CN111431853A - A centerless instant network identity authentication method and client - Google Patents

Abstract

The invention discloses a non-center instant network identity authentication method and a client. The method includes: generating a local public key-private key pair; Perform public key exchange; after receiving the user ID sent by the other party, the hash operation result of the data containing the IP address encrypted by the other party's private key, and the data containing the IP address encrypted by the exchanged public key, decrypt the received data using the exchanged public key. and decrypt the data containing the IP address by using the local private key; perform a hash operation based on the decrypted data containing the IP address, and compare the result obtained by the operation with the decrypted hash operation result. Confirm the legal identity of the other party. The application of the present invention can achieve the purpose of non-center instant identity authentication, reduce the risk of identity forgery in the network data transmission process, and protect the security of the information system.

Description

A Centerless Instant Network Identity Authentication Method and Client

technical field

The invention relates to the technical field of communication encryption, in particular to a centerless instant network identity authentication method and a client.

Background technique

The network carries the communication of the entire information society, and the guarantee of service quality and information security is very important. With the continuous exposure of incidents such as surveillance eavesdropping and deliberate attacks, the types of information security risks faced by the network are constantly increasing, the scope is expanding, and the levels are deepening. The problem of network information security first needs to solve the problem of network identity authentication of information, and most of the existing network identity authentication methods realize the guarantee of the authentication process and the management of keys through the security authentication center. This increases the security requirements of the certification center itself, and increases the cost of key management.

The problem of network identity authentication is an important issue to ensure network information security. A good network identity authentication method can effectively reduce the risk of network identity being forged. Most of the existing network identity authentication methods use the security authentication center to realize the guarantee of the authentication process, the management of keys and other functions. This increases the security requirements of the certification center itself, increases the cost of key management, and still has the risk of identity forgery during network data transmission, threatening the security of the information system.

SUMMARY OF THE INVENTION

In view of this, the purpose of the present invention is to propose a non-central instant network identity authentication method and client, which can realize the purpose of non-central instant identity authentication, reduce the risk of identity forgery in the network data transmission process, and protect the information system. Safety.

Based on the above purpose, the present invention provides a non-center instant network identity authentication method, including:

Generate a local public-private key pair;

Based on the key K shared with the other party obtained by the symmetric encryption algorithm, exchange the public key with the other party;

After receiving the user ID sent by the other party, the hash operation result of the data containing the IP address encrypted by the other party's private key, and the data containing the IP address encrypted by the exchanged public key, decrypt the received hash operation result by using the exchanged public key, And use the local private key to decrypt the data containing the IP address;

Perform a hash operation based on the decrypted data including the IP address, compare the result obtained by the operation with the decrypted hash operation result, and store the correspondence between the other party's user ID and the IP address according to the comparison result after confirming the other party's legal identity.

Wherein, the public key exchange with the other party based on the key K shared with the other party obtained through the symmetric encryption algorithm specifically includes:

Entity A sends a public key exchange request to the counterpart entity B, and the public key exchange request carries the user identity of the entity A and the public key CertA encrypted with the key K;

After receiving the public key distribution information returned by the entity B, the entity A obtains the user identity of the entity B and the public key CertB encrypted with the key K;

The entity A decrypts the CertB by using the key K, and stores the CertB corresponding to the user ID of the entity B.

Wherein, after the user identification sent by the receiving party, the hash operation result of the data containing the IP address encrypted by the private key of the other party, and the data containing the IP address encrypted by the exchanged public key, the received public key is decrypted using the exchanged public key. The hash operation result is used to decrypt the data containing the IP address using the local private key, including:

The entity A sends an authentication request to the entity B, and the authentication request carries the user identity of the entity A, the hash of the data containing the IP address of the entity A encrypted by the private key SkeyA of the entity A The result of the operation and the data containing the IP address of the entity A encrypted by CertB;

After receiving the authentication request, the entity B uses CertA to decrypt the hash operation result of the data containing the IP address of the entity A encrypted by the private key SkeyA, and uses the private key SkeyB to decrypt the encrypted data containing the data of the IP address of entity A; after that, return authentication response information to entity A;

After receiving the authentication response information returned by the entity B, the entity A obtains the user ID of the entity B, the data containing the IP address of the entity B encrypted by the private key SkeyB of the entity B. The result of the hash operation and the data encrypted by CertA containing the IP address of the entity B;

The entity A uses CertB to decrypt the hash operation result of the data containing the IP address of the entity B encrypted by the private key SkeyB, and uses the private key SkeyA to decrypt the data containing the IP address of the entity B encrypted by CertA. .

Wherein, the hash operation is performed based on the decrypted data including the IP address, and the result obtained by the operation is compared with the decrypted hash operation result, which specifically includes:

The entity A performs a hash operation based on the decrypted data including the IP address, and compares the result obtained by the operation with the decrypted hash operation result.

Further, after the entity A performs a hash operation based on the decrypted data comprising the IP address, and compares the result obtained by the operation with the decrypted hash operation result, it also includes:

If the comparison result is consistent, the entity A returns authentication confirmation information to the entity B, and the authentication confirmation information carries the user ID of the entity A and the data encrypted by SkeyA including the IP address of the entity A. The result of the hash operation and the data containing the IP address of the entity A encrypted by CertB;

After receiving the authentication confirmation information, the entity B obtains the user identity of the entity A, the hash operation result of the data containing the IP address of the entity A encrypted by SkeyA, and the encrypted data containing the entity A encrypted by CertB. After the data of the IP address of A, use CertA to decrypt the hash operation result of the data containing the IP address of the entity A encrypted by the private key SkeyA, and use the private key SkeyB to decrypt the encrypted data containing the entity A by CertB. IP address data;

The entity B performs a hash operation based on the decrypted data including the IP address, compares the result obtained by the operation with the decrypted hash operation result, and confirms that both parties of the communication have completed identity authentication after confirming that the comparison results are consistent.

The present invention also provides a client, comprising:

The key pair generation module is used to generate a local public key-private key pair;

The public key exchange module is used to exchange the public key with the other party based on the key K shared with the other party obtained through the symmetric encryption algorithm;

The identity authentication module is used for receiving the user ID sent by the other party, the hash operation result of the data containing the IP address encrypted by the private key of the other party, and the data containing the IP address encrypted by the exchanged public key, and then decrypted using the exchanged public key. The received hash operation result is used to decrypt the data containing the IP address by using the local private key; then the hash operation is performed based on the decrypted data containing the IP address, and the result obtained by the operation is compared with the decrypted hash operation result. The comparison result stores the correspondence between the user ID and the IP address of the other party after confirming the legal identity of the other party.

In the technical scheme of the present invention, both parties in communication generate a local public-private key pair; based on the key K shared with the other party obtained through a symmetric encryption algorithm, exchange the public key with the other party; receive the user ID sent by the other party, After the hash operation result of the data containing the IP address encrypted by the private key and the data containing the IP address encrypted by the exchanged public key, use the exchanged public key to decrypt the received hash operation result, and use the local private key to decrypt the data containing the IP address. IP address data; perform hash operation based on the decrypted data containing the IP address, compare the result obtained by the operation with the decrypted hash operation result, and store the other party's user ID and IP address according to the comparison result after confirming the legal identity of the other party address correspondence. Therefore, both parties of the communication can achieve the purpose of non-central instant identity authentication by sending 2 public key exchange data packets and 3 authentication data packets and processing the data packets accordingly; On the premise of security, real-time "one-time-one pad" can be realized with absolute security, and the cost of public key management by the certification center can be saved, the risk of identity forgery in the network data transmission process can be reduced, and the security of the information system can be protected.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is a flowchart of a method for instant network identity authentication without a center provided by an embodiment of the present invention;

2 is a flowchart of a method for performing network identity authentication between two communicating parties according to an embodiment of the present invention;

FIG. 3 is a block diagram of an internal structure of a client according to an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of the present invention shall have the usual meanings understood by those with ordinary skill in the art to which the present disclosure belongs. As used in this disclosure, "first," "second," and similar terms do not denote any order, quantity, or importance, but are merely used to distinguish the various components. "Comprises" or "comprising" and similar words mean that the elements or things appearing before the word encompass the elements or things recited after the word and their equivalents, but do not exclude other elements or things. Words like "connected" or "connected" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "Down", "Left", "Right", etc. are only used to represent the relative positional relationship, and when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

The inventor of the present invention considers that a method based on the combination of the symmetric encryption algorithm and the asymmetric encryption algorithm SM2 algorithm can realize a non-center instant network identity authentication method, which can ensure the security of the identity authentication during the initial session of the data communication party. On the premise of security, real-time "one-time-one pad" can be realized with absolute security, and the cost of public key management by the certification center can be saved, the risk of identity forgery in the network data transmission process can be reduced, and the security of the information system can be protected.

Here is a brief introduction to a symmetric encryption algorithm AES algorithm:

Advanced Encryption Standard (AES) is a block encryption standard adopted by the US federal government. This standard is used to replace the original DES, which has been analyzed by many parties and is widely used all over the world. After a five-year selection process, AES was published by the National Institute of Standards and Technology (NIST) in FIPS PUB 197 on November 26, 2001, and became a valid standard on May 26, 2002; the AES algorithm is symmetric encryption The same key K is used for encryption and decryption.

Here is a brief introduction to the SM2 algorithm:

With the development of cryptography and computing technology, the commonly used 1024-bit RSA algorithm faces serious security threats. After research, our national password management department has designed the SM2 elliptic curve algorithm to replace the RSA algorithm. The SM2 elliptic curve encryption algorithm is an encryption algorithm independently designed by my country based on the international public ECC encryption algorithm. Its standard was released on December 17, 2010 by the State Cryptography Administration. The SM2 standard includes four parts: general principles, digital signature algorithm, key exchange protocol, and public key encryption algorithm, which are respectively used to realize functions such as digital signature, key negotiation and data encryption; SM2 algorithm is an asymmetric encryption algorithm, and the data sender and The receivers have their own public and private key pairs: (CertA, SkeyA) and (CertB, SkeyB).

The technical solutions of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

A non-central instant network identity authentication method provided by the present invention, as shown in Figure 1, includes the following steps:

Step S101: Generate a local public-private key pair.

Specifically, the process of generating a local public key-private key pair when entity A and entity B as two communicating parties perform non-central instant network identity authentication with each other, as shown in Figure 2, includes the following sub-steps:

Sub-step S200: entity A generates an instant key pair (CertA, SkeyA), and entity B generates an instant key pair (CertB, SkeyB);

Among them, CertA and SkeyA are the public and private keys generated by entity A, respectively; CertB and SkeyB are the public and private keys generated by entity B, respectively.

Step S102: Based on the key K shared with the other party obtained through the symmetric encryption algorithm, exchange the public key with the other party.

In this step, the process of public key exchange, as shown in Figure 2, specifically includes the following sub-steps:

Sub-step S201: entity A sends a public key exchange request to the counterpart entity B;

Specifically, in this sub-step, entity A sends a public key exchange request to the counterpart entity B:

Request,ID_A,SN,EK( _CertA );

The public key exchange request may carry the user identity ID_A of the entity A, the public key CertA encrypted with the key K, that is, E _K (CertA), and the session sequence number SN randomly generated by the entity A.

The key K is a shared key generated by entity A and entity B through a symmetric encryption algorithm in advance; the symmetric encryption algorithm may be a symmetric encryption algorithm in the prior art, such as the Advanced Encryption Standard AES algorithm.

Sub-step S202: Entity B acquires CertA.

Specifically, in this sub-step, after receiving the public key exchange request, entity B performs data filtering based on the IP address, port number and network protocol on the received request, and obtains ID_A, E _K (CertA);

Furthermore, entity B decrypts E _K (CertA) using the shared key K, obtains CertA, and stores ID_A and CertA in correspondence with them.

Sub-step S203: Entity B returns public key distribution information to entity A.

Specifically, in this sub-step, entity B returns public key distribution information to entity A:

Dispense, ID_B, SN+1, E _K (CertB);

The public key distribution information may carry the user identity ID_B of the entity B, the public key CertB encrypted with the key K, that is, E _K (CertB), and SN+1.

Sub-step S204: Entity A acquires CertB.

Specifically, in this sub-step, after receiving the public key distribution information returned by the entity B, entity A performs an IP (Internet Protocol, Internet Protocol) address, port number and network protocol based on the received public key distribution information. After the data is filtered, obtain the user ID_B, E _K (CertB) of the entity B;

Furthermore, entity A decrypts E _K (CertB) using the shared key K, and after obtaining CertB, ID_B and CertB are stored correspondingly, thereby completing the mutual exchange of public keys of entity A and entity B.

Step S103: After receiving the user ID sent by the other party, the hash operation result of the data containing the IP address encrypted by the private key of the other party, and the data containing the IP address encrypted by the exchanged public key, decrypt using the exchanged public key The received hash operation result is obtained, and the data containing the IP address is decrypted using the local private key.

The specific process of this step, as shown in Figure 2, includes the following sub-steps:

Sub-step S205: Entity A sends an authentication request to entity B.

Specifically, in this sub-step, the entity A sends an authentication request to the entity B:

Request,ID_A,SN+2,E _CertB (IP_A||SN+2||X),E _SkeyA (H(IP_A||SN+2||X));

The authentication request may carry the user identity ID_A of the entity A, the hash operation result E _SkeyA (H(IP_A) of the data containing the IP address (IP_A) of the entity A encrypted by the private key SkeyA of the entity A. ||SN+2||X)) and CertB encrypted data E _CertB (IP_A||SN+2||X) containing the IP address of said entity A (IP_A), and SN+2.

Among them, E _SkeyA (H(IP_A||SN+2||X)) is the encryption result obtained by encrypting the hash operation result of IP_A||SN+2||X by SkeyA; E _CertB (IP_A|| SN+2||X) is the encryption result obtained by encrypting IP_A||S+N 2 by CertB; wherein || represents a data connection operation, and X is a reserved keyword.

Sub-step S206: Entity B decrypts the received encrypted data in the authentication request.

Specifically, in this sub-step, after the entity B receives the authentication request, it uses CertA to decrypt the hash operation result H(IP_A||SN+2| of the data containing the IP address of the entity A encrypted by the private key SkeyA |X), using the private key SkeyB to decrypt the data IP_A||SN+2||X encrypted by CertB and including the IP address of the entity A.

Sub-step S207: Entity B performs identity authentication of entity A according to the decryption information.

Specifically, in this sub-step, entity B performs a hash operation based on the decrypted data IP_A||SN+2||X containing the IP address, and compares the result obtained by the operation with the decrypted hash operation result H(IP_A||SN+ 2||X) to compare; according to the comparison result, after confirming the legal identity of the other party, the corresponding relationship between the user ID and the IP address of the other party is stored. That is, if the comparison results are consistent, the legal identity of the counterparty is confirmed, and the correspondence between the user identifier ID_A of the counterparty entity A and the IP address IP_A of the counterparty entity A is stored; otherwise, the identity authentication fails.

Sub-step S208: Entity B returns authentication response information to the entity A.

Specifically, after confirming the legal identity of entity A, entity B returns authentication response information to entity A in this sub-step:

Dispense,ID_B,SN+3,E _CertA (IP_B||SN+3||X),E _SkeyB (H(IP_B||SN+3||X));

The authentication response information may carry the user identity ID_B of the entity B, the hash operation result E _SkeyB (H(H( IP_B||SN+3||X)) and CertA-encrypted data E _CertA (IP_B||SN+3||X) containing the IP address of said entity B, and SN+3.

Among them, E _SkeyB (H(IP_B||SN+3||X)) is the encryption result obtained by encrypting the hash operation result of IP_B||SN+3||X by SkeyB; E _CertA (IP_B|| SN+3||X) is the encryption result obtained by encrypting IP_B||SN+3||X by CertA; wherein || represents a data connection operation, and X is a reserved keyword.

Sub-step S209: Entity A decrypts the encrypted data in the received authentication response information.

Specifically, in this sub-step, after receiving the authentication response information returned by the entity B, the entity A performs data filtering based on the IP address, port number and network protocol on the authentication response information; and then obtains the entity from the authentication response information. User identification ID_B of B, the hash operation result E _SkeyB (H(IP_B||SN+3||X)) of the data containing the IP address of the entity B encrypted by the private key SkeyB of the entity B, and the data obtained by CertA Encrypted data E _CertA (IP_B||SN+3||X) containing the IP address of said entity B.

Further, the entity A uses CertB to decrypt the hash operation result H(IP_B||SN+3||X) of the data containing the IP address of the entity B encrypted by the private key SkeyB, and uses the private key SkeyA to decrypt the result H(IP_B||SN+3||X) CertA-encrypted data IP_B||SN+3||X containing the IP address of said entity B.

Step S104: perform hash operation based on the decrypted data including the IP address, compare the result obtained by the operation with the decrypted hash operation result, and store the user ID and IP address of the other party according to the comparison result after confirming the legal identity of the other party. Correspondence.

As shown in Figure 2, this step may specifically include the following sub-steps:

Sub-step S210: Entity A performs identity authentication of entity B according to the decryption information.

Specifically, in this sub-step, entity A performs a hash operation based on the decrypted data IP_B||SN+3|| containing the IP address, and compares the result obtained by the operation with the decrypted hash operation result H(IP_B||SN+3 ||X) to compare; according to the comparison result, after confirming the legal identity of the counterparty entity B, store the correspondence between the counterparty's user identification ID_B and the counterparty's IP address IP_B. That is to say, when the comparison results are consistent, confirm the legal identity of the other party, and store the corresponding relationship between ID_B and IP_B;

After entity A confirms the legal identity of entity B, it can also perform the following sub-steps to return authentication confirmation information to entity B:

Sub-step S211: Entity A returns authentication confirmation information to entity B.

Specifically, in this sub-step, entity A returns authentication confirmation information to entity B:

Acknowledge,ID_A,SN+4,E _CertB (IP_A||SN+4||X),E _SkeyA (H(IP_A||SN+4||X))

The authentication confirmation information carries the user identity ID_A of the entity A and the hash operation result of the data containing the IP address of the entity A encrypted by SkeyA E _SkeyA (H(IP_A||SN+4||X)) and CertB-encrypted data E _CertB (IP_A||SN+4||X) containing the IP address of said entity A, and SN+4.

Among them, E _SkeyA (H(IP_A||SN+4||X)) is the encryption result obtained by encrypting the hash operation result of IP_A||SN+4||X by SkeyA; E _CertB (IP_A|| SN+4||X) is an encryption result obtained by encrypting IP_A||SN+4||X by CertB; wherein || represents a data connection operation, and X is a reserved keyword.

Sub-step S212: Entity B decrypts the encrypted data in the received authentication confirmation information.

Specifically, in this sub-step, after the entity B receives the authentication confirmation information, it obtains the user identification ID_A of the entity A, the hash operation result E _{SkeyA of the data containing the IP address of the entity A encrypted by SkeyA} ( After H(IP_A||SN+4||X)) and the data E _CertB (IP_A||SN+4||X) encrypted by CertB containing the IP address of the entity A, use CertA to decrypt the data obtained by the private key The hash operation result H(IP_A||SN+4||X) of the data containing the IP address of the entity A encrypted by SkeyA, and using the private key SkeyB to decrypt the data containing the IP address of the entity A encrypted by CertB Data IP_A||SN+4||X.

Sub-step S213: Entity B confirms that both parties of the communication have completed identity authentication based on the decrypted data.

Specifically, in this sub-step, entity B performs a hash operation based on the decrypted data IP_A||SN+4||X containing the IP address, and compares the result obtained by the operation with the decrypted hash operation result H(IP_A||SN+ 4||X) to compare; after confirming that the comparison results are consistent, confirm that both parties of the communication have completed identity authentication.

Based on the above-mentioned non-central instant network identity authentication method, a client provided by an embodiment of the present invention has an internal structure as shown in FIG. 3 , including: a key pair generation module 301 , a public key exchange module 302 , and an identity authentication module 303.

The key pair generation module 301 is used to generate a local public key-private key pair;

The public key exchange module 302 is configured to exchange the public key with the other party based on the key K shared with the other party obtained through the symmetric encryption algorithm;

The identity authentication module 303 is used for receiving the user identification sent by the other party, the hash operation result of the data containing the IP address encrypted by the private key of the counterparty, and the data containing the IP address encrypted by the exchanged public key, and decrypted using the exchanged public key. The received hash operation result is used to decrypt the data containing the IP address by using the local private key; then the hash operation is performed based on the decrypted data containing the IP address, and the result obtained by the operation is compared with the decrypted hash operation result. The comparison result stores the correspondence between the user ID and the IP address of the other party after confirming the legal identity of the other party.

Specifically, the above client can be set in the above entity A to implement the relevant functions of the entity A:

The key pair generation module 301 can specifically send a public key exchange request to the counterparty (entity B), where the public key exchange request carries a local user identity (the user identity of entity A), a local public key ( Entity A's public key) CertA; and after receiving the public key distribution information returned by the counterparty (entity B), obtain the counterparty's user ID (entity B's user ID) and the counterparty's public key encrypted with key K. (public key of entity B) CertB, and then decrypt CertB by using the key K, and store CertB in correspondence with the user ID of the other party (the user ID of entity B).

The identity authentication module 303 may specifically send an authentication request to the counterparty, where the authentication request carries the local user ID (the user ID of the entity A), and the local IP address encrypted by the local private key (the private key of the entity A) SkeyA contains the local IP address. The hash operation result of the data of the address (the IP address of the entity A) and the data containing the local IP address (the IP address of the entity A) encrypted by CertB; and after receiving the authentication response information returned by the other party, obtain from it The hash operation of the user ID of the counterparty (the user ID of the entity B), the data containing the IP address of the counterparty (the IP address of the entity B) encrypted by the private key of the counterparty (the private key of the entity B) SkeyB The result and the data encrypted by CertA containing the IP address of the other party (the IP address of the entity B); and then using CertB to decrypt the data encrypted by the private key SkeyB and containing the IP address of the other party (the IP address of the entity B) After decrypting the data containing the IP address of the other party (the IP address of entity B) encrypted by CertA using the private key SkeyA, perform hash operation based on the decrypted data containing the IP address, and obtain The result is compared with the decrypted hash operation result, and the correspondence between the user ID and IP address of the other party (entity B) is stored after confirming the legal identity of the other party (entity B) according to the comparison result.

Further, the identity authentication module 303 can also be used to return authentication confirmation information to the counterparty (entity B) after confirming the legal identity of the counterparty (entity B). The hash operation result of the data of the IP address and the data containing the local IP address encrypted by CertB.

Further, the above-mentioned key pair generation module 301 can also be used to obtain the other party's user identity and the other party's public key encrypted by the shared key K after receiving the public key exchange request; and then use the shared key K to decrypt to obtain the other party After the public key of the other party is stored, the user ID of the other party and the public key of the other party are stored correspondingly; after that, the public key distribution information is returned to the other party.

Further, the identity authentication module 303 can also be used to decrypt the encrypted data in the received authentication request: decrypt the hash operation result of the data containing the IP address of the opponent encrypted by the opponent's private key using the opponent's public key, and use the local private key to decrypt the hash operation result of the data encrypted by the opponent's private key. The key decrypts the data containing the IP address of the other party encrypted by the other party using the exchanged public key; and then performs the identity authentication of the other party according to the decrypted information: based on the decrypted data containing the IP address, hash operation is performed, and the result obtained by the operation is The decrypted hash operation results are compared; according to the comparison results, after confirming the legal identity of the other party, the corresponding relationship between the user ID and the IP address of the other party is stored.

Further, the identity authentication module 303 can also be used to decrypt the encrypted data in the received authentication confirmation information, and confirm that both parties of the communication have completed identity authentication based on the decrypted data.

Further, the above client may further include: a shared key generation module 304 .

The shared key generation module 304 is configured to generate a key K shared with the counterparty based on a symmetric encryption algorithm.

For the specific implementation method of the functions of the modules in the above-mentioned client, reference may be made to the methods detailed in each step in the process shown in FIG. 1 or FIG. 2 , and details are not repeated here.

The apparatuses in the foregoing embodiments are used to implement the corresponding methods in the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

In the technical scheme of the present invention, both parties in communication generate a local public-private key pair; based on the key K shared with the other party obtained through a symmetric encryption algorithm, exchange the public key with the other party; receive the user ID sent by the other party, After the hash operation result of the data containing the IP address encrypted by the private key and the data containing the IP address encrypted by the exchanged public key, use the exchanged public key to decrypt the received hash operation result, and use the local private key to decrypt the data containing the IP address. IP address data; perform hash operation based on the decrypted data containing the IP address, compare the result obtained by the operation with the decrypted hash operation result, and store the other party's user ID and IP address according to the comparison result after confirming the legal identity of the other party address correspondence. Therefore, both parties of the communication can achieve the purpose of non-central instant identity authentication by sending 2 public key exchange data packets and 3 authentication data packets and processing the data packets accordingly; On the premise of security, real-time "one-time-one pad" can be realized with absolute security, and the cost of public key management by the certification center can be saved, the risk of identity forgery in the network data transmission process can be reduced, and the security of the information system can be protected.

The computer readable medium of this embodiment includes both permanent and non-permanent, removable and non-removable media and can be implemented by any method or technology for information storage. Information may be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Flash Memory or other memory technology, Compact Disc Read Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

Those of ordinary skill in the art should understand that the discussion of any of the above embodiments is only exemplary, and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples; under the spirit of the present invention, the above embodiments or There may also be combinations between technical features in different embodiments, steps may be carried out in any order, and there are many other variations of the different aspects of the invention as described above, which are not provided in detail for the sake of brevity.

Additionally, well known power/ground connections to integrated circuit (IC) chips and other components may or may not be shown in the figures provided in order to simplify illustration and discussion, and in order not to obscure the present invention. . Furthermore, devices may be shown in block diagram form in order to avoid obscuring the present invention, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the invention will be implemented (i.e. , these details should be fully within the understanding of those skilled in the art). Where specific details (eg, circuits) are set forth to describe exemplary embodiments of the invention, it will be apparent to those skilled in the art that these specific details may be used without or with changes The present invention is carried out below. Accordingly, these descriptions are to be regarded as illustrative rather than restrictive.

Although the present invention has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations to these embodiments will be apparent to those of ordinary skill in the art from the foregoing description. For example, other memory architectures (eg, dynamic RAM (DRAM)) may use the discussed embodiments.

Embodiments of the present invention are intended to cover all such alternatives, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omission, modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. A centerless instant network identity authentication method is characterized by comprising the following steps:

generating a local public-private key pair;

performing public key exchange with the other side based on a secret key K shared with the other side and obtained by a symmetric encryption algorithm;

after receiving a user identifier sent by an opposite party, a hash operation result of data containing an Internet Protocol (IP) address encrypted by a private key of the opposite party and data containing the IP address encrypted by an exchanged public key, decrypting the received hash operation result by using the exchanged public key and decrypting the data containing the IP address by using a local private key;

and performing hash operation on the decrypted data containing the IP address, comparing the operation result with the decrypted hash operation result, and storing the corresponding relation between the user identification of the opposite side and the IP address after the legal identity of the opposite side is confirmed according to the comparison result.

2. The method according to claim 1, wherein the exchanging a public key with the other party based on the secret key K shared with the other party obtained through the symmetric encryption algorithm specifically includes:

an entity A sends a public key exchange request to an opposite entity B, wherein the public key exchange request carries a user identifier of the entity A and a public key CertA encrypted by using a key K;

after receiving the public key distribution information returned by the entity B, the entity A acquires the user identification of the entity B and a public key CertB encrypted by using a secret key K;

and the entity A decrypts the certB by using the key K and correspondingly stores the certB and the user identification of the entity B.

3. The method according to claim 2, wherein after receiving the user identifier sent by the other party, the hash operation result of the data containing the IP address encrypted by the private key of the other party, and the data containing the IP address encrypted by the exchanged public key, decrypting the received hash operation result by using the exchanged public key, and decrypting the data containing the IP address by using the local private key, specifically comprises:

the entity A sends an authentication request to the entity B, wherein the authentication request carries a user identifier of the entity A, a hash operation result of data which is encrypted by a private key SkyA of the entity A and contains an IP address of the entity A, and data which is encrypted by certB and contains the IP address of the entity A;

after receiving the authentication request, the entity B decrypts a hash operation result of the data which is encrypted by the private key SkyA and contains the IP address of the entity A by using the certA, and decrypts the data which is encrypted by the certB and contains the IP address of the entity A by using the private key SkyB; then, returning authentication response information to the entity A;

after receiving the authentication response information returned by the entity B, the entity A acquires the user identification of the entity B, a hash operation result of data containing the IP address of the entity B and encrypted by a private key SkeyB of the entity B, and data containing the IP address of the entity B and encrypted by Certa;

the entity A decrypts the hash operation result of the data containing the IP address of the entity B encrypted by the private key SkeyB by using the certB, and decrypts the data containing the IP address of the entity B encrypted by the certA by using the private key SkeyA.

4. The method according to claim 3, wherein performing a hash operation based on the decrypted data including the IP address, and comparing a result of the hash operation with a result of the decrypted hash operation specifically comprises:

and the entity A performs hash operation on the decrypted data containing the IP address, and compares the operation result with the decrypted hash operation result.

5. The method according to claim 4, wherein after the entity a performs a hash operation based on the decrypted data containing the IP address, and compares a result of the hash operation with a result of the decrypted hash operation, the method further comprises:

if the comparison result is consistent, the entity A returns authentication confirmation information to the entity B, and the authentication confirmation information carries the user identification of the entity A, the hash operation result of the data which is encrypted by SkyA and contains the IP address of the entity A, and the data which is encrypted by CertB and contains the IP address of the entity A;

after receiving the authentication confirmation information, the entity B acquires the user identifier of the entity a, the hash operation result of the data containing the IP address of the entity a encrypted by SkeyA and the data containing the IP address of the entity a encrypted by CertB, decrypts the hash operation result of the data containing the IP address of the entity a encrypted by the private key SkeyA by using CertA, and decrypts the data containing the IP address of the entity a encrypted by CertB by using the private key SkeyB;

and the entity B performs hash operation on the decrypted data containing the IP address, compares the operation result with the decrypted hash operation result, and confirms that both communication parties complete identity authentication after the comparison result is consistent.

6. The method according to any of claims 1 to 5, wherein the symmetric encryption algorithm is in particular the advanced encryption standard, AES, algorithm.

7. A client, comprising:

the key pair generation module is used for generating a local public key-private key pair;

the public key exchange module is used for carrying out public key exchange with the other party on the basis of the secret key K shared with the other party and obtained by the symmetric encryption algorithm;

the identity authentication module is used for decrypting the received hash operation result by using the exchanged public key and decrypting the data containing the IP address by using a local private key after receiving the user identification sent by the opposite party, the hash operation result of the data containing the IP address encrypted by the private key of the opposite party and the data containing the IP address encrypted by the exchanged public key; and then carrying out hash operation based on the decrypted data containing the IP address, comparing the operation result with the decrypted hash operation result, and storing the corresponding relation between the user identification of the opposite side and the IP address after the legal identity of the opposite side is confirmed according to the comparison result.

8. The apparatus of claim 7,

the public key exchange module is specifically used for sending a public key exchange request to the other party, wherein the public key exchange request carries a local user identifier and a local public key CertA encrypted by using a secret key K; and after receiving the public key distribution information returned by the opposite party, acquiring the user identification of the opposite party and the public key CertB of the opposite party encrypted by using the key K, further decrypting the CertB by using the key K, and correspondingly storing the CertB and the user identification of the opposite party.

9. The apparatus of claim 8,

the identity authentication module is specifically used for sending an authentication request to the opposite side, wherein the authentication request carries a local user identifier, a hash operation result of data which is encrypted by a local private key SkyA and contains a local IP address, and data which is encrypted by a certB and contains the local IP address; after receiving authentication response information returned by the opposite party, acquiring a user identifier of the opposite party, a hash operation result of data containing the IP address of the opposite party and encrypted by a private key SkeyB of the opposite party and data containing the IP address of the opposite party and encrypted by Certa from the authentication response information; and then decrypting a hash operation result of the data containing the IP address of the opposite party encrypted by the private key SkyB by using the certB, decrypting the data containing the IP address of the opposite party encrypted by the certA by using the private key SkyA, performing a hash operation based on the decrypted data containing the IP address, comparing the operation result with the decrypted hash operation result, and storing the corresponding relation between the user identification of the opposite party and the IP address after the legal identity of the opposite party is confirmed according to the comparison result.

10. The apparatus of any of claims 7-9, further comprising:

and the shared key generation module is used for generating a key K shared with the other side based on a symmetric encryption algorithm.

Images