Key sharing method and device

Key sharing method and apparatus

TECHNICAL FIELD

[0001] The present invention relates to the field of network information security technology, particularly to a key sharing method and apparatus.

Background technique

[0002] As the world continues to improve the level of information, the importance of network and information security is becoming increasingly. Current network and information security industry has become the national security of States, political stability, economic development, social life, health, culture and other aspects critical to the survival and security of the industry supportive role. Network and information security may affect the individual's work and life, and even affect the country's economic development, social stability and national security. Therefore, network and information security industry has a pivotal position and role in the national strategy as well as the industrial layout pattern.

[0003] Modern cryptography network and information security is an important part. The design philosophy is to make the security system depends on the key, which means that the system has lost leakage security. In order to address key protection issues, the most appropriate method is to key in a place can receive a well-protected secure, for example, in a computer, a person's mind or a safe medium, although this method safe but unreliable because of a disaster (such as computer failure, the accidental death of personnel, is safe destruction), encrypted information will no longer be able to recover the plaintext. Improvements to this program one of the most obvious approach is to: copy the key number of copies, they are separately stored in different places. Although this solution increases the reliability, but the opportunity to make key exposure increase, decrease confidentiality, and it will increase the cost of protecting key.

SUMMARY

[0004] The present invention provides a method and apparatus for key sharing, and aims to provide a safe and feasible key distribution, management and systems and the methods used to address the reliability and safety of the two key issues.

[0005] The present invention in one aspect there is provided a method of sharing a key, the key sharing method comprising:

[0006] The system according to preset parameters, the use of (t, n) threshold algorithm key k η decomposed into a mutually different subkeys;

[0007] for each of the sub-key add a timestamp and parity bits generated η subkey interactive information package;

[0008] using a second public key and private key pair for each of the first sub-key interactive information package is signed, signatures generated η packets, and the signature of each packet distributed to the corresponding sub-key in the client ;

[0009] The use of a first and a second private key of a public key to verify the signature information packets and parity bits based on the time stamp and verify the signature packet, for each of the sub-key and stored in corresponding sub-key in the client;

[0010] t get at least one of the sub-key is stored in the client sub-key, use (t, n) threshold algorithm for the least t subkey back into the key k;

[0011] wherein said first public key and the first private key pair match each other, the second private key and the second public key match each key pair.

[0012] In one embodiment, the system according to the preset parameters, the use of (t, n) threshold algorithm key k η decomposed into a mutually different subkeys, comprising:

[0013] The system according to preset parameters and (t, n) threshold algorithm, using the random key k construct a polynomial a (x);

<img id="idf0007" file="CN106027245AD00051.tif" img-content="drawing" img-format="tif" />

[0015] The use of a random polynomial curve to determine and select n points (Xl, yi) from the curve to obtain the key k η subkeys yi, where h is different from each other;

[0016] where, k is the key; Yi for the i-th key, a randomly selected element of San, San prime number greater than 1 and t k.

[0017] In one embodiment, the use of (t, N) t least the threshold algorithm to recover the key subkeys k, comprising:

[0018] According to (t, n) threshold algorithm, the sub-key in accordance with the following formula to obtain the key k:

<img id="idf0008" file="CN106027245AD00052.tif" img-content="drawing" img-format="tif" />

[0020] wherein, bj intermediate variables:

<img id="idf0009" file="CN106027245AD00053.tif" img-content="drawing" img-format="tif" />

, 111 is a positive integer, satisfying 1 San j &lt;m to San

[0021] In one embodiment, the timestamp in parity check and the signature packet, comprising:

Whether [0022] comparing the signature with time stamp packet system time to determine the signature packet has expired;

[0023] If the packet is not invalid signature, the signature is determined based on the signature parity packet information package is complete.

[0024] In one embodiment, the first public key and private key first, second and second private keys have been public CA certification system certification.

[0025] Another aspect of the present invention, there is provided a key sharing apparatus, a key sharing apparatus comprising:

[0026] The subkey generation unit for generating system according to preset parameters, the use of (t, n) threshold algorithm key k η decomposed into a mutually different subkeys;

[0027] interactive packet generating unit for each of the sub-key add a timestamp and parity bits generated η subkey interactive information package;

[0028] signature packet distribution unit for public use of the second and the first private key pair for each of the key sub-signature packets interactive information generated η signatures pack and distribute the signature of each packet to the corresponding sub-key in the client; [0029] calibration unit for the private use of the second and the first public key to verify the signature packet, and according to the time stamp and said parity check signature packet, for each of the sub-key and stored in the corresponding sub-key in the client;

[0030] key recovery unit for acquiring at least one of the t sub-keys stored in the client sub-key, use (t, n) threshold algorithm for the least t subkey back into the key k ;

[0031] wherein said first public key and the first private key pair match each other, the second private key and the second public key match each key pair.

[0032] In one embodiment, the subkey generating unit comprising:

[0033] random polynomials module for system default parameters and (t, n) threshold algorithm, using the random key k construct a polynomial a (x);

<img id="idf0010" file="CN106027245AD00054.tif" img-content="drawing" img-format="tif" />

[0035] The sub-key generation module for determining a polynomial using said random curve, and select η points (Xl, yi) from the curve to obtain the key k η subkeys 71, wherein Xl different from each other;

[0036] where, k is the key; Yi for the i-th key, a randomly selected element of San, San prime number greater than 1 and t k.

[0037] In one embodiment, the key recovery unit comprises:

[0038] sub-key acquisition module for acquiring at least one of the t sub-keys stored in the client sub-key;

[0039] key recovery module for (t, n) threshold algorithm, the sub-key in accordance with the following formula to obtain the key k:

<img id="idf0011" file="CN106027245AD00061.tif" img-content="drawing" img-format="tif" />

[0041] wherein, bj intermediate variable

<img id="idf0012" file="CN106027245AD00062.tif" img-content="drawing" img-format="tif" />

, 111 is a positive integer, satisfying 1 San j &lt;m to San

[0042] In one embodiment, the check unit comprises:

[0043] signature information verification module for using the second private key and the first public key to verify the signature information packets;

If the [0044] time stamp verification module for comparing the signature with the time stamp packet system time, determines the signature packet has expired;

[0045] checksum verification module for, when the signature packet does not fail, according to the judgment of the parity packet signature of the signature information package is complete.

[0046] In one embodiment, the first public key and private key first, second and second private keys have been public CA certification system certification.

[0047] the beneficial effects of the present invention is used in the invention (t, n) threshold algorithm is based on integer factorization and discrete realization sub key generation and key recovery, in terms of security, administrators can resist the deceit and members of spoofing attack, while avoiding an attacker using known information reconstruction unknown key. Further, since the present invention in the sub-key distribution process of adding a time stamp check code and certificate signature, it is possible to ensure the correctness of the sub-key distribution and security. The distribution and preservation process involves only the key sub-key, and when less than t sub key is compromised or stolen key itself does not affect safety.

BRIEF DESCRIPTION

[0048] In order to more clearly illustrate the embodiments or the prior art technical solutions embodiment of the present invention, it will implement the following figures for the cases described in the prior art or the need to use a simple introduction. Apparently, the following description the drawings are only some embodiments of the present invention, those of ordinary skill in speaking, without creative efforts of the premise, but also can derive other drawings from these drawings.

[0049] FIG. 1 embodiment of the present invention key sharing process flow diagram of embodiment;

[0050] FIG. 2 is a schematic diagram illustrating the structure of a key sharing device implementation.

detailed description

[0051] the following with the present invention that reference implementation, carried a clear example of the technical solutions of the present invention, a complete description, it is clear that the described embodiments are merely part of the embodiments of the present invention, but not all embodiments example. Based on the embodiments of the present invention, all other embodiments of the ordinary skill in the creative work did not make the premise obtained, are within the scope of the present invention is protected.

[0052] FIG. 1 embodiment of the present invention key sharing process flow diagram implemented. As shown in Figure 1, the key sharing method includes the steps of:

[0053] Step S1, the system according to preset parameters, the use of (t, n) threshold algorithm key k η decomposed into a mutually different subkeys.

[0054] Step S2, the above η sub-key lu, k2 ,..., 1 ^, respectively, timestamp and parity bits generated η subkey interactive information package.

[0055] Step S3, using a second public key and private key pair for each of the first sub-key interactive information package is signed, signatures generated η packets, and each signature packets distributed to the corresponding sub-key client.

[0056] Step S4, the signature packet using a second private key and the first public step S3 generated verified, and according to the time stamp and the signature parity check packets for each sub-key and storage key client in the corresponding sub.

[0057] said first private key and the first public key pair to match each other, the second private key and a second public key match each key pair.

[0058] Step S5, get at least t sub-keys stored in the client sub-key, use (t, n) threshold algorithm for the least t of the key sub-key recovery into k.

(T, n) threshold algorithm [0059] embodiment of the present invention is used is based on integer factorization and discrete realization sub key generation and key recovery, in terms of security, administrators can withstand deception and members of spoofing attacks, while prevent attackers from using known information reconstruction unknown key. Further, since the present invention in the sub-key distribution process of adding a time stamp check code and certificate signature, it is possible to ensure the correctness of the sub-key distribution and security. The distribution and preservation process involves only the key sub-key, and when less than t sub key is compromised or stolen key itself does not affect safety.

[0060] In one embodiment, the above-described step S1 when the key generator, (t, n) threshold secret sharing algorithm based on the principle of taking Lagrange polynomial, first construct a k-times of up to t random polynomial a (x):

<img id="idf0013" file="CN106027245AD00071.tif" img-content="drawing" img-format="tif" />

[0062] where, a (x) of the constant term k is the key, aKKKt-l) be a randomly selected element, e.g., with stealth selecting random parameter, P is a prime number greater than k and t, and k, a " , p and other parameters as the default parameters, which are not disclosed.

[0063] After generating the sub-key, you need this key distributed η η sub sub-key in the client storage. After subkey before distributed to each sub-key client, separately for each sub-key add a timestamp and the parity generating η subkey interactive information package, to be the first use of a second public key and private key information for each sub-key interactive sign the package, η signatures generated packets distributed to the respective sub-key client.

[0064] As a sub-key in the client device memory sub-key, after receiving the packet including the signature of the sub-key using the second public key and the first private key of the received packet to verify the signature. Wherein said first private key and a public key and a second private first, and the second is through CA public key certification system certification. The second public key and a private key can use the second sub-key private and public clients, that is, when the sub-key interactive information package is signed with the private key can be used for each of the first sub-key client public interactive information for each sub-key to sign the package. At the time of signature verification information packet, you can use the private key to each of the first sub-key in the client's public key signature of each packet received verified.

[0065] Next, based on the comparison of the time stamp signature information within the package with the system time to determine whether the timestamp expires, if the system time exceeds the timestamp, the signature packet failure, on the contrary, the signature packet does not fail, that use check the timestamp of the way to prevent simple replay attacks. If the signature is not invalid packets, according to the parity bit signature information within the package to determine whether it intact, avoid the loss of data causes an exception.

[0066] By the above-described random polynomial (1) to determine a curve η selected points (Xi, yi) from the curve, l &lt;i &lt;n, to give the key k η subkeys 71, wherein mutually ^ the same, but can be made public.

[0067] The above η subkeys: yi, y2 ,., yn meet the following requirements:

[0068] 1) any t yi known values, can effectively calculates a key K;

[0069] 2) any known t-1 or fewer yi value, due to shortage of information but can not calculate the key k.

[0070] The sub-key key points η to η users (ie sub-key client), due to the need to reconstruct the key k t sub-keys, so the number of sub-keys if exposure does not exceed the t -Ι one, would not jeopardize the security key k, because less than t subkey is impossible to calculate the key, thus ensuring the confidentiality of the key k. Also, if a child is lost or damaged key to restore the key k can be reached on the remaining n-1 sub-key, as long as the number of small pieces missing no more than nt a key k is still reliable.

[0071] In step S5, a recovery key k, t need to get at least a sub-key in the client stored in the sub-key embodiment of the invention to take advantage of t sub-key recovery key k as an example of the key recovery process will be described, the present invention is not limited.

[0072] t the time when the use of a key reconstruction sub-key k, that is known t t points subkeys corresponding coordinates (Xi, yi), l &lt;i San t, due yi = aUi), can be obtained t a t on unknowns k, ai, a2, ......, at-linear equations:

<img id="idf0014" file="CN106027245AD00081.tif" img-content="drawing" img-format="tif" />

[0074] The above-mentioned linear equations written in matrix form:

<img id="idf0015" file="CN106027245AD00082.tif" img-content="drawing" img-format="tif" />

[0076] Let the coefficient matrix, A, A is clearly a Vandermonde matrix (Vandermonde matrix), the ranks of the coefficient matrix can be represented by the following formula:

<img id="idf0016" file="CN106027245AD00083.tif" img-content="drawing" img-format="tif" />

[0078] 11 because, Magic, ' "knowledge different from each other, so (to 1) oct 0, so linear equations (3) has a unique solution, the only solution may be to determine k, that is able to reconstruct the key k.

Coordinates (Xj, yj) [0079] When the use of the key sub-Shi t-1 re-keying k, again, this t-1 sub-key corresponding to the given points t-1, j 1 Pie Pie t, but t-1 to obtain only one unknown in t k, ai, a2, ......, at-ι linear equation, since t-1 linear equations can not be determined on unknown t k, m, a2, ......, ^ &amp; unique solution, thus using only t-Ι subkeys can not be rebuilt key k.

[0080] For the equations (2), we can use Lagrange interpolation formula to reconstruct the polynomial a (x), in order to obtain the key k, instead of solving linear equations:

<img id="idf0017" file="CN106027245AD00091.tif" img-content="drawing" img-format="tif" />

[0088] That is, after acquiring subkeys t according to equation (8) is used to reconstruct the key k, where, BJ intermediate variable, m is a positive integer, and satisfies K j &lt;m &lt;t.

[0089] Based on key sharing method shown in FIG. 1 the same inventive concept, an embodiment of the present application also provides a key sharing device, as described in the examples below. Since the principle of the means to solve the problem and the key sharing method similar to Figure 1, and therefore the implementation of the device can be found in the implementation of key sharing method in FIG. 1, duplications not repeat them.

[0090] In another embodiment, the present invention also provides a method for key sharing, the structure shown in Figure 2, the apparatus comprising: a subkey generation unit 1, the interactive information packet generation unit 2, the signature information package distribution unit 3, 4 and check unit key recovery unit 5.

[0091] sub-key generation unit 1, according to pre-set system parameters, and the use of (t, n) threshold algorithm key k η is decomposed into a mutually different sub-key.

[0092] interactive information packet generation unit 2, for each sub-key add a timestamp and parity bits generated η subkey interactive information package.

[0093] signature packet distributing unit 3 for using a second public key and private key pair for each of the first sub-key interactive information package is signed, signatures generated η packets, and each signature packets distributed to the appropriate sub-key client.

[0094] calibration unit 4 for the private use of the second and the first public key to verify the signature packet, and according to the time stamp and signature parity check packets for each sub-key and storage in the corresponding sub-key client.

[0095] key recovery unit 5 for obtaining at least t sub-keys stored in the client sub-key, and use the (t, n) threshold algorithm for the least t subkey back into the key k.

[0096] wherein said first public key and the first private key pair match each other, the second private key and a second public key match each key pair.

[0097] In one embodiment, a subkey generating unit 11 includes a random polynomials module 12 and the sub-key generation module. Random polynomials module 11 is used according to the system default parameters and (t, n) threshold algorithm, using the key k construct a random polynomial a (x), see equation (1). Subkey generating module 12 for using a random polynomial (1) determining a curve and select η points (Xl, Yi) from the curve to obtain key k η subkeys 71, wherein Xl different from each other.

[0098] calibration unit 4 includes: signature information verification module 41, a time stamp check code check module 42 and authentication module 43. Wherein the signature information verification module 41 for using a second private key and the first public key to verify the signature packet; check module 42 for comparing the time stamp signature packet timestamp and the system time, it is determined whether the packet signature has failed; check code authentication module 43 is used when the packet is not invalid signature, according to the parity judgment data packet signature signature information packet is complete.

[0099] key recovery unit 5 includes a sub-key acquisition module 51 and module 52 key recovery. Sub-key acquisition module for acquiring at least 51 t sub-keys stored in the client sub-key. Key recovery module 52 is used in accordance with (t, n) threshold algorithm, the child will get the key in accordance with the formula (6), (7) and (8) calculated key k.

[0100] Generally, said first public key and private key first, second and second public private certification system were approved by the CA certification. The second public key and a private key can use the second sub-key private and public clients, that is, when the sub-key interactive information package is signed with the private key can be used for each of the first sub-key client public interactive information for each sub-key to sign the package. At the time of signature verification information packet, you can use the private key to each of the first sub-key in the client's public key signature of each packet received verified. The first public key and a private key can be selected first sub-key generation unit private key and a public key, that key pair to sign the package exchanging information, you can use the child's private key generation unit and each sub-secret key client public key information for each sub-key interactive sign the package. At the time of signature verification information packet, the child can use the private key to generate the respective sub-unit of the key client public key signature for each sub-packet received by the client to authenticate.

(T, n) threshold algorithm [0101] embodiment of the present invention is used is based on integer factorization and discrete realization sub key generation and key recovery, in terms of security, administrators can withstand deception and members of spoofing attacks, while prevent attackers from using known information reconstruction unknown key. Further, since the present invention in the sub-key distribution process of adding a time stamp check code and certificate signature, it is possible to ensure the correctness of the sub-key distribution and security. The distribution and preservation process involves only the key sub-key, and when less than t sub key is compromised or stolen key itself does not affect safety.

[0102] Those skilled in the art should be appreciated, embodiments of the present invention to provide a method, system, or computer program product. Accordingly, the present invention may be entirely hardware embodiment, an entirely software embodiment, or a combination of forms of embodiment of software and hardware aspects. Moreover, the present invention may be implemented in the form of one or more of which contain computer usable program code, computer usable storage media (including but not limited to, disk storage, CD-ROM, optical storage, etc.) on a computer program product.

[0103] The present invention is a reference to the method according to embodiments of the present invention, apparatus (systems) and computer program product flowchart and / or block diagram to describe. It should be understood by the computer program instructions, and a combination of the flowchart and / or block diagram each process and / or blocks in the flowchart and / or block diagram of the process and / or box. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor or other programmable data processing apparatus to produce a machine, such that the instructions executed by a computer or other programmable data processing apparatus generating in the apparatus for implementing a process flow chart or a plurality of processes and / or block diagram block or blocks a specified function.

[0104] These computer program instructions may also be stored in a computer can direct a computer or other programmable data processing apparatus to function in a particular manner readable memory, such that stored in the memory of the computer readable instructions comprising instruction means generating article of manufacture the instruction means implemented in a process flow chart or a plurality of processes and / or block diagram block or blocks a specified function.

[0105] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus, so that the implementation of a series of steps on the computer or other programmable apparatus to produce a computer implemented process, resulting in a computer or other programmable apparatus provide instruction on the implementation of a process flow diagram for implementing or more processes and / or block diagram block or blocks a specified function steps.

[0106] The present invention is applied to a specific embodiment of the principles and embodiments of the present invention have been set forth, the above embodiment is described only method used to help understand the present invention and its core ideology; at the same time, for those of ordinary skill in , according to the idea of ​​the present invention, in the specific embodiments and applications are subject to change place, summary, contents of this document should not be construed as limiting the present invention.