CN111259353A - Identity authentication method and device based on SM9 algorithm and computer equipment - Google Patents

Identity authentication method and device based on SM9 algorithm and computer equipment Download PDF

Info

Publication number
CN111259353A
CN111259353A CN202010041318.XA CN202010041318A CN111259353A CN 111259353 A CN111259353 A CN 111259353A CN 202010041318 A CN202010041318 A CN 202010041318A CN 111259353 A CN111259353 A CN 111259353A
Authority
CN
China
Prior art keywords
variable element
claimant
verifier
token
time
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202010041318.XA
Other languages
Chinese (zh)
Other versions
CN111259353B (en
Inventor
罗影
李先强
周海涛
王鹏
竹贝芬
曾伟
罗建洪
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Jiangsu Xinsheng Intelligent Technology Co ltd
Original Assignee
Jiangsu Xinsheng Intelligent Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Jiangsu Xinsheng Intelligent Technology Co ltd filed Critical Jiangsu Xinsheng Intelligent Technology Co ltd
Priority to CN202010041318.XA priority Critical patent/CN111259353B/en
Publication of CN111259353A publication Critical patent/CN111259353A/en
Priority to PCT/CN2020/137631 priority patent/WO2021143457A1/en
Application granted granted Critical
Publication of CN111259353B publication Critical patent/CN111259353B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/101—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM] by binding digital rights to specific entities
    • G06F21/1014—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM] by binding digital rights to specific entities to tokens

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

The application relates to an identity authentication method and device based on SM9 algorithm, computer equipment and storage medium. The method comprises the following steps: when an identity authentication request is triggered, generating a random number and a time-varying parameter; based on the password function, obtaining an element of the identification of the claiming party according to the identification of the claiming party; determining a first variable element according to the random number and the element of the identification of the claimant; determining a second variable element according to the random number, the time-varying parameter, the element of the identifier of the claimant, the token of the claimant and the password; sending the identification of the claimant, the time-varying parameter, the first variable element and the second variable element to the verifier; and verifying the validity of the time-varying parameter by the verifier, obtaining a bilinear pairing operation result according to the token, the time-varying parameter, the first variable element and the second variable element of the verifier based on bilinear pairing operation when the validity is valid, judging whether a preset condition is met according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met. The method can improve the safety of identity authentication.

Description

Identity authentication method and device based on SM9 algorithm and computer equipment
Technical Field
The present application relates to the field of information security technologies, and in particular, to an identity authentication method and apparatus based on an SM9 algorithm, a computer device, and a storage medium.
Background
With the development of information security technology and internet technology, more and more users send requests to a server through a client to obtain various data services of the server. Generally, in order to protect user privacy information, a server side authenticates user identity information before providing various services, and provides a request service for a user when the authentication is passed, otherwise, the service is refused to be provided.
At present, identity authentication is realized by adopting a user name plus password mode in most identity authentication processes of a server side to a client side, and the traditional authentication mode has many potential safety hazards, so that user information is easy to leak, and the problem of low safety exists.
Disclosure of Invention
In view of the above, it is necessary to provide an identity authentication method, apparatus, computer device and storage medium based on SM9 algorithm, which can improve security.
An identity authentication method based on SM9 algorithm, the method comprising:
when an identity authentication request is triggered, generating a random number and a time-varying parameter;
based on the password function, obtaining an element of the identification of the claiming party according to the identification of the claiming party;
determining a first variable element according to the random number and the element of the claimant identifier; the first variable element is an element of a first addition cycle group;
determining a second variable element according to the random number, the time-varying parameter, the element of the identifier of the claimant, the token of the claimant and the password; the token of the claimant is obtained by sending the claimant identifier and the password application to a key generation center before triggering an identity authentication request; the second variable element is an element of a second addition cycle group;
sending the claimant identifier, the time-varying parameter, the first variable element and the second variable element to a verifier; and verifying the validity of the time-varying parameter by the verifier, obtaining an operation result of bilinear pairing operation according to the token of the verifier, the time-varying parameter, the first variable element and the second variable element based on bilinear pairing operation when the verification result of the time-varying parameter is valid, judging whether a preset condition is met according to the operation result, and returning an authentication passing message to the alleged party when the preset condition is met.
An identity authentication method based on SM9 algorithm, the method comprising:
receiving an identification of a claimant, a time-varying parameter, a first variable element and a second variable element which are sent by the claimant; when the time-varying parameter, the first variable element and the second variable element are used for triggering an identity authentication request, the claiming party generates the time-varying parameter, the first variable element is an element of a first addition cycle group, and the second variable element is an element of a second addition cycle group;
verifying the validity of the time-varying parameter;
when the verification result of the time-varying parameter is valid, based on bilinear pairing operation, obtaining an operation result of the bilinear pairing operation according to a token of a verifier, the time-varying parameter, the first variable element and the second variable element; before the token of the verifier triggers the identity authentication request, the key generation center obtains the token according to the identification and the password of the claimant sent by the claimant and sends the token to the verifier;
and judging whether a preset condition is met or not according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met.
An identity authentication method based on SM9 algorithm, the method comprising:
generating a first random number when an identity authentication request is triggered;
based on the password function, obtaining an element of the identification of the claiming party according to the identification of the claiming party;
determining a first variable element according to the first random number and the element of the claimant identifier; the first variable element is an element of a first addition cycle group;
sending the claimant identifier and the first argument to a verifier;
receiving a second random number sent by the verifier; the second random number is generated by the verifier after receiving the identification of the allegator and the first variable element sent by the allegator;
determining a second variable element according to the first random number, the second random number, the element of the identifier of the claimant, the token of the claimant and the password; the token of the claimant is obtained by sending the claimant identifier and the password application to a key generation center before triggering an identity authentication request; the second variable element is an element of a second addition cycle group;
sending the second variable element to the verifier; and obtaining an operation result of the bilinear pairing operation by the verifier based on the bilinear pairing operation according to the token of the verifier, the second random number, the first variable element and the second variable element, judging whether a preset condition is met or not according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met.
An identity authentication method based on SM9 algorithm, the method comprising:
receiving a claimant identifier and a first variable element sent by a claimant; the first variable element is an element of a first addition cycle group, when an identity authentication request is triggered, the claiming party generates a first random number, and based on a cryptographic function, after the element of the claiming party identifier is obtained according to the claiming party identifier, the first random number is obtained according to the first random number and the element of the claiming party identifier;
generating a second random number;
sending the second random number to the claimant;
receiving a second variable element sent by the claimant; the second variable element is an element of a second addition cycle group;
based on bilinear pairing operation, obtaining an operation result of the bilinear pairing operation according to a token of a verifier, the second random number, the first variable element and the second variable element; before the token of the verifier triggers the identity authentication request, the key generation center obtains the token according to the identification and the password of the claimant sent by the claimant and sends the token to the verifier;
and judging whether a preset condition is met or not according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met.
An identity authentication device based on the SM9 algorithm, the device comprising:
the time-varying parameter generating module is used for generating a random number and a time-varying parameter when an identity authentication request is triggered;
the first variable element determining module is used for obtaining an element of the identifier of the claiming party according to the identifier of the claiming party based on a cryptographic function; determining a first variable element according to the random number and the element of the claimant identifier; the first variable element is an element of a first addition cycle group;
a second variable element determination module for determining a second variable element according to the random number, the time-varying parameter, the element of the identifier of the claimant, the token of the claimant and the password; the token of the claimant is obtained by sending the claimant identifier and the password application to a key generation center before triggering an identity authentication request; the second variable element is an element of a second addition cycle group;
the variable element sending module is used for sending the claimant identifier, the time-varying parameter, the first variable element and the second variable element to a verifier; and verifying the validity of the time-varying parameter by the verifier, obtaining an operation result of bilinear pairing operation according to the token of the verifier, the time-varying parameter, the first variable element and the second variable element based on bilinear pairing operation when the verification result of the time-varying parameter is valid, judging whether a preset condition is met according to the operation result, and returning an authentication passing message to the allegiation party when the preset condition is met.
An identity authentication device based on the SM9 algorithm, the device comprising:
the variable element receiving module is used for receiving the identification of the claimant, the time-varying parameter, the first variable element and the second variable element which are sent by the claimant; when the time-varying parameter, the first variable element and the second variable element are used for triggering an identity authentication request, the claiming party generates the time-varying parameter, the first variable element is an element of a first addition cycle group, and the second variable element is an element of a second addition cycle group;
a time-varying parameter verification module for verifying the validity of the time-varying parameter;
the pairing operation module is used for obtaining an operation result of the bilinear pairing operation according to the token of the verification party, the time-varying parameter, the first variable element and the second variable element based on the bilinear pairing operation when the verification result of the time-varying parameter is valid; before the token of the verifier triggers the identity authentication request, the key generation center obtains the token according to the identification and the password of the claimant sent by the claimant and sends the token to the verifier;
and the authentication judgment module is used for judging whether a preset condition is met or not according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met.
A computer device comprising a memory storing a computer program and a processor implementing the above method steps when executing the computer program.
A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the above-mentioned method steps.
According to the identity authentication method, the identity authentication device, the computer equipment and the storage medium based on the SM9 algorithm, the claimant calculates the first variable element and the second variable element through the random number, the time-varying parameter, the claimant identification, the claimant token and the password generated when the identity authentication request is triggered, and sends the time-varying parameter, the claimant identification, the first variable element and the second variable element to the verifier, the verifier verifies the validity of the time-varying parameter, the timeliness of the identity authentication process is improved, and the identity of the claimant is authenticated based on the result of bilinear pairing operation according to the first variable element and the second variable element. The method does not need to directly carry out identity authentication in a user name plus password mode, solves the problem that user information is easy to divulge secrets in the prior art, and improves the security of identity authentication.
Drawings
Fig. 1 is a diagram of an application environment of an identity authentication system based on SM9 algorithm in one embodiment;
FIG. 2 is a timing diagram of an identity authentication method based on the SM9 algorithm in one embodiment;
FIG. 3 is a flow diagram of an identity authentication method based on the SM9 algorithm applied to an alleged party in one embodiment;
fig. 4 is a schematic flowchart of an identity authentication method based on the SM9 algorithm applied to a verifier in one embodiment;
fig. 5 is a timing diagram of an identity authentication method based on the SM9 algorithm in another embodiment;
fig. 6 is a schematic flow chart of an identity authentication method based on the SM9 algorithm applied to an alleged party in another embodiment;
fig. 7 is a schematic flowchart of an identity authentication method based on the SM9 algorithm applied to a verifier in another embodiment;
FIG. 8 is a timing diagram illustrating the steps of obtaining a token before triggering identity authentication in one embodiment;
fig. 9 is a block diagram of an identity authentication device based on the SM9 algorithm in one embodiment;
fig. 10 is a block diagram of an identity authentication device based on SM9 algorithm in a preferred embodiment;
fig. 11 is a block diagram of an identity authentication device based on SM9 algorithm in another embodiment;
FIG. 12 is a diagram showing an internal structure of a computer device in one embodiment;
fig. 13 is an internal structural view of a computer device in another embodiment.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.
In one embodiment, as shown in FIG. 1, an identity authentication system based on the SM9 algorithm is provided, comprising an allegiator 102 and a verifier 104, the allegiator 102 may be a terminal, the verifier 104 may be a server, and the allegiator 102 communicates with the verifier 104 over a network. Specifically, when an identity authentication request is triggered, the claimant 102 generates a random number and a time-varying parameter, obtains an element of the identifier of the claimant according to the identifier of the claimant based on a cryptographic function, determines a first variable element according to the random number and the element of the identifier of the claimant, determines a second variable element according to the random number, the time-varying parameter, the element of the identifier of the claimant, a token of the claimant and a password, sends the identifier of the claimant, the time-varying parameter, the first variable element and the second variable element to the verifier 104, the verifier 104 receives the identifier of the claimant, the time-varying parameter, the first variable element and the second variable element sent by the claimant 102, verifies the validity of the time-varying parameter, and obtains an operation result of a bilinear pairing operation according to the token of the verifier, the time-varying parameter, the first variable element and the second variable element based on the bilinear pairing operation when, and judging whether a preset condition is met or not according to the operation result, and returning an authentication passing message to the allegian 102 when the preset condition is met. Where claimant 102 may be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices, authenticator 104 may be implemented with a stand-alone server or a server cluster of multiple servers. The claimant 102 may be used to implement an identity authentication method based on the SM9 algorithm, and the server 104 may also be used to implement an identity authentication method based on the SM9 algorithm.
In one embodiment, as shown in fig. 2, an identity authentication method based on SM9 algorithm is provided, which is described by taking the method as an example applied to the above identity authentication system based on SM9 algorithm in fig. 1.
Step S201, when an identity authentication request is triggered, the claimant generates a random number and a time-varying parameter.
The identity authentication request is an identity information authentication request sent by a claiming party to a verifier, and a user corresponding to the claiming party triggers a client interface to generate the identity authentication request. Random number r1Is a random number between 1 and N-1, N is a first addition cycle group G1Or a second addition cycle group G2Order of (1) N, r1May be generated by a random number generator. Time varying parameter r2The parameter used by the claimant in relation to the time of sending the request when the user triggers an authentication request may be a serial number or a time stamp, the time stamp is converted into a number between 1 and N-1, N is the first group G of addition cycles1Or a second addition cycle group G2The order of (1) is N.
Specifically, if the timestamp is the one, the clocks of the alleged party and the verified party need to be ensured to be synchronous in advance, the delay can be detected, the verified party needs to detect the timestamp after receiving the message of the alleged party, and the absolute value of the difference between the timestamp information in the message and the time point when the verified party receives the timestamp does not exceed a tolerable time window; if the serial number is the message verifier who needs to ensure the specific serial number in advance to receive only once or the verifier receives only once within the specified time, the allegger maintains the previously used or future used serial number which will still be valid, the serial number can be generated by a serial number counter, and a special program can be adopted to reset or restart the serial number generator to update the serial number.
Specifically, when a user triggers an authentication request of a client interface, the claimant generates a random number r1And a time-varying parameter r2。
Step S202, the claimant obtains the element of the claimant identifier according to the claimant identifier based on the password function.
Wherein the cryptographic function H (U) is based on SM9The cipher function of the method has input of bit string information U and output of integer h, i.e. the first addition cycle group G1A member P inU，H(U)＝[H1(U)]P or [ H2(U)]P, wherein P is the first addition cyclic group G1Is generated from1(U) is a cryptographic function H1Output value when U is input, H2(U) is a cryptographic function H2The output value when inputting U, H (U) being H of element P1(U) times or H2(U) times. Claimant identification IDAIdentifying information such as a name, email address, telephone number, etc. for the purported party. Meta P of claimant identificationAIdentifying ID for allegiatorAInputting the integer output after the cipher function H (U) is input.
Specifically, the claimant is based on a cryptographic function H (U) and a claimant identification IDAGet the meta P of the claimant's identityAThe formula is as follows:
PA＝U(IDA)
in step S203, the claimant determines a first variable element according to the random number and the element identified by the claimant.
Wherein the first variable element X is a first addition cycle group G1Is based on a random number r1Meta P with claimant identificationAThe formula for determining the first variable element X is as follows:
X＝[r1]PA
in the above formula, the first variable element X is the element P of the claimant identifierAR of1The value of the factor.
In step S204, the claimant determines a second variable element according to the random number, the time-varying parameter, the element identified by the claimant, the token of the claimant and the password.
Wherein the second variable element Y is the second addition cyclic group G2The Token of the allekerASending a claimant identity ID to a claimant Key Generation Center (KGC) before triggering an identity authentication requestAAnd the password pwd application. Password pwd is the password owned by the claimant.
In particular, the claimant depends on a random number r1When in useVariable parameter r2Meta P of the alleged party identificationAToken of the allekerAAnd a password pwd, the formula for determining the second variable element Y is as follows:
Y＝[r1r2](TokenA-[pwd]PA)
in step S205, the claimant sends the claimant identifier, the time-varying parameter, the first variable element and the second variable element to the verifier.
Specifically, the claimant identifies the claimant ID with the claimantATime-varying parameter r2And the first variable element X and the second variable element Y are sent to a verifier, and the verifier authenticates the identity of the claiming party.
In step S206, the verifier receives the identifier of the claimant, the time-varying parameter, the first variable element and the second variable element sent by the claimant.
Specifically, the verifier receives the purporter identification ID sent by the purporterATime-varying parameter r2A first variable element X and a second variable element Y.
In step S207, the verifier verifies the validity of the time-varying parameter.
Wherein, the time-varying parameter r2May be a timestamp or a sequence number. In particular, if the time-varying parameter r2If the time stamp is the time stamp, the verifier verifies whether the absolute value of the difference between the time stamp and the time point of receiving the time stamp by the verifier exceeds a preset delay time, wherein the preset delay time is 1 minute, if the absolute value of the difference does not exceed the preset delay time, the verification result is valid, otherwise, the verification result is invalid, and the verification is returned to fail; if the time-varying parameter r2And if the serial number is the serial number, the verifying party verifies whether the serial number sent by the claiming party is consistent with the serial number generated by the serial number counter of the verifying party, if so, the verification result is valid, otherwise, the verification result is invalid, and the verification is returned to fail. When the serial number is abnormal, the serial number counters of the claiming party and the verifying party are restarted or reset, or the serial number counters can be restarted or reset at preset interval time periods, for example, 30 daysAnd reset once.
And step S208, when the verification result of the time-varying parameter is valid, the verifying party obtains the operation result of the bilinear pairing operation based on the bilinear pairing operation according to the token, the time-varying parameter, the first variable element and the second variable element of the verifying party.
Wherein the Token of the verifierBBefore triggering identity authentication request, the key generation center identifies ID according to the claimant sent by the claimantAAnd password pwd, and sent to the verifier. The bilinear pairing operation e is the first addition cycle group G1And a second addition cyclic group G2To multiplication loop group GTOf bilinear pairings, i.e. G1×G2To GTBilinear pairs of (c). The operation result of the bilinear pairing operation e may be one or more.
In one embodiment, the operation result of the bilinear pairing operation e comprises a first operation result e1And a second operation result e2Token according to the verifierBTime-varying parameter r2A first variable element X and a second variable element Y to obtain a first operation result e1And a second operation result e2The formula of (1) is as follows:
e1＝e(Y，Q)
e2＝e[X，[r2]TokenB]
wherein Q is a second addition cyclic group G2The generator of (1).
In step S209, the verifier determines whether a preset condition is satisfied according to the operation result, and if so, the method proceeds to step S210.
The preset condition is set according to an operation result of bilinear pairing operation, and can be preset by a server or manually.
Specifically, in one embodiment, the verifier bases on the first operation result e1And a second operation result e2Determining the first operation result e1And a second operation result e2Whether they are equal to each other or not, and when they are equal to each other, it is determined that the predetermined condition is satisfied, and it indicates that the sound is equal to the predetermined conditionThe identity authentication of the calling party passes.
In step S210, the verifier returns an authentication pass message to the claimant.
The verifying party passes the identity authentication of the claiming party and returns an authentication passing message to the claiming party.
In the identity authentication method based on the SM9 algorithm, the identification of the claiming party, the time-varying parameter, the first variable element and the second variable element are sent by the claiming party verifying party, wherein the first variable element is generated according to the identification of the claiming party, the second variable element is generated according to the token and the password of the claiming party, the validity of the time-varying parameter is verified by the verifying party, the claiming party is prevented from sending data which is verified before, the time validity of the verification process is ensured, and when the time-varying parameter is verified to be valid, the verifying party verifies the first variable element and the second variable element by using the time-varying parameter and the token of the verifying party based on bilinear pairing operation, so that the identity information of the claiming party is authenticated. The method has higher efficiency through one-time information transmission of the claiming direction verifying party, the system deployment of SM9 is used, a brand-new system is not required to be arranged, the privacy information of the claiming party is divided into the token and the password of the claiming party, the password is not required to be directly used for information transmission, the safety of identity authentication is improved, the requirement on the computing capacity of the claiming party is low, and complex computation is performed, for example, bilinear pairing operation e is placed on the verifying party.
In one embodiment, as shown in fig. 3, there is provided an identity authentication method based on SM9 algorithm, which is illustrated by taking the method as an example applied to the claimant in fig. 1, and includes the following steps:
step S302, when an identity authentication request is triggered, a random number and a time-varying parameter are generated.
And step S304, obtaining an element of the identifier of the claimant according to the identifier of the claimant based on the password function.
Step S306, determining a first variable element according to the random number and the element of the identification of the claimant; the first variable element is an element of the first addition cycle group.
Step S308, determining a second variable element according to the random number, the time-varying parameter, the element of the identification of the claiming party, the token of the claiming party and the password; the method comprises the steps that before an identity authentication request is triggered, a token of an allegedly-speaking party is obtained by sending an allegedly-speaking party identifier and a password application to a secret key generation center; the second variable element is an element of the second addition cycle group.
Step S310, the identification of the claimant, the time-varying parameter, the first variable element and the second variable element are sent to the verifier; the validity of the time-varying parameter is verified by the verifier, when the verification result of the time-varying parameter is valid, the operation result of the bilinear pairing operation is obtained according to the token, the time-varying parameter, the first variable element and the second variable element of the verifier based on the bilinear pairing operation, whether the preset condition is met or not is judged according to the operation result, and when the preset condition is met, an authentication passing message is returned to the claiming party.
In the identity authentication method based on the SM9 algorithm, the identification of the claiming party, the time-varying parameter, the first variable element and the second variable element are sent by the claiming party to the verifier, wherein the first variable element is generated according to the identification of the claiming party, the second variable element is generated according to the token and the password of the claiming party, the validity of the time-varying parameter is verified by the verifier, the claiming party is prevented from sending data which is verified before, the time validity of the verification process is ensured, when the time-varying parameter is verified to be valid, the verifier verifies the first variable element and the second variable element by using the time-varying parameter and the token of the verifier based on bilinear pairing operation, the authentication of the identity information of the claiming party is realized, the method does not need to directly use the password for information transmission, and the security of the identity authentication is improved.
In one embodiment, as shown in fig. 4, there is provided an identity authentication method based on SM9 algorithm, which is described by taking the method as an example applied to the verifier in fig. 1, and includes the following steps:
step S402, receiving the identification of the claimant, the time-varying parameter, the first variable element and the second variable element which are sent by the claimant; the time-varying parameter, the first variable element and the second variable element are generated by the claimant when the identity authentication request is triggered, wherein the first variable element is an element of a first addition cycle group, and the second variable element is an element of a second addition cycle group.
And step S404, verifying the validity of the time-varying parameter.
Step S406, when the verification result of the time-varying parameter is valid, based on bilinear pairing operation, obtaining the operation result of the bilinear pairing operation according to the token of the verifier, the time-varying parameter, the first variable element and the second variable element; before the token of the verifier triggers the identity authentication request, the key generation center obtains the token according to the identification and the password of the claimant sent by the claimant and sends the token to the verifier.
And step S408, judging whether a preset condition is met or not according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met.
In the identity authentication method based on the SM9 algorithm, the verifier verifies the validity of the time-varying parameter by receiving the identifier of the claimant, the time-varying parameter, the first variable element and the second variable element, wherein the first variable element is generated according to the identifier of the claimant, and the second variable element is generated according to the token and the password of the claimant, so that the claimant is prevented from sending previously verified data, the time validity of the authentication process is ensured, and when the time-varying parameter is verified to be valid, the first variable element and the second variable element are verified by using the time-varying parameter and the token of the verifier based on bilinear pairing operation, so that the authentication of the identity information of the claimant is realized.
In another embodiment, as shown in fig. 5, an identity authentication method based on SM9 algorithm is provided, which is exemplified by applying the method to the above-mentioned identity authentication system based on SM9 algorithm in fig. 1.
In step S501, when an identity authentication request is triggered, the claimant generates a first random number.
Wherein the first random number is r1Is a random number between 1 and N-1, N is a first addition cycle group G1Or a second addition cycle group G2Order of (1) N, r1May be generated by a random number generator.
Step S502, the claimant obtains the element of the claimant identifier according to the claimant identifier based on the cryptographic function.
Specifically, the claimant is based on a cryptographic function H (U) and a claimant identification IDAGet the meta P of the claimant's identityAThe formula is as follows:
PA＝H(IDA)
in step S503, the claimant determines a first variable element according to the first random number and the element identified by the claimant.
Wherein the first variable element X is a first addition cycle group G1Is based on a random number r1Meta P with claimant identificationAThe formula for determining the first variable element X is as follows:
X＝[r1]PA
in the above formula, the first variable element X is the element P of the claimant identifierAR of1The value of the factor.
In step S504, the claimant sends the claimant identifier and the first argument to the verifier.
Specifically, the claimant identifies the claimant ID with the claimantAAnd the first variable element X is sent to the verifier.
In step S505, the verifier receives the identifier of the claimant and the first argument sent by the claimant.
Specifically, the verifier receives the purporter identification ID sent by the purporterAAnd a first argument X.
In step S506, the verifier generates a second random number.
Wherein the second random number r2Is a random number between 1 and N-1, N is a first addition cycle group G1Or a second addition cycle group G2Order of (1) N, r2May be generated by a random number generator. Specifically, the random number generator of the verifier generates a second random number r2。
In step S507, the verifier sends the second random number to the claimant.
Specifically, the authenticator assigns the second random number r2And sending to the alleged party.
In step S508, the claimant receives the second random number sent by the authenticator.
Specifically, the claimant receives the second random number r sent by the claimant2。
In step S509, the claimant determines a second variable element according to the first random number, the second random number, the element of the claimant identifier, the token of the claimant, and the password.
Wherein the Token of the allekerASending an alleged party identification ID to a key generation center by an alleged party before triggering an identity authentication requestAAnd the password pwd is applied for, and the second variable element Y is a second addition cycle group G2Is used as the element of (1).
In particular, the claimant is based on a first random number r1A second random number r2Meta P of the alleged party identificationAToken of the allekerAAnd a password pwd, the formula for determining the second variable element Y is as follows:
Y＝[r1r2](TokenA-[pwd]PA)
in step S510, the claimant sends the second variable element to the verifier.
Specifically, the claimant sends the second argument Y to the verifier.
In step S511, the verifier receives the second argument sent by the claimant.
Specifically, the verifier receives the second argument Y sent by the claimant.
And S512, the verifying party obtains an operation result of the bilinear pairing operation based on the bilinear pairing operation according to the token, the second random number, the first variable element and the second variable element of the verifying party.
Wherein the Token of the verifierBBefore triggering identity authentication request, the key generation center identifies ID according to the claimant sent by the claimantAAnd password pwd, and sent to the verifier. The bilinear pairing operation e is the first addition cycle group G1And a second addition cyclic group G2To multiplication loop group GTOf bilinear pairings, i.e. G1×G2To GTBilinear pairs of (c). The operation result of the bilinear pairing operation e may be one or more.
In one embodiment, the operation result of the bilinear pairing operation e comprises a first operation result e1And a second operation result e2Token according to the verifierBTime-varying parameter r2A first variable element X and a second variable element Y to obtain a first operation result e1And a second operation result e2The formula of (1) is as follows:
e1＝e(Y，Q)
e2＝e[X，[r2]TokenB]
wherein Q is a second addition cyclic group G2The generator of (1).
In step S513, the verifier determines whether a preset condition is satisfied according to the operation result, and if the preset condition is satisfied, the method proceeds to step S514.
The preset condition is set according to an operation result of bilinear pairing operation, and can be preset by a server or manually.
Specifically, in one embodiment, the verifier bases on the first operation result e1And a second operation result e2Determining the first operation result e1And a second operation result e2And if so, judging that the preset condition is met, and indicating that the identity authentication of the claiming party passes.
In step S514, the verifier returns an authentication pass message to the alleged party.
The verifying party passes the identity authentication of the claiming party and returns an authentication passing message to the claiming party.
In the identity authentication method based on the SM9 algorithm, after an identification of a claiming party and a first variable element are sent by a claiming party verifier, the first variable element is generated according to the identification of the claiming party, a second random number is generated by the verifier and sent to the claiming party, the claiming party determines the second variable element according to the first random number, the second random number, a token of the claiming party and a password and sends the second variable element to the verifier, and after the verifier receives the second variable element, the first variable element and the second variable element are verified by the token of the verifier and the second random number based on bilinear pairing operation, so that the identity information of the claiming party is authenticated. The method has higher safety through multiple information transmission of the claiming party and the verifying party, the system deployment of SM9 is continued, a brand-new system is not required to be arranged, the privacy information of the claiming party is divided into the token and the password of the claiming party, the password is not required to be directly used for data transmission, the safety of identity authentication is improved, the requirement on the computing capacity of the claiming party is low, and complex computation is carried out, for example, bilinear pairing operation e is carried out on the verifying party.
In one embodiment, as shown in fig. 6, there is provided an identity authentication method based on SM9 algorithm, which is illustrated by taking the method as an example applied to the claimant in fig. 1, and includes the following steps:
step S602, when an identity authentication request is triggered, a first random number is generated.
Step S604, based on the password function, according to the identifier of the claiming party, the element of the identifier of the claiming party is obtained.
Step S606, determining a first variable element according to the first random number and the element of the identification of the claimant; the first variable element is an element of the first addition cycle group.
Step S608, the claimant identifier and the first argument are sent to the verifier.
Step S610, receiving a second random number sent by the verifier; the second random number is generated by the verifier after receiving the identification of the claimant and the first variable element sent by the claimant.
Step S612, determining a second variable element according to the first random number, the second random number, the element of the identifier of the claimant, the token of the claimant and the password; the method comprises the steps that before an identity authentication request is triggered, a token of an allegedly-speaking party is obtained by sending an allegedly-speaking party identifier and a password application to a secret key generation center; the second variable element is an element of the second addition cycle group.
Step S614, the second variable element is sent to a verifier; and obtaining an operation result of the bilinear pairing operation by the verifier based on the bilinear pairing operation according to the token, the second random number, the first variable element and the second variable element of the verifier, judging whether a preset condition is met according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met.
In the identity authentication method based on the SM9 algorithm, after an identification of a claiming party and a first variable element are sent by a claiming party verifier, the first variable element is generated according to the identification of the claiming party, a second random number is generated by the verifier and sent to the claiming party, the claiming party determines the second variable element according to the first random number, the second random number, a token of the claiming party and a password and sends the second variable element to the verifier, and after the verifier receives the second variable element, the first variable element and the second variable element are verified by the token of the verifier and the second random number based on bilinear pairing operation, so that the identity information of the claiming party is authenticated. The method has higher safety through multiple information transmission of the claiming party and the verifying party, the system deployment of SM9 is continued, a brand-new system is not required to be arranged, the privacy information of the claiming party is divided into the token and the password of the claiming party, the password is not required to be directly used for data transmission, the safety of identity authentication is improved, the requirement on the computing capacity of the claiming party is low, and complex computation is carried out, for example, bilinear pairing operation e is carried out on the verifying party.
In one embodiment, as shown in fig. 7, there is provided an identity authentication method based on SM9 algorithm, which is described by taking the method as an example applied to the verifier in fig. 1, and includes the following steps:
step S702, receiving the identification of the claimant and the first variable element sent by the claimant; the first variable element is an element of the first addition cycle group, when the identity authentication request is triggered, the claimant generates a first random number, and based on a cryptographic function, after the element of the claimant identifier is obtained according to the claimant identifier, the first random number is obtained according to the first random number and the element of the claimant identifier.
Step S704, a second random number is generated.
Step S706, the second random number is sent to the allegiator.
Step S708, receiving a second variable element sent by the claimant; the second variable element is an element of the second addition cycle group.
Step S710, based on bilinear pairing operation, obtaining an operation result of the bilinear pairing operation according to the token of the verifier, the second random number, the first variable element and the second variable element; before the token of the verifier triggers the identity authentication request, the key generation center obtains the token according to the identification and the password of the claimant sent by the claimant and sends the token to the verifier.
Step S712, according to the operation result, determining whether a preset condition is satisfied, and returning an authentication passing message to the claiming party when the preset condition is satisfied.
In the identity authentication method based on the SM9 algorithm, after a verifier receives an identifier of a claimant and a first variable element sent by the claimant, a second random number is generated and sent to the claimant, the claimant determines a second variable element according to the first random number, the second random number, a token of the claimant and a password and sends the second variable element to the verifier, and after the verifier receives the second variable element, the verifier verifies the first variable element and the second variable element by using the token of the verifier and the second random number based on bilinear pairing operation, so that the identity information of the claimant is authenticated. The method has higher safety through multiple information transmission of the claiming party and the verifying party, the system deployment of SM9 is continued, a brand-new system is not required to be arranged, the privacy information of the claiming party is divided into the token and the password of the claiming party, the password is not required to be directly used for data transmission, the safety of identity authentication is improved, the requirement on the computing capacity of the claiming party is low, and complex computation is carried out, for example, bilinear pairing operation e is carried out on the verifying party.
In one embodiment, as shown in fig. 8, before triggering the identity authentication request, the method further includes: sending a claimant identifier and a password to a key generation center; the claimant identification and password are used to apply for the claimant's token and the verifier's token; and receiving and storing the token of the alleged party sent by the key generation center.
In particular, the alleged direction Key Generation Center (KGC) sends an alleged party identification IDAAnd a password pwd, wherein the claimant identifies the IDAAnd the password pwd to apply for the claimant's TokenAAnd Token of the verifierBThe Key Generation Center (KGC) generates a random number s as the main private key, and on the basis of the cryptographic function, the Key Generation Center (KGC) identifies the claimant partyIDAGenerating a meta-P of a claimant identityAThe generation formula is as follows:
PA＝H(IDA)
key Generation Center (KGC) identifies a meta-P from a claimantAGenerating a Token for a claimantAThe generation formula is as follows:
TokenA＝[s+pwd]PA
where s is a random number from 1 to N-1, owned by the key generation center KGC, pwd is the password owned by the alleged party.
Key Generation Center (KGC) generates Token of verifierBThe formula of (1) is as follows:
TokenB＝[s]Q
wherein s is a random number from 1 to N-1 owned by the key generation center KGC, and Q is a second addition cycle group G2The generator of (1).
Key Generation Center (KGC) generates Token of claimantAAnd Token of the verifierBThereafter, the Token of the alleker is sentATo the claimant, sending the Token of the authenticatorBTo the verifying party.
In this embodiment, only the claiming party key generation center needs to send the claiming party identifier and the password, the claiming party can obtain the token of the claiming party, and the verifying party can obtain the token of the verifying party, so that the initialization of the identity authentication is realized.
It should be understood that although the various steps in the flow charts of fig. 2-8 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least some of the steps in fig. 2-8 may include multiple steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, which are not necessarily performed in sequence, but may be performed in turn or alternately with other steps or at least some of the other steps.
In one embodiment, as shown in fig. 9, there is provided an identity authentication apparatus 900 based on SM9 algorithm, applied to an alleged party, including: a time-varying parameter generating module 902, a first argument determining module 904, a second argument determining module 906, and an argument sending module 908, wherein:
a time-varying parameter generating module 902, configured to generate a random number and a time-varying parameter when the identity authentication request is triggered.
A first variable element determining module 904, configured to obtain an element of the identifier of the claiming party according to the identifier of the claiming party based on the cryptographic function; determining a first variable element according to the random number and the element of the identification of the claimant; the first variable element is an element of the first addition cycle group.
A second variable element determining module 906, configured to determine a second variable element according to the random number, the time-varying parameter, the element identified by the claimant, the token of the claimant, and the password; the method comprises the steps that before an identity authentication request is triggered, a token of an allegedly-speaking party is obtained by sending an allegedly-speaking party identifier and a password application to a secret key generation center; the second variable element is an element of the second addition cycle group.
A variable element sending module 908 for sending the claimant identifier, the time-varying parameter, the first variable element and the second variable element to the verifier; the validity of the time-varying parameter is verified by the verifier, when the verification result of the time-varying parameter is valid, the operation result of the bilinear pairing operation is obtained according to the token, the time-varying parameter, the first variable element and the second variable element of the verifier based on the bilinear pairing operation, whether the preset condition is met or not is judged according to the operation result, and when the preset condition is met, an authentication passing message is returned to the claiming party.
In one embodiment, as shown in fig. 10, the identity authentication apparatus 900 based on SM9 algorithm further includes an initialization module 901 for sending the identification of the alleged party and the password to the key generation center before triggering the identity authentication request; the claimant identification and password are used to apply for the claimant's token and the verifier's token; and receiving and storing the token of the alleged party sent by the key generation center.
In one embodiment, as shown in fig. 11, there is provided an identity authentication apparatus 1100 based on SM9 algorithm, applied to a verifier, including: a variable element receiving module 1102, a time-varying parameter verifying module 1104, a pairing operation module 1106 and an authentication judging module 1108, wherein:
a variable element receiving module 1102, configured to receive an identifier of a claimant, a time-varying parameter, a first variable element, and a second variable element, where the identifier is sent by the claimant; the time-varying parameter, the first variable element and the second variable element are generated by the claimant when the identity authentication request is triggered, wherein the first variable element is an element of a first addition cycle group, and the second variable element is an element of a second addition cycle group.
A time-varying parameter verification module 1104 for verifying the validity of the time-varying parameter.
The pairing operation module 1106 is used for obtaining an operation result of the bilinear pairing operation according to the token of the verifier, the time-varying parameter, the first variable element and the second variable element based on the bilinear pairing operation when the verification result of the time-varying parameter is valid; before the token of the verifier triggers the identity authentication request, the key generation center obtains the token according to the identification and the password of the claimant sent by the claimant and sends the token to the verifier.
And the authentication judgment module 1108 is configured to judge whether a preset condition is met according to the operation result, and when the preset condition is met, return an authentication passing message to the claiming party.
In one embodiment, the operation result of the bilinear pairing operation comprises a first operation result and a second operation result; the authentication determining module 1108 is further configured to determine whether the first operation result and the second operation result are equal according to the first operation result and the second operation result, and if so, the authentication is passed and an authentication passing message is returned to the claiming party.
For specific limitations of the identity authentication device based on the SM9 algorithm, reference may be made to the above limitations of the identity authentication method based on the SM9 algorithm, which are not described herein again. The modules in the identity authentication device based on the SM9 algorithm can be wholly or partially implemented by software, hardware and a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.
In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as shown in fig. 12. The computer device includes a processor, a memory, and a network interface connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The database of the computer device is used for storing tokens and variable metadata. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement an identity authentication method based on the SM9 algorithm.
In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as shown in fig. 13. The computer device includes a processor, a memory, a communication interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless communication can be realized through WIFI, an operator network, NFC (near field communication) or other technologies. The computer program is executed by a processor to implement an identity authentication method based on the SM9 algorithm. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, a key, a track ball or a touch pad arranged on the shell of the computer equipment, an external keyboard, a touch pad or a mouse and the like.
It will be appreciated by those skilled in the art that the configurations shown in fig. 12-13 are only block diagrams of some of the configurations relevant to the present application, and do not constitute a limitation on the computing devices to which the present application may be applied, and that a particular computing device may include more or less components than shown in the figures, or may combine certain components, or have a different arrangement of components.
In one embodiment, a computer device is provided, comprising a memory and a processor, the memory having stored therein a computer program, the processor implementing the steps of the above-described method embodiments when executing the computer program.
In an embodiment, a computer-readable storage medium is provided, on which a computer program is stored which, when being executed by a processor, carries out the steps of the above-mentioned method embodiments.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database or other medium used in the embodiments provided herein can include at least one of non-volatile and volatile memory. Non-volatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical storage, or the like. Volatile Memory can include Random Access Memory (RAM) or external cache Memory. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM), among others.
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.

Claims (10)

1. An identity authentication method based on SM9 algorithm, applied to an alleged party, the method comprises:
when an identity authentication request is triggered, generating a random number and a time-varying parameter;
based on the password function, obtaining an element of the identification of the claiming party according to the identification of the claiming party;
determining a first variable element according to the random number and the element of the claimant identifier; the first variable element is an element of a first addition cycle group;
determining a second variable element according to the random number, the time-varying parameter, the element of the identifier of the claimant, the token of the claimant and the password; the token of the claimant is obtained by sending the claimant identifier and the password application to a key generation center before triggering an identity authentication request; the second variable element is an element of a second addition cycle group;
sending the claimant identifier, the time-varying parameter, the first variable element and the second variable element to a verifier; and verifying the validity of the time-varying parameter by the verifier, obtaining an operation result of bilinear pairing operation according to the token of the verifier, the time-varying parameter, the first variable element and the second variable element based on bilinear pairing operation when the verification result of the time-varying parameter is valid, judging whether a preset condition is met according to the operation result, and returning an authentication passing message to the alleged party when the preset condition is met.
2. An identity authentication method based on SM9 algorithm, applied to a verifier, the method comprises:
receiving an identification of a claimant, a time-varying parameter, a first variable element and a second variable element which are sent by the claimant; when the time-varying parameter, the first variable element and the second variable element are used for triggering an identity authentication request, the claiming party generates the time-varying parameter, the first variable element is an element of a first addition cycle group, and the second variable element is an element of a second addition cycle group;
verifying the validity of the time-varying parameter;
when the verification result of the time-varying parameter is valid, based on bilinear pairing operation, obtaining an operation result of the bilinear pairing operation according to a token of a verifier, the time-varying parameter, the first variable element and the second variable element; before the token of the verifier triggers the identity authentication request, the key generation center obtains the token according to the identification and the password of the claimant sent by the claimant and sends the token to the verifier;
and judging whether a preset condition is met or not according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met.
3. An identity authentication method based on SM9 algorithm, applied to an alleged party, the method comprises:
generating a first random number when an identity authentication request is triggered;
based on the password function, obtaining an element of the identification of the claiming party according to the identification of the claiming party;
determining a first variable element according to the first random number and the element of the claimant identifier; the first variable element is an element of a first addition cycle group;
sending the claimant identifier and the first argument to a verifier;
receiving a second random number sent by the verifier; the second random number is generated by the verifier after receiving the identification of the allegator and the first variable element sent by the allegator;
determining a second variable element according to the first random number, the second random number, the element of the identifier of the claimant, the token of the claimant and the password; the token of the claimant is obtained by sending the claimant identifier and the password application to a key generation center before triggering an identity authentication request; the second variable element is an element of a second addition cycle group;
sending the second variable element to the verifier; and obtaining an operation result of the bilinear pairing operation by the verifier based on the bilinear pairing operation according to the token of the verifier, the second random number, the first variable element and the second variable element, judging whether a preset condition is met or not according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met.
4. An identity authentication method based on SM9 algorithm, applied to a verifier, the method comprises:
receiving a claimant identifier and a first variable element sent by a claimant; the first variable element is an element of a first addition cycle group, when an identity authentication request is triggered, the claiming party generates a first random number, and based on a cryptographic function, after the element of the claiming party identifier is obtained according to the claiming party identifier, the first random number is obtained according to the first random number and the element of the claiming party identifier;
generating a second random number;
sending the second random number to the claimant;
receiving a second variable element sent by the claimant; the second variable element is an element of a second addition cycle group;
based on bilinear pairing operation, obtaining an operation result of the bilinear pairing operation according to a token of a verifier, the second random number, the first variable element and the second variable element; before the token of the verifier triggers the identity authentication request, the key generation center obtains the token according to the identification and the password of the claimant sent by the claimant and sends the token to the verifier;
and judging whether a preset condition is met or not according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met.
5. The method according to any one of claims 1 and 3, wherein before triggering the identity authentication request, further comprising:
sending the purporter identification and the password to a key generation center; the claimant identification and the password are used to apply for the claimant's token and the verifier's token;
and receiving and storing the token of the alleged party sent by the key generation center.
6. The method according to any one of claims 2 and 4, wherein the operation result of the bilinear pairing operation comprises a first operation result and a second operation result; the judging whether a preset condition is met or not according to the operation result, and when the preset condition is met, returning an authentication passing message to the claiming party comprises the following steps:
and judging whether the first operation result and the second operation result are equal or not according to the first operation result and the second operation result, if so, passing the authentication, and returning an authentication passing message to the claimant.
7. An identity authentication device based on SM9 algorithm, applied to an allegiator, the device comprises:
the time-varying parameter generating module is used for generating a random number and a time-varying parameter when an identity authentication request is triggered;
the first variable element determining module is used for obtaining an element of the identifier of the claiming party according to the identifier of the claiming party based on a cryptographic function; determining a first variable element according to the random number and the element of the claimant identifier; the first variable element is an element of a first addition cycle group;
a second variable element determination module for determining a second variable element according to the random number, the time-varying parameter, the element of the identifier of the claimant, the token of the claimant and the password; the token of the claimant is obtained by sending the claimant identifier and the password application to a key generation center before triggering an identity authentication request; the second variable element is an element of a second addition cycle group;
the variable element sending module is used for sending the claimant identifier, the time-varying parameter, the first variable element and the second variable element to a verifier; and verifying the validity of the time-varying parameter by the verifier, obtaining an operation result of bilinear pairing operation according to the token of the verifier, the time-varying parameter, the first variable element and the second variable element based on bilinear pairing operation when the verification result of the time-varying parameter is valid, judging whether a preset condition is met according to the operation result, and returning an authentication passing message to the allegiation party when the preset condition is met.
8. An identity authentication device based on SM9 algorithm, applied to a verifier, the device comprising:
the variable element receiving module is used for receiving the identification of the claimant, the time-varying parameter, the first variable element and the second variable element which are sent by the claimant; when the time-varying parameter, the first variable element and the second variable element are used for triggering an identity authentication request, the claiming party generates the time-varying parameter, the first variable element is an element of a first addition cycle group, and the second variable element is an element of a second addition cycle group;
a time-varying parameter verification module for verifying the validity of the time-varying parameter;
the pairing operation module is used for obtaining an operation result of the bilinear pairing operation according to the token of the verification party, the time-varying parameter, the first variable element and the second variable element based on the bilinear pairing operation when the verification result of the time-varying parameter is valid; before the token of the verifier triggers the identity authentication request, the key generation center obtains the token according to the identification and the password of the claimant sent by the claimant and sends the token to the verifier;
and the authentication judgment module is used for judging whether a preset condition is met or not according to the operation result, and returning an authentication passing message to the claiming party when the preset condition is met.
9. A computer device comprising a memory and a processor, the memory storing a computer program, wherein the processor implements the steps of the method of any one of claims 1 to 6 when executing the computer program.
10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 6.
CN202010041318.XA 2020-01-15 2020-01-15 SM9 algorithm-based identity authentication method and device and computer equipment Active CN111259353B (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202010041318.XA CN111259353B (en) 2020-01-15 2020-01-15 SM9 algorithm-based identity authentication method and device and computer equipment
PCT/CN2020/137631 WO2021143457A1 (en) 2020-01-15 2020-12-18 Identity authentication method and apparatus based on sm9 algorithm, and computer device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010041318.XA CN111259353B (en) 2020-01-15 2020-01-15 SM9 algorithm-based identity authentication method and device and computer equipment

Publications (2)

Publication Number Publication Date
CN111259353A true CN111259353A (en) 2020-06-09
CN111259353B CN111259353B (en) 2022-10-14

Family

ID=70948768

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010041318.XA Active CN111259353B (en) 2020-01-15 2020-01-15 SM9 algorithm-based identity authentication method and device and computer equipment

Country Status (2)

Country Link
CN (1) CN111259353B (en)
WO (1) WO2021143457A1 (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111865964A (en) * 2020-07-16 2020-10-30 董海霞 Identity authentication system based on enterprise private cloud encrypted file system
WO2021143457A1 (en) * 2020-01-15 2021-07-22 江苏芯盛智能科技有限公司 Identity authentication method and apparatus based on sm9 algorithm, and computer device
CN113381982A (en) * 2021-05-17 2021-09-10 北京字跳网络技术有限公司 Registration method, registration device, electronic equipment and storage medium
CN114745114A (en) * 2022-04-25 2022-07-12 四川凝思软件有限公司 Key agreement method, device, equipment and medium based on password derivation

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114301651B (en) * 2021-12-22 2023-07-21 河南大学 Yellow river dam bank monitoring data sharing method based on CP-ABE
CN115150062B (en) * 2022-06-10 2024-04-02 武汉理工大学 SM9 digital signature generation method and system with signature production data controlled safely

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130283361A1 (en) * 2012-04-23 2013-10-24 General Instrument Corporation Identity verification
CN109639426A (en) * 2019-02-26 2019-04-16 中国人民解放军国防科技大学 Bidirectional self-authentication method based on identification password
CN109981292A (en) * 2019-03-27 2019-07-05 北京思源互联科技有限公司 A kind of authentication method based on SM9 algorithm, apparatus and system

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108989054B (en) * 2018-08-30 2020-08-04 武汉理工大学 Cipher system and digital signature method
CN109600225B (en) * 2018-12-04 2019-10-15 北京海泰方圆科技股份有限公司 A kind of key exchange method, device and storage medium
CN111259353B (en) * 2020-01-15 2022-10-14 江苏芯盛智能科技有限公司 SM9 algorithm-based identity authentication method and device and computer equipment

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130283361A1 (en) * 2012-04-23 2013-10-24 General Instrument Corporation Identity verification
CN109639426A (en) * 2019-02-26 2019-04-16 中国人民解放军国防科技大学 Bidirectional self-authentication method based on identification password
CN109981292A (en) * 2019-03-27 2019-07-05 北京思源互联科技有限公司 A kind of authentication method based on SM9 algorithm, apparatus and system

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021143457A1 (en) * 2020-01-15 2021-07-22 江苏芯盛智能科技有限公司 Identity authentication method and apparatus based on sm9 algorithm, and computer device
CN111865964A (en) * 2020-07-16 2020-10-30 董海霞 Identity authentication system based on enterprise private cloud encrypted file system
CN111865964B (en) * 2020-07-16 2022-05-20 北京望京科技孵化服务有限公司 Identity authentication system based on enterprise private cloud encrypted file system
CN113381982A (en) * 2021-05-17 2021-09-10 北京字跳网络技术有限公司 Registration method, registration device, electronic equipment and storage medium
CN114745114A (en) * 2022-04-25 2022-07-12 四川凝思软件有限公司 Key agreement method, device, equipment and medium based on password derivation

Also Published As

Publication number Publication date
WO2021143457A1 (en) 2021-07-22
CN111259353B (en) 2022-10-14

Similar Documents

Publication Publication Date Title
CN111259353B (en) SM9 algorithm-based identity authentication method and device and computer equipment
Li et al. Fuzzy identity-based data integrity auditing for reliable cloud storage systems
CN111212095B (en) Authentication method, server, client and system for identity information
US20220255920A1 (en) System and method for proximity-based authentication
JP4790731B2 (en) Derived seed
US9240891B2 (en) Hybrid authentication
WO2021184755A1 (en) Application access method and apparatus, and electronic device and storage medium
US10924289B2 (en) Public-private key pair account login and key manager
CN113691502B (en) Communication method, device, gateway server, client and storage medium
US20160381003A1 (en) Universal enrollment using biometric pki
US10878108B1 (en) Delegated private set intersection, and applications thereof
KR102284396B1 (en) Method for generating pki keys based on bioinformation on blockchain network and device for using them
CN115001841A (en) Identity authentication method, identity authentication device and storage medium
CN113709115A (en) Authentication method and device
US20060129815A1 (en) Generation of identities and authentication thereof
CN116170144B (en) Smart power grid anonymous authentication method, electronic equipment and storage medium
KR20060069611A (en) User authentication method in other network using digital signature made by mobile terminal
CN114124440B (en) Secure transmission method, apparatus, computer device and storage medium
CN115442037A (en) Account management method, device, equipment and storage medium
CN116015900A (en) Data self-storage self-verification method, device, equipment and storage medium
CN114238914A (en) Digital certificate application system, method, device, computer equipment and storage medium
Guo et al. Extending registration and authentication processes of FIDO2 external authenticator with qr codes
Zhang et al. Traceable dynamic public auditing with identity privacy preserving for cloud storage
KR101363290B1 (en) Lightweight authentication key agreement method between terminals
JP5101535B2 (en) Authentication method, authentication system, program, and shared key generation method

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant