CN101977380A - Wireless Mesh network identification method - Google Patents

Abstract

The invention discloses a wireless Mesh network identification method. The identification method is based on a certificateless public key cryptography system and mainly comprises the following steps of: (1) initializing by a credible third party and then publishing a known system parameter; (2) carrying out intra-domain registration by a domain access point at a domain manager, and periodically broadcasting a known parameter identification message 1; (3) passing the legality of a domain parameter certificate in the known parameter identification message 1 published by the credible third party by a user, then identifying the legality of an intra-domain public key of the domain access point by utilizing a domain parameter, and finally checking a timestamp signature of the domain access point according to the intra-domain public key of the domain access point to finish identifying the domain access point; after the identifying work is ended, sending a message 2 to the domain access point; (4) after the domain access point receives the message 2, checking the legality of a user long-term public key in the message 2, and then checking the timestamp signature of the user by utilizing the user long-term public key to finish identifying the user; and then sending a message 3 to the domain manager.

Description

A kind of wireless Mesh netword authentication method

Technical field

The present invention relates to a kind of wireless network secure technology, be specially a kind of authentication method of wireless Mesh netword.This authentication method is based on no certificate public key cryptography (Certificateless Public Key Cryptography is called for short CL-PKC).

Background technology

Because the opening of the whole network architecture, safety issue have become restriction wireless Mesh netword (Wireless Mesh Networks, WMN) Fa Zhan bottleneck.The security mechanism that is applied at present among the WMN is the IEEE working group 802.11i mechanism that defined is continued to use in the Draft 802.11s D1.01 standard of announcing in April, 2007, promptly shake hands and carry out access authentication and key agreement by traditional 802.1X and four steps, and in this traditional verification process, finally be used to generate master key (the Primary Master Key of session key, PMK) be by certificate server (Authentication Server, AS) generate and be directly passed to mesh router (mesh-router) by escape way, this obviously is that user (clients) is reluctant to see, because AS knows PMK and can generate the session key between clients and the mesh-router, wherein all the elements all can be obtained by AS, even AS is honest, in case but AS is broken through by opponent (adversary) and control fully, its PMK also will expose so, all session content will be no longer safe also, and this shows that the method does not possess forward secrecy.Other safety defect comprises that also wireless user's identity is difficult for the authentication operation complexity of protection, PKI, key manageability etc. not in the wildcard authentication.

Prior art related to the present invention has: WLAN (wireless local area network) (Wireless Local Area Network, WLAN) safety standard 802.11i.Support two kinds of authentication modes 802.11i be responsible for the 802.1X standard of access authentication aspect in the safety standard, promptly based on the authentication mode of public key certificate with based on the authentication mode of wildcard.But this dual mode all more or less exist some problems, preceding a kind of mode exists the associative operation that public key certificate is safeguarded, there is the key escrow problem in then a kind of mode.On the basis of 802.11i, 802.11s has defined effective Mesh security association, and (Efficient Mesh Security Association EMSA) realizes inserting safely of WMN.The EMSA security framework has been continued to use the safe practice in the 802.11i standard when finishing certification work, be faced with that traffic redundancy, user identity are difficult for protection, do not possess forward secrecy, public key certificate safeguard complicated, have a challenge such as key escrow problem.

The Cao Chun outstanding person of Xian Electronics Science and Technology University has proposed access, switching and roaming authentication agreement (the 3 Parties Authentication and Key Exchange Protocol of WMN; 3PAKE) (Cao Chunjie. the authentication of provable security and IKE design and analysis. Xian Electronics Science and Technology University's thesis for the doctorate; 2008); wherein user identity protection and problem such as forward secrecy have been solved; but agreement has been continued to use authentication public key and the wildcard pattern of 802.11i, still can't avoid key escrow problem and public key certificate maintenance issues.

Summary of the invention

At the deficiencies in the prior art, the technical problem that quasi-solution of the present invention is determined is that a kind of wireless Mesh netword authentication method is provided.This authentication method is based on no certificate common key cryptosystem, utilize CL-PKC principle design agreement, and finish the formal proof of protocol safety with the approved safe method, have and avoid the key escrow problem, guarantee wireless user's anonymity, avoid public key certificate to safeguard and have characteristics of approved safe attribute.

The technical scheme that the present invention solve the technical problem is: design a kind of wireless Mesh netword authentication method, this authentication method is based on no certificate common key cryptosystem, and key step comprises: { F, G ₁, G ₂, q, P _Pub, H ₁, H ₂.

(1) TTP of trusted third party (Trusted Third Party) initialization, public address system known parameters then; User (client) and domain manager (operator) are finished registration process under the line at the trusted third party place, and client obtains its long-term private

With long-term PKI

Operator obtains its long-term private Long-term PKI

With the field parameter certificate

(, be used to accept the field parameter of mesh-router registration and return corresponding field parameter certificate) by TTP so when TTP registers, submit to because operator need provide registration to the mesh-router in the territory of living in;

(2) access point mesh-router in territory registers in the operator place carries out the territory, obtains private key in its territory

With PKI in the territory

And periodic broadcast known parameters authentication message 1;

(3) client is at first by field parameter certificate in the known parameters authentication message 1 of TTP issue

Legitimacy, utilize the field parameter authentication in the field parameter certificate then

Legitimacy, last basis

Verify the signature of mesh-router, thereby finish authentication, after the certification work end to message 1, send message 2 to mesh-router to mesh-router to timestamp;

(4) after mesh-router receives message 2, in the known parameters checking message 2 by TTP

Legitimacy, and utilize

Verify the signature of client, thereby finish authentication, send message 3 to operator then client to timestamp;

(5) it is contained that operator will utilize message 3

With

Generate and share key F (C _i, O _i) the secret M of encryption section, promptly generate message 4, and send to client, receive message 4 after, client uses

With

Generate and share key F (O _i, C _i) untie the secret M of enciphered message acquisition part, utilize the secret M of this part, client generates private key in its territory in this authenticated domain

With PKI in the territory

(6) client utilizes private key in the territory that has generated With PKI in the territory of mesh-router

Generate the shared key F ' (C between client and the mesh-router _i, MR _i) and will by message 5 Inform mesh-router.After receiving message 5, this shared key F ' (C _i, MR _i) the mesh-router place by the territory of mesh-router in private key

With PKI in the territory of client

Generate.

Compared with prior art, the present invention utilizes Authentication and Key Agreement (the Authentication and Key Agreement between PKI, private key, signature mode and the participant of each participant in the principle design agreement of CL-PKC, AKA) process, thereby make the user side that is linked into for the first time among the WMN only finish the AKA process alternately, and the required interaction times of AKA process of being carried out in the switching of user side subsequently with when setting up user side self-organizing (ad hoc) network is less by a spot of three parts.The network model that the present invention is based on the basic theories of CL-PKC and WMN has designed the registration process of each entity and the authentication key agreement method of WMN among the WMN, has the communication redundancy of reduction, avoids the key escrow problem, guarantees wireless user's anonymity, avoids public key certificate to safeguard and has characteristics such as approved safe attribute.

Description of drawings

Fig. 1 is the registration model schematic diagram of a kind of embodiment of wireless Mesh netword authentication method of the present invention;

Fig. 2 is the process schematic diagram of AKA agreement between the territory of a kind of embodiment of wireless Mesh netword authentication method of the present invention;

Fig. 3 is the process schematic diagram of AKA agreement in the territory of a kind of embodiment of wireless Mesh netword authentication method of the present invention;

Fig. 4 is the process schematic diagram of AKA agreement between the user of a kind of embodiment of wireless Mesh netword authentication method of the present invention.

Embodiment

Further narrate the present invention below in conjunction with embodiment and accompanying drawing thereof:

At first introduce the rudimentary knowledge of bilinearity mapping among the CL-PKC that the present invention uses:

If G ₁And G ₂Be the cyclic group on two q rank, wherein q is a big prime number (more than 160 bits).G ₁And G ₂Be respectively module and multiplicative group.G ₁, G ₂On bilinearity mapping e:G ₁* G ₁→ G ₂Be meant the mapping of satisfying following character:

● bilinearity: e (aP, bQ)=e (P, Q) ^Ab, wherein P, Q ∈ G ₁, a, b ∈ N;

● non-degeneracy: if P, Q ∈ G ₁Not G ₁Identical element, then e (P, Q) ≠ 1;

● computability: have an effective algorithm, for P, Q ∈ G arbitrarily ₁, can effectively calculate e (P, Q).

Available bilinearity is mapped with Weil mapping and the Tate mapping on elliptic curve and the Abel algebraic variety at present.Following mathematical problem has constituted the foundation for security of the present invention's design.

● G ₁On Computational Diffie-Hellman (CDH) problem: establish G ₁Be to be the cyclic group on rank with q, q is a big prime number, and P is G ₁Generator.Picked at random＜aP, bP〉(a, b ∈ Z _q ^*And unknown), make and calculate abP ∈ G ₁Difficulty.

● Bilinear Diffie-Hellman (BDH) problem: establish G ₁And G ₂Be two cyclic groups that rank are q, q is a big prime number.E:G ₁* G ₁→ G ₂Be a bilinearity mapping, P is G ₁Generator.Picked at random＜aP, bP, cP〉(a, b, c ∈ Z _q ^*And unknown), and feasible calculating e (P, P) ^Abc∈ G ₂Difficulty.

Wireless Mesh netword authentication method (the Certificateless Wirless Mesh Networks Authentication Scheme of the present invention's design, be called for short CWMNA or authentication method, referring to Fig. 1-4), this authentication method is made up of " system initialization " and " authenticated key agreement " based on no certificate public key cryptography (CL-PKC).Wherein " system initialization " comprises that system parameters makes up and each entity initialization in the WMN network trust model; " authenticated key agreement " then defined authentication and session key agreement in the basic territory, authentication of switching between the territory and session key agreement, and two-way authentication between the user and session key agreement.Specifically describe implementation step below:

1. system initialization

(1) trust model and notion

In the present invention, because the design of CWMNA depends on mixed type WMN network model, when the trust model of design CWMNA, also used the notion in territory.At first, in trust model, there is a trusted third party (TTP) that serves as by off-line CA (Certificate Authority), it will provide registration for all users (client) and domain manager (operator), after finishing registration, client and operator obtain its long-term private and long-term PKI.As mentioned above, trust model is turned to different trust domain, each trust domain is by the authentication and the session key agreement work of different domain manager (operator) leading subscriber.Operator is after TTP has finished registration, obtain long-term PKI and long-term private, because also need the mesh-router in territory of living in that registration is provided, be used to accept the field parameter of mesh-router registration and return corresponding field parameter certificate by TTP so when TTP registers, submit to.Itself does not authenticate operator user identity, but utilizes the mesh-router register in its management domain to replace it to finish certification work to client.Mesh-router becomes a WMN access point in this operator management domain obtaining in its territory private key in the PKI and territory after the registration of having finished at operator.Client then is after the two-way authentication of finishing with mesh-router, finishes in the territory at operator place registration process and obtains in its territory private key in the PKI and territory.Wherein in long-term private and long its PKI and the territory in PKI and the territory the concrete effect of private key will set forth in next part.Trust model is shown in figure one.

The operator note is O _i, the client note is C _iUser C _iAfter the registration of TTP place, the long-term PKI that is generated, long-term private remember that respectively doing note does O _iRemember respectively in the long-term PKI of TTP place registration gained, long-term private and to do In addition O _iThe testimonial material of the field parameter that can also obtain, note is done

At O _iRegistration in the territory of being managed adds O _iThe mesh-router note in territory is done

After registration process finishes,

To generate in its territory private key in PKI, the territory, note is done respectively

And C _iWill generate in its territory private key in PKI, the territory after by two-way authentication, note is done respectively

In addition, will use symmetric key K that information M is encrypted note and be E _K(M), will use private key SK that the signature note of information M is SIG _K(M), utilize key K that the hash signature note of information M is h _K(M).

(2) TTP initialization

TTP is responsible for accepting the registration of client and operator, and returns the field parameter certificate of its long-term PKI, long-term private and operator respectively.Announce that simultaneously some known parameters make each participant can verify a certain long-term PKI or a certain field parameter certificate whenever and wherever possible, and a certain long-term private is to the legitimacy of the signature of certain information.These known parameters are defined as follows: at first select big prime number q and be the module G on rank with q ₁Be the multiplicative group G on rank with q ₂, and G ₁Generator P, and F:G ₁* G ₁→ G ₂Be G ₁And G ₂On bilinearity mapping.Also to select a TTP master key s ∈ Z _q, and calculate P _Pub=sP ∈ G ₁If H ₁: 0,1} ^*→ G ₁, H ₂: Z _q* G ₁* 0,1} ^*→ Z _qBe hash function.At last, TTP announces that its known parameters is as follows: { F, G ₁, G ₂, q, P _Pub, H ₁, H ₂}

(3) client registration

User i provides its identity information ID _iAnd send to TTP, after TTP is known this parameter, this parameter is done Hash operation get

And with the master key s of system with

Multiply each other

And should

Return to user i as the part secret.After user i receives the part secret of returning from TTP, will select own part secret x at random _Ci∈ Z _qAnd multiply each other with it its long-term private

Generate its long-term PKI then The method of verifying its legitimacy is as follows:

Its corresponding long-term private to the signature of information M is: The certifying signature method is as follows:

(4) operator registration

The registration process of operator and client registration are similar, send oneself

Give TTP, the returning part secret

After knowing this secret, operator selects the secret x of the part of oneself _Oi, then both are multiplied each other the private key SK of operator _Oi=x _OiSQ _Oi, the PKI PK of generation simultaneously oneself _Oi=(x _OiSP, x _OiQ _Oi).Because mesh-router also need be provided providing operator registration in the territory in, thus at operator in the process of TTP registration, also need provide the field parameter of oneself to TTP, TTP will be by returning corresponding field parameter certificate, next this field parameter witnessed.The field parameter system of selection is as follows: select big prime number q ', and be the addition cyclic group G on rank with q ' ₁' and multiplication loop group G ₂', select P ' as G simultaneously ₁' generator.And bilinearity mapping F ' satisfies F ': G ₁' * G ₁' → G ₂'.In addition, establish new hash function H ₁' and H ₂' be respectively H ₁': 0,1} ^*→ G ₁', H ₂': Z _q' * G ₁' * { 0,1} ^*→ Z _q', calculate at last

Wherein

Generating field parameter subsequently is

The field parameter certificate that TTP returns is as follows: domain-params-cert _Oi={ domain-params, sH ₁(domain-params) } method of checking field parameter certificate is: F (P, sH ₁(domain-params))=F (H ₁(domain-params), P _Pub).

(5) mesh-router registration

Similar to the registration process of operator and client, be the parameter difference that mesh-router uses when registration, detailed process is as follows: mesh-router sends the identity of oneself

Give the operator in territory, place, after receiving the identity information of mesh-router, operator can carry out Hash operation to its identity information and get

Will after finishing

Part secret as mesh-router returns to mesh-router.Mesh-router generates the part secret of oneself subsequently

Multiplying each other with the part secret of the mesh-router that returns to obtain private key in its territory, promptly

And PKI in the territory corresponding with it

Verification method is:

Private key to the signature of information M is in its territory The method of verifying this signature is as follows: $F(z_{{\mathrm{MR}}_i}{x_{O_i}}^{\′}{Q}_{{\mathrm{MR}}_i}{H_2}^{\′}\left(M\right),{Q_{O_i}}^{\′})=F({H_2}^{\′}\left(M\right)z_{{\mathrm{MR}}_i}{Q}_{{\mathrm{MR}}_i},{x_{O_i}}^{\′}{Q_{O_i}}^{\′}).$

2. authenticated key agreement

(1) AKA between the territory

Be the convenient protocol procedures of describing, request inserted the client note of WMN and be C ₁, be responsible for C ₁Provide the mesh-router note of access service to be MR ₁, C ₁The operator note in the WMN territory of being inserted is O ₁The AKA process is as shown in Figure 2 between the territory so.

MR ₁In its range of signal intercycle broadcast message (A.1), this information comprise in have: O ₁The field parameter certificate

MR ₁The territory in PKI

Timestamp timestamp ₁, and use MR ₁Private key in the territory

Signature to timestamp

Receive after this information C ₁With the known parameters of at first utilizing TTP to announce, to O ₁The field parameter certificate

Verify.Prove conclusively credible after, field parameter wherein is right with utilizing

Verify, after checking is passed through, utilize this PKI and timestamp timestamp ₁Right

Verify, after signature verification is also passed through, then prove O ₁And MR ₁All credible.

At C ₁Finish after information (A.1) check, will be to MR ₁Transmission information (A.2).The long-term PKI that wherein comprises the user

Timestamp timestamp ₂, utilize in the field parameter

The user identity value of calculating

And use private key

Signature to timestamp and identity value Wherein, directly do not send C ₁Identity information Be because according to algorithm needs in not generating the process of session key

Cryptographic Hash promptly

So not only save the workload of operator, can also well hide user's identity, effectively protected user's privacy.

MR ₁Receive that information (A.2) will utilize known parameters that TTP announces to C afterwards ₁PKI

Verify that after checking was passed through, binding time stabbed timestamp ₂With the identity information value

Signature to the user

Verify.By after, then finish C to the user ₁Verification process.So far, mutual authentication process is finished.Subsequently, MR ₁Will be by before the WMN network design, the escape way of setting up when territory operator registers will

With

Send to O ₁, i.e. information (A.3).

To O ₁, any information that its phase believer in a certain religion escape way sends receives that so information (A.3) means MR ₁Passed through C ₁Authentication, O ₁Only need to finish to C ₁The territory in registration process, generate in its territory private key in the PKI and territory.To C ₁, having only in the territory that generates oneself private key in the PKI and territory, just can finish and MR ₁The session key agreement process and following territory in the switching verification process.Detailed process: O ₁Receive information (A.3) afterwards, will pass through C ₁PKI With the private key of oneself

Generate O ₁With C ₁Between shared key F (C ₁, O ₁), its generative process: Subsequently, by this secret key encryption C ₁The part secret that needs

The information of getting

This information will be from O ₁Send back MR ₁Again by MR ₁Send C to ₁

After receiving (A.4) information, C ₁By the O that in information (A.1), obtains ₁PKI

With the private key of oneself

Generate shared key F (O between the two ₁, C ₁), its generative process is as follows:

Because calculating the process of sharing key is the bilinearity mapping operations, F (O ₁, C ₁) and F (C ₁, O ₁) equate, prove as

Utilize and to share ciphering key ₁Untie (A.4) and obtain the part secret, generate the secret factor of selecting oneself at random then Be created on private key in the territory in this territory subsequently

PKI in the territory

Can utilize subsequently this territory public and private key to finish and cipher key agreement process, promptly shown in the information (A.5).The shared key that wherein negotiates Generation was stabbed timestamp with binding time after should sharing key ₃Make hash signature

After receiving message (A.5), MR ₁With private key in the territory of utilization oneself

And C ₁The territory in PKI

Generate and share key F ' (MR ₁, C ₁), generative process is as follows

With generation O ₁And C ₁Between shared key similar be bilinearity mapping because generate the method for this shared key, F ' (C then ₁, MR ₁) and F ' (MR ₁, C ₁) equate that it is as follows to derive:

$F^{\′}(C_1,{\mathrm{MR}}_1)=F^{\′}({{\mathrm{SK}}_{C_1}}^{O_1},{{\mathrm{PK}}_{{\mathrm{MR}}_1}}^{O_1})=F^{\′}(z_{C_1}{x_{O_1}}^{\′}{Q_{C_1}}^{\′},z_{{\mathrm{MR}}_1}{Q}_{{\mathrm{MR}}_1})$

$=F^{\′}{({Q_{C_1}}^{\′},Q_{{\mathrm{MR}}_1})}^{z_{C_1}{x_{O_1}}^{\′}{z}_{{\mathrm{MR}}_1}}=F^{\′}(z_{{\mathrm{MR}}_1}{x_{O_1}}^{\′}{Q}_{{\mathrm{MR}}_1},z_{C_1}{Q_{C_1}}^{\′})=F^{\′}({{\mathrm{SK}}_{{\mathrm{MR}}_1}}^{O_1},{{\mathrm{PK}}_{C_1}}^{O_1})=F^{\′}({\mathrm{MR}}_1,C_1).$

Utilize then and should share key and timestamp timestamp ₃, verify whether this signature is effective.If effectively, then prove C ₁Success generates shares key, and this shared key is promptly as C ₁And MR ₁Between session key use.So far, the AKA process prescription finishes between the territory.

(2) AKA in the territory

Achievement above having had is done the basis, and the AKA process just can have been finished very rapidly in the territory, supposes user C ₁From MR ₁Range of signal in move to MR ₂Range of signal in, the user will be interrupted and MR ₁Communication then and MR ₂Carry out the AKA process.Concrete steps are as shown in Figure 3:

MR ₂At its range of signal intercycle broadcast message (B.1), wherein content and MR ₁The information (A.1) of broadcasting is similar.User C ₁After receiving this information, carry out being similar to for one time to the performed verification operation of information (A.1).Promptly prove conclusively MR after finishing checking ₂Legal effectively after, utilize oneself territory private key

And MR ₂The territory in PKI

Carry out the work of one time similar (A.5), wherein be used for the key of hash signature Send information (B.2) subsequently and give MR ₂MR ₂After receiving information, checking earlier

Legitimacy, by after can with private key in the territory

Generate key

Proof procedure is as follows: $=F^{\′}(z_{{\mathrm{MR}}_2}{x_{O_1}}^{\′}{Q}_{{\mathrm{MR}}_2},z_{C_1}{Q_{C_1}}^{\′})=F^{\′}({{\mathrm{SK}}_{{\mathrm{MR}}_2}}^{O_1},{{\mathrm{PK}}_{C_1}}^{O_1})=F^{\′}({\mathrm{MR}}_2,C_1)$

After utilizing the intact hash signature of this key authentication, can prove conclusively session key F ' (C to timestamp ₁, MR ₂) successfully generate.So far, switching and cipher key agreement process are finished in the territory.

(3) AKA between the user

Mention at network model, the important difference of WMN network and traditional WLAN is exactly that numerous client in the WMN territory can an ad hoc of self-organizing network, carries out direct communication by unified low frequency signal then.In design,, all obtained in oneself the territory private key in the PKI and territory because each user is when access authentication procedure is finished.In the process of forming ad hoc network, public, private key in the territory that utilizes each user to generate is authenticated and session key agreement work finishing so.Its course of work is as shown in Figure 4:

At first, to user C ₁, can obtain PKI in the territory of other users in this territory from the mesh-router of its access there, and be responsible for that the mesh-router of access service is also obligated to provide these data to the user; C ₁Inquire C ₂The territory in PKI

Private key in the territory of utilization simultaneously oneself

Can generate shared key between the two

The generation method is identical with the front introduction method.And then utilize and to carry out hash signature to timestamp by shared key; Send to C at last with the synthetic message (C.1) of this three part, and with this message ₂, C ₂Receiving will be according to C after the information (C.1) ₁The territory in private key in the territory of PKI and oneself Generate and share key

This key and F ' (C ₁, C ₂) equate proof procedure:

$=F^{\′}{({Q_{C_1}}^{\′},{Q_{C_2}}^{\′})}^{z_{C_1}{x_{O_1}}^{\′}{z}_{C_2}}=F^{\′}(z_{C_2}{x_{O_1}}^{\′}{Q_{C_2}}^{\′},z_{C_1}{Q_{C_1}}^{\′})=F^{\′}({{\mathrm{SK}}_{C_2}}^{O_1},{{\mathrm{PK}}_{C_1}}^{O_1})=F^{\′}(C_2,C_1)$

Utilize and to share key and timestamp timestamp _a, C ₂Can verify the signature in the message (C.1)

After the signature verification success, C ₂To set up and C ₁Communicate to connect, and session key is exactly F ' (C ₂, C ₁).

So far, the Authentication and Key Agreement process between the user is finished.

In design agreement CWMNA, client and operator are in the process of carrying out the registration of TTP place, TTP returns to just their needed part secrets of client and operator, and thereby client and operator are receiving that the later secret factor separately of just having selected respectively of part secret has separately generated long-term private separately and long-term PKI in this locality, so that is to say TTP and do not know client and the secret factor of operator has no way of obtaining the long-term private of client and operator, therefore avoided the key escrow problem at all.On the other hand, just because of in CL-PKC, client and operator are PKIs obtained the secret territory that just generates separately of part from TTP in, and TTP announces a known parameters simultaneously, any participant of wanting to verify client or the long-term PKI legitimacy of operator only need utilize the known parameters of this TTP to carry out the bilinearity mapping operations and get final product.User's anonymity carries out embodying in the access authentication procedure and guaranteeing the user, the user is when having passed through authentication and carry out registering in the territory, because registration process only needs the cryptographic Hash of user identity ID and is not user ID itself in the territory, so what client transmitted by authentication the time in the agreement only is the cryptographic Hash of ID own, therefore concerning mesh-router and operator, just know the client identity legal and and do not know the concrete identity ID of client, so user's anonymity has obtained appropriate assurance.

The contrast of protocol capabilities of the present invention:

The performance index of an agreement mainly comprise two parts: communication overhead and computing cost.Wherein, communication overhead is mainly reflected on the message number, and computing cost is mainly reflected on the bigger public key operation of operand.Table 1 has provided CWMNA in the territory in the authenticated key agreement process (other 2 kinds of authenticated key agreements have expense still less) and the performance comparison between three kinds of authentication modes of existing 802.1X:

Table 1: protocol capabilities contrast table

As can be seen from Table 1, because CWMNA uses the bilinearity mapping techniques in design, therefore the amount of calculation of the module exponent computing carried out of amount of calculation of carrying out when checking operators and mesh-router identity concerning the user and conventional authentication mode and public key signature and certifying signature is suitable, but that the signature process of being done in CWMNA is based on elliptic curve and only be to do once simple scalar to take advantage of calculating, so the amount of calculation of clients is less relatively among the CWMNA.In CWMNA, with concentrate in the EMSA authentication mode Mesh key distribution person (Mesh Key Distributors, MKD) and the certification work of AS be distributed among numerous mesh-router and finish.In sum, the computing cost of CWMNA almost with the 802.1X framework in employed several authentication modes maintain an equal level; The message wheel number of CWMNA has only 3 to take turns, and has minimum communication overhead.

The formal proof of authentication protocol of the present invention:

The present invention proves by the fail safe of UC security model to CWMNA.

Because the theoretical foundation of design CWMNA is no certificate public key cryptography (CL-PKC), and in the process of design agreement, the secret means of a large amount of utilization parts are finished the negotiation of session key.So, select document (D.Boneh and M.Franklin.Identity-based Encryption from the Weil pairing.SIAM Journal of Computing, 2003,32 (3): 586-615.Extended abstract in Advances in Cryptology--Crypto 2001.LNCS 2139, Heidelberg:Springer-Verlag, 2001.213-229.) (Dan Bonei and Ma Te Franklin. based on the right encryption of Weil based on identity. the computational mathematics journal, 2003,32 (3): 586-615. cryptography progress expansion digest---2001 cryptography meetings. computer science teaching materials 2139, Heidelberg: Springer Verlag publishing house, 2001.213-229.) in " judging bilinear Diffie-Hellman (DBDH) problem " in cited many bilinearity mapping difficulty problems as the theoretical foundation of proof, and make rational indistinguishability according to this problem and suppose that promptly DBDH supposes.

Before proposing hypothesis, do earlier as giving a definition:

Definition 1:{0,1} ^kExpression length is the binary sequence set of k.

Definition 2:N ← ^RS represents picked at random element N from S set.

Definition 3: can ignore: claim that a real function ε (k) is insignificant,, have k if for any c＞0 _c＞0 makes to all k＞k _cε (k)＜k is arranged ^-c

Definition 4: polynomial time indistinguishability: claim X={X _n| n ∈ N} and Y={Y _n| two sample spaces of n ∈ N} are polynomial time undistinguishables, if any probability polynomial time algorithm D, | Pr[D (X _n, N)=1]-Pr[D (Y _n, N)=1] | be negligible.The polynomial time indistinguishability is also referred to as the calculating indistinguishability.Definition 5: judge bilinearity DH problem (DBDHP)

Given (P, aP, bP.cP, γ), and a wherein, b, c ← ^RZ _q ^*, γ ← ^RG ₂, if γ=e (P, P) ^Abc, output "Yes", otherwise output "No".In view of the above, can draw corresponding D BDH supposes as follows: any one PPT algorithm A is at group G ₁, G ₂The interior advantage that solves DBDHP is defined as:

In view of the above, can get:

The DBDH hypothesis: for any PPT algorithm A,

Can ignore.

According to defining 5 DBDH hypothesis and defining 4, the following form of DBDH hypothesis is arranged:

Select big prime number q, and be the addition cyclic group G on rank with q ₁And be the multiplication loop group G on rank with q together ₂, define bilinearity mapping e:G simultaneously ₁* G ₁→ G ₂, P is group G ₁On generator, a, b, c are from Z _q ^*In evenly choose, γ is from group G ₂Middle picked at random.Then for any polynomial time algorithm D, Q ₀=(q, P, aP, bP, cP, e (P, P) ^Abc): a, b, c ← Z _q ^*And Q ₁=(q, P, aP, bP, cP, γ): a, b, c ← Z _q ^*, γ ← G ₂Probability distribution be to calculate undistinguishable.

At first design agreement CWMNA of the present invention is carried out abstractly, process is as follows:

Define symbol:

Authentication?Server(AS)，?

Authentication(A)?ID _R：Supplicant(S)。

It is the legitimacy testimonial material that generates that AS registers from TTP there.

The authentication material of a certain A in AS institute control domain uses private key in its territory

Cryptographic Hash to message is signed, and guarantees message integrity and finishes authentication.

The authentication material of user side S uses its long-term private SK _RCryptographic Hash to message is signed, and guarantees message integrity and finishes authentication.

Shared key between user side S and the AS both had been used for the encryption section secret

Also be used for authenticating the AS identity.

Shared key between user side S and the connector A is used for finishing key earlier and generates conclusive evidence, and the back is as the session key session information in future.

CWMNA agreement of the present invention is conceptualized as:

$I\→R:{\mathrm{Cert}}_{I_1},{\mathrm{Auth}}_{I_2}$

R→I：Auth _R

$I\→R:{\mathrm{TS}}_3,E_{K_1}\left(P_{{{\mathrm{SK}}_R}^{\′}}\right)$

$R\→I:{\mathrm{TS}}_4,h_{K_2}\left({\mathrm{TS}}_3\right|\left|{\mathrm{TS}}_4\right),$

Theorem 1: agreement π safety has realized ideal function F under the true model _KE, therefore to any environment machine Z, equation REAL _{π, A, Z}≈ IDEAL _{FKE, S, Z}All set up, claim that then design agreement π is a UC safety.

The thinking of agreement π fail safe proof: the ideal function F that at first provides cipher key change _KEAnd difference design agreement π ' and agreement ρ _S, agreement ρ wherein _SSafety has realized signature ideal function F _SigIdentification protocol π ' is at mixed model F subsequently _Sig-hybird is by calling F _SigSafety has realized F _KE, at last with agreement π ' and agreement ρ _SMake up, by UC security combination theorem, prove combination protocol and design agreement π equivalence, agreement π has realized F under real model _KE

Lemma 1: make Sig=(gen, sig, ver) be as document (Canetti R, Krawczyk H.Universally composable notions of key exchange and secure channels[G] .LNCS 2332:Proc of the Advances in Cryptology EUROCRYPT 02.Berlin Springer, 2002:337-351.) (carry in the card, Kerafyrm very restrains. the general notion capable of being combined of cipher key change and escape way [G]. and computer science teaching materials 2332: cryptography progress---European cryptography meeting 02. Berlin Springer, 2002:337-351) Ding Yi signature, so under true environment, agreement ρ _SAssailant for static state can realize F safely _Sig, and if only if, and S can resist the forgery of selection message existence, and structure can be realized F safely _SigAgreement ρ _S, as follows:

Agreement ρ among the Ideal-life _s

Agreement participant P _i, P _j, operation is based on signature algorithm Sig=(gen, sig, agreement ρ ver) _s, carry out mutual.

● P _iReceive input (signer, id) back execution algorithm gen keeps signature key s, v sends to P with authentication secret _j

● work as P _jNeed sign to certain message m, then with (sign, id m) send to P _i, P _iMake σ=sig (s, m), and will (m σ) sends to P for signature, id _j

● work as P _jNeed verify certain message m signature, then with (m σ) sends to P for verify, id _i, P _iThen output (verified, id, m, ver (v, m, σ)) to P _j

Lemma 2: if DBDH hypothesis is set up, and message authentication algorithm is safe, and agreement π ' is at model F _SigThe following function F of realizing ideal safely of-hybird _KE

Proof: at first design F _SigThe agreement π ' that carries out among-the Hybird, as follows.

Make that q is big prime number, G ₁Be that q is the addition cyclic group on rank, P is G ₁On generator, agreement participant P _iAnd P _j, at mixed model F _SigThe operation agreement π ' among-Hybird.

As agreement promoter P _iObtain input (P _i, P _j, sid), then send initialization information (signer, 0, sid) give F _Sig, in like manner, as protocol responses person P _jObtain input (P _j, P _i, sid), then send initialization information (signer, 1, sid) give F _Sig

Agreement promoter P _iOrganizational information

And computing information M ₁Cryptographic Hash h (M ₁), send (sign, 0, sid, h (M ₁)) to F _Sig, obtain it and return signature δ _i, send to P at last _jInformation (P _i, sid, " start " M ₁, δ _i).

Agreement recipient P _jAfter receiving start information, utilize known parameters to know

Correctness.Computing information M subsequently ₁Cryptographic Hash h (M ₁), send (verify, 0, sid, P _i, h (M ₁), δ _i) to F _Sig, after checking is passed through, with organizational information

Calculate h (M ₂).Transmission information (sign, 1, sid, h (M ₂)) to F _Sig, get its signature return value δ _j, send to P at last _iInformation (P _j, sid, M ₂, δ _j).Checking is passed through when meanwhile, receiving start information

Parameter can be provided

Utilize P again _jLong-term private SK _R, generate and share key K ₁Standby.

P _iReceive P _jReturn information after, computing information M ₂Cryptographic Hash h (M ₂), send (verify, 1, sid, P _j, h (M ₂), δ _j) to F _Sig, after checking is passed through, utilize P _jLong-term PKI PK _RAnd I ₁Long-term private

Generate and share key K ₁Simultaneously by information M ₂In comprise

Can generate and to be returned to P _jThe part secret

Use key K subsequently ₁The encryption section secret

With time stamp T S ₃, formation information

With information M ₃Send to P _j

P _jReceive information M ₃After will utilize the key K that has generated ₁The information of untiing obtains the part secret

And generate P in view of the above _jThe territory in private key

And PKI in the corresponding territory

Utilize private key in the territory

And I ₂The territory in PKI

Can generate shared key K ₂Rise time is stabbed TS subsequently ₄, and utilize and share key K ₂, to (TS ₃‖ TS ₄) do Hash operation and get

Formation information M ₄, and send to P _iInformation (P _j, sid, M ₄).And local output information (sid, P _i, P _j, K ₁, K ₂).

P _iAfter receiving last information, will utilize

With

Form and share key K ₂, binding time stabs TS ₃With time stamp T S ₄, authorization information M ₄Whether credible, if then local output information (sid, P are passed through in checking _i, P _j, K ₁, K ₂).

Be defined in mixed model F subsequently _SigAssailant H under the-Hybird is configured in the assailant S (promptly being simulator S) under the ecotopia simultaneously.Make for any environment machine Z, its can not differentiate be with simulator S and H and agreement π ' at mixed model F _Sig-Hybird is mutual down, still with S and F _KEUnder Ideal-life, carry out mutual.That is: concerning any environment machine Z, equation

All set up.

For simulator S:

(1). any input from Z all passes to H, and the output of any H all can be used as the output of S and can be read by Z.

(2). when S from F _KEInformation (sid, P receive in the place _i, P _j, role), learn P _iAnd P _jInitiated the authenticate key exchange process.S will simulate F _SigF under the-hybird model _SigWith the π ' that under this model, carries on an agreement, and the input of given same-type.And S allows H and P _i, P _jExecuting rule and Z according to agreement π ' are mutual.Meanwhile, S can activate F _SigGenerate corresponding signature value δ.

(3). certain the participant P in π ' _iProduced local output, and this moment another participant P _jDo not captured, S is with F so _KEOutput send to P _iIf P _jCaptured, then F _KEAllow part S determine key, S will utilize front P _iThe P of emulation is determined in output _i, P _jThis locality output key.

(4). when carrying out, H captures P _iOperation, S captures P equally _iIf F _KEGiven participant P _iSent key, then S will obtain this key.If P _iAnd P _jAll do not produce local output, then S passes to H with its internal state, comprises their secret choosing value.If P _iAnd P _jWherein a side has produced local output, then wipes their temporary private, and S will directly pass to H to this locality output key.

The validity of simulator S.Suppose to exist an environment machine Z ', can with can not ignore probability distinguish under the mixed model mutual and ideal model down alternately, promptly

Be 1/2 to add ε, ε can not ignore.Construct a circuit sectionalizer D (as follows) so, utilize this environment machine Z ' to crack the DBDH hypothesis, and then stipulations are to contradiction.

For circuit sectionalizer D:

(1). select with 1/2 probability, select Q ← { Q ₀, Q ₁, be designated as { q, P, α as the input of D ^*, β ^*, γ ^*.

(2). select immediately τ ← 1,2 ... the previous term of the session number that l}, l can initiate as the assailant.Emulation F then _SigMutual among the-hybird between π ' and H and the environment machine Z.

(3). when H activated a participant set up a new dialogue t (t ≠ τ) or when accepting a piece of news, D represent this participant according to agreement π ' at F _SigCarry out normal mutual among the-hybird.If t=is τ, then D represents P _iTo P _jSend message (P _i, sid, α ^*, δ _i), work as P _jAfter receiving this message, will call F _SigGenerate the signature of its corresponding informance, send to P subsequently _iInformation (P _j, sid, β ^*, δ _i), the last D side of letting on P _i, P _jAll produce local output (sid, P _i, P _j, γ ^*).

(4) if. H has captured a participant, and then D returns to H to the internal state of this participant, if be one of participant of session τ by the participant of being captured, then D exports that a random bit b ' ← { 0,1} also stops.

(5) if. F _SigAfter agreement π ' operation among the-hybird was finished, Z exported b, then D output b '=b and termination.

Execution according to D can draw: if the D input is from Q ₀In select γ so ^*Be the true key of mutual both sides' output under mixed model, the mixed model F that coexists such as its visual angle concerning D _SigThe agreement π ' among-hybird is mutual with assailant H's.If the input of D is from Q ₁In select γ so ^*Be a random value, because F _KEThe mode that generates key is exactly at G ₂Value of picked at random among the group.And the visual angle of D is equal to F under ideal model Ideal-life at this moment _KEMutual with S.According to the principle of circuit sectionalizer D, D successfully distinguishes Q ₀And Q ₁Probability be equal to the probability that environment machine Z ' successfully distinguishes mixed model and ideal model, promptly circuit sectionalizer D can 1/2 adds a probability ε who can not ignore, and successfully distinguishes Q ₀And Q ₁And this is to contradict with the DBDH hypothesis.Must demonstrate,prove.

Lemma 3: make that π ' is model F _Sig-hybird is the operation agreement down, agreement ρ _SFor safety realizes F _Sig, so there is an assailant H in any assailant A, make equation REAL concerning any environment machine Z _{π-ρ S, A, Z}≈ F _Sig-hybird _{π ', H, Z}All set up, i.e. combination protocol π-ρ _SSafe simulation F _SigThe agreement π ' under-hybird.

Lemma 4: under the true environment, combination protocol π-ρ _SWith agreement π equivalence.

Proof: with mixed model F _SigAgreement π ' is to F under the-hybird _SigVisit all change into agreement ρ _SVisit, can draw agreement π '-ρ _SWith agreement π equivalence.

According to lemma 1 to 4, can release theorem 1.Proof finishes.

Agreement have the forward secrecy of improving (Perfect Forward Secrecy, PFS).So-called PFS promptly is: when all communication participants' long-term private all was cracked, former session key was still unaffected.In agreement, the effect that the long-term private of user's long-term private and territory operator plays all is to finish authentication function, as for the generation of the session key in future then is that the user reselects the new secret factor and generates, so even if the long-term private of user's long-term private and operator is all cracked, because the existence of the new secret factor, Adversary still can't be known session key, and former session content is safety still.

Agreement have well-known key safety (Known Key Security, KKS).Even KKS is meant the assailant and has known session key in the past that agreement still can guarantee the safety of current sessions key.In agreement of the present invention, if former session key is cracked, Adversary can obtain former content with this session key so, even but it is F (C that Adversary has this session key ₁, MR ₁) and MR ₁PKI

According to the one-way of bilinearity mapping, want from as the generation of mapping F (C as a result ₁, MR ₁) and one of them parameter

Calculating another parameter is user's territory private key Be impossible.Since user's territory private key has obtained protection, so in following territory in the handoff procedure and the session key that generates of other MR also can not know.

Agreement have non-key reveal camouflage (no Key Compromise Impersonation, Non-KCI).Non-KCI is meant after the long-term private of A is revealed, the assailant A that in agreement, can only disguise oneself as, and can not be to the A all other men that disguise oneself as.In agreement, all be that the mode with safety is carried out under the line to the TTP registration process, and TTP give that each registrant returns all is the part secret, promptly Even Adversary has obtained registrant's long-term private, want to utilize this long-term private to forge other people identity, need from In solve TTP secret factor s come, and this faces big several branch problem of solving problem, and is infeasible in the calculating.So the fail safe target of Non-KCI successfully realizes.

Agreement have non-unknown key share (no Unkown Key Share, Non-UKS).Non-UKS refers to assailant Adversary can make user A think the shared secret with assailant Adversary, in fact is user A and user B shared secret.The agreement of mentioning has in front been finished explicit key authentication, and explicit key authentication just means that can prevent that key is unknown shares.

In brief, the present invention utilizes the basic principle of no certificate common key cryptosystem, and network model during according to the wireless Mesh netword practical application and safety problem have designed registration model and the authentication key agreement method that adapts with it.The invention describes the complete method of wireless Mesh netword access authentication, have the advantages that to reduce communication redundancy, avoid the key escrow problem, guarantee wireless user's anonymity and avoid public key certificate to safeguard.Wireless Mesh netword cut-in method of the present invention adopts that general capable of being combined (Universally Composable, UC) security model has carried out the proof of fail safe, has the characteristics of approved safe design of protocol and relevant security attribute.The present invention does not address part and is applicable to prior art.

Claims (1)

1. wireless Mesh netword authentication method, this authentication method is based on no certificate common key cryptosystem, and key step comprises:

(1) trusted third party's initialization, public address system known parameters then; User and domain manager are finished registration process under the line at the trusted third party place, and the user obtains user's long-term private and the long-term PKI of user, and domain manager obtains its domain manager long-term private, the long-term PKI of domain manager and field parameter certificate;

(2) the territory access point is registered in the domain manager place carries out the territory, PKI in private key and the access point territory, territory in the acquisition access point territory, territory, and periodic broadcast known parameters authentication message 1;

(3) user's legitimacy by field parameter certificate in the known parameters authentication message 1 of trusted third party issue at first, utilize the legitimacy of PKI in the field parameter authenticated domain access point territory in the field parameter certificate then, last signature to timestamp according to public key verifications territory access point in the access point territory, territory, finish authentication to the territory access point, after the certification work end to message 1, send message 2 to the territory access point;

(4) after the territory access point is received message 2, legitimacy by the long-term PKI of user in the known parameters checking message 2 of trusted third party, and utilize the long-term public key verifications user's of user signature to timestamp, and finish authentication to the user, send message 3 to domain manager then;

(5) domain manager will utilize message long-term PKI of 3 contained users and domain manager long-term private to generate shared secret key encryption part secret, promptly generate message 4, and send to the user, after receiving message 4, the user uses the long-term PKI of domain manager long-term private and user to generate identical shared key and unties enciphered message acquisition part secret, utilize this part secret, the user generates in its user domain in this authenticated domain PKI in the private key and user domain;

(6) user utilizes PKI in the territory of private key and territory access point in the user domain generated, the shared key between generation user and the territory access point, and PKI in user's the territory is informed the territory access point by message 5; After receiving message 5, this shared key territory access point place by access point territory, territory in private key and the user domain PKI generate.

Images