Anonymous entity authentication method and system

This application is a US National Stage of International Application No. PCT/CN2011/077024, filed on 11 Jul. 2011, designating the United States, and claiming the benefit of Chinese Patent Application No. 201010546320.9, filed with the Chinese Patent Office on Nov. 12, 2010 and entitled “Anonymous entity authentication method and system”, which is hereby incorporated by reference in its entirety.

The present invention relates to the field of entity authentication and particularly to an anonymous entity authentication method and system.

At present, an entity authentication method using an asymmetric cryptographic technique involves two scenarios in which there is an online trusted third party involving and in which there is no trusted third party involving, where the identity of an authenticated entity can be verified for legality through entity authentication, and also an authenticator can further obtain identity information of the authenticated entity, but such a scenario may arise in real life that the authenticated entity would not like to have its identity information disclosed. For example, when people vote on some sensitive event, e.g., voting on a personal appointment decision, electronic bidding, etc., anonymous voting is desirable, that is, their own voting opinions are signed without disclosing their identities. Thus there is a need of an anonymous entity authentication method capable of both authenticating the identity of an entity and protecting identity information of the authenticated entity from being exposed.

In order to address the foregoing technical problem in the prior art, the invention proposes an anonymous entity authentication method and system.

An anonymous entity authentication method includes the steps of:

an entity B sending a message 1 to an entity A to initiate an authentication process;

the entity A sending a message 2 to a trusted third party TP, wherein the message 2 includes an identity I GA of a group GA where the entity A resides;

the trusted third party TP verifying the group GA against I GA for legality upon reception of the message 2 ; and returning a message 3 to the entity A, wherein the message 3 includes a verification result Res GA of the group GA and a first token including a signature of the trusted third party TP;

the entity A sending a message 4 to the entity B upon reception of the message 3 , wherein the message 4 includes I GA and a second token including Res GA , the first token and a signature of the entity A; and

the entity B verifying the message 4 upon reception of the message 4 and determining from a verification result the legality of the entity A.

An anonymous entity authentication apparatus includes:

a first message receiving unit configured to receive a message 1 sent by an entity B;

a first message sending unit configured to send a message 2 to a trusted third party TP, wherein the message 2 includes an identity I GA of a group GA where the anonymous entity authentication apparatus resides;

a second message receiving unit configured to receive a message 3 returned from the trusted third party TP, wherein the message 3 includes a verification result Res GA of the group GA and a first token including a signature of the trusted third party TP; and

a second message sending unit configured to send a message 4 to the entity B upon reception of the message 3 , wherein the message 4 includes I GA and a second token including Res GA , the first token and a signature of the entity A.

An anonymous entity authentication apparatus includes:

a first message sending unit configured to send a message 1 to an entity A to initiate an authentication process;

a first message receiving unit configured to receive a message 4 sent by the entity A, wherein the message 4 includes an identity I GA of a group GA and a second token including a verification result Res GA of a trusted third party TP on the group GA, a first token and a signature of the entity A, and the first token includes a signature of the trusted third party TP; and

an entity authenticating unit configured to verify the message 4 upon reception of the message 4 and to determine from a verification result the legality of the entity A.

A trusted third party apparatus includes:

a message receiving unit configured to receive a message 2 sent by an entity A, wherein the message 2 includes an identity I GA of a group GA where the entity A resides; and

a group verifying unit configured to verify the group GA against I GA for legality upon reception of the message 2 and to return a message 3 to the entity A, wherein the message 3 includes a verification result Res GA of the group GA and a first token comprising a signature of the trusted third party apparatus.

In the invention, an authenticated entity will not send its own identity information to an opposite entity or a trusted third party but will send only identity information of a group where it resides to the opposite entity or the trusted third party for verification, and a verification result will be passed to the requesting opposite entity. The opposite entity can verify a signature of the authenticated entity simply with a result of verification by the trusted third party on the group where the authenticated entity resides to thereby authenticate the identity of the authenticated entity. Throughout the authentication process, the identity information of the authenticated entity will be neither disclosed nor passed to the opposite entity to thereby avoid the identity information of the authenticated entity from being exposed. The invention defines an anonymous entity authentication mechanism capable of protecting identity information of an authenticated entity, as compared with the traditional entity authentication mechanism.

FIG. 1 is a schematic flow chart of a method according to an embodiment of the invention;

FIG. 2 is a schematic diagram of a preferred implementation of an anonymous entity authentication system according to a first embodiment of the invention;

FIG. 3 is a schematic diagram of a preferred implementation of an anonymous entity authentication system according to a second embodiment of the invention;

FIG. 4 is a schematic structural diagram of an anonymous entity authentication apparatus according to an embodiment of the invention;

FIG. 5 is a schematic structural diagram of another anonymous entity authentication apparatus according to an embodiment of the invention; and

FIG. 6 is schematic structural diagram of a trusted third party apparatus according to an embodiment of the invention.

A method according to the invention involves entities including authenticated entities A and B, groups GA and GB, and a Trusted third Party (TP). The entities A and B reside respectively in the groups GA and GB as members of the groups where they reside respectively. The Trusted third Party (TP) is a trusted third party of the entities A and B and the groups GA and GB to provide an authentication service for the entities. Before being authenticated, the entities A and B possess their own private keys respectively, the groups GA and GB possess their own group public keys respectively, and against signatures generated using their own private keys, the entities A and B can be verified using the pubic keys of the groups where they reside respectively.

The following notations are defined for the sake of convenience:

Valid GX indicates the validity of a certificate Cert GX (X represents A or B, where A refers to the entity A, and B refers to the entity B); PublicKey GX is a public key of a group GX; I GX is an identity of the group GX, which can be the certificate Cert GX or a distinguishing identifier GX of the group; Res GX indicates a verification result of the group GX consisted of the certificate Cert GX and the validity thereof Valid GX or of the group GX and the public key thereof PublicKey GX ; Token is a token field; sSY(M) is a signature of Y on a message M (Y represents A or B or T, where T refers to the trusted third party TP here and hereinafter); and Text is an optional text. “y∥z” indicates a result of concatenating sequentially a data item y and a data item z in that order.

Referring to FIG. 1 , an embodiment of the invention provides an anonymous entity authentication method, where the method includes the following steps:

Step 10: An entity B sends a message 1 to an entity A to initiate an authentication process;

Step 11: The entity A sends a message 2 to a trusted third party TP, where the message 2 includes an identity I GA of a group GA where the entity A resides;

Step 12: The trusted third party TP verifies the group GA against I GA for legality upon reception of the message 2 ; and returns a message 3 to the entity A, where the message 3 includes a verification result Res GA of the group GA and a first token including a signature of the trusted third party TP;

Step 13: The entity A sends a message 4 to the entity B upon reception of the message 3 , where the message 4 includes I GA and a second token including Res GA , the first token and a signature of the entity A; and

Step 14: The entity B verifies the message 4 upon reception of the message 4 and determines from a verification result the legality of the entity A.

Preferably after the entity A receives the message 3 and before the entity A sends the message 4 to the entity B, the entity A can determine whether a random number R′ A generated by the entity A in the message 2 is consistent with a random number R′ A included in the signature of the trusted third party TP; and when the random number R′ A generated by the entity A in the message 2 is determined as being consistent with the random number R′ A included in the signature of the trusted third party TP, the entity A sends the message 4 to the entity B; otherwise, the authentication process ends.

Specifically the entity B can verify the message 4 and determine from the verification result the legality of the entity A particularly in the following step a to step c:

a. The entity B verifies whether the signature of the trusted third party TP is valid and determines whether a random number R B generated by the entity B in the message 1 is consistent with a random number R B included in the signature of the trusted third party TP, and if both are positive, then the entity B performs the step b; otherwise, the entity B determines the entity A as being illegal and can further send a subsequent message 5 ;

b. If the entity B determines, from Res GA , the group GA as being legal and valid, then the entity B performs the step c; otherwise, the entity B determines the entity A as being illegal and can further send the subsequent message 5 ; and

c. The entity B obtains a public key of the group GA by I GA , verifies, against the public key, whether the signature of the entity A is valid, determines whether a distinguishing identifier of a group GB is consistent with a group distinguishing identifier GB included in the signature of the entity A and determines whether the random number R B generated by the entity B in the message 1 is consistent with a random number R B included in the signature of the entity A, and if all are positive, then the entity B determines the entity A as being legal; otherwise, the entity B determines the entity A as being illegal.

Furthermore the message 1 further includes an identity I GB of a group GB where the entity B resides; and the message 2 further include I GB , the trusted third party TP further verifies the group GB against I GB for legality, and the message 3 further includes a verification result Res GB of the group GB; and

Correspondingly in the step 14, after the entity B determines from the verification result the legality of the entity A, the entity B sends the message 5 to the entity A, where the message 5 includes a third token including a signature of the entity B; and the entity A verifies the message 5 upon reception of the message 5 and determines from a verification result the legality of the entity B.

Specifically the entity A can verify the message 5 and determine from the verification result the legality of the entity B particularly in the following two approaches:

In a first approach, there are the following step a to step c:

a. The entity A verifies whether the signature of the trusted third party TP is valid and determines whether the random number R′ A generated by the entity A in the message 2 is consistent with the random number R′ A included in the signature of the trusted third party TP; and if they are consistent, then the entity A performs the step b; otherwise, the entity A determines the entity B as being illegal, and the flow ends;

b. If the entity A determines, from Res GB , the group GB as being legal and valid, then the entity A performs the step c; otherwise, the entity A determines the entity B as being illegal, and the flow ends; and

c. The entity A obtains a public key of the group GB by I GB , verifies against the public key whether the signature of the entity B is valid, determines whether a distinguishing identifier of the group GA is consistent with a group distinguishing identifier GA included in the signature of the entity B and determines whether a random number R A generated by the entity A in the message 4 is consistent with a random number R A included in the signature of the entity B, and if all are positive, then the entity A determines the entity B as being legal; otherwise, the entity A determines the entity B as being illegal.

In a second approach, before the entity A sends the message 4 to the entity B, firstly the entity A can verify whether the signature of the trusted third party TP is valid and determine whether the random number R′ A generated by the entity A in the message 2 is consistent with the random number R′ A included in the signature of the trusted third party TP; and when the signature of the trusted third party TP is verified as being valid and the random number R′ A generated by the entity A in the message 2 is determined as being consistent with the random number R′ A included in the signature of the trusted third party TP, then the entity A sends the message 4 to the entity B; and

Correspondingly the entity A can verify the entity B for legality particularly in the following step a to step b:

a. If the entity A determines from Res GB the group GB as being legal and valid, then the entity A performs the step b; otherwise, the entity A determines the entity B as being illegal, and the flow ends; and

b. The entity A obtains a public key of the group GB by I GB , verifies, against the public key, whether the signature of the entity B is valid, determines whether a distinguishing identifier of the group GA is consistent with a group distinguishing identifier GA included in the signature of the entity B and determines whether a random number R A generated by the entity A in the message 4 is consistent with a random number R A included in the signature of the entity B, and if all are positive, then the entity A determines the entity B as being legal; otherwise, the entity A determines the entity B as being illegal.

The trusted third party TP can verify the group GA against I GA for legality particularly in the following two approaches:

In a first approach, if I GA in the message 2 is the distinguishing identifier GA of the group GA, then the trusted third party TP searches for a valid public key PublicKey GA of the group GA, and if it is found, then the trusted third party TP determines GA as being legal; otherwise, the trusted third party TP determines GA as being illegal; and

In a second approach, if I GA in the message 2 is a certificate Cert GA of the group GA, then the trusted third party TP checks the certificate Cert GA for validity Valid GA , and if Cert GA is valid, then the trusted third party TP determines GA as being legal; otherwise, the trusted third party TP determines GA as being illegal.

Alike the trusted third party TP can verify the group GB against I GB for legality particularly in the following two approaches:

In a first approach, if I GB in the message 2 is the distinguishing identifier GB of the group GB, then the trusted third party TP searches for a valid public key PublicKey GB of the group GB, and if it is found, then the trusted third party TP determines GB as being legal; otherwise, the trusted third party TP determines the GB as being illegal; and

In a second approach, if I GB in the message 2 is a certificate Cert GB of the group GB, then the trusted third party TP checks the certificate Cert GB for validity Valid GB , and if Cert GB is valid, then the trusted third party TP determines GB as being legal; otherwise, the trusted third party TP determines the GB as being illegal.

In this method, the first token can include a token TokenTA, or the first token includes tokens TokenTA 1 and TokenTA 2 , where TokenTA includes a signature of the trusted third party TP on a message including R′ A , R B , Res GB and Res GA , TokenTA 1 includes a signature of the trusted third party TP on a message including R′ A and Res GB , and TokenTA 2 includes a signature of the trusted third party TP on a message including R B and Res GA ; and R′ A is the random number generated by the entity A included in the message 2 , that is, the message 2 can further include the random number generated by the entity A; and R B is the random number generated by the entity B included in the message 1 , and the message 2 also carries R B .

For example, TokenTA=sS T (R′ A ∥R B ∥Res GB ∥Res GA ∥Text 3 ), where Text 3 is an optional text, and sS T is the signature of the trusted third party TP.

TokenTA 1 =sS T (R′ A ∥Res GB ∥Text 4 ) and TokenTA 2 =sS T (R B ∥Res GA ∥Text 3 ), where Text 3 is an optional text, and sS T is the signature of the trusted third party TP.

The second token includes a token TokenAB including R A , R′ A , Res GB , Res GA , TokenTA and a signature of the entity A on a message including GA, R A , GB, R B , Res GB , Res GA and TokenTA; or

The second token includes R A , Res GA , TokenTA 2 and a signature of the entity A on a message including GA, R A , GB, R B and TokenTA 2 ; and R A is the random number generated by the entity A included in the message 4 . For example:

TokenAB=R A ∥R′ A ∥Text 7 ∥Res GB ∥Res GA ∥TokenTA∥sS A (GA∥R A ∥GB∥R B ∥Res GB ∥Res GA ∥TokenTA∥Text 6 ), where Text 6 and Text 7 are optional texts, and sS A is the signature of the entity A; or

TokenAB=R A ∥Res GA ∥Text 7 ∥TokenTA 2 ∥sS A (GA∥R A ∥GB∥R B ∥TokenTA 2 ∥Text 6 ), where Text 6 and Text 7 are optional texts, and sS A is the signature of the entity A;

The third token includes TokenBA including a signature of the entity B on a message including GB, R B , GA and R A ; and R A is the random number generated by the entity A included in the message 4 , that is, the message 4 can further include the random number generated by the entity A; and R B is the random number generated by the entity B included in the message 1 , that is, the message 1 can further include the random number generated by the entity B.

For example, TokenBA=Text 9 ∥sS B (GB∥R B ∥GA∥R A ∥Text 8 ), where Text 8 and Text 9 are optional texts, and sS B is the signature of the entity B.

In the invention, the message 1 , the message 2 and the message 3 further include optional texts respectively. The various random numbers carried in the messages can be replaced with time labels or sequence numbers.

First Embodiment

Referring to FIG. 2 , this embodiment includes a flow of only anonymous authentication on an entity A by an entity B, particularly as follows:

Step (1): The entity B sends a message 1 to the entity A, where the message 1 includes a random number R B generated by the entity B, an identity I GB of a group GB and an optional text Text 1 .

Step (2): The entity A sends a message 2 to a trusted third party TP, where the message 2 includes R B , a random number R′ A generated by the entity A, an identity I GA of a group GA, the identity I GB of the group GB and an optional text Text 2 .

Step (3): The trusted third party TP checks the group GA and the group GB against the identities I GA and I GB for legality upon reception of the message 2 .

The trusted third party TP can check the group GA and the group GB for legality particularly in the following several approaches:

In the message 2 , if the identity I GA of the group GA is a distinguishing identifier GA of the group GA, then the trusted third party TP searches for a valid public key PublicKey GA of the group GA, or if the identity I GA of the group GA is a certificate Cert GA of the group GA, then the trusted third party TP checks the certificate Cert GA for validity Valid GA ; and if the identity I GB of the group GB is a distinguishing identifier GB of the group GB, then the trusted third party TP searches for a valid public key PublicKey GB of the group GB, or if the identity I GB of the group GB is a certificate Cert GB of the group GB, then the trusted third party TP checks the certificate Cert GB for validity Valid GB .

Step (4): The trusted third party TP returns a message 3 to the entity A after checking the group GA and the group GB for legality, where the message 3 includes group verification results Res GA and Res GB , a token TokenTA and an optional text Text 5 or includes group verification results Res GA and Res GB , tokens TokenTA 1 and TokenTA 2 and an optional text Text 5 . Particularly TokenTA includes a signature of the trusted third party TP on a message including R′ A , R B , Res GB and Res GA , TokenTA 1 includes a signature of the trusted third party TP on a message including R′ A and Res GB , and TokenTA 2 includes a signature of the trusted third party TP on a message including R B and Res GA . A preferred embodiment of Token according to the invention is TokenTA=sS T (R′ A ∥R B ∥Res GB ∥Res GA ∥Text 3 ). A preferred embodiment of TokenTA 1 and TokenTA 2 according to the invention is TokenTA 1 =sS T (R′ A ∥Res GB ∥Text 4 ) and TokenTA 2 =sS T (R B ∥Res GA ∥Text 3 ).

Step (5): The entity A sends a message 4 to the entity B upon reception of the message 3 , where the message 4 includes a token TokenAB and the group identity I GA . Particularly TokenAB includes R A , R′ A , Res GB , Res GA , TokenTA and a signature of the entity A on a message including GA, R A , GB, R B , Res GB , Res GA and TokenTA, and a preferred embodiment according to the invention is TokenAB=R A ∥R′ A ∥Text 7 ∥Res GB ∥Res GA ∥TokenTA∥sS A (GA∥R A ∥GB∥R B ∥Res GB ∥Res GA ∥TokenTA∥Text 6 ); or TokenAB includes R A , Res GA , TokenTA 2 and a signature of the entity A on a message including GA, R A , GB, R B and TokenTA 2 , and a preferred embodiment according to the invention is TokenAB=R A ∥Res GA ∥Text 7 ∥TokenTA 2 ∥sS A (GA∥R A ∥GB∥R B ∥TokenTA 2 ∥Text 6 ).

Step (6): The entity B verifies the message 4 upon reception of the message 4 . A verification process is as follows:

Step (6.1): The entity B verifies against a public key of the trusted third party TP whether the signature of the trusted third party TP included in TokenTA or TokenTA 2 in Token AB is valid and determines whether the random number R B generated by the entity B in the message 1 is consistent with the random number R B in the signature of the trusted third party TP included in TokenTA or TokenTA 2 , and if so, then the entity B performs the step (6.2); otherwise, the entity B determines the entity A as being illegal;

Step (6.2): The entity B obtains the verification result Res GA of the group GA, and if the entity B determines from Res GA the group GA as being legal and valid, then the entity B performs the step (6.3); otherwise, the entity B determines the entity A as being illegal; and

Step (6.3): The entity B obtains the public key of the group GA, verifies against the public key whether the signature of the entity A in TokenAB is valid, determines whether the distinguishing identifier of the group GB is consistent with the group distinguishing identifier (GB) included in the signature of the entity A in Token AB and determines whether the random number R B generated by the entity B in the message 1 is consistent with the random number R B included in the signature of the entity A in TokenAB, and if so, then the entity B determines the entity A as being legal; otherwise, the entity B determines the entity A as being illegal. The entity B finishes the authentication on the entity A.

Second Embodiment

Referring to FIG. 3 , a specific flow of anonymous authentication between an entity A and an entity B is as follows:

Step (1): The entity B sends a message 1 to the entity A, where the message 1 includes a random number R B generated by the entity B, an identity I GB of a group GB and an optional text Text 1 .

Step (2): The entity A sends a message 2 to a trusted third party TP upon reception of the message 1 , where the message 2 includes R B , a random number R′ A generated by the entity A, an identity I GA of a group GA, the identity I GB of the group GB and an optional text Text 2 .

Step (3): The trusted third party TP checks the group GA and the group GB against the identities I GA and I GB for legality upon reception of the message 2 .

The trusted third party TP can check the group GA and the group GB for legality particularly in the following several approaches:

In the message 2 , if the identity I GA of the group GA is a distinguishing identifier GA of the group GA, then the trusted third party TP searches for a valid public key PublicKey GA of the group GA, or if the identity I GA of the group GA is a certificate Cert GA of the group GA, then the trusted third party TP checks the certificate Cert GA for validity Valid GA ; and if the identity I GB of the group GB is a distinguishing identifier GB of the group GB, then the trusted third party TP searches for a valid public key PublicKey GB of the group GB, or if the identity I GB of the group GB is a certificate Cert GB of the group GB, then the trusted third party TP checks the certificate Cert GB for validity Valid GB .

Step (4): The trusted third party TP returns a message 3 to the entity A after checking the group GA and the group GB for legality, where the message 3 includes group verification results Res GA and Res GB , a token TokenTA and an optional text Text 5 or includes group verification results Res GA and Res GB , tokens TokenTA 1 and TokenTA 2 and an optional text Text 5 . Particularly TokenTA includes a signature of the trusted third party TP on a message including R′ A , R B , Res GB and Res GA , TokenTA 1 includes a signature of the trusted third party TP on a message including R′ A and Res GB , and TokenTA 2 includes a signature of the trusted third party TP on a message including R B and Res GA . A preferred embodiment of Token according to the invention is TokenTA=sS T (R′ A ∥R B ∥Res GB ∥Res GA ∥Text 3 ). A preferred embodiment of TokenTA 1 and TokenTA 2 according to the invention is TokenTA 1 =sS T (R′ A ∥Res GB ∥Text 4 ) and TokenTA 2 =sS T (R B ∥Res GA ∥Text 3 ).

Step (5): The entity A sends a message 4 to the entity B upon reception of the message 3 , where the message 4 includes a token TokenAB and the group identity I GA . Particularly TokenAB includes R A , R′ A , Res GB , Res GA , TokenTA and a signature of the entity A on a message including GA, R A , GB, R B , Res GB , Res GA and TokenTA, and a preferred embodiment according to the invention is TokenAB=R A ∥R′ A ∥Text 7 ∥Res GB ∥Res GA ∥TokenTA∥sS A (GA∥R A ∥GB∥R B ∥Res GB ∥Res GA ∥TokenTA∥Text 6 ); or TokenAB includes R A , Res GA , TokenTA 2 and a signature of the entity A on a message including GA, R A , GB, R B and TokenTA 2 , and a preferred embodiment according to the invention is TokenAB=R A ∥Res GA ∥Text 7 ∥TokenTA 2 ∥sS A (GA∥R A ∥GB∥R B ∥TokenTA 2 ∥Text 6 ).

Step (6): The entity B verifies the message 4 upon reception of the message 4 . A verification process is as follows:

Step (6.1): The entity B verifies against a public key of the trusted third party TP whether the signature of the trusted third party TP included in TokenTA or TokenTA 2 in Token AB is valid and determines whether the random number R B generated by the entity B in the message 1 is consistent with the random number R B included in the signature of the trusted third party TP in TokenTA or TokenTA 2 , and if so, then the entity B performs the step (6.2); otherwise, the entity B determines the entity A as being illegal and terminates the authentication flow or performs the step (7);

Step (6.2): The entity B obtains the verification result Res GA of the group GA, and if the entity B determines from Res GA the group GA as being legal and valid, then the entity B performs the step (6.3); otherwise, the entity B determines the entity A as being illegal and terminates the authentication flow or performs the step (7); and

Step (6.3): The entity B obtains the public key of the group GA, verifies against the public key whether the signature of the entity A in TokenAB is valid, determines whether the distinguishing identifier of the group GB is consistent with the group distinguishing identifier (GB) included in the signature of the entity A in Token AB and determines whether the random number R B generated by the entity B in the message 1 is consistent with the random number R B included in the signature of the entity A in TokenAB, and if so, then the entity B determines the entity A as being legal; otherwise, the entity B determines the entity A as being illegal. The entity B finishes the authentication on the entity A and performs the step (7).

Step (7): The entity B sends a message 5 to the entity A, where the message 5 includes a token TokenBA. TokenBA includes a signature of the entity B on a message including GB, R B , GA and R A . A preferred embodiment of TokenBA according to the invention is TokenBA=Text 9 ∥sS B (GB∥R B ∥GA∥R A ∥Text 8 ).

Step (8): The entity A verifies the message 5 upon reception of the message 5 . A verification process is as follows:

Step (8.1): The entity A verifies against the public key of the trusted third party TP whether the signature of the trusted third party TP in TokenTA or TokenTA 1 in the message 3 is valid and determines whether the random number R′ A generated by the entity A in the message 2 is consistent with the random number R′ A included in the signature of the trusted third party TP in TokenTA or TokenTA 1 , and if so, then the entity B performs the step (8.2); otherwise, the entity A determines the entity B as being illegal;

Step (8.2): The entity A obtains the verification result Res GB of the group GB, and if the entity A determines from Res GB the group GB as being legal and valid, then the entity B performs the step (8.3); otherwise, the entity A determines the entity B as being illegal and finishes the authentication on the entity B; and

Step (8.3): The entity A obtains the public key of the group GB, verifies against the public key whether the signature of the entity B in TokenBA is valid, determines whether the distinguishing identifier of the group GA is consistent with the group distinguishing identifier (GA) included in the signature of the entity B in Token BA and determines whether the random number R′ A generated by the entity A in the message 4 is consistent with the random number R A included in the signature of the entity B in TokenBA, and if so, then the entity A determines the entity B as being legal; otherwise, the entity A determines the entity B as being illegal. The entity A finishes the authentication on the entity B.

Particularly in the step (4), when the message 3 includes the verification results Res GA and Res GB , the token TokenTA and an option text Text 5 , the step (8.1) can be earlier performed in the step (5), that is, upon reception of the message 3 , the entity A firstly performs the step (8.1) and then sends the message 4 to the entity B after the verification is passed.

The random number R A , R′ A and R B can be replaced with time labels or sequence numbers.

With the foregoing bidirectional anonymous authentication process between the entity A and the entity B, bidirectional identity legality authentication between the two entities can be performed while protecting identity information of the two entities from being disclosed.

The presence and contents of the optional texts Text 1 , Text 2 , Text 3 , . . . , as referred to in the foregoing embodiments are indeterminate in view of the possibility for those skilled in the art to define the contents of the optional texts as they desire for the purpose of extending the optional texts, and thus the optional texts may be omitted in other embodiments.

Referring to FIG. 4 , an embodiment of the invention further provides an anonymous entity authentication apparatus, and the apparatus includes:

A first message receiving unit 40 configured to receive a message 1 sent by an entity B;

A first message sending unit 41 configured to send a message 2 to a trusted third party TP, where the message 2 includes an identity I GA of a group GA where the anonymous entity authentication apparatus resides;

A second message receiving unit 42 configured to receive a message 3 returned from the trusted third party TP, where the message 3 includes a verification result Res GA of the group GA and a first token including a signature of the trusted third party TP; and

A second message sending unit 43 configured to send a message 4 to the entity B upon reception of the message 3 , where the message 4 includes I GA and a second token including Res GA , the first token and a signature of the entity A.

Furthermore the second message sending unit is configured:

To determine whether a random number R′ A generated by the entity A in the message 2 is consistent with a random number R′ A included in the signature of the trusted third party TP before sending the message 4 to the entity B; and when they are consistent, to send the message 4 to the entity B.

Furthermore the message 1 received by the first message receiving unit further includes an identity I GB of a group GB where the entity B resides; and the message 2 sent by the first message sending unit further include I GB , and the message 3 received by the second message receiving unit further includes a verification result Res GB of the group GB; and the apparatus further includes:

A third message receiving unit 44 configured to receive a message 5 sent by the entity B after the message 4 is sent to the entity B, where the message 5 includes a third token including a signature of the entity B; and

An entity authenticating unit 45 configured to verify the message 5 upon reception of the message 5 and to determine from a verification result the legality of the entity B.

The entity authenticating unit 45 is configured:

a. To verify whether the signature of the trusted third party TP is valid and to determine whether the random number R′ A generated by the anonymous entity authentication apparatus in the message 2 is consistent with the random number R′ A included in the signature of the trusted third party TP; and if they are consistent, to perform the step b; otherwise, to determine the entity B as being illegal and end the flow;

b. If the group GB is determined from Res GB as being legal and valid, to perform the step c; otherwise, to determine the entity B as being illegal and end the flow; and

c. To obtain a public key of the group GB by I GB , to verify against the public key whether the signature of the entity B is valid, to determine whether a distinguishing identifier of the group GA is consistent with a group distinguishing identifier GA included in the signature of the entity B and to determine whether a random number R A generated by the entity A in the message 4 is consistent with a random number R A included in the signature of the entity B, and if all are positive, to determine the entity B as being legal; otherwise, to determine the entity B as being illegal.

Furthermore the first token includes a token TokenTA, or the first token includes tokens TokenTA 1 and TokenTA 2 , where:

TokenTA includes a signature of the trusted third party TP on a message including R′ A , R B , Res GB and Res GA , TokenTA 1 includes a signature of the trusted third party TP on a message including R′ A and Res GB , and TokenTA 2 includes a signature of the trusted third party TP on a message including R B and Res GA ; and

R′ A is the random number generated by the entity A included in the message 2 ; and R B is the random number generated by the entity B included in the message 1 , and the message 2 also carries R B .

Furthermore TokenTA=sS T (R′ A ∥R B ∥Res GB ∥Res GA ∥Text 3 ), where Text 3 is an optional text, and sS T is the signature of the trusted third party TP.

Furthermore TokenTA 1 =sS T (R′ A ∥Res GB ∥Text 4 ) and TokenTA 2 =sS T (R B ∥Res GA ∥Text 3 ), where Text 3 is an optional text, and sS T is the signature of the trusted third party TP.

Furthermore the second message sending unit 43 is further configured:

If the first token includes the token TokenTA, to verify whether the signature of the trusted third party TP is valid and to determine whether the random number R′ A generated by the entity A in the message 2 is consistent with the random number R′ A included in the signature of the trusted third party TP before sending the message 4 to the entity B; and

To send the message 4 to the entity B when the signature of the trusted third party TP is verified as being valid and the random number R′ A generated by the entity A in the message 2 is determined as being consistent with the random number R′ A included in the signature of the trusted third party TP.

Furthermore the entity authenticating unit 45 is configured:

a. If the group GB is determined from Res GB as being legal and valid, to perform the step b; otherwise, to determine the entity B as being illegal and end the flow; and

b. To obtain a public key of the group GB by I GB , to verify against the public key whether the signature of the entity B is valid, to determine whether a distinguishing identifier of the group GA is consistent with a group distinguishing identifier GA included in the signature of the entity B and to determine whether a random number R A generated by the entity A in the message 4 is consistent with a random number R A included in the signature of the entity B, and if all are positive, to determine the entity B as being legal; otherwise, to determine the entity B as being illegal.

Furthermore the second token includes a token TokenAB including R A , R′ A , Res GB , Res GA , TokenTA and a signature of the entity A on a message including GA, R A , GB, R B , Res GB , Res GA and TokenTA; or

The second token includes R A , Res GA , TokenTA 2 and a signature of the entity A on a message including GA, R A , GB, R B and TokenTA 2 ; and R A is the random number generated by the entity A included in the message 4 .

Furthermore TokenAB=R A ∥R′ A ∥Text 7 ∥Res GB ∥Res GA ∥TokenTA∥sS A (GA∥R A ∥GB∥R B ∥Res GB ∥Res GA ∥TokenTA∥Text 6 ), where Text 6 and Text 7 are optional texts, and sS A is the signature of the entity A.

Furthermore TokenAB=R A ∥Res GA ∥Text 7 ∥TokenTA 2 ∥sS A (GA∥R A ∥GB∥R B ∥TokenTA 2 ∥Text 6 ), where Text 6 and Text 7 are optional texts, and sS A is the signature of the entity A;

Furthermore the third token includes TokenBA including a signature of the entity B on a message including GB, R B , GA and R A ; and

R A is the random number generated by the entity A included in the message 4 ; and R B is the random number generated by the entity B included in the message 1 .

Furthermore TokenBA=Text 9 ∥sS B (GB∥R B ∥GA∥R A ∥Text 8 ), where Text 8 and Text 9 are optional texts, and sS B is the signature of the entity B.

Furthermore the message 1 , the message 2 and the message 3 further include optional texts respectively.

Furthermore the random numbers are replaced with time labels or sequence numbers.

Referring to FIG. 5 , an embodiment of the invention further provides another anonymous entity authentication apparatus, and the apparatus includes:

A first message sending unit 50 configured to send a message 1 to an entity A to initiate an authentication process;

A first message receiving unit 51 configured to receive a message 4 sent by the entity A, where the message 4 includes an identity I GA of a group GA and a second token including a verification result Res GA of a trusted third party TP on the group GA, a first token and a signature of the entity A, and the first token includes a signature of the trusted third party TP; and

An entity authenticating unit 52 configured to verify the message 4 upon reception of the message 4 and to determine from a verification result the legality of the entity A.

Furthermore the apparatus further includes:

A second message sending unit 53 configured to send a message 5 to the entity A after determining from the verification result the legality of the entity A, where the message 5 includes a third token including a signature of the entity B.

Furthermore the entity authenticating unit 52 is configured:

a. To verify whether the signature of the trusted third party TP is valid and to determine whether a random number R B generated by the anonymous entity authentication apparatus in the message 1 is consistent with a random number R B included in the signature of the trusted third party TP; and if both are positive, to perform the step b; otherwise, to determine the entity A as being illegal;

b. If the group GA is determined from Res GA as being legal and valid, to perform the step c; otherwise, to determine the entity A as being illegal; and

c. To obtain a public key of the group GA by I GA , to verify against the public key whether the signature of the entity A is valid, to determine whether a distinguishing identifier of the group GB is consistent with a group distinguishing identifier GB included in the signature of the entity A and to determine whether the random number R B generated by the entity B in the message 1 is consistent with a random number R B included in the signature of the entity AB, and if all are positive, to determine the entity A as being legal; otherwise, to determine the entity A as being illegal.

Furthermore the first token includes a token TokenTA, or the first token includes tokens TokenTA 1 and TokenTA 2 , where:

TokenTA includes a signature of the trusted third party TP on a message including R′ A , R B , Res GB and Res GA , TokenTA 1 includes a signature of the trusted third party TP on a message including R′ A and Res GB , and TokenTA 2 includes a signature of the trusted third party TP on a message including R B and Res GA ; and

R′ A is a random number generated by the entity A included in a message 2 ; and R B is the random number generated by the entity B included in the message 1 , and the message 2 is a message, including the identity I GA of the group GA, sent to the trusted third party TP by the entity A upon reception of the message 1 .

Furthermore TokenTA=sS T (R′ A ∥R B ∥Res GB ∥Res GA ∥Text 3 ), where Text 3 is an optional text, and sS T is the signature of the trusted third party TP.

Furthermore TokenTA 1 =sS T (R′ A ∥Res GB ∥Text 4 ) and TokenTA 2 =sS T (R B ∥Res GA ∥Text 3 ), where Text 3 is an optional text, and sS T is the signature of the trusted third party TP.

Furthermore the second token includes a token TokenAB including R A , R′ A , Res GB , Res GA , TokenTA and a signature of the entity A on a message including GA, R A , GB, R B , Res GB , Res GA and TokenTA; or

The second token includes R A , Res GA , TokenTA 2 and a signature of the entity A on a message including GA, R A , GB, R B and TokenTA 2 ; and R A is a random number generated by the entity A included in the message 4 .

Furthermore TokenAB=R A ∥R′ A ∥Text 7 ∥Res GB ∥Res GA ∥TokenTA∥sS A (GA∥R A ∥GB∥R B ∥Res GB ∥Res GA ∥TokenTA∥Text 6 ), where Text 6 and Text 7 are optional texts, and sS A is the signature of the entity A.

Furthermore TokenAB=R A ∥Res GA ∥Text 7 ∥TokenTA 2 ∥sS A (GA∥R A ∥GB∥R B ∥TokenTA 2 ∥Text 6 ), where Text 6 and Text 7 are optional texts, and sS A is the signature of the entity A;

Furthermore the third token includes TokenBA including a signature of the entity B on a message including GB, R B , GA and R A ; and

R A is the random number generated by the entity A included in the message 4 ; and R B is the random number generated by the entity B included in the message 1 .

Furthermore TokenBA=Text 9 ∥sS B (GB∥R B ∥GA∥R A ∥Text 8 ), where Text 8 and Text 9 are optional texts, and sS B is the signature of the entity B.

Furthermore the message 1 further includes an optional text.

Furthermore the random numbers are replaced with time labels or sequence numbers.

Referring to FIG. 6 , an embodiment of the invention further provides a trusted third party apparatus including:

A message receiving unit 60 configured to receive a message 2 sent by an entity A, where the message 2 includes an identity I GA of a group GA where the entity A resides;

A group verifying unit 61 configured to verify the group GA against I GA for legality upon reception of the message 2 ; and

A message receiving unit 62 configured to return a message 3 to the entity A, where the message 3 includes a verification result Res GA of the group GA and a first token including a signature of the trusted third party apparatus.

Furthermore the group verifying unit 61 is further configured:

When the message 2 further include I GB , to verify a group GB against I GB for legality, where the message 3 further includes a verification result Res GB of the group GB.

Furthermore the group verifying unit 61 is further configured:

If I GA in the message 2 is a distinguishing identifier GA of the group GA, to search for a valid public key PublicKey GA of the group GA, and if it is found, to determine GA as being legal; otherwise, to determine GA as being illegal; and

If I GA in the message 2 is a certificate Cert GA of the group GA, to check the certificate Cert GA for validity Valid GA , and if Cert GA is valid, to determine GA as being legal; otherwise, to determine GA as being illegal.

Furthermore the group verifying unit 61 is further configured:

if I GB in the message 2 is a distinguishing identifier GB of the group GB, to search for a valid public key PublicKey GB of the group GB, and if it is found, to determine GB as being legal; otherwise, to determine GB as being illegal; and

If I GB in the message 2 is a certificate Cert GB of the group GB, to check the certificate Cert GB for validity Valid GB , and if Cert GB is valid, to determine GB as being legal; otherwise, to determine GB as being illegal.

Furthermore the first token includes a token TokenTA, or the first token includes tokens TokenTA 1 and TokenTA 2 , where:

TokenTA includes a signature of the trusted third party TP on a message including R′ A , R B , Res GB and Res GA , TokenTA 1 includes a signature of the trusted third party TP on a message including R′ A and Res GB , and TokenTA 2 includes a signature of the trusted third party TP on a message including R B and Res GA ; and

R′ A is a random number generated by the entity A included in the message 2 ; R B is a random number generated by an entity B included in a message 1 ; and the message 1 is a message, including I GB , sent by the entity B to the entity A.

Furthermore TokenTA=sS T (R′ A ∥R B ∥Res GB ∥Res GA ∥Text 3 ), where Text 3 is an optional text, and sS T is the signature of the trusted third party TP.

Furthermore TokenTA 1 =sS T (R′ A ∥Res GB ∥Text 4 ) and TokenTA 2 =sS T (R B ∥Res GA ∥Text 3 ), where Text 3 is an optional text, and sS T is the signature of the trusted third party TP.

Although the preferred embodiments of the invention have been described, those skilled in the art benefiting from the underlying inventive concept can make additional modifications and variations to these embodiments. Therefore the appended claims are intended as being construed as encompassing the preferred embodiments and all the modifications and variations coming into the scope of the invention.

Evidently those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus the invention is also intended to encompass these modifications and variations thereto so long as the modifications and variations come into the scope of the claims appended to the invention and their equivalents.