WO2020238537A1 - 利用非对称式加密算法建立、验证输入值的方法及其应用 - Google Patents

利用非对称式加密算法建立、验证输入值的方法及其应用 Download PDF

Info

Publication number
WO2020238537A1
WO2020238537A1 PCT/CN2020/087655 CN2020087655W WO2020238537A1 WO 2020238537 A1 WO2020238537 A1 WO 2020238537A1 CN 2020087655 W CN2020087655 W CN 2020087655W WO 2020238537 A1 WO2020238537 A1 WO 2020238537A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
input value
recorded
encryption algorithm
private key
Prior art date
Application number
PCT/CN2020/087655
Other languages
English (en)
French (fr)
Inventor
魏文科
Original Assignee
魏文科
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 魏文科 filed Critical 魏文科
Publication of WO2020238537A1 publication Critical patent/WO2020238537A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the invention relates to the technical field of information security, in particular to a method for establishing and verifying input values by using an asymmetric encryption algorithm and an application method thereof.
  • the hash value is easy to reduce its protection due to the rainbow table technology. Therefore, adding salt to the plain text of the password and then storing it after hashing is the current mainstream method, which can effectively avoid the rainbow table. Parallel attacks.
  • Brute force cracking can crack any password or serial number, and when to crack it is only a matter of time.
  • KDF Key derivation functions
  • the purpose of the present invention is to provide a method and application method for establishing and verifying input values by using an asymmetric encryption algorithm that can improve information security and strengthen privacy protection.
  • the present invention was developed to solve the above-mentioned problems.
  • the first method of establishing an input value of the present invention is realized in this way. It is an asymmetric encryption algorithm for establishing an input value.
  • the method includes the following steps: receiving an original input value; using the characteristics of an asymmetric encryption algorithm to use the original input value as a private key to further derive the public key; retaining the public key and discarding the private key; And convert the public key as the stored input value.
  • the original input value is in the form of one of plain text, hash value, key, and cipher text, and the nature of the original input value is one of password and serial number.
  • the first application method of the first method of establishing an input value of the present invention is realized by the technical means.
  • the method includes the following steps: extracting the public key recorded in the first method of establishing an input value; receiving a dependent data; and Use the public key to encrypt the dependent data into a ciphertext using an asymmetric encryption algorithm.
  • the second application method of the first method of establishing an input value of the present invention is realized by the technical means.
  • the method includes the following steps: extracting the private key recorded in the first method of establishing an input value; receiving a dependent data; Before discarding the private key, first convert it to a symmetric encryption algorithm key, encrypt the dependent data into a ciphertext; and discard the key.
  • the third application method of the first method of establishing an input value of the present invention is realized in this way.
  • the method includes the following steps: the system administrator generates a key pair through an asymmetric encryption algorithm, and the key pair Have a private key and a public key; extract the public key recorded in the first method of establishing input values; use the public key and the private key of the system administrator to jointly generate a shared key using the characteristics of the key agreement algorithm ; Receive a dependent data; and use the shared key to encrypt the dependent data into a ciphertext with a symmetric encryption algorithm.
  • the fourth application method of the first method of establishing an input value of the present invention is realized in this way.
  • the method includes the following steps: the system administrator generates a key pair through an asymmetric encryption algorithm, and the key pair Have a private key and a public key; extract the private key recorded in the first method of establishing an input value; before discarding the private key, first use the private key and the public key of the system administrator, and use the key agreement algorithm
  • the first method of verifying the input value of the present invention is realized in this way. It is a method of verifying the input value using an asymmetric encryption algorithm.
  • the method includes the following steps: receiving a pending input value; using the asymmetric
  • the characteristics of the encryption algorithm use the input value to be verified as a private key to further derive the public key; convert the public key as a temporary input value to be verified; extract the stored input value recorded in the first method of establishing an input value; If the pending temporary input value is consistent with the stored input value, the verification is determined to be passed; and if the pending temporary input value is inconsistent with the stored input value, the verification is determined to be failed
  • the input value to be verified is in the form of one of plain text, hash value, key, and cipher text, and the nature of the input value to be verified is one of a password and a serial number.
  • the first application method of the first method of verifying the input value of the present invention is realized in this way.
  • the method includes the following steps: When the first method of verifying the input value records the pending input value and the storage When the input value is consistent, it is determined that the verification is passed; extract the private key recorded in the first method of verifying the input value; extract the cipher text recorded in the first application method of the first method of establishing the input value; and use the private key to Symmetric encryption algorithm to decrypt the ciphertext.
  • the second application method of the first method of verifying input values of the present invention is realized in this way.
  • the method includes the following steps: When the first method of verifying input values records the pending input value and the storage When the input values are consistent and the verification is determined to be passed; extract the private key recorded in the first method of verifying input values; extract the cipher text recorded in the second method of establishing the input value; and convert the private key to The key of the symmetric encryption algorithm decrypts the ciphertext.
  • the third application method of the first method of verifying input values of the present invention is realized in this way.
  • the method includes the following steps: when the first method of verifying input values records the pending temporary input value and the storage When the input values are consistent and the verification is judged to pass; extract the private key recorded in the first method of verifying input values; extract the public key and the ciphertext of the system administrator recorded in the first method of establishing input values and the third application method ; Use the private key and the public key to use the characteristics of the key agreement algorithm to jointly generate a shared key; and use the shared key to decrypt the ciphertext with a symmetric encryption algorithm.
  • the fourth application method of the first method of verifying input values of the present invention is realized in this way.
  • the method includes the following steps: When the first method of verifying input values records the pending input value and the stored value When the input value is consistent, the verification is judged to pass; extract the public key recorded in the first method of verifying the input value; extract the private key and the ciphertext of the system administrator recorded in the first method of establishing the input value and the fourth application method ; Use the public key and the private key to use the characteristics of the key agreement algorithm to jointly generate a shared key; and use the shared key to decrypt the ciphertext with a symmetric encryption algorithm.
  • the second method of establishing an input value of the present invention is realized in this way. It is a method of establishing an input value using an asymmetric encryption algorithm. The method includes the following steps: receiving an original input value; using asymmetric encryption The characteristic of the algorithm is to use the original input value as a seed to further derive a private key and a public key; retain the public key, discard the private key; and convert the public key as a stored input value.
  • the original input value is in the form of one of plain text, hash value, key, and cipher text, and the nature of the original input value is one of password and serial number.
  • the first application method of the second method for establishing an input value of the present invention is achieved in this way.
  • the method includes the following steps: extracting the public key recorded in the second method for establishing an input value; receiving a dependent data; and Use the public key to encrypt the dependent data into a ciphertext using an asymmetric encryption algorithm.
  • the second application method of the second method for establishing an input value of the present invention is realized in this way.
  • the method includes the following steps: extracting the private key recorded in the second method for establishing an input value; receiving a dependent data; Before discarding the private key, first convert it to a symmetric encryption algorithm key, encrypt the dependent data into a ciphertext; and discard the key.
  • the third application method of the second method of establishing input values of the present invention is realized in this way.
  • the method includes the following steps: the system administrator generates a key pair through an asymmetric encryption algorithm, and the key pair Have a private key and a public key; extract the public key recorded in the second method of establishing input values; use the public key and the private key of the system administrator to jointly generate a shared key using the characteristics of the key agreement algorithm ; Receive a dependent data; and use the shared key to encrypt the dependent data into a ciphertext with a symmetric encryption algorithm.
  • the fourth application method of the second method for establishing input values of the present invention is realized in this way.
  • the method includes the following steps:
  • the system administrator generates a key pair through an asymmetric encryption algorithm, and the key pair Have a private key and a public key; extract the private key recorded in the second method of establishing an input value; before discarding the private key, first use the private key and the public key of the system administrator, and use the key agreement algorithm
  • the second method of verifying the input value of the present invention is realized in this way. It is a method of verifying the input value using an asymmetric encryption algorithm.
  • the method includes the following steps: receiving a pending input value; using the asymmetric
  • the characteristics of the encryption algorithm are to use the input value to be verified as a seed to further derive a private key and a public key; convert the public key as a temporary input value to be verified; extract the input value recorded in the second method of establishing input value Store the input value; if the pending temporary input value is consistent with the stored input value, it is determined that the verification is passed; and if the pending temporary input value is inconsistent with the stored input value, it is determined that the verification fails.
  • the input value to be verified is in the form of one of plain text, hash value, key, and cipher text, and the nature of the input value to be verified is one of a password and a serial number.
  • the first application method of the second method of verifying input values of the present invention is realized in this way.
  • the method includes the following steps: When the second method of verifying input values records the pending input value and the stored value When the input value is consistent, it is determined that the verification is passed; extract the private key recorded in the second method of verifying the input value; extract the cipher text recorded in the first application method of the second method of establishing input values; and use the private key to Symmetric encryption algorithm to decrypt the ciphertext.
  • the second application method of the second method of verifying input value of the present invention is realized in this way.
  • the method includes the following steps: when the pending input value recorded in the second method of verifying input value and the storage When the input values are consistent and the verification is determined to pass; extract the private key recorded in the second method of verifying input values; extract the cipher text recorded in the second application method of the second method of establishing input values; and convert the private key to The key of the symmetric encryption algorithm decrypts the ciphertext.
  • the third application method of the second method of verifying input values of the present invention is realized in this way.
  • the method includes the following steps: When the second method of verifying input values records the pending input value and the stored value When the input value is consistent, it is judged that the verification is passed; extract the private key recorded in the second method of verifying the input value; extract the public key and the ciphertext of the system administrator recorded in the third method of establishing the input value ; Use the private key and the public key to use the characteristics of the key agreement algorithm to jointly generate a shared key; and use the shared key to decrypt the ciphertext with a symmetric encryption algorithm.
  • the fourth application method of the second method of verifying input value of the present invention is realized in this way.
  • the method includes the following steps: when the pending input value recorded in the second method of verifying input value and the storage When the input value is consistent, the verification is judged to pass; extract the public key recorded in the second method of verifying the input value; extract the private key and the ciphertext of the system administrator recorded in the fourth application method of the second method of establishing input values ; Use the public key and the private key to use the characteristics of the key agreement algorithm to jointly generate a shared key; and use the shared key to decrypt the ciphertext with a symmetric encryption algorithm.
  • the present invention uses an asymmetric encryption algorithm to establish and verify the input value method and its application method. Not only can the security and protection of the current verification method be further strengthened, but also dependent data can be selectively encrypted and decrypted according to requirements to complement Where there is insufficient privacy protection, at the same time, it is convenient and fast to implement, and is fully compatible with the current system. It does not require substantial system changes and changes. It can be applied to scenarios such as operating system login verification, network service login verification, and software serial number verification; If the database is stolen due to other problems such as system intrusion or hacking, there will be no problem of user privacy leakage.
  • FIG. 1 is a schematic diagram of a block flow diagram of a method for establishing an input value of the present invention.
  • Fig. 2 is a schematic block diagram of the first application method of the method for establishing input values of the present invention.
  • FIG. 3 is a schematic block diagram of a second application method of the method for establishing an input value of the present invention.
  • Fig. 4 is a schematic block diagram of a third application method of the method for establishing an input value of the present invention.
  • Fig. 5 is a schematic block diagram of a fourth application method of the method for establishing an input value of the present invention.
  • Figure 6 is a schematic block diagram of the method for verifying input values of the present invention.
  • FIG. 7 is a schematic block diagram of the first application method of the method for verifying input values of the present invention.
  • FIG. 8 is a schematic block diagram of a second application method of the method for verifying input values of the present invention.
  • FIG. 9 is a schematic block diagram of a third application method of the method for verifying input values of the present invention.
  • Fig. 10 is a schematic block diagram of a fourth application method of the method for verifying input values of the present invention.
  • FIG. 11 is a schematic block diagram of another method for establishing an input value according to the present invention.
  • FIG. 12 is a schematic block diagram of the first application method of another method for establishing input values according to the present invention.
  • FIG. 13 is a schematic block diagram of a second application method of another method for establishing an input value of the present invention.
  • FIG. 14 is a schematic block diagram of a third application method of another method for establishing input values of the present invention.
  • FIG. 15 is a schematic block diagram of a fourth application method of another method for establishing an input value of the present invention.
  • Fig. 16 is a schematic block diagram of another method for verifying input values of the present invention.
  • FIG. 17 is a schematic block diagram of the first application method of another method for verifying input values of the present invention.
  • FIG. 18 is a schematic block diagram of a second application method of another method for verifying input values of the present invention.
  • FIG. 19 is a schematic block diagram of a third application method of another method for verifying input values of the present invention.
  • 20 is a schematic block diagram of a fourth application method of another method for verifying input values of the present invention.
  • the original input values 1, 5 and the pending input values 3, 7 of the present invention are in the form of plain text, hash value, key, and cipher text, and the original input values 1, 5 and the The nature of the input values 3 and 7 to be verified is one of password and serial number.
  • the first method for establishing an input value of the present invention is a method for establishing an input value using an asymmetric encryption algorithm.
  • the method 100 includes the following steps: S1 receives an original input value 1; S2 uses non- The characteristic of the symmetric encryption algorithm, the original input value 1 is used as the private key 10a, and the public key 10b is further derived; S3 retains the public key 10b, discards the private key 10a; and S4 transfers the public key 10b as the storage input Value 2.
  • the characteristics of the asymmetric encryption algorithm are used, and the original input value 1 is regarded as the private key 10a, and the public key 10b is derived.
  • the private key 10a is discarded, and then The public key 10b is converted to the stored input value 2 to be retained for use as a verification basis.
  • This improves the security and protection of the method 100 of the present invention, and can effectively avoid the parallel attack of the rainbow table.
  • the implementation is convenient, fast, and fully compatible with The current system does not require major system changes and changes, and can be applied to operating system login verification, network service login verification, software serial number verification, etc.
  • the method 110 includes the following steps: S5 extracts the record of the first method of establishing input values.
  • this method 110 is the first derivative application method of the first method of establishing an input value of the present invention.
  • the public key 10b is used to encrypt the dependent data A1 through an asymmetric encryption algorithm.
  • the method 120 includes the following steps: S8 extracts the private record recorded in the first method of establishing input value. Key 10a; S9 receives a dependent data A2; S10, before discarding the private key 10a, converts it to the key C1 of the symmetric encryption algorithm, encrypts the dependent data A2 into a ciphertext B2; and S11 discards the key C1.
  • this method 120 is the second derivative application method of the first method for establishing input values of the present invention.
  • the private key 10a is extracted first before the private key 10a is discarded.
  • the dependent data A1 can be encrypted.
  • the key C1 which is the original private key 10a, will also be discarded, effectively avoiding user privacy in case the database is stolen There is a leakage problem.
  • the method 130 includes the following steps: S12 system administrator generates an asymmetric encryption algorithm.
  • the key pair 20 has a private key 20a and a public key 20b;
  • S13 extracts the public key 10b recorded in the first method for establishing input values;
  • S14 uses the public key 10b with the private key of the system administrator Key 20a uses the characteristics of the key agreement algorithm to jointly generate a shared key D1;
  • S15 receives a dependent data A3;
  • S16 uses the shared key D1 to encrypt the dependent data A3 into a ciphertext using a symmetric encryption algorithm B3.
  • this method 130 is the third derivative application method of the first method of establishing input values of the present invention.
  • the public key 10b is extracted to cooperate with the key pair owned by the system administrator
  • the private key 20a in 20 uses a key agreement algorithm to generate a shared key D1, and then uses a symmetric encryption algorithm to encrypt the dependent data A3.
  • the system administrator has the ability to encrypt the dependent data A3 , Decryption authority.
  • the method 140 includes the following steps: S17.
  • the system administrator generates an asymmetric encryption algorithm.
  • Key pair 30, the key pair 30 has a private key 30a and a public key 30b;
  • S18 extracts the private key 10a recorded in the first method for establishing input values;
  • S19 uses the private key 10a before discarding the private key 10a
  • the private key 10a and the public key 30b of the system administrator use the characteristics of the key agreement algorithm to jointly generate a shared key D2;
  • S20 receives a dependent data A4; and
  • S21 uses the shared key D2 to use a symmetric encryption algorithm, Encrypt the dependent data A4 into a ciphertext B4.
  • this method 140 is the fourth derivative application method of the first method of establishing input values of the present invention.
  • the private key 10a is extracted first before the private key 10a is discarded.
  • the public key 30b in the key pair 30 owned by the system administrator apply the key agreement algorithm to generate a shared key D2, and then use the shared key D2 with the symmetric encryption algorithm to encrypt the dependent data A4.
  • the system administrator is allowed to retain all users the authority to encrypt and decrypt the dependent data.
  • the method 200 includes the following steps: S22 receives a wait Verify input value 3; S23 uses the characteristics of the asymmetric encryption algorithm to use the pending input value 3 as the private key 40a, and further derives the public key 40b; S24 converts the public key 40b as the pending temporary input value 4 S25 extract the stored input value 2 recorded in the first method of establishing input values; S26 if the pending temporary input value 4 is consistent with the stored input value 2, determine that the verification is passed; and S27 if the pending temporary input value 4 is inconsistent with the stored input value 2, and it is determined that the verification has failed.
  • the input value verification method of the present invention is also applied to the characteristics of an asymmetric encryption algorithm, and the pending input value 3 is used as the private key 40a to derive the public
  • the key 40b, the public key 40b can be converted into the pending temporary input value 4, and the pending temporary input value 4 is combined with the stored input value 2 for verification, which can improve the security and effectively avoid the parallel attack of the rainbow table. To achieve the goal of effective protection.
  • the method 210 includes the following steps: S28: Verify that the temporarily stored input value 4 is consistent with the stored input value 2, and when it is determined that the verification is passed; S29 extracts the private key 40a recorded in the first method of verifying input values; S30 extracts the first application method of the first method of establishing input values The recorded ciphertext B1; and S31 use the private key 40a to decrypt the ciphertext B1 with an asymmetric encryption algorithm.
  • this method 210 is the first derivative application method of the first method for verifying input values of the present invention. It cooperates with the method 200 shown in FIG. 6.
  • the private key 40a in the aforementioned method 200 is extracted, and then Using an asymmetric encryption algorithm, the first derivative application method used to establish the input value method, in which the ciphertext B1, is decrypted, so that the data in the database can be applied smoothly under the premise of security .
  • the method 220 includes the following steps: S32: Verify that the temporary storage input value 4 is consistent with the stored input value 2, and when it is determined that the verification is passed; S33 extracts the private key 40a recorded in the first method of verifying input values; S34 extracts the second application method of the first method of establishing input values The recorded ciphertext B2; and S35 convert the private key 40a into the key C2 of the symmetric encryption algorithm, and decrypt the ciphertext B2.
  • this method 220 is the second derivative application method of the first method for verifying input values of the present invention. It cooperates with the method 200 as shown in FIG. 6.
  • the private key 40a in the aforementioned method 200 is extracted, and It is converted into the key C2 of the symmetric encryption algorithm, and the ciphertext B2 extracted from the second application method of the first method of establishing input values of the present invention is decrypted, under the premise of safety , So that the data in the database can be extracted and applied smoothly.
  • the method 230 is characterized by including the following steps: S36: When the first method of verifying input values is recorded The pending temporary input value 4 is consistent with the stored input value 2, and it is determined that the verification is passed; S37 extracts the private key 40a recorded in the first method of verifying input values; S38 extracts the system recorded in the method of claim 5
  • the administrator s public key 20b and the ciphertext B3; S39 uses the private key 40a and the public key 20b to use the characteristics of the key agreement algorithm to jointly generate a shared key D3; and S40 uses the shared key D3 to The symmetric encryption algorithm decrypts the ciphertext B3.
  • this method 230 is the third derivative application method of the first method for verifying input values of the present invention. It cooperates with the method 200 as shown in FIG. 6.
  • the public key 20b owned by the system administrator uses the aforementioned two keys to generate the shared key D3 through the key agreement algorithm, and then uses it to symmetrically
  • the type encryption algorithm decrypts the ciphertext B2 extracted from the third application method of the first method of establishing input values of the present invention, so that the system administrator can decrypt the data in the database under the premise of safety. Data management application.
  • the method 240 includes the following steps: S41: Verify that the temporary storage input value 4 is consistent with the stored input value 2, and when it is determined that the verification is passed; S42 extracts the public key 40b recorded in the first method of verifying input values; S43 extracts the fourth application method of the first method of establishing input values The private key 30a and the ciphertext B4 of the recorded system administrator; S44 uses the public key 40b and the private key 30a to jointly generate a shared key D4 using the characteristics of the key agreement algorithm; and S45 uses the shared secret The key D4 uses a symmetric encryption algorithm to decrypt the ciphertext B4.
  • this method 240 is the fourth derivative application method of the first method for verifying input values of the present invention. It cooperates with the method 200 shown in FIG. 6.
  • the public key 40b in the aforementioned method 200 is extracted first.
  • the private key 30a owned by the system administrator uses the aforementioned public key 40b and private key 30a through the key agreement algorithm, Generate the shared key D4, and then use its symmetric encryption algorithm to decrypt the ciphertext B4 extracted from the fourth application method of the first method of establishing input values of the present invention, so that the system administrator can have Manage the permissions of the data in the database, and the data is safe.
  • the method 300 includes the following steps: S46 receives an original Input value 5; S47 uses the characteristics of the asymmetric encryption algorithm to use the original input value 5 as a seed to further derive a private key 50a and a public key 50b; S48 retains the public key 50b and discards the private key 50a; And S49 converts the public key 50b as the stored input value 6.
  • the second method of establishing an input value is different from the first method of establishing an input value. Because of the characteristics of the asymmetric encryption algorithm, in this method 300, the original input value 5 is used as a seed and then derived The private key 50a and the public key 50b, the present invention converts the public key 50b as the stored input value 6 and saves it for use as a verification basis, and at the same time discards the private key 50a, the security and protection are not reduced, and the application of the present invention category.
  • the method 310 includes the following steps: S50 extracts the public record recorded in the second method for establishing input values. Key 50b; S51 receives a dependent data A5; and S52 uses the public key 50b to encrypt the dependent data A5 into a ciphertext B5 using an asymmetric encryption algorithm.
  • this method 310 is a derivative application method of the second method of establishing input values of the present invention.
  • the public key 50b is used to apply an asymmetric encryption algorithm to encrypt the corresponding dependent data A5. In this way, in case the database is stolen, there is no need to worry about the user's privacy being leaked.
  • the method 320 includes the following steps: S53 extracts the private record recorded in the second method for establishing input values. Key 50a; S54 receives a dependent data A6; S55, before discarding the private key 50a, converts it as a symmetric encryption algorithm key C3, encrypts the dependent data A6 into a ciphertext B6; and S56 discards the key C3.
  • this method 320 is a derivative application method of the second method for establishing input values of the present invention.
  • the private key 10a is extracted first, and the private key 10a is extracted through symmetric encryption.
  • Algorithm get the key C3, encrypt the dependent data A1, after the encryption is completed, discard the key C5, which is the original private key 50a, in case the ciphertext B6 in the database is stolen, in a state that is difficult to decrypt, the user Your privacy can get the greatest protection.
  • the method 330 includes the following steps: S57 the system administrator generates an asymmetric encryption algorithm.
  • the key pair 60 has a private key 60a and a public key 60b;
  • S58 extracts the public key 50b recorded in the second method of establishing input values;
  • S59 uses the public key 50b with the private key of the system administrator Key
  • Key 60a uses the characteristics of the key agreement algorithm to jointly generate a shared key D5;
  • S60 receives a dependent data A7;
  • S61 uses the shared key D5 to encrypt the dependent data A7 into a ciphertext using a symmetric encryption algorithm B7.
  • this method 330 is the third derivative application method of the second method for establishing input values of the present invention.
  • the public key 50b is extracted and matched with the key owned by the system administrator
  • For the private key 60a in 60 apply the key agreement algorithm to generate a shared key D5, and then use the symmetric encryption algorithm to encrypt the dependent data A7 into the corresponding ciphertext B7.
  • the system administrator Have sufficient authority to manage ciphertext B7.
  • the method 340 includes the following steps: S62 The system administrator generates an asymmetric encryption algorithm.
  • the key pair 70 has a private key 70a and a public key 70b;
  • S63 extracts the private key 50a recorded in the second method of establishing input values;
  • S64 uses the private key 50a before discarding the private key 50a.
  • the private key 50a and the public key 70b of the system administrator use the characteristics of the key agreement algorithm to jointly generate a shared key D6;
  • S65 receives a dependent data A8; and
  • S66 uses the shared key D6 to use a symmetric encryption algorithm,
  • the dependent data A8 is encrypted into a ciphertext B8.
  • this method 340 is the fourth derivative application method of the second method for establishing input values of the present invention.
  • the private key 50a is extracted first.
  • the public key 70b in the key pair 70 owned by the system administrator apply the key agreement algorithm to generate a shared key D6, and then use it with the symmetric encryption algorithm to encrypt the dependent data A8.
  • This method 340 Enable the system administrator to maintain certain authority to perform encryption and decryption actions on all users' dependent data.
  • the method 400 includes the following steps: S67 receives a wait Verify the input value 7; S68 uses the characteristics of the asymmetric encryption algorithm to use the pending input value 7 as a seed, and further derives a private key 80a and a public key 80b; S69 converts the public key 80b as a pending temporary Save the input value 8; S70 extract the stored input value 6 recorded in the second method of creating input values; S71 if the pending temporary input value 8 is consistent with the stored input value 6, determine that the verification is passed; and S72 if the pending input value The temporarily stored input value 8 is inconsistent with the stored input value 6, and it is determined that the verification has failed.
  • the input value verification method of the present invention is also applied to the characteristics of an asymmetric encryption algorithm.
  • the input value 7 to be verified is regarded as Seed, and then derive the private key 80a and the public key 80b.
  • the public key 80b can be converted into the pending temporary input value 8, and both the pending temporary input value 8 and the stored input value 6 are verified, which can effectively avoid The parallel attack of the rainbow table makes the overall security of the present invention high.
  • the method 410 includes the following steps: S73. Verify that the temporary storage input value 8 is consistent with the stored input value 6, when it is determined that the verification is passed; S74 extracts the private key 80a recorded in the second method of verifying input values; S75 extracts the first application method of the second method of establishing input values The recorded ciphertext B5; and S76 use the private key 80a to decrypt the ciphertext B5 with an asymmetric encryption algorithm.
  • this method 410 is the first derivative application method of the second method for verifying input values of the present invention. It cooperates with the method 400 shown in FIG. 16.
  • the private key 80a in the aforementioned method 400 is extracted to be asymmetric
  • the encryption algorithm is used to create the first derivative application method of the second method of establishing input values.
  • the ciphertext B5 is decrypted, so that the data in the database can be applied smoothly under the premise of sufficient security. Let privacy get the greatest protection.
  • the method 420 includes the following steps: S77. Verify that the temporary storage input value 8 is consistent with the stored input value 6, when it is determined that the verification is passed; S78 extracts the private key 80a recorded in the second method of verifying input values; S79 extracts the second application method of the second method of establishing input values The recorded ciphertext B6; and S80 convert the private key 80a into the key C4 of the symmetric encryption algorithm, and decrypt the ciphertext B6.
  • this method 420 is the second derivative application method of the second method for verifying input values of the present invention. It cooperates with the method 400 shown in FIG. 16.
  • the private key 80a in the aforementioned method 400 is extracted, and then The aforementioned private key 80a is converted into the key C4 of the symmetric encryption algorithm, and then the key C4 is used to decrypt the ciphertext B6 in the second application method of the second method of establishing input values of the present invention, so that the database data , Can be applied smoothly and safely.
  • the method 430 includes the following steps: S81: Verify that the temporary storage input value 8 is consistent with the stored input value 6, when it is determined that the verification is passed; S82 extracts the private key 80a recorded in the second method of verifying input values; S83 extracts the third application method of the second method of establishing input values
  • the public key 60b and the ciphertext B7 of the recorded system administrator S84 uses the private key 80a and the public key 60b to jointly generate a shared key D7 using the characteristics of the key agreement algorithm; and S85 uses the shared secret
  • the key D7 uses a symmetric encryption algorithm to decrypt the cipher text B7.
  • this method 430 is the third derivative application method of the second method for verifying input values of the present invention. It cooperates with the method 400 shown in FIG. 16.
  • the public key 60b owned by the system administrator uses the aforementioned private key 80a and public key 60b to generate a shared key D7 through a key agreement algorithm, and then uses it It uses a symmetric encryption algorithm to decrypt the cipher text B7 extracted from the third application method of the second method of establishing input values of the present invention, and gives the system administrator sufficient authority to manage the application database safely. Data within.
  • the method 440 includes the following steps: S86: Verify that the temporary storage input value 8 is consistent with the stored input value 6, when it is determined that the verification is passed; S87 extracts the public key 80b recorded in the second method of verifying input values; S88 extracts the fourth application method of the second method of establishing input values
  • the key D8 uses a symmetric encryption algorithm to decrypt the ciphertext B8.
  • this method 440 is the fourth derivative application method of the second method for verifying input values of the present invention. It cooperates with the method 400 as shown in FIG. 16.
  • the public key 80b in the aforementioned method 400 is first extracted.
  • the private key 70a owned by the system administrator uses the aforementioned two keys to pass the public key 80b and the private key 70a through the key agreement algorithm, Generate the shared key D8, and then use the shared key D8 to decrypt the ciphertext B8 extracted from the fourth application method of the second method of establishing input values of the present invention with a symmetric encryption algorithm.
  • the system administrator can encrypt and decrypt the data in the database, that is, gain sufficient management authority under the premise of safety.
  • password modification verification must be passed first, such as the verification of the first and second methods of verifying input values of the present invention. At this time, if any dependent data is encrypted, it must be decrypted first; and then according to the present invention described above The first and second methods of establishing the input value are to regenerate the password, replace the old password, and use the new password to re-encrypt the decrypted dependent data.
  • the dependent data is encrypted and encrypted with a shared key, first decrypt it with the authority of the system administrator, and then re-encrypt it after the password reset is completed. If you use asymmetric or symmetric encryption, you must first discard the encrypted For the data part, after resetting the password, reset its data and re-encrypt it.
  • the account number is the basis of dependent data. If it is also encrypted, the account to be verified must first go through the same method during the verification process, and use the method to be verified, such as the first and second methods of the present invention Establish an input value method, in which the derived public key or private key is encrypted; and further search and compare with the existing account in the system; if there is no matching account, it means that the account to be verified does not exist or It is an input error. If there is a matching account, the stored input value of the corresponding public key is further extracted and the verification procedure is performed.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本发明在于提供一种利用非对称式加密算法建立、验证输入值的方法及其应用方法。其技术手段包括：利用非对称式加密算法，将原始/待验输入值当私钥，推导出公钥、又或者是将原始/待验输入值当种子，推导出私钥、公钥，接着再保留公钥，丢弃私钥，最后将公钥转作储存、待验暂存输入值，验证时，通过比对待验暂存、储存输入值两者是否一致，来判定验证是否成功。应用方法为利用前述密钥，以对称、非对称式加密算法及密钥协商算法，来做相依数据的加密、解密的使用。

Description

利用非对称式加密算法建立、验证输入值的方法及其应用 技术领域
本发明涉及信息安全技术领域，尤指一种利用非对称式加密算法建立、验证输入值的方法及其应用方法。
背景技术
现今的密码或序号的保护，主要是以明文的方式存放，或是以散列函数运算其散列值的方式，来取代明文存放。
但是散列值又容易因彩虹表的技术，而降低其保护性，所以在密码明文中加上盐值(Salt)，再进行散列运算后存放，为目前的主流方式，可有效避免彩虹表的并行攻击手段。
暴力破解法(穷举法)可以破解任何的密码或序号，何时破解只是时间的问题。当前有几种方法，可以有效的降低暴力破解的成功率，包括：在限定的时间内，限制登入错误次数或来源IP地址，以及禁止使用过于简单的密码或序号；现今也常见使用一些特殊的密钥衍生函数(KDF)，例如：PBKDF2、Scrypt、Bcrypt和ARGON2等，利用增加散列迭代次数与时间或资源成本，来抵御暴力破解法，然而就算如此，被暴力破解的成功率还是颇高。
另一方面，由于系统被入侵或骇入等其他问题，而造成的数据外泄，也是对隐私保护的一大伤害，这是因为除了密码是以散列值或密钥的形式存放，现今的个人或其他种类的数据(信息)存放还是以明文为主，一旦系统被入侵或骇入，所有数据(信息)将暴露于阳光下了，视为隐私保护的一大漏洞。
有鉴于此，如何提供一种能解决前述问题的利用非对称式加密算法建立、验证输入值的方法及其应用方法，便成为本发明欲改进的课题。
发明内容
本发明的目的是提供一种能提高信息安全性、还能强化隐私保护的利用非对称式加密算法建立、验证输入值的方法及其应用方法。
本发明正是为了解决上述问题而研发的，为达到本发明的目的，本发明的第一种建立输入值方法，其技术手段是这样实现的，为一种利用非对称式加密算法建立输入值的方法，该方法包含下列步骤：接收一原始输入值；利用非对称式加密算法的特性，将该原始输入值当作私钥，进一步推导出公钥；保留该公钥，丢弃该私钥；以及将该公钥转作为储存输入值。
优选的是，所述原始输入值，其形式为明文、散列值、密钥、密文其中之一，而该原始输入值的性质为密码、序号其中之一。
本发明第一种建立输入值方法的第一种应用方法，其技术手段是这样实现的，该方法包含下列步骤：提取第一种建立输入值方法记载的该公钥；接收一相依数据；以及使用该公钥以非对称式加密算法，将该相依数据加密为一密文。
本发明第一种建立输入值方法的第二种应用方法，其技术手段是这样实现的，该方法包含下列步骤：提取第一种建立输入值方法记载的该私钥；接收一相依数据；在将该私钥丢弃前，先转作为对称式加密算法的密钥，将该相依数据加密为一密文；以及丢弃该密钥。
本发明第一种建立输入值方法的第三种应用方法，其技术手段是这样实现的，该方法包含下列步骤：系统管理员通过一非对称式加密算法产生一密钥对，该密钥对具有一私钥及一公钥；提取第一种建立输入值方法记载的该公钥；使用该公钥与系统管理员的该私钥，利用密钥协商算法的特性，共同产生一共享密钥；接收一相依数据；以及使用该共享密钥以对称式加密算法，将该相依数据加密为一密文。
本发明第一种建立输入值方法的第四种应用方法，其技术手段是这样实现的，该方法包含下列步骤：系统管理员通过一非对称式加密算法产生一密钥对，该密钥对具有一私钥及一公钥；提取第一种建立输入值方法记载的该私钥；在将该私钥丢弃前，先使用该私钥与系统管理员的该公钥，利用密钥协商算法的特性，共同产生一共享密钥；接收一相依数据；以及使用该共享密钥以对称式加密算法，将该相依数据加密为一密文。
本发明第一种验证输入值方法，其技术手段是这样实现的，为一种利用非对称式加密算法验证输入值的方法，该方法包含下列步骤：接收一待验输入值；利用非对称式加密算法的特性，将该待验输入值当作私钥，进一步推导出公钥；将该公钥转作为待验暂存输入值；提取第一种建立输入值方法记载的该储存输入值；倘若该待验暂存输入值与该储存输入值一致，判定验证通过；以及倘若该待验暂存输入值与该储存输入值不一致，判定验证失败
优选的是，所述待验输入值，其形式为明文、散列值、密钥、密文其中之一，而该待验输入值的性质为密码、序号其中之一。
本发明第一种验证输入值方法的第一种应用方法，其技术手段是这样实现的，该方法包含下列步骤：当第一种验证输入值方法记载的该待验暂存输入值与该储存输入值一致，判定验证通过时；提取第一种验证输入值方法记载的该私钥；提取第一种建立输入值方法的第一种应用方法记载的该密文；以及使用该私钥以非对称式加密算法，对该密文进行解密。
本发明第一种验证输入值方法的第二种应用方法，其技术手段是这样实现的，该方法包含下列步骤： 当第一种验证输入值方法记载的该待验暂存输入值与该储存输入值一致，判定验证通过时；提取第一种验证输入值方法记载的该私钥；提取第一种建立输入值方法的第二种应用方法记载的该密文；以及将该私钥转作为对称式加密算法的密钥，对该密文进行解密。
本发明第一种验证输入值方法的第三种应用方法，其技术手段是这样实现的，该方法包含下列步骤：当第一种验证输入值方法记载的该待验暂存输入值与该储存输入值一致，判定验证通过时；提取第一种验证输入值方法记载的该私钥；提取第一种建立输入值方法的第三种应用方法记载的系统管理员的该公钥及该密文；使用该私钥与该公钥，利用密钥协商算法的特性，共同产生一共享密钥；以及使用该共享密钥以对称式加密算法，对该密文进行解密。
本发明第一种验证输入值方法的第四种应用方法，其技术手段是这样实现的，该方法包含下列步骤：当第一种验证输入值方法记载的该待验暂存输入值与该储存输入值一致，判定验证通过时；提取第一种验证输入值方法记载的该公钥；提取第一种建立输入值方法的第四种应用方法记载的系统管理员的该私钥及该密文；使用该公钥与该私钥，利用密钥协商算法的特性，共同产生一共享密钥；以及使用该共享密钥以对称式加密算法，对该密文进行解密。
本发明第二种建立输入值方法，其技术手段是这样实现的，为一种利用非对称式加密算法建立输入值的方法，该方法包含下列步骤：接收一原始输入值；利用非对称式加密算法的特性，将该原始输入值当作种子，进一步推导出一私钥与一公钥；保留该公钥，丢弃该私钥；以及将该公钥转作为储存输入值。
优选的是，所述原始输入值，其形式为明文、散列值、密钥、密文其中之一，而该原始输入值的性质为密码、序号其中之一。
本发明第二种建立输入值方法的第一种应用方法，其技术手段是这样实现的，该方法包含下列步骤：提取第二种建立输入值方法记载的该公钥；接收一相依数据；以及使用该公钥以非对称式加密算法，将该相依数据加密为一密文。
本发明第二种建立输入值方法的第二种应用方法，其技术手段是这样实现的，该方法包含下列步骤：提取第二种建立输入值方法记载的该私钥；接收一相依数据；在将该私钥丢弃前，先转作为对称式加密算法的密钥，将该相依数据加密为一密文；以及丢弃该密钥。
本发明第二种建立输入值方法的第三种应用方法，其技术手段是这样实现的，该方法包含下列步骤：系统管理员通过一非对称式加密算法产生一密钥对，该密钥对具有一私钥及一公钥；提取第二种建立输入值方法记载的该公钥；使用该公钥与系统管理员的该私钥，利用密钥协商算法的特性，共同产生一共享密钥；接收一相依数据；以及使用该共享密钥以对称式加密算法，将该相依数据加密为一密文。
本发明第二种建立输入值方法的第四种应用方法，其技术手段是这样实现的，该方法包含下列步骤： 系统管理员通过一非对称式加密算法产生一密钥对，该密钥对具有一私钥及一公钥；提取第二种建立输入值方法记载的该私钥；在将该私钥丢弃前，先使用该私钥与系统管理员的该公钥，利用密钥协商算法的特性，共同产生一共享密钥；接收一相依数据；以及使用该共享密钥以对称式加密算法，将该相依数据加密为一密文。
本发明第二种验证输入值方法，其技术手段是这样实现的，为一种利用非对称式加密算法验证输入值的方法，该方法包含下列步骤：接收一待验输入值；利用非对称式加密算法的特性，将该待验输入值当作种子，进一步推导出一私钥与一公钥；将该公钥转作为待验暂存输入值；提取第二种建立输入值方法记载的该储存输入值；倘若该待验暂存输入值与该储存输入值一致，判定验证通过；以及倘若该待验暂存输入值与该储存输入值不一致，判定验证失败。
优选的是，所述待验输入值，其形式为明文、散列值、密钥、密文其中之一，而该待验输入值的性质为密码、序号其中之一。
本发明第二种验证输入值方法的第一种应用方法，其技术手段是这样实现的，该方法包含下列步骤：当第二种验证输入值方法记载的该待验暂存输入值与该储存输入值一致，判定验证通过时；提取第二种验证输入值方法记载的该私钥；提取第二种建立输入值方法的第一种应用方法记载的该密文；以及使用该私钥以非对称式加密算法，对该密文进行解密。
本发明第二种验证输入值方法的第二种应用方法，其技术手段是这样实现的，该方法包含下列步骤：当第二种验证输入值方法记载的该待验暂存输入值与该储存输入值一致，判定验证通过时；提取第二种验证输入值方法记载的该私钥；提取第二种建立输入值方法的第二种应用方法记载的该密文；以及将该私钥转作为对称式加密算法的密钥，对该密文进行解密。
本发明第二种验证输入值方法的第三种应用方法，其技术手段是这样实现的，该方法包含下列步骤：当第二种验证输入值方法记载的该待验暂存输入值与该储存输入值一致，判定验证通过时；提取第二种验证输入值方法记载的该私钥；提取第二种建立输入值方法的第三种应用方法记载的系统管理员的该公钥及该密文；使用该私钥与该公钥，利用密钥协商算法的特性，共同产生一共享密钥；以及使用该共享密钥以对称式加密算法，对该密文进行解密。
本发明第二种验证输入值方法的第四种应用方法，其技术手段是这样实现的，该方法包含下列步骤：当第二种验证输入值方法记载的该待验暂存输入值与该储存输入值一致，判定验证通过时；提取第二种验证输入值方法记载的该公钥；提取第二种建立输入值方法的第四种应用方法记载的系统管理员的该私钥及该密文；使用该公钥与该私钥，利用密钥协商算法的特性，共同产生一共享密钥；以及使用该共享密钥以对称式加密算法，对该密文进行解密。
根据上述的实施，能获得下列结果：
本发明利用非对称式加密算法建立、验证输入值的方法及其应用方法，不但可以进一步强化现今验证方式的安全性与保护性，更可以将其相依数据，依需求选择性加解密，来补足隐私保护不足的地方，同时，实施方便与快速，完全兼容于现今系统，不须做大幅度的系统变更与异动，可应用于操作系统登入验证、网络服务登入验证、软件序号验证等场景；他日若由于系统被入侵或骇入等其他问题，造成的数据库被盗取，也不会有使用者隐私外泄的问题。
附图说明
图1为本发明建立输入值方法的方块流程示意图。
图2为本发明建立输入值方法的第一种应用方法的方块流程示意图。
图3为本发明建立输入值方法的第二种应用方法的方块流程示意图。
图4为本发明建立输入值方法的第三种应用方法的方块流程示意图。
图5为本发明建立输入值方法的第四种应用方法的方块流程示意图。
图6为本发明验证输入值方法的方块流程示意图。
图7为本发明验证输入值方法的第一种应用方法的方块流程示意图。
图8为本发明验证输入值方法的第二种应用方法的方块流程示意图。
图9为本发明验证输入值方法的第三种应用方法的方块流程示意图。
图10为本发明验证输入值方法的第四种应用方法的方块流程示意图。
图11为本发明另种建立输入值方法的方块流程示意图。
图12为本发明另种建立输入值方法的第一种应用方法的方块流程示意图。
图13为本发明另种建立输入值方法的第二种应用方法的方块流程示意图。
图14为本发明另种建立输入值方法的第三种应用方法的方块流程示意图。
图15为本发明另种建立输入值方法的第四种应用方法的方块流程示意图。
图16为本发明另种验证输入值方法的方块流程示意图。
图17为本发明另种验证输入值方法的第一种应用方法的方块流程示意图。
图18为本发明另种验证输入值方法的第二种应用方法的方块流程示意图。
图19为本发明另种验证输入值方法的第三种应用方法的方块流程示意图。
图20为本发明另种验证输入值方法的第四种应用方法的方块流程示意图。
附图标记说明：
1、5  原始输入值
2、6  储存输入值
3、7  待验输入值
4、8  待验暂存输入值
Figure PCTCN2020087655-appb-000001
私钥
Figure PCTCN2020087655-appb-000002
  公钥
20、30、60、70  密钥对
Figure PCTCN2020087655-appb-000003
相依资料
Figure PCTCN2020087655-appb-000004
密文
Figure PCTCN2020087655-appb-000005
密钥
Figure PCTCN2020087655-appb-000006
共享密钥
Figure PCTCN2020087655-appb-000007
步骤
Figure PCTCN2020087655-appb-000008
方法
110、120、130、140  方法
210、220、230、240  方法
310、320、330、340  方法
410、420、430、440  方法。
具体实施方式
下面通过参考附图描述的实施例是示例性的，仅用于解释本发明，而不能解释为对本发明的限制。
本发明所述原始输入值1、5和所述待验输入值3、7，其形式为明文、散列值、密钥、密文其中之一，而所述原始输入值1、5和所述待验输入值3、7的性质为密码、序号其中之一。
通过本发明中储存输入值2、6和待验暂存输入值4、8的此种实施方式，能完全兼容于现今系统，不须做大幅度的系统变更与异动，应用范围更加广泛。
请参阅图1，关于本发明的第一种建立输入值方法，为一种利用非对称式加密算法建立输入值的方法，该方法100包含下列步骤：S1接收一原始输入值1；S2利用非对称式加密算法的特性，将该原始输入值1当作私钥10a，进一步推导出公钥10b；S3保留该公钥10b，丢弃该私钥10a；以及S4将该公钥10b转作为储存输入值2。
其中，本发明方法100中，应用非对称式加密算法的特性，把原始输入值1当作为私钥10a，来推 导出的公钥10b，为了安全性上的考虑，丢弃了私钥10a，再将公钥10b转作为储存输入值2留存，以做为验证依据使用，这使得本发明方法100安全性与保护性提高，更可有效避免彩虹表的并行攻击，实施方便、快速，完全兼容于现今系统，不须做大幅度的系统变更与异动，可应用于操作系统登入验证、网络服务登入验证、软件序号验证等处。
再者，现今一般向大众提供服务的业者，所有数据都储存于关系数据库内，其用户信息都以明文的方式储存，密码则以一般散列函数转化为散列值储存,验证方式以比对散列值的方式进行，有在限定的时间内限制登入错误次数及来源IP地址，以及禁止使用过于简单的密码，以防止暴力破解，但是通过本发明此种建立输入值方法的应用，如此一来，就算他日若由于系统被入侵或骇入等其他问题，而造成的数据库被盗取，也不会有使用者隐私外泄的问题。
请参阅图2，关于本发明第一种建立输入值方法的第一种应用方法，其技术手段是这样实现的，为该方法110包含下列步骤：S5提取第一种建立输入值方法记载的该公钥10b；S6接收一相依数据A1；以及S7使用该公钥10b以非对称式加密算法，将该相依数据A1加密为一密文B1。
其中，此方法110为本发明第一种建立输入值方法的第一种衍生应用法，配合如图1所示的方法100，利用公钥10b，通过非对称式加密算法，对相依数据A1加密，强化或补足隐私保护的不足，如此一来，就算数据库被盗，用户也不用担心隐私会外泄。
请参阅图3，关于本发明第一种建立输入值方法的第二种应用方法，其技术手段是这样实现的，该方法120包含下列步骤：S8提取第一种建立输入值方法记载的该私钥10a；S9接收一相依数据A2；S10在将该私钥10a丢弃前，先转作为对称式加密算法的密钥C1，将该相依数据A2加密为一密文B2；以及S11丢弃该密钥C1。
其中，此方法120为本发明第一种建立输入值方法的第二种衍生应用法，配合如图1所示的方法100，在将私钥10a丢弃前，先一步将私钥10a提取出来，以通过对称式加密算法，取得密钥C1，好将相依数据A1加密，加密完成后密钥C1，也就是原本的私钥10a也会被丢弃，有效避免掉万一数据库被盗后，用户隐私发生外泄的问题。
请参阅图4，关于本发明第一种建立输入值方法的第三种应用方法，其技术手段是这样实现的，该方法130包含下列步骤：S12系统管理员通过一非对称式加密算法产生一密钥对20，该密钥对20具有一私钥20a及一公钥20b；S13提取第一种建立输入值方法记载的该公钥10b；S14使用该公钥10b与系统管理员的该私钥20a，利用密钥协商算法的特性，共同产生一共享密钥D1；S15接收一相依数据A3；以及S16使用该共享密钥D1以对称式加密算法，将该相依数据A3加密为一密文B3。
其中，此方法130为本发明第一种建立输入值方法的第三种衍生应用法，配合如图1所示的方法100， 将公钥10b提取出来，配合系统管理员所拥有之密钥对20中的私钥20a，应用密钥协商算法，产生一共享密钥D1，随后再以对称式加密算法，让相依数据A3被加密，通过此方法130，让系统管理者拥有对相依数据A3加密、解密的权限。
请参阅图5，关于本发明第一种建立输入值方法的第四种应用方法，其技术手段是这样实现的，该方法140包含下列步骤：S17系统管理员通过一非对称式加密算法产生一密钥对30，该密钥对30具有一私钥30a及一公钥30b；S18提取第一种建立输入值方法记载的该私钥10a；S19在将该私钥10a丢弃前，先使用该私钥10a与系统管理员的该公钥30b，利用密钥协商算法的特性，共同产生一共享密钥D2；S20接收一相依数据A4；以及S21使用该共享密钥D2以对称式加密算法，将该相依数据A4加密为一密文B4。
其中，此方法140为本发明第一种建立输入值方法的第四种衍生应用法，配合如图1所示的方法100，在将私钥10a丢弃前，先一步将私钥10a提取出来，并配合系统管理员所拥有之密钥对30中的公钥30b，应用密钥协商算法，产生一共享密钥D2，再以共享密钥D2配合对称式加密算法，让相依数据A4被加密，通过此方法140，让系统管理者保有所有用户其相依数据加解密的权限。
请参阅图6，关于本发明第一种验证输入值方法，其技术手段是这样实现的，为一种利用非对称式加密算法验证输入值的方法，该方法200包含下列步骤：S22接收一待验输入值3；S23利用非对称式加密算法的特性，将该待验输入值3当作私钥40a，进一步推导出公钥40b；S24将该公钥40b转作为待验暂存输入值4；S25提取第一种建立输入值方法记载的该储存输入值2；S26倘若该待验暂存输入值4与该储存输入值2一致，判定验证通过；以及S27倘若该待验暂存输入值4与该储存输入值2不一致，判定验证失败。
其中，配合如图1所示的建立输入值方法，本发明此种验证输入值方法，一样是应用到非对称式加密算法的特性，将待验输入值3作为私钥40a，以推导出公钥40b，此公钥40b能转作待验暂存输入值4，以待验暂存输入值4配合上储存输入值2，进行验证，能提高安全性，可有效避免彩虹表的并行攻击，达到有效保护的目标。
请参阅图7，关于本发明第一种验证输入值方法的第一种应用方法，其技术手段是这样实现的，该方法210包含下列步骤：S28当第一种验证输入值方法记载的该待验暂存输入值4与该储存输入值2一致，判定验证通过时；S29提取第一种验证输入值方法记载的该私钥40a；S30提取第一种建立输入值方法的第一种应用方法记载的该密文B1；以及S31使用该私钥40a以非对称式加密算法，对该密文B1进行解密。
其中，此方法210为本发明第一种验证输入值方法的第一种衍生应用法，配合如图6所示的方法200， 验证通过时，提取前述方法200中的私钥40a，并将其以非对称式加密算法，拿来对第一种建立输入值方法的第一种衍生应用法，其中的密文B1，进行解密，让数据库的数据，在安全的前提下，能顺利地被应用。
请参阅图8，关于本发明第一种验证输入值方法的第二种应用方法，其技术手段是这样实现的，该方法220包含下列步骤：S32当第一种验证输入值方法记载的该待验暂存输入值4与该储存输入值2一致，判定验证通过时；S33提取第一种验证输入值方法记载的该私钥40a；S34提取第一种建立输入值方法的第二种应用方法记载的该密文B2；以及S35将该私钥40a转作为对称式加密算法的密钥C2，对该密文B2进行解密。
其中，此方法220为本发明第一种验证输入值方法的第二种衍生应用法，配合如图6所示的方法200，当验证通过时，提取前述方法200中的私钥40a，并将其转换为对称式加密算法的密钥C2，以其对自本发明第一种建立输入值方法的第二种应用方法中所提取出的密文B2，进行解密，在安全无虞的前提下，让数据库的数据，能顺利地被提取应用。
请参阅图9，关于本发明第一种验证输入值方法的第三种应用方法，其技术手段是这样实现的，该方法230的特征在于包含下列步骤：S36当第一种验证输入值方法记载的该待验暂存输入值4与该储存输入值2一致，判定验证通过时；S37提取第一种验证输入值方法记载的该私钥40a；S38提取如权利要求5所述方法记载的系统管理员的该公钥20b及该密文B3；S39使用该私钥40a与该公钥20b，利用密钥协商算法的特性，共同产生一共享密钥D3；以及S40使用该共享密钥D3以对称式加密算法，对该密文B3进行解密。
其中，此方法230为本发明第一种验证输入值方法的第三种衍生应用法，配合如图6所示的方法200，当验证通过时，提取前述方法200中的私钥40a，和本发明第一种建立输入值方法的第三种衍生应用法中，系统管理员所拥有的公钥20b，以前述两密钥，通过密钥协商算法，产生共享密钥D3，随后使用其以对称式加密算法，对自本发明第一种建立输入值方法的第三种应用方法中所提取出的密文B2，进行解密，让系统管理员能在安全无虞的前提下，对数据库内的数据进行管理应用。
请参阅图10，关于本发明第一种验证输入值方法的第四种应用方法，其技术手段是这样实现的，该方法240包含下列步骤：S41当第一种验证输入值方法记载的该待验暂存输入值4与该储存输入值2一致，判定验证通过时；S42提取第一种验证输入值方法记载的该公钥40b；S43提取第一种建立输入值方法的第四种应用方法记载的系统管理员的该私钥30a及该密文B4；S44使用该公钥40b与该私钥30a，利用密钥协商算法的特性，共同产生一共享密钥D4；以及S45使用该共享密钥D4以对称式加密算法，对该密文B4进行解密。
其中，此方法240为本发明第一种验证输入值方法的第四种衍生应用法，配合如图6所示的方法200，当验证通过时，先对前述方法200中的公钥40b进行提取，并配合本发明第一种建立输入值方法的第四种衍生应用法中，系统管理员所拥有的私钥30a，以前述公钥40b、私钥30a两密钥，通过密钥协商算法，产生共享密钥D4，之后使用其以对称式加密算法，对自本发明第一种建立输入值方法的第四种应用方法中所提取出的密文B4，进行解密，让系统管理员能具有管理数据库内的数据的权限，且数据安全无虞。
请参阅图11，关于本发明第二种建立输入值方法，其技术手段是这样实现的，为一种利用非对称式加密算法建立输入值的方法，该方法300包含下列步骤：S46接收一原始输入值5；S47利用非对称式加密算法的特性，将该原始输入值5当作种子，进一步推导出一私钥50a与一公钥50b；S48保留该公钥50b，丢弃该私钥50a；以及S49将该公钥50b转作为储存输入值6。
其中，第二种建立输入值方法与第一种建立输入值方法，不同处在于，因为非对称式加密算法的特性，在于此方法300中，原始输入值5是被当作种子，进而推导出私钥50a和公钥50b，本发明将公钥50b转作为储存输入值6留存，以做为验证依据使用，同时还丢弃私钥50a，安全性与保护性不减，能扩展本发明的应用范畴。
请参阅图12，关于本发明第二种建立输入值方法的第一种应用方法，其技术手段是这样实现的，该方法310包含下列步骤：S50提取第二种建立输入值方法记载的该公钥50b；S51接收一相依数据A5；以及S52使用该公钥50b以非对称式加密算法，将该相依数据A5加密为一密文B5。
其中，此方法310为本发明第二种建立输入值方法的衍生应用法，配合如图11所示的方法300，利用公钥50b，应用非对称式加密算法，对相应的相依数据A5加密，如此，万一数据库被盗，也不用担心使用者的隐私会外泄。
请参阅图13，关于本发明第二种建立输入值方法的第二种应用方法，其技术手段是这样实现的，该方法320包含下列步骤：S53提取第二种建立输入值方法记载的该私钥50a；S54接收一相依数据A6；S55在将该私钥50a丢弃前，先转作为对称式加密算法的密钥C3，将该相依数据A6加密为一密文B6；以及S56丢弃该密钥C3。
其中，此方法320为本发明第二种建立输入值方法的衍生应用法，配合如图11所示的方法300，在私钥50a被丢弃前，先一步提取出私钥10a，通过对称式加密算法，取得密钥C3，加密相依数据A1，加密完成后再将密钥C5，也就是原本的私钥50a丢弃，万一数据库中的密文B6被盗，在难以解密的状态下，使用者的隐私，能获得最大的保全。
请参阅图14，关于本发明第二种建立输入值方法的第三种应用方法，其技术手段是这样实现的，该 方法330包含下列步骤：S57系统管理员通过一非对称式加密算法产生一密钥对60，该密钥对60具有一私钥60a及一公钥60b；S58提取第二种建立输入值方法记载的该公钥50b；S59使用该公钥50b与系统管理员的该私钥60a，利用密钥协商算法的特性，共同产生一共享密钥D5；S60接收一相依数据A7；以及S61使用该共享密钥D5以对称式加密算法，将该相依数据A7加密为一密文B7。
其中，此方法330为本发明第二种建立输入值方法的第三种衍生应用法，配合如图11所示的方法300，将其公钥50b提取出来，配合系统管理员所拥有的密钥对60中的私钥60a，应用密钥协商算法，产生一共享密钥D5，随后再以对称式加密算法，让相依数据A7被加密为相应的密文B7，通过此方法330，系统管理者拥有足够的权限，能对密文B7进行管理。
请参阅图15，关于本发明第二种建立输入值方法的第四种应用方法，其技术手段是这样实现的，该方法340包含下列步骤：S62系统管理员通过一非对称式加密算法产生一密钥对70，该密钥对70具有一私钥70a及一公钥70b；S63提取第二种建立输入值方法记载的该私钥50a；S64在将该私钥50a丢弃前，先使用该私钥50a与系统管理员的该公钥70b，利用密钥协商算法的特性，共同产生一共享密钥D6；S65接收一相依数据A8；以及S66使用该共享密钥D6以对称式加密算法，将该相依数据A8加密为一密文B8。
其中，此方法340为本发明第二种建立输入值方法的第四种衍生应用法，配合如图11所示的方法300，在将私钥50a丢弃前，先一步将私钥50a提取出来，并配合系统管理员所拥有的密钥对70中的公钥70b，应用密钥协商算法，产生一共享密钥D6，再以其配合对称式加密算法，让相依数据A8被加密，通过此方法340，使系统管理者保有一定的权限，能对所有用户其相依数据，进行加解密的动作。
请参阅图16，关于本发明第二种验证输入值方法，其技术手段是这样实现的，为一种利用非对称式加密算法验证输入值的方法，该方法400包含下列步骤：S67接收一待验输入值7；S68利用非对称式加密算法的特性，将该待验输入值7当作种子，进一步推导出一私钥80a与一公钥80b；S69将该公钥80b转作为待验暂存输入值8；S70提取第二种建立输入值方法记载的该储存输入值6；S71倘若该待验暂存输入值8与该储存输入值6一致，判定验证通过；以及S72倘若该待验暂存输入值8与该储存输入值6不一致，判定验证失败。
其中，配合如图11所示的建立输入值方法，本发明此种验证输入值方法，一样是应用到非对称式加密算法的特性，在于此方法400中，待验输入值7是被当作种子，进而推导出私钥80a与公钥80b，此公钥80b能转作待验暂存输入值8，以待验暂存输入值8和储存输入值6两者，进行验证，可有效避免彩虹表的并行攻击，本发明整体的安全性高。
请参阅图17，关于本发明第二种验证输入值方法的第一种应用方法，其技术手段是这样实现的，该 方法410包含下列步骤：S73当第二种验证输入值方法记载的该待验暂存输入值8与该储存输入值6一致，判定验证通过时；S74提取第二种验证输入值方法记载的该私钥80a；S75提取第二种建立输入值方法的第一种应用方法记载的该密文B5；以及S76使用该私钥80a以非对称式加密算法，对该密文B5进行解密。
其中，此方法410为本发明第二种验证输入值方法的第一种衍生应用法，配合如图16所示的方法400，验证通过时，提取前述方法400中的私钥80a，以非对称式加密算法，拿来对第二种建立输入值方法的第一种衍生应用法，其中的密文B5，进行解密，在安全性足够的前提下，让数据库的数据，能顺利地被应用，让隐私获得最大的保护。
请参阅图18，关于本发明第二种验证输入值方法的第二种应用方法，其技术手段是这样实现的，该方法420包含下列步骤：S77当第二种验证输入值方法记载的该待验暂存输入值8与该储存输入值6一致，判定验证通过时；S78提取第二种验证输入值方法记载的该私钥80a；S79提取第二种建立输入值方法的第二种应用方法记载的该密文B6；以及S80将该私钥80a转作为对称式加密算法的密钥C4，对该密文B6进行解密。
其中，此方法420为本发明第二种验证输入值方法的第二种衍生应用法，配合如图16所示的方法400，当验证通过时，提取前述方法400中的私钥80a，再将前述私钥80a转换为对称式加密算法的密钥C4，随后再使用密钥C4，对本发明第二种建立输入值方法的第二种应用方法中的密文B6，进行解密，让数据库的数据，能顺利、安全无虞的被应用。
请参阅图19，关于本发明第二种验证输入值方法的第三种应用方法，其技术手段是这样实现的，该方法430包含下列步骤：S81当第二种验证输入值方法记载的该待验暂存输入值8与该储存输入值6一致，判定验证通过时；S82提取第二种验证输入值方法记载的该私钥80a；S83提取第二种建立输入值方法的第三种应用方法记载的系统管理员的该公钥60b及该密文B7；S84使用该私钥80a与该公钥60b，利用密钥协商算法的特性，共同产生一共享密钥D7；以及S85使用该共享密钥D7以对称式加密算法，对该密文B7进行解密。
其中，此方法430为本发明第二种验证输入值方法的第三种衍生应用法，配合如图16所示的方法400，当验证通过，提取前述方法400中的私钥80a，和本发明第二种建立输入值方法的第三种衍生应用法中，系统管理员所拥有的公钥60b，利用前述私钥80a、公钥60b，通过密钥协商算法，产生共享密钥D7，随后使用其以对称式加密算法，对自本发明第二种建立输入值方法的第三种应用方法中所提取出的密文B7，进行解密，给予系统管理员足够的权限，能安全地管理应用数据库内的数据。
请参阅图20，关于本发明第二种验证输入值方法的第四种应用方法，其技术手段是这样实现的，该 方法440包含下列步骤：S86当第二种验证输入值方法记载的该待验暂存输入值8与该储存输入值6一致，判定验证通过时；S87提取第二种验证输入值方法记载的该公钥80b；S88提取第二种建立输入值方法的第四种应用方法记载的系统管理员的该私钥70a及该密文B8；S89使用该公钥80b与该私钥70a，利用密钥协商算法的特性，共同产生一共享密钥D8；以及S90使用该共享密钥D8以对称式加密算法，对该密文B8进行解密。
其中，此方法440为本发明第二种验证输入值方法的第四种衍生应用法，配合如图16所示的方法400，当验证通过时，先对提取前述方法400中的公钥80b，并配合本发明第二种建立输入值方法的第四种衍生应用法中，系统管理员所拥有的私钥70a，以前述两密钥，让公钥80b、私钥70a通过密钥协商算法，产生共享密钥D8，之后使用共享密钥D8以对称式加密算法，对自本发明第二种建立输入值方法的第四种应用方法中所提取出的密文B8，进行解密，如此一来，系统管理员就能对数据库内的数据，进行加解密，也就是在安全无虞的前提下，获得足够的管理权限。
以密码为例，关于密码修改方面，须先通过验证，如本发明第一、二种验证输入值方法的验证，此时若有相依数据已加密，须先进行解密；接着再依据上述本发明第一、二种建立输入值方法，重新产生出密码，替换旧有密码，并使用新的密码，对已解密之相依数据重新进行加密。
当密码遗忘或遗失时，须先依需求进行一定程度的身份验证，待通过之后，若相依数据无加密，直接进行密码重设即可。
但若相依数据有加密，使用共享密钥加密，先利用系统管理者权限先进行解密，待密码重设完成后，再重新进行加密，若使用非对称式或对称式加密，须先丢弃已加密数据部份，待重设密码后，重设其数据，再重新进行加密。
关于账号方面，账号为相依数据的基础，若其也进行加密，在验证过程中，欲进行验证的账号，也须先经一样的方法，使用欲进行验证方法，如本发明第一、二种建立输入值方法，其中所推导出的公钥、或私钥来加密；并进一步与系统内已存在的账号，进行搜寻与比对；若无符合的账号，表示欲进行验证的账号不存在或是输入错误，若有符合的账号，进一步提取其相应公钥的储存输入值，进行验证程序。
以上依据图式所示的实施例详细说明了本发明的构造、特征及作用效果，以上所述仅为本发明的较佳实施例，但本发明不以图面所示限定实施范围，凡是依照本发明的构想所作的改变，或修改为等同变化的等效实施例，仍未超出说明书与图示所涵盖的精神时，均应在本发明的保护范围内。

Claims (24)

  1. 一种利用非对称式加密算法建立输入值的方法，其特征在于,包含下列步骤：
    接收一原始输入值(1)；
    利用非对称式加密算法的特性，将所述原始输入值(1)当作私钥(10a)，进一步推导出公钥(10b)；
    保留所述公钥(10b)，丢弃所述私钥(10a)；以及
    将所述公钥(10b)转作为储存输入值(2)。
  2. 根据权利要求1所述的方法，其特征在于,所述原始输入值(1)，其形式为明文、散列值、密钥、密文其中之一，而所述原始输入值(1)的性质为密码、序号其中之一。
  3. 一种如权利要求1所述方法的应用方法，其特征在于,包含下列步骤：
    提取如权利要求1所述方法记载的所述公钥(10b)；
    接收一相依数据(A1)；以及
    使用所述公钥(10b)以非对称式加密算法，将所述相依数据(A1)加密为一密文(B1)。
  4. 一种如权利要求1所述方法的应用方法，其特征在于,包含下列步骤：
    提取如权利要求1所述方法记载的所述私钥(10a)；
    接收一相依数据(A2)；
    在将所述私钥(10a)丢弃前，先转作为对称式加密算法的密钥(C1)，将所述相依数据(A2)加密为一密文(B2)；以及
    丢弃所述密钥(C1)。
  5. 一种如权利要求1所述方法的应用方法，其特征在于,包含下列步骤：
    系统管理员通过一非对称式加密算法产生一密钥对(20)，所述密钥对(20)具有一私钥(20a)及一公钥(20b)；
    提取如权利要求1所述方法记载的所述公钥(10b)；
    使用所述公钥(10b)与系统管理员的所述私钥(20a)，利用密钥协商算法的特性，共同产生一共享密钥(D1)；
    接收一相依数据(A3)；以及
    使用所述共享密钥(D1)以对称式加密算法，将所述相依数据(A3)加密为一密文(B3)。
  6. 一种如权利要求1所述方法的应用方法，其特征在于,包含下列步骤：
    系统管理员通过一非对称式加密算法产生一密钥对(30)，所述密钥对(30)具有一私钥(30a)及一公钥(30b)；
    提取如权利要求1所述方法记载的所述私钥(10a)；
    在将所述私钥(10a)丢弃前，先使用所述私钥(10a)与系统管理员的所述公钥(30b)，利用密钥协商算法的特性，共同产生一共享密钥(D2)；
    接收一相依数据(A4)；以及
    使用所述共享密钥(D2)以对称式加密算法，将所述相依数据(A4)加密为一密文(B4)。
  7. 一种利用非对称式加密算法验证输入值的方法，其特征在于,包含下列步骤：
    接收一待验输入值(3)；
    利用非对称式加密算法的特性，将所述待验输入值(3)当作私钥(40a)，进一步推导出公钥(40b)；
    将所述公钥(40b)转作为待验暂存输入值(4)；
    提取如权利要求1所述方法记载的所述储存输入值(2)；
    倘若所述待验暂存输入值(4)与所述储存输入值(2)一致，判定验证通过；以及
    倘若所述待验暂存输入值(4)与所述储存输入值(2)不一致，判定验证失败。
  8. 根据权利要求7所述的方法，其特征在于,所述待验输入值(3)，其形式为明文、散列值、密钥、密文其中之一，而所述待验输入值(3)的性质为密码、序号其中之一。
  9. 一种如权利要求7所述方法的应用方法，其特征在于,包含下列步骤：
    当如权利要求7所述方法记载的所述待验暂存输入值(4)与所述储存输入值(2)一致，判定验证通过时；
    提取如权利要求7所述方法记载的所述私钥(40a)；
    提取如权利要求3所述方法记载的所述密文(B1)；以及
    使用所述私钥(40a)以非对称式加密算法，对所述密文(B1)进行解密。
  10. 一种如权利要求7所述方法的应用方法，其特征在于,包含下列步骤：
    当如权利要求7所述方法记载的所述待验暂存输入值(4)与所述储存输入值(2)一致，判定验证通过时；
    提取如权利要求7所述方法记载的所述私钥(40a)；
    提取如权利要求4所述方法记载的所述密文(B2)；以及
    将所述私钥(40a)转作为对称式加密算法的密钥(C2)，对所述密文(B2)进行解密。
  11. 一种如权利要求7所述方法的应用方法，其特征在于,包含下列步骤：
    当如权利要求7所述方法记载的所述待验暂存输入值(4)与所述储存输入值(2)一致，判定验证通过时；
    提取如权利要求7所述方法记载的所述私钥(40a)；
    提取如权利要求5所述方法记载的系统管理员的所述公钥(20b)及所述密文(B3)；
    使用所述私钥(40a)与所述公钥(20b)，利用密钥协商算法的特性，共同产生一共享密钥(D3)；以及
    使用所述共享密钥(D3)以对称式加密算法，对所述密文(B3)进行解密。
  12. 一种如权利要求7所述方法的应用方法，其特征在于,包含下列步骤：
    当如权利要求7所述方法记载的所述待验暂存输入值(4)与所述储存输入值(2)一致，判定验证通过时；
    提取如权利要求7所述方法记载的所述公钥(40b)；
    提取如权利要求6所述方法记载的系统管理员的所述私钥(30a)及所述密文(B4)；
    使用所述公钥(40b)与所述私钥(30a)，利用密钥协商算法的特性，共同产生一共享密钥(D4)；以及
    使用所述共享密钥(D4)以对称式加密算法，对所述密文(B4)进行解密。
  13. 一种利用非对称式加密算法建立输入值的方法，其特征在于,包含下列步骤：
    接收一原始输入值(5)；
    利用非对称式加密算法的特性，将所述原始输入值(5)当作种子，进一步推导出一私钥(50a)与一公钥(50b)；
    保留所述公钥(50b)，丢弃所述私钥(50a)；以及
    将所述公钥(50b)转作为储存输入值(6)。
  14. 根据权利要求13所述的方法，其特征在于,所述原始输入值(5)，其形式为明文、散列值、密钥、密文其中之一，而所述原始输入值(5)的性质为密码、序号其中之一。
  15. 一种如权利要求13所述方法的应用方法，其特征在于,包含下列步骤：
    提取如权利要求13所述方法记载的所述公钥(50b)；
    接收一相依数据(A5)；以及
    使用所述公钥(50b)以非对称式加密算法，将所述相依数据(A5)加密为一密文(B5)。
  16. 一种如权利要求13所述方法的应用方法，其特征在于,包含下列步骤：
    提取如权利要求13所述方法记载的所述私钥(50a)；
    接收一相依数据(A6)；
    在将所述私钥(50a)丢弃前，先转作为对称式加密算法的密钥(C3)，将所述相依数据(A6)加密为一密文(B6)；以及
    丢弃所述密钥(C3)。
  17. 一种如权利要求13所述方法的应用方法，其特征在于,包含下列步骤：
    系统管理员通过一非对称式加密算法产生一密钥对(60)，所述密钥对(60)具有一私钥(60a)及一公钥(60b)；
    提取如权利要求13所述方法记载的所述公钥(50b)；
    使用所述公钥(50b)与系统管理员的所述私钥(60a)，利用密钥协商算法的特性，共同产生一共享密钥(D5)；
    接收一相依数据(A7)；以及
    使用所述共享密钥(D5)以对称式加密算法，将所述相依数据(A7)加密为一密文(B7)。
  18. 一种如权利要求13所述方法的应用方法，其特征在于,包含下列步骤：
    系统管理员通过一非对称式加密算法产生一密钥对(70)，所述密钥对(70)具有一私钥(70a)及一公钥(70b)；
    提取如权利要求13所述方法记载的所述私钥(50a)；
    在将所述私钥(50a)丢弃前，先使用所述私钥(50a)与系统管理员的所述公钥(70b)，利用密钥协商算法的特性，共同产生一共享密钥(D6)；
    接收一相依数据(A8)；以及
    使用所述共享密钥(D6)以对称式加密算法，将所述相依数据(A8)加密为一密文(B8)。
  19. 一种利用非对称式加密算法验证输入值的方法，其特征在于,包含下列步骤：
    接收一待验输入值(7)；
    利用非对称式加密算法的特性，将所述待验输入值(7)当作种子，进一步推导出一私钥(80a)与一公钥(80b)；
    将所述公钥(80b)转作为待验暂存输入值(8)；
    提取如权利要求13所述方法记载的所述储存输入值(6)；
    倘若所述待验暂存输入值(8)与所述储存输入值(6)一致，判定验证通过；以及
    倘若所述待验暂存输入值(8)与所述储存输入值(6)不一致，判定验证失败。
  20. 根据权利要求19所述的方法，其特征在于,所述待验输入值(7)，其形式为明文、散列值、密钥、密文其中之一，而所述待验输入值(7)的性质为密码、序号其中之一。
  21. 一种如权利要求19所述方法的应用方法，其特征在于,包含下列步骤：
    当如权利要求19所述方法记载的所述待验暂存输入值(8)与所述储存输入值(6)一致，判定验证通过时；
    提取如权利要求19所述方法记载的所述私钥(80a)；
    提取如权利要求15所述方法记载的所述密文(B5)；以及
    使用所述私钥(80a)以非对称式加密算法，对所述密文(B5)进行解密。
  22. 一种如权利要求19所述方法的应用方法，其特征在于,包含下列步骤：
    当如权利要求19所述方法记载的所述待验暂存输入值(8)与所述储存输入值(6)一致，判定验证通过时；
    提取如权利要求19所述方法记载的所述私钥(80a)；
    提取如权利要求16所述方法记载的所述密文(B6)；以及
    将所述私钥(80a)转作为对称式加密算法的密钥(C4)，对所述密文(B6)进行解密。
  23. 一种如权利要求19所述方法的应用方法，其特征在于,包含下列步骤：
    当如权利要求19所述方法记载的所述待验暂存输入值(8)与所述储存输入值(6)一致，判定验证通过时；
    提取如权利要求19所述方法记载的所述私钥(80a)；
    提取如权利要求17所述方法记载的系统管理员的所述公钥(60b)及所述密文(B7)；
    使用所述私钥(80a)与所述公钥(60b)，利用密钥协商算法的特性，共同产生一共享密钥(D7)；以及
    使用所述共享密钥(D7)以对称式加密算法，对所述密文(B7)进行解密。
  24. 一种如权利要求19所述方法的应用方法，其特征在于,包含下列步骤：
    当如权利要求19所述方法记载的所述待验暂存输入值(8)与所述储存输入值(6)一致，判定验证通过时；
    提取如权利要求19所述方法记载的所述公钥(80b)；
    提取如权利要求18所述方法记载的系统管理员的所述私钥(70a)及所述密文(B8)；
    使用所述公钥(80b)与所述私钥(70a)，利用密钥协商算法的特性，共同产生一共享密钥(D8)；以及
    使用所述共享密钥(D8)以对称式加密算法，对所述密文(B8)进行解密。
PCT/CN2020/087655 2019-05-24 2020-04-29 利用非对称式加密算法建立、验证输入值的方法及其应用 WO2020238537A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910441883.2A CN111988268A (zh) 2019-05-24 2019-05-24 利用非对称式加密算法建立、验证输入值的方法及其应用
CN201910441883.2 2019-05-24

Publications (1)

Publication Number Publication Date
WO2020238537A1 true WO2020238537A1 (zh) 2020-12-03

Family

ID=73436911

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/087655 WO2020238537A1 (zh) 2019-05-24 2020-04-29 利用非对称式加密算法建立、验证输入值的方法及其应用

Country Status (2)

Country Link
CN (1) CN111988268A (zh)
WO (1) WO2020238537A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114257402A (zh) * 2021-11-12 2022-03-29 中国南方电网有限责任公司 加密算法确定方法、装置、计算机设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1987716A (zh) * 2005-12-20 2007-06-27 李代甫 软件使用权加密保护的系统和方法
WO2013102003A1 (en) * 2011-12-30 2013-07-04 Vasco Data Security, Inc. A strong authentication token with visual output of pki signatures
CN103595530A (zh) * 2012-08-17 2014-02-19 华为技术有限公司 软件密钥更新方法和装置
CN103684766A (zh) * 2012-08-30 2014-03-26 卓望数码技术（深圳）有限公司 一种终端用户的私钥保护方法和系统
CN106034122A (zh) * 2015-03-16 2016-10-19 联想(北京)有限公司 一种信息处理方法、电子设备及服务器

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8995653B2 (en) * 2005-07-12 2015-03-31 International Business Machines Corporation Generating a secret key from an asymmetric private key
CN102333308A (zh) * 2011-09-28 2012-01-25 辽宁国兴科技有限公司 一种基于位置信息的加密认证方法
GB2512749B (en) * 2014-02-25 2015-04-01 Cambridge Silicon Radio Ltd Linking ad hoc networks
CN111585749B (zh) * 2016-10-26 2023-04-07 创新先进技术有限公司 数据传输方法、装置、系统及设备
CN108111524A (zh) * 2017-12-28 2018-06-01 广州江南科友科技股份有限公司 基于私钥动态生成机制的终端数据保护方法及系统
CN109067545A (zh) * 2018-08-10 2018-12-21 航天信息股份有限公司 密钥管理方法、装置及存储介质
CN109412798A (zh) * 2018-12-06 2019-03-01 中链科技有限公司 区块链的私钥生成、数据交互方法及其系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1987716A (zh) * 2005-12-20 2007-06-27 李代甫 软件使用权加密保护的系统和方法
WO2013102003A1 (en) * 2011-12-30 2013-07-04 Vasco Data Security, Inc. A strong authentication token with visual output of pki signatures
CN103595530A (zh) * 2012-08-17 2014-02-19 华为技术有限公司 软件密钥更新方法和装置
CN103684766A (zh) * 2012-08-30 2014-03-26 卓望数码技术（深圳）有限公司 一种终端用户的私钥保护方法和系统
CN106034122A (zh) * 2015-03-16 2016-10-19 联想(北京)有限公司 一种信息处理方法、电子设备及服务器

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114257402A (zh) * 2021-11-12 2022-03-29 中国南方电网有限责任公司 加密算法确定方法、装置、计算机设备和存储介质
CN114257402B (zh) * 2021-11-12 2024-04-09 中国南方电网有限责任公司 加密算法确定方法、装置、计算机设备和存储介质

Also Published As

Publication number Publication date
CN111988268A (zh) 2020-11-24

Similar Documents

Publication Publication Date Title
US9893892B2 (en) Authenticated remote pin unblock
US10116453B2 (en) Method for distributed trust authentication
US20170142082A1 (en) System and method for secure deposit and recovery of secret data
US9338163B2 (en) Method using a single authentication device to authenticate a user to a service provider among a plurality of service providers and device for performing such a method
EP3605373B1 (en) Authentication method for a client over a network
TW202019119A (zh) 利用非對稱式加密演算法建立、驗證輸入值的方法及其應用方法
US7698565B1 (en) Crypto-proxy server and method of using the same
US20120284506A1 (en) Methods and apparatus for preventing crimeware attacks
Kumar An Enhanced Remote User Authentication Scheme with Smart Card.
CN111954211B (zh) 一种移动终端新型认证密钥协商系统
CN113541935B (zh) 一种支持密钥托管的加密云存储方法、系统、设备、终端
CN110069916A (zh) 一种密码安全管理系统和方法
WO2008053279A1 (en) Logging on a user device to a server
WO2020238537A1 (zh) 利用非对称式加密算法建立、验证输入值的方法及其应用
CN110493177A (zh) 基于非对称密钥池对和序列号的量子通信服务站aka密钥协商方法和系统
CN114175079A (zh) 用于生物识别协议标准的系统和方法
KR100986980B1 (ko) 생체 인증 방법, 클라이언트 및 서버
US11671475B2 (en) Verification of data recipient
US20210306306A1 (en) Method and system for secure communication
Chaimaa et al. Authentication mechanisms in cloud computing environments
WO2012166669A2 (en) Methods and apparatus for preventing crimeware attacks
WO2018142291A1 (en) Identity verification
Kumar et al. Secured authentication method for wireless networks
Kashyap et al. A survey on various authentication attacks and database secure authentication techniques
Chang et al. An Owner-managed Indirect-Permission Social Authentication Method for Private Key Recovery

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20813047

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 16/03/2022)

122 Ep: pct application non-entry in european phase

Ref document number: 20813047

Country of ref document: EP

Kind code of ref document: A1