CN104753879A - Method and system for authenticating cloud service provider through terminal and method and system for authenticating terminal through cloud service provider - Google Patents

Abstract

The present invention provides a method for a terminal to authenticate a cloud service provider, comprising: generating a terminal-related predicate evaluation token STK _f according to a predicate evaluation function; generating a data packet including the predicate evaluation token STK _f and a public key SK _pu , the data packet also includes identity data indicating the identity of the cloud service provider; sending the data packet to a device related to the cloud service provider; at the device related to the cloud service provider, according to The predicate evaluation anonymous judgment function parses the received data packet, and authenticates the cloud service provider according to the parsing result. Also provided are a system for terminal authentication of cloud service providers, a method and system for cloud service authentication terminals, and a two-way cloud authentication method and system.

Description

Method and system for terminal authentication cloud service provider, method and system for cloud service provider authentication terminal

technical field

The present invention relates to security authentication technology, in particular, to cloud identity authentication technology. the

Background technique

Existing cloud identity authentication technologies mainly adopt a federated identity authentication mechanism, involving identity providers (IDPs) and service providers (SPs). In this case, multiple SPs share one IDP, and if the IDP fails, multiple SPs will not be able to implement identity authentication. In addition, if this IDP is attacked, it will cause data leakage or even system paralysis, resulting in huge losses. the

In the process of federated identity authentication, usually only focus on how to conveniently realize the authentication of user identity, which exposes users to dangers such as phishing. the

the

Contents of the invention

In view of this, the present invention provides a method for _terminal authentication cloud service provider, including: generating a terminal-related predicate evaluation token STK _f according to a predicate evaluation function; A data packet of _pu , the data packet also includes identity data indicating the identity of the cloud service provider; sending the data packet to a device related to the cloud service provider; At the device, the anonymous judgment function is evaluated according to the predicate to analyze the received data packet, and the cloud service provider is authenticated according to the analysis result.

According to the method for terminal authentication cloud service provider of the present invention, preferably, said generating the predicate evaluation token STK _f related to the terminal according to the predicate evaluation function includes: generating a pair of keys SPK and SMSK; The key SPK and the SMSK generate a terminal-related predicate evaluation token STK _f according to the predicate evaluation function.

According to yet another aspect of the present invention, a method for authenticating a terminal of a cloud service provider is also provided, including: after receiving a request from the terminal, processing the intermediate data for authentication with a predicate encryption algorithm, thereby generating ciphertext UCT and predicate evaluation Token UTK _f ; combine the ciphertext UCT with the predicate evaluation token UTK _f , the data SeP related to the security mechanism, and the public key AK _pu together with the public key SK _pu provided by the cloud service provider to generate a security active constraint package SAB; The security active constraint package SAB is provided to a device related to the cloud service provider; the security active constraint package SAB is decrypted through the private key provided by the cloud service provider; the decrypted security active constraint package SAB follows the The data SeP related to the security mechanism performs a security check; in the case of passing the security check, obtain the ciphertext UCT and the predicate evaluation token UTK _f from the decrypted security active constraint package SAB and decrypt the UTK _f , after the decryption result is consistent with the If the intermediate data for authentication described above are the same, the authentication is passed.

According to the method for authenticating a terminal provided by a cloud service provider in the present invention, optionally, the authentication intermediate data is identity data of the cloud service provider. the

According to the method for authenticating a terminal provided by a cloud service provider in the present invention, optionally, after receiving the request from the terminal, process the intermediate data for authentication with a predicate encryption algorithm, thereby generating a ciphertext UCT and a predicate evaluation token UTK _f includes: after receiving the request from the terminal, judging whether the cloud service provider is authenticating the terminal for the first time; if so, providing the virtual identity of the terminal, and generating a digital signature based on the virtual identity; The identity data of the service provider is used as the intermediate data for authentication, and the intermediate data for authentication is processed with the predicate encryption algorithm to generate the ciphertext UCT and the predicate evaluation token UTK _f based on the identity data; and if not, according to the cloud service The provider's identity data obtains the terminal's digital signature, and processes the digital signature with a predicate encryption algorithm, thereby generating a ciphertext UCT and a predicate evaluation token UTK _f based on the digital signature.

According to another example of the present invention, there is also provided a two-way cloud authentication method for mutual authentication between a terminal and a cloud service provider, the method comprising:

The terminal authentication cloud service provider includes: generating a predicate evaluation token STK _f related to the terminal according to the predicate evaluation function; generating a data packet including the predicate evaluation token STK _f and a public key SK _pu , and the data packet also includes Indicate the identity data of the identity of the cloud service provider; send the data packet to the device related to the cloud service provider; at the device related to the cloud service provider, evaluate the anonymous judgment function according to the predicate Analyzing the received data packet, and authenticating the cloud service provider according to the analysis result; and

The cloud service provider authenticates the terminal, including: after receiving the request from the terminal, processing the intermediate data for authentication with the predicate encryption algorithm, thereby generating the ciphertext UCT and the predicate evaluation token UTK _f ; combining the ciphertext UCT and the predicate evaluation token UTK _f , and the data SeP related to the security mechanism, and the public key AK _pu are encrypted with the public key SK _pu provided by the cloud service provider to generate a security active constraint package SAB; the security initiative constraint package SAB is sent to the cloud service provider A device related to the provider; decrypt the security active constraint package SAB through the private key provided by the cloud service provider; perform a security check on the decrypted security active constraint package SAB according to the data SeP related to the security mechanism included therein; When the security check is passed, obtain the ciphertext UCT and the predicate evaluation token UTK _f from the decrypted security active constraint package SAB and decrypt the UTK _f , and if the decryption result is the same as the authentication intermediate data, the authentication is passed .

According to the two-way cloud authentication method of the present invention, preferably, said generating the predicate evaluation token STK _f related to the terminal according to the predicate evaluation function includes: generating a pair of keys SPK and SMSK; A terminal-dependent predicate evaluation token _STKf is generated from the predicate evaluation function.

According to the two-way cloud authentication method of the present invention, optionally, the intermediate data for authentication is the identity data of the cloud service provider. the

According to the two-way cloud authentication method of the present invention, optionally, after receiving the request from the terminal, processing the intermediate data for authentication with the predicate encryption algorithm, thereby generating the ciphertext UCT and the predicate evaluation token _UTKf includes: receiving After the request from the terminal, it is judged whether the cloud service provider is authenticating the terminal for the first time; if so, the virtual identity of the terminal is provided, and a digital signature is generated based on the virtual identity, and at the same time, the identity of the cloud service provider The data is used as the intermediate data for authentication, and the intermediate data for authentication is processed with the predicate encryption algorithm to generate the ciphertext UCT and the predicate evaluation token UTK _f based on the identity data; and if not, then according to the identity data of the cloud service provider The digital signature of the terminal is obtained, and the digital signature is processed with a predicate encryption algorithm, thereby generating a ciphertext UCT and a predicate evaluation token UTK _f based on the digital signature.

According to yet another example of the present invention, a system for terminal authentication cloud service provider is also provided, including: a terminal data packet generation module configured to generate a terminal-related predicate evaluation token STK _f according to a predicate evaluation function, and generate A data packet including the predicate evaluation token STK _f and the public key SK _pu , the data packet also includes identity data indicating the identity of the cloud service provider; a sending module configured to send the data packet; the first An authentication module configured to receive the data packet sent by the sending module, analyze the received data packet according to the predicate evaluation anonymous judgment function, and authenticate the cloud service provider according to the analysis result.

According to the system for terminal authentication cloud service provider of the present invention, preferably, the terminal data packet generation module includes: a key pair generation unit for a pair of keys SPK and SMSK; a token generation unit for the The pair of keys SPK and SMSK generate the predicate evaluation token STK _f related to the terminal according to the predicate evaluation function; the data packet generating unit generates a data packet including the predicate evaluation token STK _f and the public key SK _pu , and the data packet also Includes identity data that identifies the cloud service provider.

According to yet another example of the present invention, a system for authenticating a terminal by a cloud service provider is also provided, including: a first processing module, after receiving a request from the terminal, processing the intermediate data for authentication with a predicate encryption algorithm, thereby generating The ciphertext UCT and the predicate evaluation token UTK _f ; the SAB generation module is used to use the ciphertext UCT and the predicate evaluation token UTK _f together with the data SeP related to the security mechanism and the public key AK _pu to the cloud service provider The provided public key SK _pu encrypts to generate a security active constraint package SAB, and sends the security initiative constraint package SAB to a device related to the cloud service provider; a decryption module, which is used to decrypt the security initiative constraint package SAB through a private key , wherein, the decrypted security active constraint package SAB performs a security check according to the data SeP related to the security mechanism included therein; the second processing module, when the security check passes, performs a security check from the decrypted security active constraint package SAB Obtain the ciphertext UCT and the predicate evaluation token UTK _f and decrypt the UTK _f , and compare the decryption result with the authentication intermediate data, and if the comparison results are the same, the authentication is passed.

According to the system for authenticating a terminal by a cloud service provider according to an example of the present invention, optionally, the intermediate data for authentication is identity data of the cloud service provider. the

According to the system for authenticating a terminal by a cloud service provider according to an example of the present invention, optionally, the first processing module includes: a judging unit configured to judge whether the cloud service provider is the first after receiving a request from the terminal The terminal is authenticated once; the first processing unit is configured to provide a virtual identity to the terminal when the result of the judging unit is yes, and generate a digital signature based on the virtual identity, and at the same time, use a predicate encryption algorithm to process the The identity data of the service provider as intermediate data for authentication when the terminal makes a request to the cloud service provider for the first time, thereby generating a ciphertext UCT and a predicate evaluation token UTK _f based on the identity data; and The second processing unit is used to obtain the digital signature of the terminal according to the identity data of the cloud service provider when the result of the judging unit is negative, and process the digital signature with a predicate encryption algorithm, thereby generating a digital signature based on Said digitally signed ciphertext UCT and predicate evaluation token UTK _f .

According to yet another example of the present invention, a two-way cloud authentication system is also provided for mutual authentication between a terminal and a cloud service provider, and the two-way cloud authentication system includes:

A system for terminal authentication cloud service provider, which includes: a terminal data packet generation module configured to generate a terminal-related predicate evaluation token STK _f according to a predicate evaluation function, and generate the predicate evaluation token STK _f and public A data packet of the key SK _pu , the data packet also includes identity data indicating the identity of the cloud service provider; a sending module configured to send the data packet; a first authentication module configured to receive the sending module sending data packets, and analyzing the received data packets, and authenticating the cloud service provider according to the analysis results; and

A cloud service provider authentication terminal system, which includes: a first processing module, after receiving a request from a terminal, it uses a predicate encryption algorithm to process authentication intermediate data, thereby generating a ciphertext UCT and a predicate evaluation token UTK _f ; SAB generation module, which is used to encrypt the ciphertext UCT and the predicate evaluation token UTK _f , and the data SeP related to the security mechanism, and the public key AK _pu with the public key SK _pu provided by the cloud service provider to generate a security active Constrain the package SAB, and send the security active constraint package SAB to a device related to the cloud service provider; a decryption module, which is used to decrypt the security active constraint package SAB through a private key, wherein the decrypted security active constraint package The SAB performs a security check according to the data SeP related to the security mechanism included therein; the second processing module, when the security check passes, obtains the ciphertext UCT and the predicate evaluation token UTK from the decrypted security active constraint package SAB _f and decrypt the UTK _f , and compare the decryption result with the authentication intermediate data, and if the comparison results are the same, the authentication is passed.

In the two-way cloud authentication system, preferably, the terminal data packet generation module includes: a key pair generation unit for a pair of keys SPK and SMSK; a token generation unit for using the pair of keys SPK and SMSK SMSK generates the predicate evaluation token STK _f related to the terminal according to the predicate evaluation function; the data packet generation unit generates a data packet including the predicate evaluation token STK _f and the public key SK _pu , and the data packet also includes indicating the identity of the cloud service provider identity data.

In the two-way cloud authentication system, optionally, the authentication intermediate data is the identity data of the cloud service provider. the

In the two-way cloud authentication system, optionally, the first processing module includes: a judging unit, configured to judge whether the cloud service provider authenticates the terminal for the first time after receiving a request from the terminal; the first a processing unit, configured to provide a virtual identity to the terminal when the result of the judging unit is yes, and generate a digital signature based on the virtual identity, and at the same time, use the identity data of the cloud service provider as intermediate data for authentication, Processing the intermediate data for authentication with a predicate encryption algorithm to generate a ciphertext UCT based on the identity data and a predicate evaluation token UTK _f ; The digital signature of the terminal is obtained from the identity data of the cloud service provider, and the digital signature is processed with a predicate encryption algorithm, thereby generating a ciphertext UCT and a predicate evaluation token UTK _f based on the digital signature.

Description of drawings

Figure 1 is a flow chart of a method for a terminal authenticating a cloud service provider according to an example of the present invention. the

Fig. 2 is a flow chart of a method for authenticating a terminal by a cloud service provider according to an example of the present invention. the

Fig. 3 is a flow chart of a method for authenticating a terminal by a cloud service provider according to yet another example of the present invention. the

FIG. 4 is a structural block diagram of a system for terminal authentication of a cloud service provider according to an example of the present invention. the

Fig. 5 is a structural block diagram of a system for authenticating a terminal of a cloud service provider according to an example of the present invention. the

Fig. 6 is a structural block diagram of a system for authenticating a terminal by a cloud service provider according to yet another example of the present invention. the

FIG. 7 is a schematic structural diagram of a two-way cloud authentication system according to an example of the present invention. the

the

Detailed ways

Illustrative examples of the present invention will now be described with reference to the accompanying drawings, wherein like reference numerals refer to like elements. The embodiments described below are intended to help those skilled in the art to fully understand the present invention, and are intended to be illustrative rather than limiting. Unless defined otherwise, the terms (including scientific, technical and industry terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. the

FIG. 1 is a flowchart of a method for a terminal authenticating a cloud service provider according to an example of the present invention. In all examples of the present invention, the terminal can be any device that can access the cloud service network, such as desktop computers, notebooks, and handheld electronic devices (such as smart phones, tablet computers, etc.), servers, and servers that include multiple independent In the case of the main board, any independent main board or the like may be used. The cloud service provider may be a cloud service application running on a cloud device, or a cloud device. the

In step 100, a terminal-dependent predicate evaluation token STK _f is generated according to a predicate evaluation function. As an example, a pair of keys SPK and SMSK is generated; a predicate evaluation token STK _f is generated from the pair of keys SPK and SMSK according to a predicate evaluation function for anonymous authentication. The predicate encryption (Predicate Encryption) technology is a well-developed conventional technology. The predicate evaluation function used in the present invention can be any predicate evaluation function known to those skilled in the art for generating evaluation tokens. It should be noted that the selected predicate evaluation function has a corresponding predicate evaluation anonymous judgment function.

In step 102, the terminal generates a data packet including the predicate evaluation token STK _f and the public key SK _pu , and the data packet also includes identity data indicating the identity of the cloud service provider. Then, at step 104, the data packet is sent to a device related to the cloud service provider. The device related to the cloud service provider may be a device where the cloud service provider is located, or a device that is independent from the device where the cloud service provider is located but can communicate with the device where the cloud service provider is located.

In step 106, at the device related to the cloud service provider, the received data packet is analyzed according to the predicate evaluation anonymous judgment function, and the cloud service provider is authenticated according to the result of the analysis. The predicate evaluation anonymous judgment function is a function corresponding to the aforementioned predicate evaluation function; and if the analysis result of the predicate evaluation anonymous judgment function is true, the cloud service provider is authenticated, otherwise, the authentication is not passed. the

According to an example of the present invention, steps 100, 102, and 104 can be performed by the terminal respectively, or instead, can also be performed by a device independent of the terminal, but the device should be able to communicate with the terminal, that is, the device can receive the request sent by the terminal. Authenticate the request of the cloud service provider, and feedback the authentication result to the terminal. When the device related to the cloud service provider is the device where the cloud service provider is located, step 106 is executed on the device where the cloud service provider is located, and the device related to the cloud service provider is independent of the device where the cloud service provider is located but can be connected with it When the device communicates, step 106 is executed on the device independent of the cloud service provider. the

The method for terminal authentication cloud service provider shown in Figure 1 can be implemented as software, hardware or a combination of software and hardware. Whether implemented as software, hardware, or a combination of software and hardware, as described above, some steps in the method (such as steps 100, 102, and 104) are executed in the terminal or by a device that is independent of the terminal but can communicate with the terminal, and Part (such as step 106) is executed on the device where the cloud service provider is located or executed on a device that can communicate with the device where the cloud service provider is located. the

Fig. 2 is a flow chart of a method for authenticating a terminal by a cloud service provider according to an example of the present invention. In step 200, after receiving the authentication request from the terminal, the intermediate data for authentication is processed with the predicate encryption algorithm, thereby generating the ciphertext UCT and the predicate evaluation token UTK _f . In this example, the intermediate data for authentication may be the identity data of the cloud service provider. In another example that will be described in conjunction with FIG. 3 , the intermediate data for authentication is a digital signature for the virtual identity of the user terminal. Step 200 can be executed in the device where the cloud service provider resides; it can also be executed in a device that is independent from the device where the cloud service provider resides but can communicate with it.

In the example shown in FIG. 2, after the ciphertext UCT and the predicate evaluation token UTK _f are generated, in step 202, the ciphertext UCT, the predicate evaluation token UTK _f , the data SeP related to the security mechanism, and the public key AK _Pu is encrypted with the public key SK _pu provided by the cloud service provider to generate a security active constraint package SAB. The data SeP related to the security mechanism indicates the security check to be performed by the SAB during the decryption process, such as the self-integrity check and whether to execute the self-destruction self-destruction mechanism if the self-integrity check fails. In addition, in order to perform subsequent security checks, the SAB data package generally includes at least a virtual machine that can perform the SAB security check and can perform self-destruction if the check fails. The SAB in this example includes such virtual machine. Step 202 can be executed in the device where the cloud service provider is located; it can also be executed in a device that is independent of the device where the cloud service provider is located but can communicate with it, and the communication with the device where the cloud service provider is located is intended to enable the cloud service provider to provide The user knows the authentication result. Step 202 and step 200 may be performed by the same device or by different devices.

In step 204, the security active constraint package SAB is provided to the device related to the cloud service provider. Here, the device related to the cloud service provider refers to the device that subsequently executes the decryption process, and the device that subsequently executes the decryption process may be set in the device where the cloud service provider is located, or in other devices. the

In step 206, at the device related to the cloud service provider, the security active constraint package SAB is decrypted through the private key provided by the cloud service provider. Then in step 208, the decrypted security active constraint package SAB is subjected to a security check by the virtual machine included in the SAB according to the data SeP related to the security mechanism contained therein. Here, the security check is a self-integrity check, that is, the SAB checks whether its decrypted data packet is complete. In the case of passing the security check, execute step 210, obtain the ciphertext UCT and the predicate evaluation token UTK _f from the decrypted security active constraint package SAB, and decrypt the UTK _f to obtain the decryption result, and share the decryption result with the cloud service provider If they are the same, the authentication is passed; otherwise, the authentication is not passed, and the communication with the terminal is terminated. Here, in the case that the self-integrity check of the SAB fails, the virtual machine destroys the SAB itself in this example. Steps 208, 210 can be executed on the same device as step 206, but not limited thereto. If steps 208, 210 and step 206 are executed on the same device, the device can provide the final authentication result to the cloud service provider .

In addition, in this example and the example given below in conjunction with FIG. 3 , optionally, in order to further increase the security of authentication, attribute information related to terminal sensitive information may also be included when generating the SAB data packet. What kind of The attribute information is included in the SAB data packet, which can be determined according to the requirements of the cloud service provider, and the requirement, for example, can be notified by the cloud service provider to the device, device or module that generates the SAB before the generation of the SAB data packet, and collected and processed by it . In the case that the SAB contains attribute information, after the SAB is decrypted, the attribute public key AK _PU of the terminal is obtained, and the attribute information is decrypted by using the public key, so that the attribute information can be further verified. In such a case, only when the verification of the attribute information is successful and the authentication in step 210 of FIG. 2 and step 312 of FIG. 3 passes, the authentication of the terminal by the cloud service provider passes.

The method for authenticating a terminal by a cloud service provider shown in FIG. 2 may be implemented as software, hardware, or a combination of software and hardware. the

3 is a flowchart of a method for a cloud service provider to authenticate a terminal according to another example of the present invention. In this example, the intermediate data for authentication is the identity of the cloud service provider when the cloud service provider authenticates the terminal for the first time data, and in any other authentication, it is a digital signature for the virtual identity of the user terminal. In step 300, after receiving the authentication request from the terminal, it is determined whether the cloud service provider is authenticating the terminal for the first time, and if so, proceed to step 302a. In step 302a, the virtual identity VID is provided to the terminal, and a digital signature Sg(VID) is generated based on the virtual identity. At the same time, the identity data of the cloud service provider is used as the authentication intermediate data for the first authentication, and the predicate The encryption algorithm processes the intermediate data for authentication, thereby generating the ciphertext UCT and the predicate evaluation token UTK _f based on the identity data; in addition, in this step, VID and Sg (VID) will be stored, as will be introduced below When the cloud service provider later authenticates the terminal, the digital signature Sg(VID) will be used as the intermediate data for authentication. Step 302a can be executed in the device where the cloud service provider resides; it can also be executed in a device that is independent from the device where the cloud service provider resides but can communicate with it.

If in step 300, after receiving the authentication request from the terminal, it is determined that the cloud service provider is not authenticating the terminal for the first time, then go to step 302b. Since the cloud service provider has stored the VID and Sg(VID) when authenticating the terminal for the first time, in step 302b, the identity data of the cloud service provider is used as an index to find the VID of the terminal, and then find the Sg(VID), using the predicate encryption algorithm to process Sg(VID) as the intermediate data for authentication, and then generate the ciphertext UCT and the predicate evaluation token UTK _f based on the digital signature. As an advantage, the execution of step 302a and step 302b can be performed by the same device.

In step 304, the ciphertext UCT, the predicate evaluation token UTK _f , the data SeP related to the security mechanism, and the public key AK _pu are encrypted with the public key SK _pu provided by the cloud service provider to generate a security active constraint package SAB. The data SeP related to the security mechanism indicates the type of security check performed by the SAB during the decryption process, such as the self-integrity check and the self-destruction mechanism whether to perform self-destruction if the self-integrity check fails. In addition, in order to perform subsequent security checks, generally the SAB data package includes at least a virtual machine that can perform the SAB security check and can perform self-destruction if the check fails. In this example, the SAB includes such a virtual machine.

In step 306, the security active constraint package SAB is provided to the device related to the cloud service provider. Here, the device related to the cloud service provider refers to the device that subsequently executes the decryption process, and the device that subsequently executes the decryption process may be set in the device where the cloud service provider is located, or in other devices. the

In step 308, at the device related to the cloud service provider, the security active constraint package SAB is decrypted through the private key provided by the cloud service provider. Then at step 310, the decrypted security active constraint package SAB is subjected to a security check by the virtual machine included in the SAB according to the data SeP related to the security mechanism contained therein. Here, the security check is a self-integrity check, that is, the SAB checks whether its decrypted data packet is complete. If the security check is passed, step 312 is executed to obtain the ciphertext UCT and the predicate evaluation token UTK _f from the decrypted security active constraint package SAB, and decrypt UTK _f to obtain the decryption result. Here, if the ciphertext UCT and The predicate evaluation token UTK _f is generated in step 302a, then compare the decryption result with the identity data of the cloud service provider, if they are the same, then pass the authentication, otherwise, fail to pass the authentication, terminate the communication with the terminal; The text UCT and the predicate evaluation token UTK _f are generated in step 302b, and the decryption result is compared with the digital signature Sg(VID). If they are the same, the authentication is passed; otherwise, the authentication is not passed, and the communication with the terminal is terminated.

Similar to the example in FIG. 2 , in this example, if the self-integrity check of the SAB fails, the virtual machine will self-destruct the SAB. the

According to the present invention, a two-way cloud authentication method is also provided, which is used for mutual authentication between a terminal and a service provider. In this authentication, the process of the terminal authenticating the cloud service provider is the same as the method illustrated in FIG. 1. After the authentication of the terminal to the cloud service provider shown in FIG. 1 is passed, the cloud service provider authenticates the terminal. The authentication process of the terminal by the cloud service provider may adopt the method shown in FIG. 2 or the method shown in FIG. 3 . No matter which one is used, when the cloud service provider finally passes the authentication of the terminal, the mutual authentication between the cloud service provider and the terminal is completed. Alternatively, the terminal may be authenticated by the cloud service provider first, and then authenticated by the terminal to the cloud service provider after passing. Considering that the terminal authentication cloud service provider and the process of the cloud service provider have been described above in conjunction with FIG. 1 , FIG. 2 and FIG. 3 , the two-way cloud authentication method based on them will not be described in detail here. the

Fig. 4 is a structural block diagram of a system for terminal authentication of a cloud service provider according to an example of the present invention. As shown in the figure, the system for terminal authentication of a cloud service provider includes a terminal data packet generation module 40 , a sending module 42 , and a first authentication module 44 . The terminal data packet generation module 40 is configured to generate a predicate evaluation token STK _f related to the terminal according to the predicate evaluation function, and generate a data packet including the predicate evaluation token STK _f and the public key SK _pu , and the data packet also includes the specified cloud service Identity data for provider identity. As a specific example, the terminal data packet generation module 40 includes a key pair generation unit 400, which is configured to generate a pair of keys SPK and SMSK; a token generation unit 402, which is used to generate a pair of keys SPK and SMSK according to The predicate evaluation function generates a predicate evaluation token STK _f related to the terminal; and, a data packet generating unit 404 is configured to generate a data packet including the predicate evaluation token STK _f and the public key SK _pu , and the data packet also includes the specified cloud Identity data for the identity of the service provider. The sending module 42 sends the generated data packet to the first authentication module 44 . As an example, both the terminal data packet generation module 40 and the sending module can be set in the terminal, or can be set in a device independent of the terminal but associated with the terminal, and the device independent of the terminal can at least communicate with the terminal, that is, receive The terminal authenticates the request of the cloud service provider, and feeds back the authentication result to the terminal. The first authentication module 44 analyzes the received data packet according to the predicate evaluation anonymous judgment function, and verifies whether the cloud service provider is legal according to the analysis result. Wherein, the predicate evaluation anonymous judgment function and the predicate evaluation function are functions corresponding to each other. If the result of the analysis performed by the first authentication module 44 based on the predicate evaluation anonymous judgment function is true, then the cloud service provider has passed the authentication; otherwise, the cloud service provider has not passed the authentication. The first authentication module 44 can be set on the device where the cloud service provider is located, or can be set on a device associated with the device where the cloud service provider is located, and the associated device can send the authentication result to the cloud service provider.

The system for terminal authentication cloud service provider shown in FIG. 4 can be implemented as software, hardware or a combination of software and hardware. Whether implemented as software, hardware, or a combination of software and hardware, as described above, part of the system (such as the terminal data packet generation module 40 and the sending module 42) can be set in the terminal or in a device independent of the terminal, and another part (such as the first authentication module 44) is set on the device where the cloud service provider is located or a device that can communicate with the device where the cloud service provider is located. the

Fig. 5 is a structural block diagram of a system for authenticating a terminal by a cloud service provider according to yet another example of the present invention. As shown in the figure, the cloud service provider authentication terminal system includes a first processing module 50 , an SAB generation module 52 , a decryption module 54 and a second processing module 56 . After receiving the request from the terminal, the first processing module 50 processes the authentication intermediate data with the predicate encryption algorithm, thereby generating the ciphertext UCT and the predicate evaluation token UTK _f . In this example, the intermediate data for authentication is the identity data of the cloud service provider. The first processing module 50 can be set in a device where the cloud service provider is located, or can be set in a device that is independent of the cloud service provider's device but can communicate with it. The SAB generation module 52 encrypts the ciphertext UCT, the predicate evaluation token UTKf, the data SeP related to the security mechanism, and the public key AK _pu with the public key SK _pu provided by the cloud service provider to generate a security active constraint package SAB, and The SAB is sent to the device associated with the cloud service provider. The data SeP related to the security mechanism indicates the type of security check performed by the SAB during the decryption process, such as the self-integrity check and the self-destruction mechanism whether to self-destruct if the self-integrity check fails. In addition, in order to perform subsequent security checks, the SAB data package generally includes a virtual machine that can at least perform the SAB security check and can perform self-destruction if the check fails. The SAB in this example includes such a virtual machine machine. The SAB generation module 52 and the first processing module 50 can be set in the same device. The decryption module 54 decrypts the security active constraint package SAB through the private key provided by the cloud service provider, and makes the decrypted security active constraint package SAB perform a security check according to the data related to the security mechanism included therein; specifically, the decryption According to the data SeP related to the security mechanism included in the security active constraint package SAB, the virtual machine included in the SAB performs a security check. Here, the security check is a self-integrity check, that is, the SAB checks whether its decrypted data packet is complete. The second processing module 56 obtains the ciphertext UCT and the predicate evaluation token UTK _f from the decrypted security active constraint package SAB, and decrypts the UTK _f to obtain the decryption result, compares the decryption result with the identity data of the cloud service, and if they are the same, then If the authentication is passed, otherwise, the communication with the terminal is terminated if the authentication is not passed. Here, in the case that the self-integrity check of the SAB fails, the virtual machine destroys the SAB itself in this example.

Fig. 6 is a structural block diagram of a system for authenticating a terminal by a cloud service provider according to yet another example of the present invention. According to this example, the system for authenticating a terminal of a cloud service provider includes a first processing module 60 , an SAB generation module 62 , a decryption module 64 and a second processing module 66 . The first processing module 60 includes a judging unit 600 , a first processing unit 602 and a second processing unit 604 . The judging unit 600 is configured to judge whether the cloud service provider authenticates the terminal for the first time after receiving the request from the terminal, and the first processing unit 602 provides virtual Identity, and generate a digital signature Sg (VID) based on the virtual identity, and at the same time, use the identity data of the cloud service provider as the authentication intermediate data for the first authentication, and process the authentication intermediate data with the predicate encryption algorithm, As a result, the ciphertext UCT and the predicate evaluation token UTK _f based on the identity data are generated; in addition, VID and Sg(VID) will be stored, as will be introduced below, when the cloud service provider later authenticates the terminal , all use the digital signature Sg(VID) as the intermediate data for authentication. The second processing unit 604 is used to use the identity data of the cloud service provider as an index to find the VID of the terminal and then find the Sg(VID) when the result of the judging unit is negative, thereby using the predicate encryption algorithm The Sg(VID) which is the intermediate data for authentication is processed, and the ciphertext UCT and the predicate evaluation token UTK _f based on the digital signature are generated.

The SAB generation module 62 encrypts the ciphertext UCT, the predicate evaluation token UTKf, the data SeP related to the security mechanism, and the public key AK _pu with the public key SK _pu provided by the cloud service provider to generate a security active constraint package SAB, and The SAB is sent to the cloud service provider. The data SeP related to the security mechanism indicates the type of security check performed by the SAB during the decryption process, such as the self-integrity check and the self-destruction mechanism whether to self-destruct if the self-integrity check fails. In addition, in order to perform subsequent security checks, the SAB data package generally includes at least a virtual machine that can perform the SAB security check and can perform self-destruction if the check fails. The SAB in this example includes such virtual machine. The SAB generating module 62 and the first processing module 60 can be set in the same device. The decryption module 64 decrypts the security-active constraint package SAB through the private key provided by the cloud service provider, and makes the decrypted security-active constraint package SAB carry out a security check according to the data related to the security mechanism included therein; specifically, the decryption According to the data SeP related to the security mechanism included in the security active constraint package SAB, the virtual machine included in the SAB performs a security check. Here, the security check is a self-integrity check, that is, the SAB checks whether its decrypted data packet is complete. The second processing module 66 obtains the ciphertext UCT and the predicate evaluation token UTK _f from the decrypted security active constraint packet SAB, and decrypts the UTK _f to obtain a decryption result. In the case that the ciphertext UCT and the predicate evaluation token UTK _f are generated by the first processing unit 602, the second processing module 66 compares the decryption result with the identity data of the cloud service provider, and if they are the same, the authentication is passed; otherwise, the authentication is not Through the authentication, the communication with the terminal is terminated; under the situation that the ciphertext UCT and the predicate evaluation token UTK _f are generated by the second processing unit 604, the second processing module 66 compares the decryption result with the digital signature, and if they are the same, then If the authentication is passed, otherwise, the communication with the terminal is terminated if the authentication is not passed. Here, in the case that the self-integrity check of the SAB fails, the virtual machine destroys the SAB itself in this example.

The invention also provides a two-way cloud authentication system for mutual authentication between the terminal and the cloud service provider. Fig. 7 is a schematic block diagram of a two-way cloud authentication system according to the present invention. The two-way cloud authentication system includes a system 7a for terminal authentication cloud service provider and a system 7b for cloud service provider authentication terminal. The system 7a for the terminal to authenticate the cloud service provider is the same as the system 7a for the terminal to authenticate the cloud service provider shown in FIG. According to an example of the present invention, the cloud service provider authentication terminal system 7b may adopt the cloud service provider authentication terminal system shown in FIG. 5 , which will not be described in detail. According to yet another example of the present invention, the cloud service provider authentication terminal system 7b may also adopt the cloud service provider authentication terminal system shown in FIG. 6 . Generally speaking, when the terminal authenticates the cloud service provider's system 7a and the cloud service provider passes the authentication, the cloud service provider's terminal authentication system 7b then authenticates the cloud service provider's terminal. However, after the terminal authentication system 7b of the cloud service provider authenticates the terminal, the system 7a for terminal authentication of the cloud service provider performs the authentication of the terminal to the cloud service provider. the

Adopting the system as described in the present invention or executing the method as described in the present invention, unlike the conventional technology, only the cloud service provider authenticates the terminal, but enables the cloud service provider and the terminal to realize two-way authentication, thereby avoiding This happens with phishing. During the authentication process, the adoption of predicate evaluation, SAB technology, and self-destruction mechanism effectively prevents data theft. Public key encryption is used in the authentication process, making decimal attacks ineffective. In addition, the use of predicate encryption and virtual accounts also ensures anonymity, prevents service providers or attackers from tracking user access, and prevents multiple service providers from stealing end user information through joint decryption. In the technical solution provided by the present invention, the user and the cloud provider directly authenticate without the need for a third party, which avoids the cloud service provider from relying on a certain identity provider, and is beneficial to the expansion of the cloud service provider and resource share. the

Claims (18)

1. A method for terminal authentication cloud service provider, characterized in that the method comprises: generate a terminal-dependent predicate evaluation token STK _f according to the predicate evaluation function; Generate a data packet including the predicate evaluation token STK _f and the public key SK _pu , the data packet also includes identity data indicating the identity of the cloud service provider; sending the data packet to a device associated with the cloud service provider; At the device related to the cloud service provider, the received data packet is analyzed according to the predicate evaluation anonymous judgment function, and the cloud service provider is authenticated according to the analysis result. 2. the method for terminal certification cloud service provider as claimed in claim 1, is characterized in that, described basis predicate evaluation function generates the predicate evaluation token STK _f relevant to terminal comprising: Generate a pair of keys SPK and SMSK; A terminal-related predicate evaluation token STK _f is generated from the pair of keys SPK and SMSK according to the predicate evaluation function. 3. A method for cloud service provider authentication terminal, characterized in that the method comprises: After receiving the request from the terminal, process the intermediate data for authentication with the predicate encryption algorithm, thereby generating the ciphertext UCT and the predicate evaluation token UTK _f ; Combine the ciphertext UCT, the predicate evaluation token UTK _f , the data SeP related to the security mechanism, and the public key AK _pu together with the public key SK _pu provided by the cloud service provider to generate a security active constraint package SAB; providing the security active constraint package SAB to a device related to a cloud service provider; Decrypting the security active constraint package SAB through the private key provided by the cloud service provider; The decrypted security active constraint package SAB performs a security check according to the data SeP related to the security mechanism contained therein; If the security check is passed, obtain the ciphertext UCT and the predicate evaluation token UTK _f from the decrypted security active constraint packet SAB and decrypt the UTK _f , and if the decryption result is the same as the authentication intermediate data, the authentication pass. 4. The method for authenticating a terminal by a cloud service provider according to claim 3, wherein the intermediate data for authentication is identity data of the cloud service provider. 5. The method for cloud service provider authentication terminal as claimed in claim 3, characterized in that, after receiving the request from the terminal, the intermediate data for authentication is processed with the predicate encryption algorithm, thereby generating the ciphertext UCT and the predicate The evaluation token UTK _f includes: After receiving the request from the terminal, determine whether the cloud service provider is authenticating the terminal for the first time; If so, provide a virtual identity to the terminal, generate and store a digital signature based on the virtual identity, and at the same time, use the identity data of the cloud service provider as intermediate data for authentication, and process the intermediate data for authentication with a predicate encryption algorithm, generate a ciphertext UCT and a predicate evaluation token UTK _f based on the identity data; and If not, then obtain the digital signature of the terminal according to the identity data of the cloud service provider, process the digital signature with the predicate encryption algorithm, thereby generate the ciphertext UCT and the predicate evaluation token UTK _f based on the digital signature . 6. A two-way cloud authentication method for mutual authentication between a terminal and a cloud service provider, said method comprising: Terminal authentication cloud service provider, including: generate a terminal-dependent predicate evaluation token STK _f according to the predicate evaluation function; generate a packet comprising said predicate evaluation token STK _f and public key SK _pu , The data packet also includes identity data indicating the identity of the cloud service provider; sending the data packet to a device associated with the cloud service provider; At the device related to the cloud service provider, analyze the received data packet according to the predicate evaluation anonymous judgment function, and authenticate the cloud service provider according to the analysis result; and Cloud service provider authentication terminal, including: After receiving the request from the terminal, process the intermediate data for authentication with the predicate encryption algorithm, thereby generating the ciphertext UCT and the predicate evaluation token UTK _f ; Encrypt the ciphertext UCT, the predicate evaluation token UTK _f , the data SeP related to the security mechanism, and the public key AK _pu with the public key SK _pu provided by the cloud service provider to generate a security active constraint package SAB; Send the security active constraint package SAB to a device related to the cloud service provider; Decrypting the security active constraint package SAB through the private key provided by the cloud service provider; The decrypted security active constraint package SAB performs a security check according to the data SeP related to the security mechanism contained therein; If the security check is passed, obtain the ciphertext UCT and the predicate evaluation token UTK _f from the decrypted security active constraint packet SAB and decrypt the UTK _f , and if the decryption result is the same as the authentication intermediate data, the authentication pass. 7. The two-way cloud authentication method as claimed in claim 6, wherein said generating the predicate evaluation token STK _f related to the terminal according to the predicate evaluation function comprises: Generate a pair of keys SPK and SMSK; A terminal-related predicate evaluation token STK _f is generated from the pair of keys SPK and SMSK according to the predicate evaluation function. 8. The two-way cloud authentication method according to claim 6, wherein the intermediate data for authentication is identity data of a cloud service provider. 9. The two-way cloud authentication method according to claim 6, wherein after the request from the terminal is received, the intermediate data for authentication is processed with a predicate encryption algorithm, thereby generating a ciphertext UCT and a predicate evaluation token UTK _f include: After receiving the request from the terminal, determine whether the cloud service provider is authenticating the terminal for the first time; If so, provide a virtual identity to the terminal, and generate a digital signature based on the virtual identity. The ciphertext UCT of the identity data and the predicate evaluation token UTK _f ; wherein, when the terminal makes a request to the cloud service provider from the second time, the digital signature will be used as intermediate data for authentication; and If not, then obtain the digital signature of the terminal according to the identity data of the cloud service provider, process the digital signature with the predicate encryption algorithm, thereby generate the ciphertext UCT and the predicate evaluation token UTK _f based on the digital signature . 10. A system for terminal authentication cloud service provider, characterized in that the system comprises: A terminal data packet generating module configured to generate a terminal-related predicate evaluation token STK _f according to a predicate evaluation function, and generate a data packet including the predicate evaluation token STK _f and a public key SK _pu , and the data packet also Include identity data indicating the identity of said cloud service provider; a sending module configured to send the data packet; The first authentication module is configured to receive the data packet sent by the sending module, analyze the received data packet according to the predicate evaluation anonymous judgment function, and authenticate the cloud service provider according to the analysis result. 11. the system of terminal authentication cloud service provider as claimed in claim 10, it is characterized in that, described terminal packet generation module comprises: A key pair generating unit for a pair of keys SPK and SMSK; A token generating unit, configured to generate a terminal-related predicate evaluation token STK _f from the pair of keys SPK and SMSK according to a predicate evaluation function; The data packet generation unit generates a data packet including the predicate evaluation token STK _f and the public key SK _pu , and the data packet also includes identity data indicating the identity of the cloud service provider. 12. A system for cloud service provider authentication terminal, characterized in that the system comprises: The first processing module, after receiving the request from the terminal, processes the intermediate data for authentication with the predicate encryption algorithm, thereby generating the ciphertext UCT and the predicate evaluation token UTK _f ; SAB generation module, which is used to encrypt the ciphertext UCT, the predicate evaluation token UTK _f , and the data SeP related to the security mechanism, and the public key AK _pu with the public key SK _pu provided by the cloud service provider to generate security active constraints package SAB, and send the security active constraint package SAB to a device related to the cloud service provider; A decryption module, which is used to decrypt the security active constraint package SAB through a private key, wherein the decrypted security proactive constraint package SAB performs a security check according to the data SeP related to the security mechanism included therein; The second processing module obtains the ciphertext UCT and the predicate evaluation token UTK _f from the decrypted security active constraint package SAB when the security check is passed, decrypts the UTK _f , and compares the decryption result with the authentication intermediate The data are compared, and if the comparison results are the same, the authentication is passed. 13. The system for authenticating a terminal by a cloud service provider according to claim 12, wherein the intermediate data for authentication is identity data of the cloud service provider. 14. The system of cloud service provider authentication terminal as claimed in claim 12, is characterized in that, described first processing module comprises: A judging unit, which is used to judge whether the cloud service provider authenticates the terminal for the first time after receiving the request from the terminal; The first processing unit is configured to provide a virtual identity to the terminal when the result of the judging unit is yes, and generate a digital signature based on the virtual identity, and at the same time, use the identity data of the cloud service provider as an authentication intermediate data, process the intermediate data for authentication with the predicate encryption algorithm, and generate the ciphertext UCT and the predicate evaluation token UTK _f based on the identity data; wherein, when the terminal makes a request to the cloud service provider from the second time, the The digital signature will be used as intermediate data for authentication; and The second processing unit is used to obtain the digital signature of the terminal according to the identity data of the cloud service provider when the result of the judging unit is negative, and process the digital signature with a predicate encryption algorithm, thereby generating a digital signature based on Said digitally signed ciphertext UCT and predicate evaluation token UTK _f . 15. A two-way cloud authentication system for mutual authentication between a terminal and a cloud service provider, the two-way cloud authentication system comprising: A system for terminal authentication cloud service provider, which includes: A terminal data packet generating module configured to generate a terminal-related predicate evaluation token STK _f according to a predicate evaluation function, and generate a data packet including the predicate evaluation token STK _f and a public key SK _pu , and the data packet also Include identity data indicating the identity of said cloud service provider; a sending module configured to send the data packet; The first authentication module is configured to receive the data packet sent by the sending module, and analyze the received data packet according to the predicate evaluation anonymous judgment function, and authenticate the cloud service provider according to the analysis result; and A system for cloud service provider authentication terminal, which includes: The first processing module, after receiving the request from the terminal, processes the intermediate data for authentication with the predicate encryption algorithm, thereby generating the ciphertext UCT and the predicate evaluation token UTK _f ; SAB generation module, which is used to use the ciphertext UCT, the predicate evaluation token UTK _f , and the data SeP related to the security mechanism, and the public key AK _pu to generate a security active constraint package with the public key SK _pu provided by the cloud service provider SAB, and send the security active constraint package SAB to a device related to the cloud service provider; A decryption module, which is used to decrypt the security active constraint package SAB through a private key, wherein the decrypted security proactive constraint package SAB performs a security check according to the data SeP related to the security mechanism included therein; The second processing module obtains the ciphertext UCT and the predicate evaluation token UTK _f from the decrypted security active constraint package SAB when the security check is passed, decrypts the UTK _f , and compares the decryption result with the authentication intermediate The data are compared, and if the comparison results are the same, the authentication is passed. 16. two-way cloud authentication system as claimed in claim 15, is characterized in that, described terminal data package generation module comprises: A key pair generating unit for a pair of keys SPK and SMSK; A token generating unit, configured to generate a terminal-related predicate evaluation token STK _f from the pair of keys SPK and SMSK according to a predicate evaluation function; The data packet generation unit generates a data packet including the predicate evaluation token STK _f and the public key SK _pu , and the data packet also includes identity data indicating the identity of the cloud service provider. 17. The two-way cloud authentication system according to claim 15, wherein the intermediate data for authentication is the identity data of the cloud service provider. 18. The two-way cloud authentication system according to claim 15, wherein the first processing module comprises: A judging unit, configured to judge whether the terminal is making a request to the cloud service provider for the first time after receiving the request from the terminal; The first processing unit is configured to provide a virtual identity to the terminal when the result of the judging unit is yes, and generate a digital signature based on the virtual identity, and at the same time, use the identity data of the cloud service provider as an authentication intermediate data, process the intermediate data for authentication with the predicate encryption algorithm, and generate the ciphertext UCT and the predicate evaluation token UTK _f based on the identity data; wherein, when the terminal makes a request to the cloud service provider from the second time, the The digital signature will be used as intermediate data for authentication; and The second processing unit is used to obtain the digital signature of the terminal according to the identity data of the cloud service provider when the result of the judging unit is negative, and process the digital signature with a predicate encryption algorithm, thereby generating a digital signature based on Said digitally signed ciphertext UCT and predicate evaluation token UTK _f .