends corresponding authentication responses in response to the enquirement message to relaying；
After relaying verifies the authentication responses, sends authenticating result to member and complete AKA bodies so that member confirm
Part certification.
3. the AKA identity authorization systems based on pool of symmetric keys and trunking traffic as claimed in claim 2, which is characterized in that
When member is with trunking traffic, masters generate the negotiation code of random number form, pass through specified pointer address using the negotiation code
Algorithm obtains pointer address, takes out the random number of designated length from group key pond according to the pointer address, recycles specified
The generating random number group chat confidentiality key and group chat Integrity Key of key schedule and taking-up；
Group chat Integrity Key is used to that Content of Communication to be combined to generate and verify corresponding identifying code；
Group chat confidentiality key is for being encrypted and decrypting in conjunction with Content of Communication.
4. the AKA identity authorization systems based on pool of symmetric keys and trunking traffic as claimed in claim 2, which is characterized in that
Member and relaying also have a private cipher key pond respectively, member and relay mutually independent and server share its private cipher key pond to
Generate authentication key；
The pointer address A is that the authentication key between random number A binding members and server is obtained by the way that assignment algorithm is corresponding,
The random number A is generated by server.
5. the AKA identity authorization systems based on pool of symmetric keys and trunking traffic as claimed in claim 4, which is characterized in that
The key seed is accordingly obtained from group key pond using pointer address B, and pointer address B is to pass through finger using random number B
Determine algorithm accordingly to obtain, the random number B is generated by relaying and by the enquirement message distribution to member.
6. the AKA identity authorization systems based on pool of symmetric keys and trunking traffic as claimed in claim 5, which is characterized in that
Also include to be sent to member also by enquirement message with the relevant sequence number SQN of member, sequence number SQN in Ciphering Key, at
Member puts question to message using sequence number SQN verifications.
7. the AKA identity authorization systems based on pool of symmetric keys and trunking traffic as claimed in claim 6, which is characterized in that
Sequence number SQN in Ciphering Key is encrypted using Anonymity Key, and the Anonymity Key utilizes the authentication between member and server
Key and random number A are generated.
8. the AKA identity authorization systems based on pool of symmetric keys and trunking traffic as claimed in claim 7, which is characterized in that
Also include certification response in Ciphering Key, which utilizes the authentication key and random number A between member and server
It generates；
Relaying directly acquires certification response in Ciphering Key, and member, which receives, to be putd question to message and verify after sequence number SQN passes through, profit
Message authentication code is generated with mode corresponding with certification response is generated, and is sent to message authentication code in a manner of authentication responses
Relaying is authenticated response and the comparison certification of message authentication code for relaying.
9. the AKA identity authorization systems based on pool of symmetric keys and trunking traffic as claimed in claim 5, which is characterized in that
Participate in the servers of AKA authentications at least there are two, one of them is and the belonged to first server of relaying, wherein another
A second server belonged to by member, and one of first server and second server possess group key pond；
After first server receives the Ciphering Key request from relaying, Ciphering Key request is transmitted to second server,
Corresponding Ciphering Key is asked in response to the Ciphering Key and generated to second server, then will in the form of Ciphering Key is fed back
The Ciphering Key is sent to relaying via first server.
10. a kind of AKA identity identifying methods based on pool of symmetric keys and trunking traffic, which is characterized in that including：
Step S1, member send authentication request to relaying；
Step S2, relaying obtains corresponding Ciphering Key in response to the authentication request and from server, and the Ciphering Key includes
There is pointer address A and random number A；
The pointer address A is that the authentication key between random number A binding members and server is obtained by the way that assignment algorithm is corresponding,
The random number A is generated by server；
The member, relaying and server three are shared group key pond, and relaying is by pointer address A in group key pond
Corresponding to obtain random number parameter, the negotiation being calculated between member and relaying in conjunction with the key seed in group key pond is close
Key；
Step S3 is relayed to send to member and is putd question to message, and includes the random number A from Ciphering Key in the enquirement message；
Member receives the enquirement message, generates pointer address A by random number A, then by pointer address A in group key pond
In accordingly obtain random number parameter, in conjunction with group key pond key seed be calculated member and relaying between negotiation it is close
Key；
Step S4, member send corresponding authentication responses to relaying；
After relaying verifies the authentication responses, authenticating result is sent so that member confirmed to member by step S5
At AKA authentications.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810529942.7A CN108768632B (en) | 2018-05-29 | 2018-05-29 | AKA identity authentication system and method based on symmetric key pool and relay communication |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810529942.7A CN108768632B (en) | 2018-05-29 | 2018-05-29 | AKA identity authentication system and method based on symmetric key pool and relay communication |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108768632A true CN108768632A (en) | 2018-11-06 |
| CN108768632B CN108768632B (en) | 2021-03-02 |
Family
ID=64003227
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810529942.7A Active CN108768632B (en) | 2018-05-29 | 2018-05-29 | AKA identity authentication system and method based on symmetric key pool and relay communication |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108768632B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110176997A (en) * | 2019-05-15 | 2019-08-27 | 如般量子科技有限公司 | Based on unsymmetrical key pond to and digital signature quantum communications service station AKA cryptographic key negotiation method and system, computer equipment |
| WO2020221252A1 (en) * | 2019-04-28 | 2020-11-05 | 中兴通讯股份有限公司 | Method and apparatus for sending terminal sequence number and authentication method and apparatus |
| CN112994883A (en) * | 2021-04-22 | 2021-06-18 | 浙江九州量子信息技术股份有限公司 | Symmetric key negotiation system and method based on quantum key and true random number source |
| CN114244499A (en) * | 2020-09-09 | 2022-03-25 | 如般量子科技有限公司 | Group communication method and system based on tree structure symmetric key pool |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103560879A (en) * | 2013-10-09 | 2014-02-05 | 中国科学院信息工程研究所 | Method for achieving lightweight authentication and key agreement |
| CN106612176A (en) * | 2016-12-16 | 2017-05-03 | 中国电子科技集团公司第三十研究所 | Negotiation system and negotiation method based on quantum truly random number negotiation secret key |
-
2018
- 2018-05-29 CN CN201810529942.7A patent/CN108768632B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103560879A (en) * | 2013-10-09 | 2014-02-05 | 中国科学院信息工程研究所 | Method for achieving lightweight authentication and key agreement |
| CN106612176A (en) * | 2016-12-16 | 2017-05-03 | 中国电子科技集团公司第三十研究所 | Negotiation system and negotiation method based on quantum truly random number negotiation secret key |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2020221252A1 (en) * | 2019-04-28 | 2020-11-05 | 中兴通讯股份有限公司 | Method and apparatus for sending terminal sequence number and authentication method and apparatus |
| CN110176997A (en) * | 2019-05-15 | 2019-08-27 | 如般量子科技有限公司 | Based on unsymmetrical key pond to and digital signature quantum communications service station AKA cryptographic key negotiation method and system, computer equipment |
| CN114244499A (en) * | 2020-09-09 | 2022-03-25 | 如般量子科技有限公司 | Group communication method and system based on tree structure symmetric key pool |
| CN114244499B (en) * | 2020-09-09 | 2023-09-26 | 如般量子科技有限公司 | Group communication method and system based on tree structure symmetric key pool |
| CN112994883A (en) * | 2021-04-22 | 2021-06-18 | 浙江九州量子信息技术股份有限公司 | Symmetric key negotiation system and method based on quantum key and true random number source |
| CN112994883B (en) * | 2021-04-22 | 2021-08-13 | 浙江九州量子信息技术股份有限公司 | Symmetric key negotiation system and method based on quantum key and true random number source |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108768632B (en) | 2021-03-02 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108599925B (en) | Improved AKA identity authentication system and method based on quantum communication network | |
| CN101640886B (en) | Authentication method, re-authentication method and communication device | |
| CN108173649B (en) | Message authentication method and system based on quantum key card | |
| CN106411525B (en) | Message authentication method and system | |
| WO2017185999A1 (en) | Method, apparatus and system for encryption key distribution and authentication | |
| CN108712252A (en) | It is a kind of based on pool of symmetric keys and span centre after AKA identity authorization systems and method | |
| CN108683501B (en) | Multiple identity authentication system and method with timestamp as random number based on quantum communication network | |
| WO2018040758A1 (en) | Authentication method, authentication apparatus and authentication system | |
| CN108768632A (en) | A kind of AKA identity authorization systems and method based on pool of symmetric keys and trunking traffic | |
| CN108964897B (en) | Identity authentication system and method based on group communication | |
| CN108650028B (en) | Multiple identity authentication system and method based on quantum communication network and true random number | |
| CN107317789A (en) | Key distribution, authentication method, apparatus and system | |
| CN101741555A (en) | Method and system for identity authentication and key agreement | |
| CN108964888A (en) | A kind of modified AKA identity authorization system and method based on pool of symmetric keys and relayed communications | |
| CN101931955A (en) | Authentication method, device and system | |
| CN108809636B (en) | Communication system for realizing message authentication between members based on group type quantum key card | |
| CN108510270A (en) | A kind of move and transfer accounts method of quantum safety | |
| CN108632042A (en) | A kind of class AKA identity authorization systems and method based on pool of symmetric keys | |
| CN108600152B (en) | Improved Kerberos identity authentication system and method based on quantum communication network | |
| CN108599926A (en) | A kind of HTTP-Digest modified AKA identity authorization systems and method based on pool of symmetric keys | |
| CN108880799B (en) | Multi-time identity authentication system and method based on group key pool | |
| CN108964896A (en) | A kind of Kerberos identity authorization system and method based on group key pond | |
| CN108718237A (en) | A kind of modified AKA identity authorization systems and method based on pool of symmetric keys | |
| CN108616350A (en) | A kind of HTTP-Digest class AKA identity authorization systems and method based on pool of symmetric keys | |
| CN104753682A (en) | Generating system and method of session keys |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |