CN100589375C - Mapping method for identification and key - Google Patents

Abstract

The invention relates to a projection method between mark and key, wherein said method can be used in the combined key manage system based on mark; said system has generated key factor matrix; said method comprises: based on the length value of constant binary mark or the constant binary mark transformed from variable binary mark, checking the size of key factor matrix; based on the constant binary mark, calculating out the row mark group and queen mark group of key factor in the key factor matrix to position the key factor; using said key factor to calculate the key relative to the constant binary mark. The invention simplifies the projection method from mark to key, to be used on IPv4 and IPv6, to realize non-conflict projection.

Description

The mapping method of a kind of sign and key

Technical field

The present invention relates to the combined key managing technical field, relate in particular to the combined key managing technical field based on sign, specifically is the mapping method of a kind of sign and key.

Background technology

The safety of contemporary cryptology be based upon that key is maintained secrecy rather than the basis of algorithm secrecy on, so the administrative protection of key has become the key of information privacy.Binding between key and the key owner sign is one of most important content of modern network security study.At present key and key owner being identified binding has dual mode, and a kind of is the sign that generates the key owner by key, and CGA (Cryptographically Generated Address) is typical case's representative of this mode; Another kind of mode is to determine the corresponding key of this sign by sign, promptly based on the cryptographic system that identifies.1984, Shamir proposed the signature imagination based on sign, and calendar year 2001 Don Boneh and Matthew Franklin have proposed the key management system based on sign that realizes with the Weil matching method according to the imagination of Shamir.Conbined public or double key (CPK) cryptographic system also is a kind of key management system based on sign, and it can directly calculate the other side's PKI according to the sign of communication counterpart, and the mapping that realizes being identified to key in the CPK system is a key issue.In general public key system, each user's PKI is directly to announce, how many users are arranged, just announce what PKIs, and in the Conbined public or double key technology, each user's PKI is directly announcement, and only announces the shared key factor matrix, and each user's PKI then calculates by shared key factor matrix and correlated identities.

In combined key managing system based on sign, document ([1] Nan Xianghao, Chen Zhong; The network security technology outline; Beijing, National Defense Industry Press, 2003.7; [2] Tang Wen, Nan XiangHao, Chen Zhong; Conbined public or double key technology based on the elliptic curve key system; Computer engineering and application, 2003 21 phases) mapping algorithm by being identified to key that provides is as described below:

At first be to calculate rower:

Given capable key RowKey, it is disclosed constant in the system.At first, the sign ID of indefinite length is transformed into the variables D ata1 of a regular length by a kind of HASH function (such as MD5, SHA-1 etc.).

That is HASH (ID)=Data1;

Then, by cryptographic algorithm (as AES) with intermediate variable Data1 as data, obtain MAP after encrypting with row key RowKey ₀With MAP ₀As data, encrypt with key RowKey again and draw MAP ₁Similarly till drawing required MAP value.For convenience of explanation, the size of establishing the cryptographic key factor matrix is 32 * 32.Then

AES _RowKey(Data1)＝MAP ₀；

AES _RowKey(MAP0)＝MAP ₁；

Then, MAP ₀16 bytes use M (M=32 in this example) mould respectively, draw 16 rowers, with MAP[0 less than M]～MAP[15] expression, MAP ₁16 bytes draw 16 rowers behind the mould M respectively less than M, with MAP[16]～MAP[31] expression;

MAP ₀[i]mod?M＝MAP[i](i＝0，1...，15)；

MAP ₁[i]mod?M＝MAP[i](i＝16，17...，31)；

So far draw 32 rowers, be used for 32 selections of row.

After rower calculates, carry out the row target and calculate:

Take in proper order for fear of the row target, the replacement algorithm PMT of row variable be set, consequently (0,1,2 ..., 31) full arrangement a kind of, computational methods are as follows.

At first calculate the used key PMT_KEY of PMT algorithm;

AES _ColKey(ID)=and PMT_KEY, ColKey is disclosed constant in the system.

Use PMT _{PMT_KEY}(former preface)=PERMUT; Former preface is 0,1 ... 31 natural preface.PERMUT is new displacement.

Above-mentioned method is a kind of general mapping method of making at various types of signs, and this method amount of calculation is big, calculation of complex, and may have the mapping collision problem.In the existing scheme, do not provide a specific mapping algorithm, and in the scene of reality, the sign of this class has a very wide range of applications at resembling the sign that IPv4, this class of IPv6 address have certain particularity.

Summary of the invention

In view of the problems referred to above of the prior art, the invention provides the mapping method of a kind of sign and key, simplified the mapping that is identified to key and calculated, mapping method is succinctly efficient, and can realize being identified to the no conflict mapping of key for the sign with particularity.

The mapping method that the invention provides a kind of sign and key is applied to based in the combined key managing system that identifies, in described system, generated the cryptographic key factor matrix, described method comprises step: step 1, according to binary mark or by the size of the length value check cryptographic key factor matrix of the binary mark of non-binary mark conversion, the size of described cryptographic key factor matrix is expressed as M * 2 ⁿWherein, comprising: the length value of binary mark is carried out the factor decompose and carry out according to formula, the expression formula of this formula is: S=M * r+k; Wherein, S: the length value of binary mark; M: the line number of cryptographic key factor matrix; 2 ⁿ: cryptographic key factor matrix column number; K 〉=0 and k＜M; S, M, k, r, n are integer; The result who decomposes according to the factor judges whether the size of cryptographic key factor matrix is suitable; If judged result is suitable, then execution in step 2; Step 2 calculates cryptographic key factor corresponding rower group and row mark group in the cryptographic key factor matrix according to described binary mark; Wherein, comprising: calculate with described binary mark and be listed as the mark group accordingly; All rowers to the cryptographic key factor matrix are replaced, and obtain and the corresponding rower group of described binary mark; Step 3 utilizes the cryptographic key factor of described rower group and row mark group correspondence to calculate the key corresponding with described binary mark.Described step 1 also comprises: as if judged result is improper, then the regenerating key factor matrix.

Whether the size of judging the cryptographic key factor matrix suitable being meant: judge that whether r is greater than n; As if judged result is r≤n＜S, then the size to fit of this cryptographic key factor matrix; If judged result is r＞n, then described cryptographic key factor matrix big or small improper; Wherein, S: the length value of binary mark; N, r are integer.

Described calculating and binary mark are listed as the mark group accordingly, comprising: judge whether k＜n-r sets up;

If judged result is for being, then according to formula calculated column mark group C _i(ID), the expression formula of this formula is: C _i(ID)=[ID＞＞(the] ﹠amp of i * r); (2 ⁿ-1), i=0 ... M-1; Wherein,＞＞the expression cycle shift operation, ID is described binary mark;

If judged result is for not, then according to formula calculated column mark group C _i(ID), this formula expression is:

C _i(ID)=[ID＞＞(the] ﹠amp of i * r); (2 ⁿ-1), i=0...M-[k-(n-r)]-1 and

C _i(ID)＝{ID＞＞[i×(r+1)]}&(2 ⁿ-1)，i＝M-[k-(n-r)]…M-1；

Wherein,＞＞the expression cycle shift operation, ID is described binary mark; M, k, n, r, i are integer.

Described calculating and binary mark are listed as the mark group accordingly, comprising: according to formula calculated column mark group C _i(ID), this formula expression is: C _i(ID)=ID＞＞[i * (r+1)] } ﹠amp; (2 ⁿ-1), i=0...M-1; Wherein,＞＞the expression cycle shift operation; ID is a binary mark; N, r, i are integer.

Described calculating and binary mark are listed as the mark group accordingly, comprising: according to formula calculated column mark group C _i(ID), this formula expression is: C _i(ID)=[ID＞＞(i * r ')] ﹠amp; (2 ⁿ-1), i=0...M-1;

Wherein,＞＞the expression cycle shift operation, S＞r '＞r, r ' they are not the factors of S, ID is a binary mark; S is the length value of binary mark; R, r ', n, i are integer.

Described all rowers to the cryptographic key factor matrix are replaced, and comprising: directly choose data sequence as the rower group, this data sequence is: 0,1 ..., M-1, wherein, M is the line number of cryptographic key factor matrix.

Described all rowers to the cryptographic key factor matrix are replaced, and comprising: with the data sequence order deposit, backward is deposited or leave array R[i in at random order] in, this data sequence is: 0,1 ..., M-1; I=0 wherein, 1 ..., M-1; M is the line number of cryptographic key factor matrix.

Described all rowers to the cryptographic key factor matrix are replaced, and also comprise step:

Step 11 is provided with i=0;

Step 12 judges whether ID mod (M-i)＜M-i-1 sets up;

Step 13 is if the judged result of step 12 is for being, then with R[ID mod (M-i)] and R[M-i-1] switch; If the judged result of step 12 is that then execution in step 14;

Step 14 is provided with i=i+1, judges whether i equals M-2;

Step 15 is if the judged result of step 14 is that then repeating step 12 is not to step 15; If the judged result of step 14 is for being then replacement completion, and the array R[i after above-mentioned steps is handled] what deposit is (0 ... M-1) a displacement.

Described all rowers to the cryptographic key factor matrix are replaced, and also comprise step:

Step 21 is provided with i=0;

Step 22 judges whether ID mod (M-i) ≠ 0 sets up;

Step 23 is if the judged result of step 22 is for being, then with R[(ID mod (M-i))+i] and R[i] switch; If the judged result of step 22 is that then execution in step 24;

Step 24 is provided with i=i+1, judges whether i equals M-2;

Step 25 is if the judged result of step 24 is that then repeating step 22 is not to step 25; If the judged result of step 24 is for being then replacement completion, and the array R[i after above-mentioned steps is handled] what deposit is a displacement of (0...M-1).

The present invention also provides the mapping method of a kind of sign and key, be applied in the combined key managing system based on sign, in described system, generated the cryptographic key factor matrix, described method comprises step: step 1, according to binary mark or by the size of the length value check cryptographic key factor matrix of the binary mark of non-binary mark conversion, the size of described cryptographic key factor matrix is expressed as 2 ^m* N; Wherein, comprising: the length value of binary mark is carried out the factor decompose and carry out according to formula, the expression formula of this formula is: S=N * r+k; Wherein, S: the length value of binary mark; 2 ^m: the line number of cryptographic key factor matrix; N: cryptographic key factor matrix column number; K 〉=0 and k＜N; S, N, k, r, m are integer; The result who decomposes according to the factor judges whether the size of cryptographic key factor matrix is suitable; If judged result is suitable, then execution in step 2; Step 2 calculates cryptographic key factor corresponding rower group and row mark group in the cryptographic key factor matrix according to described binary mark; Wherein, comprising: calculate and the corresponding rower group of described binary mark; All row marks to the cryptographic key factor matrix are replaced, and obtain being listed as the mark group accordingly with described binary mark; Step 3 utilizes the cryptographic key factor of described rower group and row mark group correspondence to calculate the key corresponding with described binary mark.

Described step 1 also comprises: as if judged result is improper, then the regenerating key factor matrix.

Whether the size of judging the cryptographic key factor matrix suitable being meant: judge that whether r is greater than m; As if judged result is r≤m＜S, then the size to fit of this cryptographic key factor matrix; If judged result is r＞m, then described cryptographic key factor matrix big or small improper; Wherein, S: the length value of binary mark; M, r are integer.

The corresponding rower group of described calculating and binary mark comprises: judge whether k＜m-r sets up;

If judged result is for being, then according to formula calculating rower group C _i(ID), the expression formula of this formula is: C _i(ID)=[ID＞＞(the] ﹠amp of i * r); (2 ^m-1), i=0 ... N-1;

If judged result is then calculated rower group C according to formula for not _i(ID), this formula expression is:

C _i(ID)=[ID＞＞(the] ﹠amp of i * r); (2 ^m-1), i=0 ... N-[k-(m-r)]-1 and

C _i(ID)＝{ID＞＞[i×(r+1)]}&(2 ^m-1)，i＝N-[k-(m-r)]…N-1；

Wherein,＞＞the expression cycle shift operation, ID is described binary mark; N, k, r, m, i are integer.

The corresponding rower group of described calculating and binary mark comprises: calculate rower group C according to formula _i(ID), this formula expression is: C _i(ID)=ID＞＞[i * (r+1)] } ﹠amp; (2 ^m-1), i=0...N-1; Wherein,＞＞the expression cycle shift operation, ID is described binary mark; N, r, m, i are integer.

The corresponding rower group of described calculating and binary mark comprises: calculate rower group C according to formula _i(ID), this formula expression is: C _i(ID)=[ID＞＞(i * r ')] ﹠amp; (2 ^m-1), i=0...N-1; Wherein,＞＞the expression cycle shift operation, S＞r '＞r, r ' they are not the factors of S, ID is described binary mark; R ', r, m, i are integer.

Described all row marks to the cryptographic key factor matrix are replaced, and comprising: directly choose data sequence as row mark group, this data sequence is: 0,1 ..., N-1, wherein, N is a cryptographic key factor matrix column number.

Described all row marks to the cryptographic key factor matrix are replaced, and comprising: with the data sequence order deposit, backward is deposited or leave array R[i in at random order] in, this data sequence is: 0,1 ..., N-1; I=0 wherein, 1 ..., N-1; N is a cryptographic key factor matrix column number.

Described all row marks to the cryptographic key factor matrix are replaced, and also comprise step:

Step 31 is provided with i=0;

Step 32 judges whether ID mod (N-i)＜N-i-1 sets up;

Step 33 is if the judged result of step 32 is for being, then with R[ID mod (N-i)] and R[N-i-1] switch; If the judged result of step 32 is that then execution in step 34;

Step 34 is provided with i=i+1, judges whether i equals N-2;

Step 35 is if the judged result of step 34 is that then repeating step 32 is not to step 35; If the judged result of step 34 is for being then replacement completion, and the array R[i after above-mentioned steps is handled] what deposit is (0 ... M-1) a displacement.

Described all row marks to the cryptographic key factor matrix are replaced, and also comprise step:

Step 41 is provided with i=0;

Step 42 judges whether ID mod (N-i) ≠ 0 sets up;

Step 43 is if the judged result of step 42 is for being, then with R[(ID mod (N-i))+i] and R[i] switch; If the judged result of step 42 is that then execution in step 44;

Step 44 is provided with i=i+1, judges whether i equals N-2;

Step 45 is if the judged result of step 44 is that then repeating step 42 is not to step 45; If the judged result of step 44 is for being then replacement completion, and the array R[i after above-mentioned steps is handled] what deposit is (0 ... M-1) a displacement.

Described step 3 comprises: choose from the cryptographic key factor matrix and described rower group and the corresponding cryptographic key factor of row mark group; Utilize described cryptographic key factor to calculate the key corresponding with described binary mark.

In the discrete logarithm cryptographic system, utilize cryptographic key factor according to the formula computation key; Wherein, according to formula Calculate private key SK _IDAccording to formula

Calculate PKI PK _IDWherein, p and g are the parameter of discrete logarithm cryptographic system, and p is a prime number, and g is a finite field Fp generator, and g is less than p, R _iBe rower, C _iBe row mark, S[R _i, C _i] be the private key factor corresponding with sign.

In elliptic curve cipher system, utilize cryptographic key factor according to the formula computation key; Wherein, according to formula

Calculate private key SK _IDAccording to formula S K _ID=SK _ID* G calculates PKI PK _IDWherein, n and G are the parameter of elliptic curve cipher system, and G is the basic point on the elliptic curve E (Fp), and n is a prime number, and n is the rank of basic point G, R _iBe rower, C _iBe row mark, S[R _i, C _i] be the private key factor corresponding with sign.

Adopt hash function or Message Authentication Code function that described non-binary mark is converted to binary mark.

Beneficial effect of the present invention is, has simplified the mapping that is identified to key and has calculated, and mapping algorithm is succinctly efficient, and can realize being identified to the no conflict mapping of key for the sign with particularity.

Description of drawings

Figure 1A and Figure 1B are respectively the schematic diagram of shared key factor matrix of the present invention and private key factor matrix;

Fig. 2 is the method flow diagram of one embodiment of the invention;

Fig. 3 is the method flow diagram of one embodiment of the invention;

Fig. 4 is the method flow diagram of one embodiment of the invention;

Fig. 5 is the method flow diagram of another embodiment of the present invention.

Embodiment

Describe the present invention in detail below in conjunction with accompanying drawing.

The invention provides the mapping method of a kind of sign and key, be applied in the combined key managing system based on sign, generated the cryptographic key factor matrix in described system, described method comprises: according to binary mark or by the size of the length value check cryptographic key factor matrix of the binary mark of non-binary mark conversion; Calculate cryptographic key factor corresponding rower group and row mark group in the cryptographic key factor matrix according to described binary mark, with the location cryptographic key factor; Utilize the cryptographic key factor of described rower group and row mark group correspondence to calculate the key corresponding with described binary mark.

Wherein, described sign can be the sign that has certain particularity as IPv4, this class of IPv6 address, and for picture IPv4, this class sign of IPv6 address, its particularity is that sign itself is the binary identification of S bit (bit); For original sign is a sign of being made up of complex elements such as letter, numerals, shine upon calculating more accordingly after can handling the binary identification that generates a fixed length by Hash (HASH) or cryptographic algorithm earlier, wherein, the method that elongated sign is transformed to the fixed length value can adopt Message Authentication Code (MAC:Message Authentication Code) function or common HASH algorithm.

In a word, for any one sign, all can be by the mapping method realization key of sign provided by the invention and key and the binding between the key owner sign.

In an embodiment of the present invention, the cryptographic key factor matrix comprises shared key factor matrix and private key factor matrix, and key comprises PKI and private key, and cryptographic key factor comprises shared key factor and private key factor.And, when implementing mapping method of the present invention, generated size in the system and be the cryptographic key factor matrix of M * N, wherein N=2 ⁿ, M=2 ^mThe basis public, that the private key factor matrix is based on the combined key managing system of sign.Private key is to choose a private key factor according to certain mapping ruler at every row (or row) to calculate by corresponding computing in the private key factor matrix; Accordingly, PKI is to choose a shared key factor according to certain mapping ruler at every row (or row) to calculate by corresponding computing in the shared key factor matrix.If the private key factor matrix is SKM=[S _Ij], i=0...M-1 wherein, j=0...N-1; If private key is that every row is chosen a private key factor and calculated from the private key factor matrix, then N is done qualification, require N=2 ⁿ, n is a positive integer; If private key is that every row are chosen a private key factor and calculated from the private key factor matrix, then M is limited, require M=2 ^m, m is a positive integer.

The public and private key factor is that to choose or get its calculating by column selection all be similar by row.Its difference only is:

If choose then first calculated column mark group by row; Again all rowers are replaced the full arrangement that promptly resulting rower is all rowers a kind of;

If get, then calculate the rower group earlier by column selection; All row marks are replaced, promptly resulting row mark group is complete arrange a kind of of all row targets again.

The present invention is described in detail below in conjunction with accompanying drawing.

Embodiment one

In the present embodiment, be to be chosen for example by row to be introduced with the public and private key factor.

Shown in Figure 1A and Figure 1B, be respectively private key factor matrix and shared key factor matrix schematic diagram.As shown in the figure, the private key factor matrix is SKM=[S _Ij], i=0...M-1 wherein, j=0...N-1; The corresponding public key factor matrix is PKM=[P _Ij], i=0...M-1 wherein, j=0...N-1.

In elliptic curve cipher system, establishing G is the basic point of certain elliptic curve, then P _Ij=S _Ij* G, i.e. PKM=SKM * G.

In the discrete logarithm cryptographic system, T={g, p}, wherein p is a prime number, and g is a finite field Fp generator, and g is less than p, then

Usually the magnitude relationship of cryptographic key factor matrix is to the fail safe of system, be relevant with the scale (being number of users) of system also simultaneously, and the length of sign determined the number of users of maximum in the system.

Below, in conjunction with Fig. 2 to Fig. 4 present embodiment is described, in the flow chart of Fig. 2 to Fig. 4, before implementing mapping method of the present invention, generated size in the system and be the cryptographic key factor matrix of M * N, wherein N=2 ⁿ, M=2 ^mMapping method of the present invention is divided into three processes: the checkout procedure of cryptographic key factor matrix, rower group and the computational process of row mark group and the computational process of key.

Mapping method of the present invention need to prove, because for having the binary mark of S bit and include the sign of being made up of complex elements such as letter, numerals as IPv4, this class of IPv6 address, can be used.

Therefore, be similar to the system of the general identifications of DNS domain name for use, as shown in Figure 2, before the check of carrying out the cryptographic key factor matrix, general identifications need be converted to binary mark, and with it directly as the binary mark of using in the following process (seeing step S101).

For the binary mark that is designated S bit, as shown in Figure 4, can be with it directly as the binary mark of using in the following process (seeing step S301).

In addition, as shown in Figure 3, the part that can also choose above-mentioned binary mark is as the binary mark of using in the following process (seeing step S201).For example: if key generates the scope of managing at the center is the subnet of IPv6, its subnet prefix is n bit, and system can only consider that the interface identifier of 128-n bit partly decides the size of cryptographic key factor matrix and the mapping between sign and key when getting sign so.In like manner, be similar to the system of the general identifications of DNS domain name for a use, general identifications is being converted to fixed length when sign, the part of the value that Hash (HASH) function or Message Authentication Code (the MAC:Message Authentication Code) function calculation of can only learning from else's experience according to the scale of system draws is shone upon calculating and is got final product.

One, the checkout procedure of cryptographic key factor matrix

The checkout procedure of cryptographic key factor matrix is according to binary mark or by the size of the length value check cryptographic key factor matrix of the binary mark of non-binary mark conversion.

The size of check cryptographic key factor matrix comprises:

Length value to binary mark carries out factor decomposition; The result who decomposes according to the factor judges whether the size of cryptographic key factor matrix is suitable; If the result of described determining step is for being then to carry out the computational process of rower group and row mark group.If the result of described determining step is not, then the regenerating key factor matrix.

As Fig. 2, Fig. 3 and shown in Figure 4, specific as follows to the checkout procedure of cryptographic key factor matrix:

The length value of binary mark is carried out factor decomposition, wherein k 〉=0 and k＜M (seeing step S102) according to S=M * r+k; If r≤n＜S, then the cryptographic key factor matrix can be with (seeing step S103); If r＞n, then described cryptographic key factor matrix is too little, needs regenerating key factor matrix (seeing step S109), and wherein M is the line number of cryptographic key factor matrix, and S is the length value of binary mark, and k is 0 or positive integer, and r, n are positive integer.

Lifting a special case describes: the binary identification of the S bit of the fixed length in the system is expressed as: S=M * r (getting k=0 this moment), suppose that still public and private key is to choose a public and private key factor according to certain mapping ruler at every row to calculate by corresponding computing in public and private key factor matrix, then the size of cryptographic key factor matrix can be got M * 2 ⁿ', n ' 〉=n.Be in the system of sign with the IPv6 address for example, the IPv6 address is 128bit, 128=32 * 4, and then the size of cryptographic key factor matrix can be taken as 32 * 2 ⁴

Two, the computational process of rower group and row mark group

In order to calculate a public and private key that sign is corresponding, need find out the cryptographic key factor that calculates public and private key, locate cryptographic key factor, then need to calculate cryptographic key factor corresponding rower group and row mark group in the cryptographic key factor matrix according to sign.

At first, be listed as the calculating of mark group.

In the checkout procedure of above-mentioned cryptographic key factor matrix, the length value of binary mark ID is carried out the factor according to S=M * r+k and decompose, wherein k 〉=0 and k＜M, M is the line number of cryptographic key factor matrix, S is the length value of binary mark.Because passed through the checkout procedure of above-mentioned cryptographic key factor matrix, therefore, the r≤n in this formula＜S.

Provide three kinds of methods to come the method for calculated column mark group by described binary mark ID below.

First method

As shown in Figure 2, computational process is as follows:

If k＜n-r, then calculated column mark group C _i(ID)=[ID＞＞(the] ﹠amp of i * r); (2 ⁿ-1), i=0...M-1; Wherein,＞＞expression cycle shift operation (seeing step S104, S105);

If k 〉=n-r, then calculated column mark group C according to the following equation _i(ID) (see step S110):

C _i(ID)＝[ID＞＞(i×r)]&(2 ⁿ-1)，i＝0...M-[k-(n-r)]-1，

C _i(ID)＝{ID＞＞[i×(r+1)]}&(2 ⁿ-1)，i＝M-[k-(n-r)]...M-1

Wherein,＞＞the expression cycle shift operation.

Second method

As shown in Figure 3, by following formula calculated column mark group C _i(ID) (see step S205):

C _i(ID)＝{ID＞＞[i×(r+1)]}&(2 ⁿ-1)，i＝0...M-1

Wherein,＞＞the expression cycle shift operation.

The third method

As shown in Figure 4, by following formula calculated column mark group C _i(ID) (see step S305):

C _i(ID)＝[ID＞＞(i×r’)]&(2 ⁿ-1)，i＝0...M-1

Wherein,＞＞the expression cycle shift operation, S＞r '＞r requires r ' no the S factor.

Secondly, carry out the calculating of rower group.

Cryptographic key factor is chosen one from each row of cryptographic key factor matrix, so the rower group is a displacement of (0...M-1), and as shown in Figure 2, the simplest mode is exactly directly to choose 0...M-1 (seeing step S106).

In addition, can also carry out the rower displacement by following two kinds of methods:

First method

As shown in Figure 3, see step S206～S212, the 0...M-1 order be placed on array R[0] ... R[M-1].Calculation step below carrying out then:

1) i=0 is set;

2) judge whether ID mod (M-i)＜M-i-1 sets up;

3) if 2) the result for being, then with R[ID mod (M-i)] and R[M-i-1] switch; If result 2) then carries out 4 for not);

4) i=i+1 is set, repeating step 2) to 4), when i=M-2, finish.

Through the array R[0 after the top processing] ... R[M-1] what deposit is a displacement of (0...M-1).The data sequence that array after then replacing is deposited is the rower group.

Second method

As shown in Figure 4, see that step S306 to step S312, is placed on array A[0 to the 0...M-1 backward] ... A[M-1].Calculation step below carrying out then:

1 ') i=0 is set;

2 ') judge whether ID mod (M-i) ≠ 0 sets up;

3 ') if 2 ') judged result for being, then with A[(ID mod (M-i))+i] and A[i] switch; If 2 ') judged result carries out 4 ' for not);

4 ') i=i+1 is set, repeating step 2 ') to 4 '), when i=M-2, finish.

Through the array A[0 after the top processing] ... A[M-1] what deposit is a displacement of (0...M-1).The data sequence that array after then replacing is deposited is the rower group.

In step S206 shown in Figure 3 and step S306 shown in Figure 4, the order that 0...M-1 is placed in the array can be that order is deposited, backward is deposited, also can be to deposit with order at random.

Three, the computational process of key

After calculating described sign corresponding row mark group and rower group, from the cryptographic key factor matrix, choose the cryptographic key factor (see step S107) corresponding with described rower group and row mark group.For example: the size of establishing the cryptographic key factor matrix is 16 * 64, i.e. M=16, and N=64 forms the cryptographic key factor of public and private key and chooses from the cryptographic key factor matrix by row.If for a sign ID, according to the mapping method that provides above, can calculate as 16 values of row marks for (8,2,62 ..., 33), corresponding rower displacement (3,8,1 ..., 12), so in the private key factor matrix, get S _3,8, S _8,2, S _1,62..., S _12,33Calculate the private key of ID correspondence; The PKI of corresponding sign ID correspondence is got P from the shared key factor matrix _3,8, P _8,2, P _1,62..., P _12,33Calculate.

After obtaining identifying corresponding rower group and row mark group, carry out the calculating (seeing step S108) of public private key pair again.

Because private key is need to be keep secret, have only KMC could preserve the private key factor matrix, the generation of private key can only be carried out in KMC, generates after discharge and gives corresponding entity, and each entity in the system and not knowing is used to calculate each private key factor of self private key; The PKI of each sign is disclosed in the territory that whole KMC managed, so the shared key factor matrix is need be disclosed.

In the discrete logarithm cryptographic system, system parameters T={g, p}, wherein p is a prime number, g is finite field F _pGenerator, g is less than p.The row of a sign ID correspondence are designated as C ₀, C ₁～C _M-1, corresponding rower is R ₀, R ₁～R _M-1, S[R _i, C _i] be the private key factor corresponding with sign, then identify the private key of ID correspondence:

${\mathrm{SK}}_{\mathrm{ID}}=\underset{i=0}{\overset{M}{\mathrm{\Σ}}}S[R_i,C_i]\mathrm{mod}p;$

Corresponding PKI:

${\mathrm{PK}}_{\mathrm{ID}}=\underset{i=0}{\overset{M}{\mathrm{\&Pi;}}}P[\mathrm{Ri},\mathrm{Ci}]\mathrm{mod}p=(g^{S[{\mathrm{<figure-callout\; id="0"\; label="R"\; filenames="C2006101154400030H1.png"\; state="\{\{state\}\}">R</figure-callout>}}_0,C_0]}\&times;g^{S[{\mathrm{<figure-callout\; id="1"\; label="R"\; filenames="C2006101154400026H1.png,C2006101154400026H2.png"\; state="\{\{state\}\}">R</figure-callout>}}_1,C_1]}...\&times;g^{S[R_{31},C_{31}]})\mathrm{mod}p$

$=\left(g^{S[{\mathrm{<figure-callout\; id="0"\; label="R"\; filenames="C2006101154400030H1.png"\; state="\{\{state\}\}">R</figure-callout>}}_0,C_0]+S[{\mathrm{<figure-callout\; id="1"\; label="R"\; filenames="C2006101154400026H1.png,C2006101154400026H2.png"\; state="\{\{state\}\}">R</figure-callout>}}_1,C_1]...+S[R_{31},C_{31}]}\right)\mathrm{mod}p=g^{{\mathrm{SK}}_{\mathrm{ID}}}\mathrm{mod}p;$

If elliptic curve cipher system, system parameters T:(a, b, G, n, p), wherein p is a positive integer, and Fp is a finite field, and a, b are the positive integers on the Fp, and G is the basic point on the elliptic curve E (Fp), n is a prime number, is the rank of basic point G.The row of a sign ID correspondence are designated as C ₀, C ₁～C _M-1, corresponding rower is R ₀, R ₁～R _M-1, then identify the private key of ID correspondence:

${\mathrm{SK}}_{\mathrm{ID}}=\underset{i=0}{\overset{M}{\mathrm{\&Sigma;}}}S[R_i,C_i]\mathrm{mod}n;$

Corresponding PKI:

${\mathrm{SK}}_{\mathrm{ID}}=\underset{i=0}{\overset{M}{\mathrm{\&Sigma;}}}P[R_i,C_i]\mathrm{mod}p={\mathrm{SK}}_{\mathrm{ID}}\&times;G$

Embodiment two

In the present embodiment, according to Fig. 5 the public and private key factor is got by column selection and describe.No matter the public and private key factor is to choose or get by column selection by row, and its calculating all is similar.

Same private key factor matrix and the shared key factor matrix that adopts as Figure 1A and Figure 1B.Carry out before the method for present embodiment, generated size in the system and be the cryptographic key factor matrix of M * N, wherein N=2 ⁿ, M=2 ^mSize with the cryptographic key factor matrix is expressed as S=2 in the present embodiment ^m* N.The mapping method of present embodiment also is divided into three processes: the checkout procedure of cryptographic key factor matrix, rower group and the computational process of row mark group and the computational process of key.

Same for having the binary mark of S bit and include the random length binary identification of being made up of complex elements such as letter, numerals to IPv4, this class of IPv6 address, mapping method of the present invention can use.In the flow chart of Fig. 5, before implementing mapping method of the present invention, generated size in the system and be the cryptographic key factor matrix of M * N, wherein N=2 ⁿ, M=2 ^m, m is a positive integer.As shown in Figure 5 be designated general identifications, sign need be converted to binary identification, and choose a part as the binary mark in the following step (seeing step S401).

One, the checkout procedure of cryptographic key factor matrix

The checkout procedure of cryptographic key factor matrix is identical with embodiment one, just when the factor is decomposed, counts the line number M that N replaces the cryptographic key factor matrix with the cryptographic key factor matrix column.The step S402 of detailed process such as Fig. 5, step S403 and step S409: the length value S of binary mark is carried out factor decomposition, wherein k 〉=0 and k＜N according to S=N * r+k; If r≤m＜S, then the cryptographic key factor matrix can be used; If r＞m, then described cryptographic key factor matrix is too little, needs the regenerating key factor matrix.

Two, the computational process of rower group and row mark group

Owing to be to get cryptographic key factor, therefore, need now carry out the calculating of rower group in the present embodiment, again row mark group be replaced by column selection.

At first, carry out the calculating of rower group.

In the checkout procedure of above-mentioned cryptographic key factor matrix, binary mark ID is carried out the factor according to S=N * r+k and decompose, wherein k 〉=0 and k＜N, N is a cryptographic key factor matrix column number.Because passed through the checkout procedure of cryptographic key factor matrix, therefore, the r≤m in this formula＜S.Calculate the rower group by described binary mark ID three kinds of methods arranged equally:

The first method (not shown) is to calculate rower group C according to following formula _i(ID):

If k＜m-r, C _i(ID)=[ID＞＞(the] ﹠amp of i * r); (2 ^m-1), i=0...N-1

Wherein,＞＞the expression cycle shift operation;

If k 〉=m-r, C _i(ID)=[ID＞＞(the] ﹠amp of i * r); (2 ^m-1), i=0...N-[k-(m-r)]-1,

C _i(ID)＝{ID＞＞[i×(r+1)]}&(2 ^m-1)，i＝M-[k-(m-r)]...N-1，

Wherein,＞＞the expression cycle shift operation.

The second method (not shown) is calculated rower group C according to following formula _i(ID):

C _i(ID)＝{ID＞＞[i×(r+1)]}&(2 ^m-1)，i＝0...N-1

Wherein,＞＞the expression cycle shift operation.

The third method is seen the step S405 among Fig. 5, calculates rower group C according to following formula _i(ID),

C _i(ID)＝[ID＞＞(i×r’)]&(2 ^m-1)，i＝0...N-1

Wherein,＞＞the expression cycle shift operation, S＞r '＞r, requiring r ' is not the factor of S.

Then, be listed as the calculating of mark group.

Cryptographic key factor is got one from each column selection of cryptographic key factor matrix, therefore is listed as the displacement that the mark group is (0...N-1), and the simplest mode is exactly directly to choose the 0...N-1 (not shown).In addition, replace equally also to do slightly to change and get final product by two kinds of methods among the embodiment one:

The first method (not shown), the 0...N-1 order deposit, backward is deposited or leave array R[0 in at random order] ... R[N-1].Calculation step below carrying out then:

1) i=0 is set;

2) judge whether ID mod (N-i)＜N-i-1 sets up;

3) if 2) the result for being, then with R[ID mod (N-i)] and R[N-i-1] switch; If result 2) then carries out 4 for not);

4) i=i+1 is set, repeating step 2) to 4), when i=N-2, finish.

Through the array R[0 after the top processing] ... R[N-1] what deposit is a displacement of (0...N-1).The data sequence that array after then replacing is deposited is a row mark group.

Be depicted as second method as the step S406 of Fig. 5 to step S412, the 0...N-1 order deposit, backward is deposited or leave array A[0 in at random order] ... A[N-1].Calculation step below carrying out then:

1 ') i=0 is set;

2 ') judge whether ID mod (N-i) ≠ 0 sets up;

3 ') if 2 ') the result for being, then with A[(ID mod (N-i))+i] and A[i] switch; If 2 ') result then carries out 4 ' for not);

4 ') i=i+1 is set, repeating step 2 ') to 4 '), when i=N-2, finish.

Through the array A[0 after the top processing] ... A[N-1] what deposit is a displacement of (0...N-1).The data sequence that array after then replacing is deposited is a row mark group.

Three, the computational process of key is identical with embodiment one, does not repeat them here.

By the present invention, simplified the mapping method that is identified to key, mapping method is succinctly efficient, is easy to realize, and can realizes being identified to the no conflict mapping of key for the sign of IPv4, this class of IPv6.

The foregoing description only is used to illustrate the present invention, but not is used to limit the present invention.

Claims (24)

1. the mapping method of sign and key is applied to generate the cryptographic key factor matrix in the combined key managing system based on sign in described system, it is characterized in that described method comprises step:

Step 1 is according to binary mark or by the size of the length value check cryptographic key factor matrix of the binary mark of non-binary mark conversion, the size of described cryptographic key factor matrix is expressed as M * 2 ⁿWherein, comprising: the length value of binary mark is carried out the factor decompose and carry out according to formula, the expression formula of this formula is: S=M * r+k; Wherein, S: the length value of binary mark; M: the line number of cryptographic key factor matrix; 2 ⁿ: cryptographic key factor matrix column number; K 〉=0 and k＜M; S, M, k, r, n are integer; The result who decomposes according to the factor judges whether the size of cryptographic key factor matrix is suitable; If judged result is suitable, then execution in step 2;

Step 2 calculates cryptographic key factor corresponding rower group and row mark group in the cryptographic key factor matrix according to described binary mark; Wherein, comprising: calculate with described binary mark and be listed as the mark group accordingly; All rowers to the cryptographic key factor matrix are replaced, and obtain and the corresponding rower group of described binary mark;

Step 3 utilizes the cryptographic key factor of described rower group and row mark group correspondence to calculate the key corresponding with described binary mark.

2. the mapping method of sign according to claim 1 and key is characterized in that, described step 1 also comprises: as if judged result is improper, then the regenerating key factor matrix.

3. the mapping method of sign according to claim 1 and key is characterized in that, whether the size of judging the cryptographic key factor matrix suitable being meant:

Judge that whether r is greater than n; As if judged result is r≤n＜S, then the size to fit of this cryptographic key factor matrix;

If judged result is r＞n, then described cryptographic key factor matrix big or small improper;

Wherein, S: the length value of binary mark; N, r are integer.

4. the mapping method of sign according to claim 1 and key is characterized in that, described calculating and binary mark are listed as the mark group accordingly, comprising:

Judge whether k＜n-r sets up;

If judged result is for being, then according to formula calculated column mark group C _i(ID), the expression formula of this formula is: C _i(ID)=[ID＞＞(the] ﹠amp of i * r); (2 ⁿ-1), i=0 ... M-1; Wherein,＞＞the expression cycle shift operation, ID is described binary mark;

If judged result is for not, then according to formula calculated column mark group C _i(ID), this formula expression is:

C _i(ID)=[ID＞＞(the] ﹠amp of i * r); (2 ⁿ-1), i=0...M-[k-(n-r)]-1 and

C _i(ID)＝{ID＞＞[i×(r+1)]}&(2 ⁿ-1)，i＝M-[k-(n-r)]…M-1；

Wherein,＞＞the expression cycle shift operation, ID is described binary mark; M, k, n, r, i are integer.

5. the mapping method of sign according to claim 1 and key is characterized in that, described calculating and binary mark are listed as the mark group accordingly, comprising:

According to formula calculated column mark group C _i(ID), this formula expression is:

C _i(ID)＝{ID＞＞[i×(r+1)]}&(2 ⁿ-1)，i＝0...M-1；

Wherein,＞＞the expression cycle shift operation; ID is a binary mark; N, r, i are integer.

6. the mapping method of sign according to claim 1 and key is characterized in that, described calculating and binary mark are listed as the mark group accordingly, comprising:

According to formula calculated column mark group C _i(ID), this formula expression is:

C _i(ID)＝[ID＞＞(i×r’)]&(2 ⁿ-1)，i＝0...M-1

Wherein,＞＞the expression cycle shift operation, S＞r '＞r, r ' they are not the factors of S, ID is a binary mark; S is the length value of binary mark; R, r ', n, i are integer.

7. the mapping method of sign according to claim 1 and key is characterized in that, described all rowers to the cryptographic key factor matrix are replaced, and comprising:

Directly choose data sequence as the rower group, this data sequence is: 0,1 ..., M-1, wherein, M is the line number of cryptographic key factor matrix.

8. the mapping method of sign according to claim 1 and key is characterized in that, described all rowers to the cryptographic key factor matrix are replaced, and comprising:

With the data sequence order deposit, backward is deposited or leave array R[i in at random order] in, this data sequence is: 0,1 ..., M-1;

I=0 wherein, 1 ..., M-1; M is the line number of cryptographic key factor matrix.

9. the mapping method of sign according to claim 8 and key is characterized in that, described all rowers to the cryptographic key factor matrix are replaced, and also comprise step:

Step 11 is provided with i=0;

Step 12 judges whether ID mod (M-i)＜M-i-1 sets up;

Step 13 is if the judged result of step 12 is for being, then with R[ID mod (M-i)] and R[M-i-1] switch; If the judged result of step 12 is that then execution in step 14;

Step 14 is provided with i=i+1, judges whether i equals M-2;

Step 15 is if the judged result of step 14 is that then repeating step 12 is not to step 15; If the judged result of step 14 is for being then replacement completion, and the array R[i after above-mentioned steps is handled] what deposit is (0 ... M-1) a displacement.

10. the mapping method of sign according to claim 8 and key is characterized in that, described all rowers to the cryptographic key factor matrix are replaced, and also comprise step:

Step 21 is provided with i=0;

Step 22 judges whether ID mod (M-i) ≠ 0 sets up;

Step 23 is if the judged result of step 22 is for being, then with R[(ID mod (M-i))+i] and R[i] switch; If the judged result of step 22 is that then execution in step 24;

Step 24 is provided with i=i+1, judges whether i equals M-2;

Step 25 is if the judged result of step 24 is that then repeating step 22 is not to step 25; If the judged result of step 24 is for being then replacement completion, and the array R[i after above-mentioned steps is handled] what deposit is a displacement of (0...M-1).

11. the mapping method of sign and key is applied to generate the cryptographic key factor matrix in the combined key managing system based on sign in described system, it is characterized in that described method comprises step:

Step 1 is according to binary mark or by the size of the length value check cryptographic key factor matrix of the binary mark of non-binary mark conversion, the size of described cryptographic key factor matrix is expressed as 2 ^m* N; Wherein, comprising: the length value of binary mark is carried out the factor decompose and carry out according to formula, the expression formula of this formula is: S=N * r+k; Wherein, S: the length value of binary mark; 2 ^m: the line number of cryptographic key factor matrix; N: cryptographic key factor matrix column number; K 〉=0 and k＜N; S, N, k, r, m are integer; The result who decomposes according to the factor judges whether the size of cryptographic key factor matrix is suitable; If judged result is suitable, then execution in step 2;

Step 2 calculates cryptographic key factor corresponding rower group and row mark group in the cryptographic key factor matrix according to described binary mark; Wherein, comprising: calculate and the corresponding rower group of described binary mark; All row marks to the cryptographic key factor matrix are replaced, and obtain being listed as the mark group accordingly with described binary mark;

Step 3 utilizes the cryptographic key factor of described rower group and row mark group correspondence to calculate the key corresponding with described binary mark.

12. the mapping method of sign according to claim 11 and key is characterized in that, described step 1 also comprises: as if judged result is improper, then the regenerating key factor matrix.

13. the mapping method of sign according to claim 11 and key is characterized in that, whether the size of judging the cryptographic key factor matrix suitable being meant:

Judge that whether r is greater than m; As if judged result is r≤m＜S, then the size to fit of this cryptographic key factor matrix;

If judged result is r＞m, then described cryptographic key factor matrix big or small improper;

Wherein, S: the length value of binary mark; M, r are integer.

14. the mapping method of sign according to claim 11 and key is characterized in that, the corresponding rower group of described calculating and binary mark comprises:

Judge whether k＜m-r sets up;

If judged result is for being, then according to formula calculating rower group C _i(ID), the expression formula of this formula is:

C _i(ID)＝[ID＞＞(i×r)]&(2 ^m-1)，i＝0…N-1；

If judged result is then calculated rower group C according to formula for not _i(ID), this formula expression is:

C _i(ID)=[ID＞＞(the] ﹠amp of i * r); (2 ^m-1), i=0 ... N-[k-(m-r)]-1 and

C _i(ID)＝{ID＞＞[i×(r+1)]}&(2 ^m-1)，i＝N-[k-(m-r)]…N-1；

Wherein,＞＞the expression cycle shift operation, ID is described binary mark; N, k, r, m, i are integer.

15. the mapping method of sign according to claim 11 and key is characterized in that, the corresponding rower group of described calculating and binary mark comprises:

Calculate rower group C according to formula _i(ID), this formula expression is:

C _i(ID)＝{ID＞＞[i×(r+1)]}&(2 ^m-1)，i＝0...N-1；

Wherein,＞＞the expression cycle shift operation, ID is described binary mark; N, r, m, i are integer.

16. the mapping method according to claim 1 or 11 described signs and key is characterized in that, the corresponding rower group of described calculating and binary mark comprises:

Calculate rower group C according to formula _i(ID), this formula expression is:

C _i(ID)＝[ID＞＞(i×r’)]&(2 ^m-1)，i＝0...N-1

Wherein,＞＞the expression cycle shift operation, S＞r '＞r, r ' they are not the factors of S, ID is described binary mark; R ', r, m, i are integer.

17. the mapping method according to claim 1 or 11 described signs and key is characterized in that, described all row marks to the cryptographic key factor matrix are replaced, and comprising:

Directly choose data sequence as row mark group, this data sequence is: 0,1 ..., N-1, wherein, N is a cryptographic key factor matrix column number.

18. the mapping method according to claim 1 or 11 described signs and key is characterized in that, described all row marks to the cryptographic key factor matrix are replaced, and comprising:

With the data sequence order deposit, backward is deposited or leave array R[i in at random order] in, this data sequence is: 0,1 ..., N-1;

I=0 wherein, 1 ..., N-1; N is a cryptographic key factor matrix column number.

19. the mapping method of sign according to claim 18 and key is characterized in that, described all row marks to the cryptographic key factor matrix are replaced, and also comprise step:

Step 31 is provided with i=0;

Step 32 judges whether ID mod (N-i)＜N-i-1 sets up;

Step 33 is if the judged result of step 32 is for being, then with R[ID mod (N-i)] and R[N-i-1] switch; If the judged result of step 32 is that then execution in step 34;

Step 34 is provided with i=i+1, judges whether i equals N-2;

Step 35 is if the judged result of step 34 is that then repeating step 32 is not to step 35; If the judged result of step 34 is for being then replacement completion, and the array R[i after above-mentioned steps is handled] what deposit is (0 ... M-1) a displacement.

20. the mapping method of sign according to claim 18 and key is characterized in that, described all row marks to the cryptographic key factor matrix are replaced, and also comprise step:

Step 41 is provided with i=0;

Step 42 judges whether ID mod (N-i) ≠ 0 sets up;

Step 43 is if the judged result of step 42 is for being, then with R[(ID mod (N-i))+i] and R[i] switch; If the judged result of step 42 is that then execution in step 44;

Step 44 is provided with i=i+1, judges whether i equals N-2;

Step 45 is if the result of step 44 is that then repeating step 42 is not to step 45; If the result of step 44 is for being then replacement completion, and the array R[i after above-mentioned steps is handled] what deposit is (0 ... M-1) a displacement.

21. the mapping method according to claim 1 or 11 described signs and key is characterized in that described step 3 comprises:

From the cryptographic key factor matrix, choose and described rower group and the corresponding cryptographic key factor of row mark group;

Utilize described cryptographic key factor to calculate the key corresponding with described binary mark.

22. the mapping method of sign according to claim 21 and key is characterized in that, in the discrete logarithm cryptographic system, utilizes cryptographic key factor according to the formula computation key; Wherein,

According to formula ${\mathrm{SK}}_{\mathrm{ID}}=\underset{i=0}{\overset{M}{\mathrm{\&Sigma;}}}S[R_i,C_i]\mathrm{mod}p$ Calculate private key SK _ID

According to formula ${\mathrm{PK}}_{\mathrm{ID}}=g^{{\mathrm{SK}}_{\mathrm{ID}}}\mathrm{mod}p$ Calculate PKI PK _ID

Wherein, p and g are the parameter of discrete logarithm cryptographic system, and p is a prime number, and g is a finite field Fp generator, and g is less than p, R _iBe rower, C _iBe row mark, S[R _i, C _i] be the private key factor corresponding with sign.

23. the mapping method of sign according to claim 21 and key is characterized in that, in elliptic curve cipher system, utilizes cryptographic key factor according to the formula computation key; Wherein,

According to formula ${\mathrm{SK}}_{\mathrm{ID}}=\underset{i=0}{\overset{M}{\mathrm{\&Sigma;}}}S[R_i,C_i]\mathrm{mod}n$ Calculate private key SK _ID

According to formula S K _ID=SK _ID* G calculates PKI PK _ID

Wherein, n and G are the parameter of elliptic curve cipher system, and G is the basic point on the elliptic curve E (Fp), and n is a prime number, and n is the rank of basic point G, R _iBe rower, C _iBe row mark, S[R _i, C _i] be the private key factor corresponding with sign.

24. the mapping method according to claim 1 or 11 described signs and key is characterized in that, adopts hash function or Message Authentication Code function that described non-binary mark is converted to binary mark.

Images