CN102882688A - Lightweight authentication and key agreement protocol applicable to electric information acquisition - Google Patents

Abstract

The invention relates to a lightweight authentication and key agreement protocol applicable to electric information acquisition. An identify authentication stage is completed on the basis of communication of a digital certificate of an authentication center of a state grid cooperation of China and a shared key. In a key agreement stage, new and old parameter protection keys which are updated dynamically are utilized, and lightweight operators are utilized for computation, and the key agreement is completed by communication circulations only. In a key updating stage, a session key group and the new and old parameter protection keys are synchronized. During key agreement, parameters are protected alternatively by the new and old parameter protection keys so that nonsynchronous attack can be resisted effectively. The protocol can be analyzed by combination of BAN logic formal analysis and informal analysis methods, can be approved to have safety attributes such as two-way entity authentication, perfect forward security and the like when reaching first-level faith and second-level faith, resists to various attacks, and can complete identify authentication and key agreement in real time effectively on the premises of security guarantee and meet requirements of an electric information acquisition system to key application.

Description

A kind of light-weight authentication key agreement protocol that is applicable to the power information collection

Technical field

Because huge, the broad covered area of power information acquisition system Information Monitoring amount, traditional authenticated key agreement agreement metering expense is large, and communication interaction can't satisfy the demands often.In order to realize the real-time security high efficiency of transmission of electric power data, to utilize State Grid Corporation of China certificate verification center, based on certificate verification and new and old insured key dynamic negotiation mechanism, a kind of light-weight authentication key agreement protocol is proposed, in conjunction with the fractional analysis of BAN logical form and non-Formal Analysis Method agreement is analyzed, identification protocol has two-way entity authentication when reaching one-level faith and secondary faith, the perfect security attribute such as confidentiality forward, resisting various attacks, can be in the situation that guarantees safety real-time high-efficiency finish authentication and key agreement, be applicable to the secure communication of power information acquisition system.

Background technology

The intelligent power System Construction requires during " 12 " in " " 12 " power marketing development plan ", gather coverage rate 100%, 2.2 hundred million of intelligent electric meters are installed, finish 10107 constructions of intelligent community, the communication network that intelligent power relies on covers huge numbers of families.In the power marketing process, the power information acquisition system is the core business system that sales service is used, its Information Monitoring amount is huge, broad covered area, and its collection, transmission, storage, the customer information of processing and using, power information and electricity charge information etc. are not only the core data data of power industry, also relate to the every aspect of social life, has higher confidentiality, illegally using and leaking of information may bring irremediable loss, therefore the requirement of power information security protection also needs to rise to higher level (Chen Shuyong, Song Shufang, Li Lanxin etc. intelligent grid technology summary [J]. electric power network technique, 2009,33 (8): 1-7.), traditional protecting information safety strategy and safety protection technique can not adapt to the demand of power information acquisition system business development, important power information (parameter setting between the intelligent electric meter of main website and information acquisition terminal and direct communication, control command, power information etc.) transmission should have authentication and key agreement and encryption measures (Deng Chen Jun wears the Guiping China's dawn. based on the intelligent grid kilowatt meter reading-out system research [J] of radio sensing network. electrical measurement and instrument, 2010, (8) .), the security protection general requirement of building to reach national information system is for the sales service application system provides accurate, reliably, effectively, real-time basic data.So utilize the ca authentication center of State Grid Corporation of China's construction, based on digital certificate, safe in conjunction with symmetric cryptography and public-key cryptosystem design one cover, the communication interaction number of times is few, memory space and computing cost little the authenticated key agreement agreement be to guarantee power information acquisition system safe and stable operation, business datum is safe and reliable, the important channel of user power utilization information security real-time Transmission.

2002, the propositions such as the Hu Yan of Tsing-Hua University are applied to the fail safe that electric power system is used with Strengthens network with ssl protocol, but the computing cost of ssl protocol is large and communication interaction often, and pointed out to suffer easily the encryption key exhaustive attack, abandon (the Qiu Zhiguo such as change key standard message attack, the attack of＜one class SSL cryptographic algorithm 〉, Shandong University's Master's thesis, in April, 2007) (David Wagner, Bruce Schneier, " Analysis of the SSL3.0 protocol ", 2nd USENIX Workshop on Electronic Commerce, November 1996.).China in 2003 have released the WLAN (wireless local area network) standard GB/T 15629.11 (Information technology-Telecommunications and information exchange between systems-Local and metropolitan area networks-Specific requirements-Part 11:Wireless LAN Meditum Access Control (MAC) and Physical Layer (PHY) Specifications.GB 15629.11-2003. (in Chinese)) of oneself, standard comprises wireless authentication and secret infrastructure WAPI mechanism, but this agreement lacks the private key checking in the authentication link, the key agreement link does not possess the security attributes such as forward security, can not resist the attacks such as Replay Attack and key be asynchronous.2004, ieee standard approval 802.11i safety standard (IEEE P802.11i/D3.0, Specification for Enhanced Security[OL], http://standards.ieee.org/reading/ieee/std/lanman/rafts/P802.11 i.pdf.), " EAP-Success " message that sends owing to the AP end is expressly to transmit, and is easy to the victim forgery and carries out man-in-the-middle attack.2007, the people such as Feng (Feng Dengguo, Chen Weidong. the modularized design of the security protocol of password-based and analysis [J]. Chinese science E collects, 2007,37 (2): 223-237.) proposed the modularization authentication protocol of password-based, but because the expense of agreement in communication and calculating is all larger, be not suitable for the power information collection.2010, the people such as Lo (Lo J-W, Lee C-C, Hwang M-S.A secure and efficient ECC-based AKA protocol for wireless mobile communications.Int J Innovat Comput Inform Control 2010,6 (11): 5249-58.) utilize the ECC algorithm to propose the authenticated key agreement agreement of password-based, He in 2011 points out that the people's such as Lo agreement can not resist off-line password exhaustive attack (He D.Weakness in an ECC-based AKA protocol for wireless mobile communications.Cryptology ePrint Archive, Report 2011/336,2011.).Above agreement is because its communication amount of calculation expense is excessive or anti-attack ability causes not them and is not suitable for being applied to the power information acquisition system.

Summary of the invention

Because above-mentioned, this paper proposes a kind of light-weight authentication key agreement protocol that is applicable to the power information acquisition system based on certificate verification and insured key dynamic negotiation mechanism, in conjunction with the fractional analysis of BAN logical form and non-Formal Analysis Method agreement is analyzed, identification protocol reach have two-way entity authentication when one-level faith and secondary are looked up to, the perfect security attribute such as confidentiality forward, resisting various attacks can be realized the secure communication of power information acquisition system efficiently in the situation that guarantees safety.

In order to realize this purpose, the present invention has designed and has been applicable to the light-weight authentication key agreement protocol that power information gathers, and its concrete interaction flow as shown in Figure 1.

Symbol definition in the agreement:

K _a, K _b: Alice, the PKI of Bob.

Alice, the private key of Bob.

Rot (x, y): x ring shift left f (y) position.

Mixbits (x, y) arthmetic statement:

z←x

for·i＝1 to 32 do

$z\←(\frac{z}{2}+z+z+y)\mathrm{mod}{2}^L$

end for

return z

: XOR is carried out in step-by-step

∨: exclusive disjunction is carried out in step-by-step

The invention has the advantages that: memory space and computing cost are little; the communication interaction number of times is few; the agreement that is used alternatingly and upgrade uses synchronously of new and old parameter protection key can effectively be resisted asynchronous attack; and can realize two-way entity authentication; key agreement; has perfectly forward confidentiality (PFS); the opposing Replay Attack; the attacks such as known-key attacks; the safety approach that provides real-time high-efficiency for authentication and the key agreement of communicating pair in the power information acquisition system; can be applicable to pay and purchase the safe transfer of telecommunications breath; comprising holds purchases the electric industry affair; long-range recharging service; the processes such as intelligent electric meter Long-distance Control; to guarantee that the user purchases that electricity is supplemented with money or the safe transmission of the information such as control command, improve the fail safe of electric power system.

Description of drawings

Fig. 1 is the designed concrete reciprocal process that is applicable to the light-weight authentication key agreement protocol that power information gathers among the present invention;

Embodiment

(1) implementation step

As shown in Figure 1, agreement has comprised authentication, key agreement and key updating three phases, and the communication entity both sides share old insured key K s in advance _O1, Ks _O2With new insured key K s _N1, Ks _N2, agreement is used the exchange of new insured cryptographic key protection important parameter under normal circumstances, and when the authentication of both sides' entity identities or key agreement failure, Alice enables old insured key, makes Ks _N1=Ks _O1, Ks _N2=Ks _O2, restart Hello and provoke session.Now the concrete communication process with agreement is described below:

Provoke session 1.Alice send Hello message to Bob, generate 32 byte random number n _A, and with insured key K s _N1Encrypt, the digital certificate of enclosing Alice after Hello message reaches

Calculate eap-message digest and use the encrypted private key generating digital of Alice to sign.

2.Bob after receiving the Hello message of Alice, the check dight certificate validity carries out authentication, extracts the PKI of Alice, the digital signature of checking Alice checks message integrity, and proves that it is this session holder really.

3.Bob use insured key K s _N1Deciphering obtains random number n _A, then generate random number 32 byte random number n _B, calculate α, Ks _New, K _ABAs shown in Figure 1, send message Give Alice, wherein

The digital signature that generates for the eap-message digest of the several parts in encrypted private key message front of using Bob.

4.Alice after receiving message, at first check the validity of certificate, Bob carried out authentication, if the identity of the identity information in the certificate and Bob is coincide, then extract the digital signature of public key verifications Bob, the integrality of inspection message, and proof Bob is this session holder really.

5. if Alice passes through in the integrality of the 4th step inspection message, then obtain n with insured secret key decryption _B, calculating K s _New, relatively α if equate, then calculates shared key group K _AB, new key more.Use new MAC key and initial vector that α is calculated the MAC value, send to Bob.If relatively the α failure then sends alert message, and makes Ks _N1=Ks _O1, Ks _N2=Ks _O2, use old insured key to restart new round agreement as insured key.

6.Bob calculating is also compared MAC (α), if consistent, then upgrades all keys.So far authentication and key agreement stage finish, and can bring into use afterwards the secret key encryption power information data that consult to carry out secure communication.If MAC (α) value is inconsistent, then send alert message, not new key more.

(2) BAN logical form fractional analysis

At first utilize BAN formalization of logic analytical method that lightweight wireless network authentication key agreement protocol proposed by the invention is carried out formalization analysis, analytic process is carried out in strict accordance with the analytical procedure that the BAN logic requires.

The authentication purpose of agreement:

One-level faith:

Secondary faith:

The description of agreement:

$A\→B:{\{\mathrm{CertificateA},{\left\{n_A\right\}}_{{\mathrm{Ks}}_{n1}}\}}_{K_{a^{-1}}}$

$B\→A:{\{\mathrm{CertificateB},{\left\{n_B\right\}}_{{\mathrm{Ks}}_{n2}},\mathrm{\α}\}}_{K_{b^{-1}}}$ $A\→B:{\left\{(n_A,n_B)\right\}}_{K_{\mathrm{AB}}}$

Agreement is idealized:

Message 1,

Message 2:

Message 3:

Initial state assumption:

(1) (2)

(3)B|≡#(n _A)(4)A|≡#(n _B) (5)

(6)

(7) $B|\≡A\⇒\left(n_A\right)$ (8) $A|\≡B|\⇒\left(n_B\right)$ (9)A|≡n _A (10)B|≡n _B

Reasoning from logic:

Can be got by message 1

By formula (1-a), use and receive rule, obtain

By formula (1-b) and hypothesis (5), the shared key rule in the application message implication obtains

B|≡A|～n _A (1-c)

By formula (1-c) and hypothesis (3), use the nonce proof rule, can get

B|≡A|≡n _A (1-d)

By formula (1-d) and hypothesis (7), use arbitration rules, can get

B|≡n _A (1-e)

By formula (1-e) and hypothesis (10), use the faith rule, obtain

B|≡(n _A，n _B)

Namely

Can be got by message 2

By formula (2-a), use and receive rule, obtain

By formula (2-b) and hypothesis (6), the shared key rule in the application message implication obtains

A|≡B|～n _B (2-c)

(2-c) supposes (4) by formula, uses the nonce proof rule, obtains

A|≡B|≡n _B (2-d)

By formula (2-d) and hypothesis (8), use arbitration rules, obtain

A|≡n _B (2-e)

By formula (2-e) and hypothesis (9), use the faith rule, obtain

A|≡(n _A，n _B)

Namely

By formula (2-a) and hypothesis (2), the PKI rule in the application message implication obtains

By formula (2-f), use and send rule, obtain

A|≡B|～(n _A，n _B)

Namely

By hypothesis (4), use the freshness rule, obtain

A|≡#(n _A，n _B)

Namely

By formula (2-g) and (2-h), use the nonce proof rule, can get

Can be got by message 3

By formula (a) and (3-a), the shared key rule in the application message implication can get

By hypothesis (3), use the freshness rule, obtain

B|≡#(n _A，n _B)

Namely

By formula (3-b) and (3-c), use the nonce proof rule, can get

By above analysis as can be known this agreement meet final target, reach the purpose of authentication, i.e. one-level faith (a) and (b), secondary is looked up to (c) and (d).If the assailant implements Replay Attack, then Alice and Bob will find when the correctness of certificate parameter, and therefore hypothesis (3) and hypothesis (4) are set up in above analysis.

(3) security attribute and anti-attack ability analysis

Because some defectives of BAN logic itself, may probe to some attack of agreement and some security attributes of agreement, so this paper is further analyzed agreement from attack and confidentiality aspect in conjunction with non-Formal Analysis Method.

1. two-way entity authentication

Alice and Bob are at first by sending digital certificate and the digital signature that sends information being realized authentication.Because the identity information that comprises in the digital certificate has the third-party signature of CA authority, the user at first can carry out the authentication of first gravidity part by checking identity information, Bob can extract the signature of the public key information checking Alice of Alice in the certificate afterwards, thereby proof Alice is the session holder really.In like manner, Bob also is the same.Because Alice and Bob all have the new and old insured key of sharing, so in the exchange random number, can play the effect of second gravidity part authentication.Through realizing the two-way entity authentication between the user after the double authentication.

2. key agreement

Set of cipher key between Alice and the Bob and insured key are by n _A, n _BThree parameters generate through correlation computations, wherein n _AGenerated at random by Alice, and n _BGenerated at random n by Bob _A, n _BRespectively at insured key K s _N1, Ks _N2Protection under encrypted transmission, and utilize

Carry out the confirming proper of parameter, only have Alice, Bob can calculate, and MAC (α) value that last Bob sends by Alice is carried out the consistency affirmation of key, so final set of cipher key and Protective Key only have Alice and Bob to obtain.

3. perfect confidentiality (PFS) forward

In the negotiation and renewal process of set of cipher key and insured key, even the assailant has grasped the current session key of both sides, can the key agreement of next time not threatened yet.Because participating in two random numbers of each session key batch total calculation all regenerates, and respectively by two different insured secret key encryption transmission, only have the user who holds simultaneously two insured keys just can obtain, and assailant's insured key that can not make new advances from current session key derivation and consult, therefore the key agreement of next time can't be affected.In addition, even agreement participant's long-term private is leaked, also can not cause the leakage of old session key, so this agreement has PFS character.

4. preventing playback attack

When the assailant reset front two message in agreement, Alice was calculating n _BAnd relatively will find to be attacked during the correctness of α.When the assailant resets the 3rd message, because MAC (α) value is to calculate with the MAC key and the initial vector that newly consult, so will find during in comparison MAC (α) value as Bob.

5. anti-asynchronous attack

Because the communicating pair entity is shared two pairs of new and old parameter protection keys in advance, when when front two-wheeled is attacked, Alice and Bob all can make Ks _N1=Ks _O1, Ks _N2=Ks _O2, use old insured key to restart Hello as insured key and provoke new round agreement.If attacked in third round, Bob checking MAC (α) be worth unsuccessfully, and new key and send alert message more not then is owing to Alice at this moment more new key, wherein Ks _O1=Ks _N1Ks _O2=Ks _N2Ks _N1=(Ks _New) 0～15; Ks _N1=(Ks _New) _16-31, make Ks after receiving alert message _N1=Ks _O1, Ks _N1=Ks _O2, the Ks of Alice here _N1, Ks _N2Just and the Ks of Bob _N1, Ks _N2Corresponding, Alice can restart Hello and provoke new round agreement.Therefore asynchronous attack is not prove effective for this agreement.

(4) Performance Ratio

It is more as shown in table 1 that the light-weight authentication key agreement protocol that is applicable to the power information collection proposed by the invention and existing other two kinds of agreements are carried out Performance Ratio.

Table 1 with the Performance Ratio of quasi-protocol

Annotate: 1. the described every amount of calculation that all refers to session setup side of calculated performance

2.2 (1/1) the type has been carried out altogether in expression 2 times, comprises 1 cryptographic calculation and 1 decrypt operation.

The authentication link of WAPI agreement is what to be separated with the key agreement stage, lacks the private key authentication in the authentication link, and the key agreement stage lacks the key confirmation process, if consider private key authentication and key confirmation, the mutual wheel number of agreement will be more.The light-weight authentication key agreement protocol that is applicable to the power information collection that this paper carries as can be seen from Table 1, on performance, obviously be better than EAP-TLS and WAPI agreement, be more suitable for being applied to the power information acquisition system, for the safe and efficient real-time Transmission of electric power data provides safeguard.

Claims (3)

1. a power information gathers the authenticated key agreement agreement, it is characterized in that may further comprise the steps:

1) uses the digital certificate that State Grid Corporation of China certificate verification center issues and the person's that holds the certificate having property of digital signature proof private key, and carry out dual-identity authentication in conjunction with sharing symmetric key;

2) new and old parameter protection key rotation is used, the Protective Key negotiations process;

3) utilize the new MAC key of consulting and initial vector to calculate MAC value and carry out key updating and confirm, upgrade to guarantee both sides' key dynamic synchronization, in case failed then utilize old insured key to provoke new round agreement.

2. power information as claimed in claim 1 gathers the authenticated key agreement agreement, it is characterized in that:

Described step 2) concrete steps that the important parameter that calculates new session key in conjunction with new and old cryptographic key protection participation in exchanges are (the supposition communicating pair are Alice and Bob):

The communication entity both sides share old insured key K s in advance _O1, Ks _O2With new insured key K s _N1, Ks _N2, agreement is used the exchange of new insured cryptographic key protection important parameter under normal circumstances, and when the authentication of both sides' entity identities or key agreement failure, Alice enables old insured key, makes Ks _N1=Ks _O1, Ks _N2=Ks _O2, restart Hello and provoke session.Now the concrete communication process with agreement is described below:

2.1) Alice sends Hello message to Bob and provoke session, generates 32 byte random number n _A, and with insured key K s _N1Encrypt, the digital certificate of enclosing Alice after Hello message reaches

Calculating disappears

Breath is made a summary and is signed with the encrypted private key generating digital of Alice;

2.2) Bob is after receiving the Hello message of Alice, the check dight certificate validity carries out authentication,

Use insured key K s _N1Deciphering obtains random number n _A, then generate random number 32 byte random number n _B, calculate α, Ks _New, K _ABAs shown in Figure 1, send message

Give

Alice, wherein

The digital signature that generates for the eap-message digest of the several parts in encrypted private key message front of using Bob;

2.3) Alice checks validity and the having property of private key of the certificate receive, obtains n with insured secret key decryption _B, calculating K s _New, relatively α if equate, then calculates shared key group K _AB, and new key more.Use new MAC key and initial vector that α is calculated the MAC value, send to Bob.If relatively the α failure then sends alert message, and makes Ks _N1=Ks _O1, Ks _N2=Ks _O2, use old insured key to restart new round agreement as insured key.

3. wireless network light-weight authentication key agreement protocol as claimed in claim 1 is characterized in that:

Described step 3) concrete steps of key updating are in: Bob calculates and compares MAC (α), if consistent, then upgrades all keys.So far authentication and key agreement stage finish, and can bring into use afterwards the secret key encryption power information data that consult to carry out secure communication.If MAC (α) value is inconsistent, then send alert message, new key more not, detailed process is as follows:

3.1) Alice calculating K s _New, comparing α, computational process if equate, is then calculated shared key group K as shown in Figure 1 _AB, and new key more.Use new MAC key and initial vector that α is calculated the MAC value, send to Bob.If relatively the α failure then sends alert message, and makes Ks _N1=Ks _O1, Ks _N2=Ks _O2, use old insured key to restart new round agreement as insured key.

3.2) Bob calculates and MAC (α) relatively, if consistent, then more new session key and insured key.So far authentication and key agreement stage finish, and can bring into use afterwards the secret key encryption power information data that consult to carry out secure communication.If MAC (α) value is inconsistent, then send alert message, not new key more.

Images