WO2017059753A1 - 一种多ttp参与的实体身份有效性验证方法及装置 - Google Patents
一种多ttp参与的实体身份有效性验证方法及装置 Download PDFInfo
- Publication number
- WO2017059753A1 WO2017059753A1 PCT/CN2016/096940 CN2016096940W WO2017059753A1 WO 2017059753 A1 WO2017059753 A1 WO 2017059753A1 CN 2016096940 W CN2016096940 W CN 2016096940W WO 2017059753 A1 WO2017059753 A1 WO 2017059753A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- entity
- message
- trusted
- ttp
- signature
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/12—Applying verification of the received information
- H04L63/126—Applying verification of the received information the source of the received data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
- H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
- H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
Definitions
- the present invention relates to an entity identity validity verification method and apparatus, and more particularly to an entity identity validity verification method and apparatus with multiple trusted third parties participating.
- the specific identity validity verification environment is an environment that authenticates each other's identity validity between entities that trust different trusted third-party TTPs, and at the same time requires a trusted third party to participate and provide authentication. In this way, an entity identity validity verification method is needed to solve the above problem.
- the present application provides a real participation including two TTPs.
- the method of verifying the validity of the identity provides a service for the validity of the identity of each other between entity A and entity B.
- a multi-TTP participation entity identity verification method involves entity A, entity B, trusted third party TTP A and trusted third party TTP B.
- the identity valid performance of entity A is verified by TTP A
- the identity of entity B is valid.
- the performance is verified by TTP B
- entity A trusts TTP A
- entity B trusts TTP A and TTP B.
- the method includes the following steps:
- Entity B sends message 1 to entity A, message 1 includes identity information I B of entity B and random number R B generated by entity B ;
- the entity A After receiving the message 1, the entity A sends a message 2 to the trusted third party TTP A , the message 2 includes the identity information I A of the entity A, the random number R A generated by the entity A , the identity information I B of the entity B, and the random Number R B ;
- the TTP Trusted Third Party A receives the message sent by the entity A 2.
- I A A identity verification entity sends a message to the trusted third party TTP B 3, 3 comprises a random message and I B generated by the TTP A Number R TPA ;
- the message 4 includes a token TokenTPBA, wherein, TokenTPBA Res B comprising a first and the TTP B Signature, Res B is the verification result of TTP B to entity B, and the signature object of the first signature of TTP B includes R TPA and Res B ;
- the TTP A After receiving the message 4 sent by the TTP B , the TTP A verifies the first signature of the TTP B included in the TokenTPBA. After the verification is passed, it checks whether the R TPA obtained from the message 4 is sent to the TTP B in the message 3. The random number R TPA is consistent. If consistent, the TTP A construct message 5 is sent to the entity A, and the message 5 includes the token TokenTA, wherein the TokenTA includes the first signature of Res A , Res B , TTP A and the second signature of TTP A Res A is the verification result of TTP A to entity A.
- the signature object of the first signature of TTP A includes Res B and R A
- the signature object of the second signature of TTP A includes Res A and R B ;
- the entity A receives the message 5 A from the TTP verifies the signature contained in the TokenTA in the first A of the TTP, after the verification, obtained from the check message 5 R A whether to send its own message in the TTP A 2
- the random numbers R A are consistent. If they are consistent, the entity A determines the validity of the entity B identity according to the verification result Res B , and constructs a message 6 to be sent to the entity B, and the message 6 includes the second signatures of Res A and TTP A ;
- the entity B After receiving the message 6, the entity B verifies the second signature of the TTP A. After the verification is passed, it checks whether the R B obtained from the message 6 is consistent with the random number R B that is sent to the entity A in the message 1. Consistently, entity B determines the validity of entity A identity based on the verification result Res A.
- the first entity identity validity verification device includes a storage unit, a transceiver unit, and a processing unit, wherein:
- the processing unit is configured to generate a random number R A ;
- the storage unit is configured to store the identity information I A of the first entity identity validity verification device
- the transceiver unit is configured to receive the message 1 sent by the second entity identity validity verification device, and send the message 2 to the first trusted third party device, where the message 1 includes the second entity identity validity verification
- the transceiver unit is further configured to receive the message 5 sent by the first trusted third party device, and send the message 6 to the second entity identity validity verification device, where the message 5 includes a token TokenTA, where the TokenTA includes Res A , Res B , a first signature of the first trusted third party device, and a second signature of the first trusted third party device, wherein Res A is the first trusted third party device
- the verification result of the first entity identity validity verification device, Res B is the verification result of the second entity identity verification device by the second trusted third party device, and the first trusted third party device
- the signature object of the first signature includes Res B and R A
- the signature object of the second signature of the first trusted third party device includes Res A and R B
- the message 6 includes Res A and the first trusted The second signature of the third party device;
- a processing unit for verifying the first signature TokenTA said first trusted third party device obtained from the check message 5 R A to whether to transmit the first message in the trusted third party with its own 2
- the random number R A of the device is consistent, and the validity of the identity of the second entity identity validity verification device is determined according to the verification result Res B , and the message 6 is constructed.
- the second entity identity validity verification device comprises a storage unit, a transceiver unit and a processing unit, wherein:
- the processing unit is configured to generate a random number R B ;
- the storage unit is configured to store the identity information I B of the second entity identity validity verification device
- the transceiver unit is configured to send a message 1 and receive the message 6 sent by the first entity identity validity verification device, where the message 1 includes I B and R B , and the message 6 includes Res A and the first And a second signature of the third party device, wherein Res A is a verification result of the first trusted third party device to the first entity identity validity verification device, and a second of the first trusted third party device Signed signature objects include Res A and R B ;
- the processing unit is further configured to verify the second signature of the first trusted third party device, and check whether the R B obtained from the message 6 is random with the self-identification device sent to the first entity identity validity verification device in the message 1.
- the number R B is consistent, and the validity of the first entity identity validity verification device identity is determined based on the verification result Res A.
- the first trusted third party device comprises a transceiver unit and a processing unit, wherein:
- the transceiver unit is configured to receive the message 2 sent by the first entity identity validity verification device, where the message 2 includes the identity information I A of the first entity identity validity verification device, and the first entity identity validity verification a random number R A generated by the device, identity information I B of the second entity identity validity verification device, and a random number R B generated by the second entity identity validity verification device;
- the processing unit is configured to verify the identity of the first entity identity validity verification device according to the I A ;
- the transceiver unit is further configured to send a message 3 to the second trusted third party device, where the message 3 includes I B and a random number R TPA generated by the first trusted third party device;
- the transceiver unit is further configured to receive the message 4 sent by the second trusted third party device, where the message 4 includes a token TokenTPBA, where the TokenTPBA includes the Res B and the first signature of the second trusted third party device.
- Res B is a verification result of the second trusted third party device to the second entity identity validity verification device, and the signature object of the first signature of the second trusted third party device includes R TPA and Res B ;
- the processing unit is further configured to verify the first signature of the second trusted third party device included in the TokenTPBA, and check whether the R TPA obtained from the message 4 is sent to the second trusted third party in the message 3
- the random number R TPA of the device is consistent, and constructs a message 5, the message 5 including a token TokenTA, wherein the TokenTA includes Res A , Res B , the first signature of the first trusted third party device, and the first a second signature of the trusted third party device, Res A is a verification result of the first trusted third party device to the first entity identity validity verification device, and the first signature of the first trusted third party device
- the signature object includes Res B and R A
- the signature object of the second signature of the second trusted third party device includes Res A and R B ;
- the transceiver unit is further configured to send the message 5 to the first entity identity validity verification device.
- the second trusted third party device comprises a transceiver unit and a processing unit, wherein:
- the transceiver unit is configured to receive the message 3 sent by the first trusted third party device, where the message 3 includes the identity information I B of the second entity identity validity verification device and the first trusted third party device generates Random number R TPA ;
- the processing unit is configured to verify the identity of the second entity identity validity verification device according to the I B ;
- the transceiver unit is further configured to return a message 4 to the first trusted third party device, where the message 4 includes a token TokenTPBA, wherein the TokenTPBA includes Res B and a first signature of the second trusted third party device, and Res B is The second trusted third party device verifies the verification result of the second entity identity verification device, and the signature object of the first signature of the second trusted third party device includes R TPA and Res B .
- the identity validity of the entity performing mutual identity validity verification can only be verified by different trusted third party TTPs.
- the interaction between the TTPs trusted by the two entities is the mutual interaction between the entities.
- Identity validity provides verification services that complete identity validation between entities. The present application solves the problem of identity validity verification when entities trust different TTPs respectively.
- FIG. 1 is a schematic diagram of a preferred embodiment of an identity validity verification method for multi-TTP participation in the present application.
- FIG. 2 is a schematic diagram of a first entity identity validity verification apparatus according to the present application.
- FIG. 3 is a schematic diagram of a second entity identity validity verification apparatus according to the present application.
- FIG. 4 is a schematic diagram of a first trusted third party device of the present application.
- FIG. 5 is a schematic diagram of a second trusted third party device of the present application.
- Entities involved in the method of the present application include entities A and B, trusted third parties TTP A and TTP B .
- the identity valid performance of entity A is verified by TTP A
- the identity valid performance of entity B is verified by TTP B
- entity A trusts TTP A
- entity B trusts TTP A and TTP B .
- the connection relationship between the entity and the TTP is: entity B only connects to entity A, entity A connects entity B and trusted third party TTP A , and trusted third party TTP A connects entity A at the same time.
- trusted third party TTP B , trusted third party TTP B only connects to trusted third party TTP A.
- the method for verifying the validity of an entity identity involving multiple TTPs in this application involves entity A, entity B, trusted third party TTP A, and trusted third party TTP B.
- the effective performance of entity A is verified by TTP A.
- the identity valid performance of B is verified by TTP B , entity A trusts TTP A , and entity B trusts TTP A and TTP B.
- the method includes the following steps:
- Entity B sends message 1 to entity A, message 1 includes identity information I B of entity B and random number R B generated by entity B ;
- the entity A After receiving the message 1, the entity A sends a message 2 to the trusted third party TTP A , the message 2 includes the identity information I A of the entity A, the random number R A generated by the entity A , the identity information I B of the entity B, and the random Number R B ;
- the TTP Trusted Third Party A receives the message sent by the entity A 2.
- I A A identity verification entity sends a message to the trusted third party TTP B 3, 3 comprises a random message and I B generated by the TTP A Number R TPA ;
- the message 4 includes a token TokenTPBA, wherein, TokenTPBA Res B comprising a first and the TTP B Signature, Res B is the verification result of TTP B to entity B, and the signature object of the first signature of TTP B includes R TPA and Res B ;
- the TTP A After receiving the message 4 sent by the TTP B , the TTP A verifies the first signature of the TTP B included in the TokenTPBA. After the verification is passed, it checks whether the R TPA obtained from the message 4 is sent to the TTP B in the message 3. The random number R TPA is consistent. If consistent, the TTP A construct message 5 is sent to the entity A, and the message 5 includes the token TokenTA, wherein the TokenTA includes the first signature of Res A , Res B , TTP A and the second signature of TTP A Res A is the verification result of TTP A to entity A.
- the signature object of the first signature of TTP A includes Res B and R A
- the signature object of the second signature of TTP A includes Res A and R B ;
- the entity A receives the message 5 A from the TTP verifies the signature contained in the TokenTA in the first A of the TTP, after the verification, obtained from the check message 5 R A whether to send its own message in the TTP A 2
- the random numbers R A are consistent. If they are consistent, the entity A determines the validity of the entity B identity according to the verification result Res B , and constructs a message 6 to be sent to the entity B, and the message 6 includes the second signatures of Res A and TTP A ;
- the entity B After receiving the message 6, the entity B verifies the second signature of the TTP A. After the verification is passed, it checks whether the R B obtained from the message 6 is consistent with the random number R B that is sent to the entity A in the message 1. Consistently, entity B determines the validity of entity A identity based on the verification result Res A.
- entity A and entity B have verified the validity of each other's identity.
- the TTP Trusted Third Party A receives the message sent by the entity A 2, I A according to verify the identity of the entity A comprises:
- TTP A extracts the public key P A of entity A , and Re A includes P A at this time;
- Res A includes the content indicating that the verification failed.
- the trusted third party after receiving the TTP B 3, B verifies the identity of the entity in accordance with I B TTP
- a message transmitted comprises:
- TTP B extracts public key P B of entity B , and Re B includes P B at this time;
- I B is a certificate Cert Control entity B B, B checking the validity TTP Cert Control B, in which case B Res include a validity status Cert Control B;
- Res B includes the content indicating that the verification failed.
- A may not necessarily be the TTP generates a random number R TPA, but directly sent to the TTP using the generated random number R A A R TPA replaced by the entity A in the message 3, the subsequent step 4) R A is also used instead of R TPA in step 5).
- TTP A does not have to generate random numbers without affecting the security, which reduces the computational complexity of TTP A , thereby improving the efficiency of the system.
- step 5 the verification signature is not passed or judged.
- a processing method known in the art such as discarding the corresponding message or terminating the identity validity verification process may be adopted.
- the digital signature algorithm includes an algorithm with message recovery and no message recovery. If the target field can be restored when the signature is verified, the verification signer can directly recover the target from the signature after the verification signature is passed. Field; if the target field cannot be recovered when the signature is verified, those skilled in the art will usually carry the target field in the message, thereby verifying that the signer can directly obtain the target field from the message.
- step 5 if the target field R TPA can be restored when the TTP A verifies the signature, the TTP A can directly restore the R TPA from the signature after verifying that the first signature of the TTP B passes; if the TTP A verifies the signature target field can not be restored R TPA, the need for direct message carried in R TPA 4, TTP A may be acquired directly from the message R TPA 4.
- the present application further provides a first entity identity validity verification apparatus, which is used by the first trusted third party device and the second trusted third party device. And performing identity validity verification with the second entity identity validity verification device, where the first entity identity validity verification device includes a storage unit 11, a transceiver unit 12, and a processing unit 13:
- the processing unit 13 is configured to generate a random number R A ;
- the storage unit 11 is configured to store the identity information I A of the first entity identity validity verification device
- the transceiver unit 12 is configured to receive the message 1 sent by the second entity identity validity verification device, and send the message 2 to the first trusted third party device, where the message 1 includes the second entity identity validity Verifying the identity information I B of the device and the random number R B generated by the second entity identity validity verification device, the message 2 including I A , R A , I B and R B ;
- the transceiver unit 12 is further configured to receive the message 5 sent by the first trusted third party device, and send a message 6 to the second entity identity validity verification device, where the message 5 includes a token TokenTA, where TokenTA Res A , Res B , a first signature of the first trusted third party device, and a second signature of the first trusted third party device, wherein Res A is the first trusted third party device pair a verification result of the first entity identity validity verification device, Res B is a verification result of the second entity identity device verification device by the second trusted third party device, and the first trusted third party device
- the signature object of the first signature includes Res B and R A
- the signature object of the second signature of the first trusted third party device includes Res A and R B
- the message 6 includes Res A and the first The second signature of the third party device;
- the processing unit 13 is further configured to verify the signature contained in the TokenTA a first trusted third party in the first device, obtained from the check message 5 R A trusted whether to transmit to the first and the second message in its own 2
- the random number R A of the three-party device is consistent, and the validity of the identity of the second entity identity validity verification device is determined according to the verification result Res B , and the message 6 is constructed.
- the present application further provides a second entity identity validity verification apparatus, which is used by the first trusted third party device and the second trusted third party device. And performing identity validity verification with the first entity identity validity verification device, where the second entity identity validity verification device includes a storage unit 21, a transceiver unit 22, and a processing unit 23:
- the processing unit 23 is configured to generate a random number R B ;
- the storage unit 21 is configured to store the identity information I B of the second entity identity validity verification device
- the transceiver unit 22 is configured to send a message 1 and receive the message 6 sent by the first entity identity validity verification device, where the message 1 includes I B and R B , and the message 6 includes Res A and the first a second signature of the trusted third party device, wherein Res A is a verification result of the first trusted third party device to the first entity identity validity verification device, and the first trusted third party device
- the signature objects of the two signatures include Res A and R B ;
- the processing unit 23 is further configured to verify the second signature of the first trusted third party device, and check whether the R B obtained from the message 6 is sent to the first entity identity validity verification device in the message 1 The random number R B is consistent, and the validity of the first entity identity validity verification device identity is determined according to the verification result Res A.
- the present application further provides a first trusted third-party device for participating in a first entity identity validity verification device together with a second trusted third-party device.
- Identity validity verification between the second entity identity validity verification device, the first trusted third party device comprising a transceiver unit 31 and a processing unit 32:
- the transceiver unit 31 is configured to receive the message 2 sent by the first entity identity validity verification device, where the message 2 includes the identity information I A of the first entity identity validity verification device, and the first entity identity validity a random number R A generated by the verification device, identity information I B of the second entity identity validity verification device, and a random number R B generated by the second entity identity validity verification device;
- the processing unit 32 is configured to verify the identity of the first entity identity validity verification device according to the I A ;
- the transceiver unit 31 is further configured to send a message 3 to the second trusted third party device, where the message 3 includes I B and a random number R TPA generated by the first trusted third party device;
- the transceiver unit 31 is further configured to receive the message 4 sent by the second trusted third party device, where the message 4 includes a token TokenTPBA, where the TokenTPBA includes the Res B and the first signature of the second trusted third party device.
- Res B is a verification result of the second trusted third party device to the second entity identity validity verification device, and the signature object of the first signature of the second trusted third party device includes R TPA and Res B ;
- the processing unit 32 is further configured to verify the first signature of the second trusted third party device included in the TokenTPBA, and check whether the R TPA obtained from the message 4 is sent to the second trusted party in the message 3
- the random number R TPA of the three-party device is identical, and the message 5 is constructed, the message 5 includes a token TokenTA, wherein the TokenTA includes Res A , Res B , the first signature of the first trusted third party device, and the first a second signature of a trusted third party device, Res A is a verification result of the first trusted third party device to the first entity identity validity verification device, and the first of the first trusted third party device
- the signed signature object includes Res B and R A
- the signature object of the second signature of the second trusted third party device includes Res A and R B ;
- the transceiver unit 31 is further configured to send the message 5 to the first entity identity validity verification device.
- the first trusted third party TTP A receives the message 2 sent by the first entity identity validity verification device, and verifies the identity of the first entity identity validity verification device according to the I A ,
- I A is a discriminator of the first entity identity validity verification device
- the processing unit 32 is further configured to extract the public key P A of the first entity identity validity verification device
- Processing unit 32 is further configured to check the validity of Cert A.
- the present application further provides a second trusted third-party device for participating in the first entity identity validity verification device together with the first trusted third-party device.
- Identity validity verification between the second entity identity validity verification device, the second trusted third party device comprising a transceiver unit 41 and a processing unit 42:
- the transceiver unit 41 is configured to receive the message 3 sent by the first trusted third party device, where the message 3 includes the identity information I B of the second entity identity validity verification device and the first trusted third party device. Generated random number R TPA ;
- the processing unit 42 is configured to verify the identity of the second entity identity validity verification device according to the I B ;
- the transceiver unit 41 is further configured to return a message 4 to the first trusted third party device, where the message 4 includes a token TokenTPBA, wherein the TokenTPBA includes Res B and a first signature of the second trusted third party device, Res B
- the signature object of the first signature of the second trusted third party device includes R TPA and Res B .
- the second trusted third party device receives the message 3 sent by the first trusted third party device, and after verifying the identity of the second entity identity validity verification device according to the I B ,
- I B is a specifier of the second entity identity validity verification device
- the processing unit 42 is further configured to extract the public key P B of the second entity identity validity verification device
- I B is the certificate Cert B of the second entity identity validity verification device
- Processing unit 42 is further operative to check the validity of Cert B.
- the foregoing apparatus corresponds to each entity in the method embodiment of the present application.
- the first entity identity validity verification apparatus includes an entity A
- the second entity identity validity verification apparatus includes Entity B
- the first trusted third party device includes a trusted third party TTP A
- the second trusted third party device includes a trusted third party TTP B .
- the system of the above-described apparatus provided in accordance with FIG. 1 is capable of implementing the method of the present application. It should be understood by those skilled in the art that the specific configuration of each device has been demonstrated by the foregoing device embodiments, and further working details are also corresponding to the foregoing method embodiments, and need not be described.
- embodiments of the present application can be provided as a method, system, or meter Computer program product.
- the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
- the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
- the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
- the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
- These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
- the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Mobile Radio Communication Systems (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
- Storage Device Security (AREA)
- Information Transfer Between Computers (AREA)
Abstract
Description
Claims (13)
- 一种多TTP参与的实体身份有效性验证方法,涉及实体A、实体B、可信第三方TTPA和可信第三方TTPB,实体A的身份有效性能被TTPA验证,实体B的身份有效性能被TTPB验证,实体A信任TTPA,实体B信任TTPA和TTPB,其特征在于,所述方法包括以下步骤:1)实体B发送消息1到实体A,消息1包括实体B的身份信息IB以及实体B产生的随机数RB;2)实体A收到消息1后,向可信第三方TTPA发送消息2,消息2包括实体A的身份信息IA、实体A产生的随机数RA、实体B的身份信息IB以及随机数RB;3)可信第三方TTPA收到实体A发送的消息2后,根据IA验证实体A的身份,并向可信第三方TTPB发送消息3,消息3包括IB和TTPA产生的随机数RTPA;4)TTPB收到TTPA发送的消息3后,根据IB验证实体B的身份,并向TTPA返回消息4,消息4包括权标TokenTPBA,其中,TokenTPBA包含ResB和TTPB的第一签名,ResB为TTPB对实体B的验证结果,TTPB的第一签名的签名对象包括RTPA和ResB;5)TTPA收到TTPB发送的消息4后,验证包含在TokenTPBA中TTPB的第一签名,验证通过后,检查从消息4中得到的RTPA是否与自己在消息3中发送给TTPB的随机数RTPA一致,若一致,TTPA构造消息5发送给实体A,消息5包括权标TokenTA,其中,TokenTA包含ResA、ResB、TTPA的第一签名和TTPA的第二签名,ResA为TTPA对实体A的验证结果,TTPA的第一签名 的签名对象包括ResB和RA,TTPA的第二签名的签名对象包括ResA和RB;6)实体A收到来自TTPA的消息5后,验证包含在TokenTA中TTPA的第一签名,验证通过后,检查从消息5中得到的RA是否与自己在消息2中发送给TTPA的随机数RA一致,若一致,实体A根据验证结果ResB判断实体B身份的有效性,并构造消息6发送给实体B,消息6包括ResA和TTPA的第二签名;7)实体B收到消息6后,验证TTPA的第二签名,验证通过后,检查从消息6中得到的RB是否与自己在消息1中发送给实体A的随机数RB一致,若一致,实体B根据验证结果ResA判断实体A身份的有效性。
- 根据权利要求1所述的实体身份有效性验证方法,其特征在于:步骤3)中,所述可信第三方TTPA收到实体A发送的消息2后,根据IA验证实体A的身份,具体包括:如果IA是实体A的区分符,则TTPA提取实体A的公钥PA,此时ResA中包括PA;如果IA是实体A的证书CertA,则TTPA检查CertA的有效性,此时ResA中包括CertA的有效性状态;如果实体A的公钥或证书的有效性不能被TTPA获得,此时ResA中包括表示验证失败的内容。
- 根据权利要求1所述的实体身份有效性验证方法,其特征在于:步骤4)中,所述可信第三方TTPB收到TTPA发送的消息3后,根据IB验证实体B的身份,具体包括:如果IB是实体B的区分符,则TTPB提取实体B的公钥PB,此时ResB中 包括PB;如果IB是实体B的证书CertB,则TTPB检查CertB的有效性,此时ResB中包括CertB的有效性状态;如果实体B的公钥或证书的有效性不能被TTPB获得,此时ResB中包括表示验证失败的内容。
- 根据权利要求1所述的实体身份有效性验证方法,其特征在于:在所述步骤5)中,TTPA从消息4中得到RTPA的具体方式是:如果TTPA验证TTPB的第一签名时能够从该签名中恢复RTPA,则TTPA在验证TTPB的第一签名通过后从该签名中直接恢复RTPA;如果TTPA验证TTPB的第一签名时不能够从该签名中恢复RTPA,则消息4中还进一步包括RTPA字段,TTPA从消息4中直接获取RTPA;在所述步骤6)中,实体A从消息5中得到RA的具体方式是:如果实体A验证TTPA的第一签名时能够从该签名中恢复RA,则实体A在验证TTPA的第一签名通过后从该签名中直接恢复RA;如果实体A验证TTPA的第一签名时不能够从该签名中恢复RA,则消息5中还进一步包括RA字段,实体A从消息5中直接获取RA;在所述步骤7)中,实体B从消息6中得到RB的具体方式是:如果实体B验证TTPA的第二签名时能够从该签名中恢复RB,则实体B在验证TTPA的第二签名通过后从该签名中直接恢复RB;如果实体B验证TTPA的第二签名时不能够从该签名中恢复RB,则消息6中还进一步包括RB字段,实体B从消息6中直接获取RB。
- 根据权利要求1-4中任意一项所述的实体身份有效性验证方法,其特 征在于:所述步骤3)、4)及5)中的RTPA被RA代替。
- 一种第一实体身份有效性验证装置,用于在第一可信第三方装置和第二可信第三方装置的参与下,与第二实体身份有效性验证装置进行身份有效性验证,所述第一实体身份有效性验证装置包括存储单元、收发单元和处理单元,其特征在于:处理单元用于产生随机数RA;存储单元用于存储所述第一实体身份有效性验证装置的身份信息IA;收发单元用于接收所述第二实体身份有效性验证装置发送的消息1,并用于向所述第一可信第三方装置发送消息2,所述消息1包括所述第二实体身份有效性验证装置的身份信息IB和所述第二实体身份有效性验证装置产生的随机数RB,所述消息2包括IA、RA、IB和RB;收发单元还用于接收所述第一可信第三方装置发送的消息5,并用于向所述第二实体身份有效性验证装置发送消息6,所述消息5包括权标TokenTA,其中,TokenTA包含ResA、ResB、所述第一可信第三方装置的第一签名以及所述第一可信第三方装置的第二签名,其中,ResA为所述第一可信第三方装置对所述第一实体身份有效性验证装置的验证结果,ResB为所述第二可信第三方装置对所述第二实体身份有效性验证装置的验证结果,所述第一可信第三方装置的第一签名的签名对象包括ResB和RA,所述第一可信第三方装置的第二签名的签名对象包括ResA和RB,所述消息6包括ResA和所述第一可信第三方装置的第二签名;处理单元还用于验证包含在TokenTA中所述第一可信第三方装置的第一签名,检查从消息5中得到的RA是否与自己在消息2中发送给所述第一可信 第三方装置的随机数RA一致,根据验证结果ResB判断所述第二实体身份有效性验证装置身份的有效性,及构造所述消息6。
- 一种第二实体身份有效性验证装置,用于在第一可信第三方装置和第二可信第三方装置的参与下,与第一实体身份有效性验证装置进行身份有效性验证,所述第二实体身份有效性验证装置包括存储单元、收发单元和处理单元,其特征在于:处理单元用于产生随机数RB;存储单元用于存储所述第二实体身份有效性验证装置的身份信息IB;收发单元用于发送消息1,并用于接收所述第一实体身份有效性验证装置发送的消息6,所述消息1包括IB和RB,所述消息6包括ResA和所述第一可信第三方装置的第二签名,其中,ResA为所述第一可信第三方装置对所述第一实体身份有效性验证装置的验证结果,所述第一可信第三方装置的第二签名的签名对象包括ResA和RB;处理单元还用于验证所述第一可信第三方装置的第二签名,检查从消息6中得到的RB是否与自己在消息1中发送给所述第一实体身份有效性验证装置的随机数RB一致,以及根据验证结果ResA判断所述第一实体身份有效性验证装置身份的有效性。
- 一种第一可信第三方装置,用于与第二可信第三方装置一起,参与第一实体身份有效性验证装置和第二实体身份有效性验证装置之间的身份有效性验证,所述第一可信第三方装置包括收发单元和处理单元,其特征在于:收发单元用于接收所述第一实体身份有效性验证装置发送的消息2,所述消息2包括所述第一实体身份有效性验证装置的身份信息IA、所述第一实体身 份有效性验证装置产生的随机数RA、所述第二实体身份有效性验证装置的身份信息IB以及所述第二实体身份有效性验证装置产生的随机数RB;处理单元用于根据所述IA验证所述第一实体身份有效性验证装置的身份;收发单元还用于向所述第二可信第三方装置发送消息3,所述消息3包括IB和所述第一可信第三方装置产生的随机数RTPA;收发单元还用于接收所述第二可信第三方装置发送的消息4,所述消息4包括权标TokenTPBA,其中,TokenTPBA包含ResB和所述第二可信第三方装置的第一签名,ResB为所述第二可信第三方装置对所述第二实体身份有效性验证装置的验证结果,所述第二可信第三方装置的第一签名的签名对象包括RTPA和ResB;处理单元还用于验证包含在TokenTPBA中所述第二可信第三方装置的第一签名,检查从消息4中得到的RTPA是否与自己在消息3中发送给所述第二可信第三方装置的随机数RTPA一致,以及构造消息5,所述消息5包括权标TokenTA,其中,TokenTA包含ResA、ResB、所述第一可信第三方装置的第一签名以及所述第一可信第三方装置的第二签名,ResA为所述第一可信第三方装置对所述第一实体身份有效性验证装置的验证结果,所述第一可信第三方装置的第一签名的签名对象包括ResB和RA,所述第二可信第三方装置的第二签名的签名对象包括ResA和RB;收发单元还用于向所述第一实体身份有效性验证装置发送所述消息5。
- 根据权利要求8所述的第一可信第三方装置,其特征在于:当所述第一可信第三方TTPA收到所述第一实体身份有效性验证装置发送的消息2后,根据IA验证所述第一实体身份有效性验证装置的身份时,如果IA是所述第一实体身份有效性验证装置的区分符,处理单元进一步用于提取所述第一实体身份有效性验证装置的公钥PA;如果IA是所述第一实体身份有效性验证装置的证书CertA,处理单元进一步用于检查CertA的有效性。
- 一种第二可信第三方装置,用于与第一可信第三方装置一起,参与第一实体身份有效性验证装置和第二实体身份有效性验证装置之间的身份有效性验证,所述第二可信第三方装置包括收发单元和处理单元,其特征在于:收发单元用于接收所述第一可信第三方装置发送的消息3,所述消息3包括所述第二实体身份有效性验证装置的身份信息IB和所述第一可信第三方装置产生的随机数RTPA;处理单元用于根据IB验证所述第二实体身份有效性验证装置的身份;收发单元还用于向所述第一可信第三方装置返回消息4,消息4包括权标TokenTPBA,其中,TokenTPBA包含ResB和所述第二可信第三方装置的第一签名,ResB为所述第二可信第三方装置对所述第二实体身份有效性验证装置的验证结果,所述第二可信第三方装置的第一签名的签名对象包括RTPA和ResB。
- 根据权利要求10所述的第二可信第三方装置,其特征在于:当所述第二可信第三方装置收到所述第一可信第三方装置发送的消息3后,根据IB验证所述第二实体身份有效性验证装置的身份时,如果IB是所述第二实体身份有效性验证装置的区分符,处理单元进一步用于提取所述第二实体身份有效性验证装置的公钥PB;如果IB是所述第二实体身份有效性验证装置的证书CertB,处理单元进一步用于检查CertB的有效性。
- 根据权利要求6-11任意一项所述的第一实体身份有效性验证装置、第二实体身份有效性验证装置、第一可信第三方装置或第二可信第三方装置,其特征在于:所述消息1-6的发生顺序依次是消息1、消息2、消息3、消息4、消息5、消息6。
- 根据权利要求8-11任意一项所述的第一可信第三方装置或第二可信第三方装置,其特征在于:所述RTPA被RA代替。
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2018517742A JP6893919B2 (ja) | 2015-10-10 | 2016-08-26 | マルチttpが参与するエンティティアイデンティティ有効性検証方法及び装置 |
KR1020187013044A KR102104733B1 (ko) | 2015-10-10 | 2016-08-26 | 엔티티의 신원의 유효성을 검증하기 위한 다중-ttp-기반의 방법 및 장치 |
EP16853058.2A EP3361670B1 (en) | 2015-10-10 | 2016-08-26 | Multi-ttp-based method and device for verifying validity of identity of entity |
US15/766,332 US10681045B2 (en) | 2015-10-10 | 2016-08-26 | Multi-TTP-based method and device for verifying validity of identity of entity |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201510654781.0A CN106572063B (zh) | 2015-10-10 | 2015-10-10 | 一种多ttp参与的实体身份有效性验证方法及装置 |
CN201510654781.0 | 2015-10-10 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2017059753A1 true WO2017059753A1 (zh) | 2017-04-13 |
Family
ID=58487338
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2016/096940 WO2017059753A1 (zh) | 2015-10-10 | 2016-08-26 | 一种多ttp参与的实体身份有效性验证方法及装置 |
Country Status (6)
Country | Link |
---|---|
US (1) | US10681045B2 (zh) |
EP (1) | EP3361670B1 (zh) |
JP (1) | JP6893919B2 (zh) |
KR (1) | KR102104733B1 (zh) |
CN (1) | CN106572063B (zh) |
WO (1) | WO2017059753A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113744890A (zh) * | 2021-11-03 | 2021-12-03 | 北京融信数联科技有限公司 | 一种复工复产分析方法、系统和存储介质 |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101378318A (zh) * | 2008-10-08 | 2009-03-04 | 南京邮电大学 | 开放网络中基于动态可信第三方的身份认证方法 |
EP2128781A1 (en) * | 2008-05-27 | 2009-12-02 | Benny Kalbratt | Method for authentication |
CN101640593A (zh) * | 2009-08-28 | 2010-02-03 | 西安西电捷通无线网络通信有限公司 | 一种引入在线第三方的实体双向鉴别方法 |
CN101674182A (zh) * | 2009-09-30 | 2010-03-17 | 西安西电捷通无线网络通信有限公司 | 引入在线可信第三方的实体公钥获取、证书验证及鉴别的方法及系统 |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH11316543A (ja) * | 1998-02-13 | 1999-11-16 | Matsushita Electric Ind Co Ltd | カ―ドデ―タ認証システム |
KR100419484B1 (ko) * | 2001-09-07 | 2004-02-19 | 한국전자통신연구원 | 공개키 기반구조에서 검증서버를 이용한 인증서의 유효성검증 장치 및 방법 |
GB2415579B (en) * | 2004-06-23 | 2006-12-20 | Hewlett Packard Development Co | Cryptographic method and apparatus |
GB2416282B (en) * | 2004-07-15 | 2007-05-16 | Hewlett Packard Development Co | Identifier-based signcryption with two trusted authorities |
CN101222328B (zh) | 2007-12-14 | 2010-11-03 | 西安西电捷通无线网络通信股份有限公司 | 一种实体双向鉴别方法 |
EP2073140A1 (en) * | 2007-12-20 | 2009-06-24 | Meyer Ifrah | A method and system of conducting a communication |
CN101635624B (zh) * | 2009-09-02 | 2011-06-01 | 西安西电捷通无线网络通信股份有限公司 | 引入在线可信第三方的实体鉴别方法 |
US20140136419A1 (en) * | 2012-11-09 | 2014-05-15 | Keith Shoji Kiyohara | Limited use tokens granting permission for biometric identity verification |
-
2015
- 2015-10-10 CN CN201510654781.0A patent/CN106572063B/zh active Active
-
2016
- 2016-08-26 KR KR1020187013044A patent/KR102104733B1/ko active IP Right Grant
- 2016-08-26 US US15/766,332 patent/US10681045B2/en active Active
- 2016-08-26 JP JP2018517742A patent/JP6893919B2/ja active Active
- 2016-08-26 WO PCT/CN2016/096940 patent/WO2017059753A1/zh active Application Filing
- 2016-08-26 EP EP16853058.2A patent/EP3361670B1/en active Active
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP2128781A1 (en) * | 2008-05-27 | 2009-12-02 | Benny Kalbratt | Method for authentication |
CN101378318A (zh) * | 2008-10-08 | 2009-03-04 | 南京邮电大学 | 开放网络中基于动态可信第三方的身份认证方法 |
CN101640593A (zh) * | 2009-08-28 | 2010-02-03 | 西安西电捷通无线网络通信有限公司 | 一种引入在线第三方的实体双向鉴别方法 |
CN101674182A (zh) * | 2009-09-30 | 2010-03-17 | 西安西电捷通无线网络通信有限公司 | 引入在线可信第三方的实体公钥获取、证书验证及鉴别的方法及系统 |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN113744890A (zh) * | 2021-11-03 | 2021-12-03 | 北京融信数联科技有限公司 | 一种复工复产分析方法、系统和存储介质 |
Also Published As
Publication number | Publication date |
---|---|
KR20180064498A (ko) | 2018-06-14 |
EP3361670A4 (en) | 2018-08-15 |
EP3361670B1 (en) | 2020-08-19 |
JP2018530264A (ja) | 2018-10-11 |
US10681045B2 (en) | 2020-06-09 |
CN106572063B (zh) | 2019-10-29 |
CN106572063A (zh) | 2017-04-19 |
JP6893919B2 (ja) | 2021-06-23 |
KR102104733B1 (ko) | 2020-04-24 |
US20180295132A1 (en) | 2018-10-11 |
EP3361670A1 (en) | 2018-08-15 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20160269402A1 (en) | Methods and systems for managing network activity using biometrics | |
CN104836784B (zh) | 一种信息处理方法、客户端和服务器 | |
US10176307B2 (en) | Licensing using a node locked virtual machine | |
WO2019047418A1 (zh) | 数字签名方法、装置和系统 | |
US20210241270A1 (en) | System and method of blockchain transaction verification | |
WO2017059737A1 (zh) | 一种实体身份有效性验证方法及其装置 | |
US11469905B2 (en) | Device and method for processing public key of user in communication system that includes a plurality of nodes | |
WO2017059753A1 (zh) | 一种多ttp参与的实体身份有效性验证方法及装置 | |
WO2017219886A1 (zh) | 一种简单网络协议认证方法及装置 | |
WO2017059735A1 (zh) | 一种多ttp参与的实体身份有效性验证方法及装置 | |
WO2017059755A1 (zh) | 一种实体身份有效性验证方法及其装置 | |
WO2017059743A1 (zh) | 一种多ttp参与的实体身份有效性验证方法及装置 | |
WO2017059744A1 (zh) | 一种多ttp参与的实体身份有效性验证方法及装置 | |
WO2017059736A1 (zh) | 一种实体身份有效性验证方法及其装置 | |
CN112749964B (zh) | 一种信息监控方法、系统、设备及存储介质 | |
CN114338027A (zh) | 区块链的隐私处理方法、请求终端及存储介质 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16853058 Country of ref document: EP Kind code of ref document: A1 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 15766332 Country of ref document: US |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2018517742 Country of ref document: JP |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
ENP | Entry into the national phase |
Ref document number: 20187013044 Country of ref document: KR Kind code of ref document: A |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2016853058 Country of ref document: EP |