CN103428692A - Wireless access network authentication method and wireless access network authentication system capable of holding accountability and protecting privacy - Google Patents

Abstract

The invention discloses a wireless access network authentication method capable of holding accountability and protecting privacy. The wireless access network authentication method includes: step 1, user group managing staff register in network operators; step 2, users contact with the user group managing staff to authenticate to be able to join in the user group; step 3, the network operators withdraw users when the users are found to be attacked; step 4, the users can access to wireless network successfully; step 5, when two or more than two signatures are needed to be authenticated at access points, the access points perform signature verification in a large quantity on the signature; step 6, authority of law confirms users responsible for specific communicational conversation. The invention further discloses a wireless access network authentication system capable of holding accountability and protecting privacy. The wireless access network authentication system comprises the network operators, the access points, the user group managing staff, the users and authority of law. With the wireless access network authentication method and the wireless access network authentication system capable of holding accountability and protecting privacy, the credibility of each real item is limited, and the problems of agent management and single point of failure are solved.

Description

But Radio Access Network authentication method and the Verification System thereof of accountability and secret protection

Technical field

The present invention relates to a kind of wireless communication technology, but particularly Radio Access Network authentication method and the Verification System thereof of a kind of accountability and secret protection.

Background technology

The universal quality of life and the efficiency of work greatly improved of Radio Access Network, allow almost access network whenever and wherever possible of user.And, along with the demand to Radio Access Network is increasing, Radio Access Network starts to have played the part of irreplaceable role in life.But alarming, the Radio Access Network risk is ubiquitous, these risks comprise lacks experience or without the easy implementation of the user's of alertness sensitive information leakage, wireless signal interception be tending towards fast ripe watch-dog etc.So if need this Radio Access Network of any wide-area deployment, but fail safe, privacy accountability and high efficiency are to need the topmost problem of considering.Yet in the prior art, but the Radio Access Network Verification System of actual available accountability and secret protection is few.In addition, existing great majority guarantee that the Verification System of privacy all needs a third party trusty.Yet, when third party trusty exists, system can face the problem of managing on behalf of another and single point failure problem.The opponent can destroy by destroying third party trusty the configuration of whole system.Therefore, do not relating under third-party prerequisite trusty, but guaranteeing that accountability, fail safe, privacy and the high efficiency of Radio Access Network Verification System just seem very necessary simultaneously.In addition, accountability and privacy are two targets that seem contradiction, so prior art can't be applied directly in the Radio Access Network Verification System, thereby but do not lose the privacy of system when to system, providing accountability.And the present invention is based on the responsibility separation principle, solved well this problem.In the present invention, Virtual network operator has group private key (group private key, lower same), but do not know member's key (member secret keys, lower with) and the mapping of subscriber identity information right, and customer group manager (group manager, lower same) know that the mapping of member's key and subscriber identity information is to (the mapping between the member secret keys and the essential attributes of the users, lower same), but there is no group private key, this has guaranteed the privacy of system.And, under the needs of authority of law, Virtual network operator and customer group manager can provide information jointly, to find out responsible user, but this has guaranteed accountability.The present invention is not relating under a third-party prerequisite trusty, but has guaranteed fail safe, privacy accountability and the high efficiency of system simultaneously, and this is that prior art can't realize.

Existing wireless access Verification System relates to the tripartite: a wireless roaming user U, access points AP and Virtual network operator NO.The AP of some is deployed in the different location of coverage, to cover whole zone, and provides services on the Internet to the network user.The user can access this network anywhere with their mobile device.Existing Radio Access Network authentication method and Verification System thereof mainly contain two shortcomings.At first, existing method and system thereof often need a third party trusty, as member management person, trust authority (Trust Authority, lower same), home server, off line Secure Manager and aaa server.This third party trusty manages all keying materials.If, but these keying materials leak out, user's privacy can face the danger be disclosed.Unfortunately, when third party trusty is arranged, safety system can face the problem of managing on behalf of another and single point failure problem.The opponent can destroy by destroying third party trusty the configuration of whole system.The second, but existing Radio Access Network can't guarantee privacy when accountability is provided.If want, allow authority of law can find the user responsible to ad-hoc communication session, user profile can more or less be revealed; If but want to guarantee user's privacy, authority of law is difficult to according to limited information, the user be followed the trail of.The more important thing is, but do not lose privacy when accountability is provided, this is two targets that seem contradiction.There is no now directly to dispose and can reach relevant (privacy aware) cryptographic primitives of available privacy of above target.

Summary of the invention

Primary and foremost purpose of the present invention is that the shortcoming that overcomes prior art is with not enough, but the Radio Access Network authentication method of a kind of accountability and secret protection is provided, and the method has been avoided the problem of the problem of managing on behalf of another and single point failure effectively.

Another object of the present invention is to overcome the shortcoming and deficiency of prior art, but a kind of Verification System that realizes the Radio Access Network authentication method of accountability and secret protection is provided, this system does not relate to third party trusty, safe, and privacy is high.

Primary and foremost purpose of the present invention is achieved through the following technical solutions: but the Radio Access Network authentication method of a kind of accountability and secret protection comprises the following steps:

Step 1, customer group manager register at the Virtual network operator place, Virtual network operator generated group private key and partial group PKI (partial group public key, lower same), and the partial group PKI is issued to the customer group manager; After customer group manager's generated group PKI (group public key, lower same), return to Virtual network operator; Group's public key broadcasts that the Virtual network operator handle is received from the customer group manager is to each access point;

Step 2, user and customer group manager contact to be authenticated, and after this customer group manager will send member's key and the group's PKI for access network to it; Now the user successfully adds customer group, becomes user in the group;

If step 3 finds that the user is broken, the customer group manager will be broken the user to these and be considered as the user that need cancel, and the list of cancelling the user is sent to Virtual network operator; Virtual network operator is broadcast to each access point on this list after digital signature, to cancel, be broken the user; Now, the user is cancelled;

If step 4, user want access network, at first need to guarantee to lay oneself open in the communication range of an access point; After with this access point, carrying out authentication mutually and cipher key change, can set up a shared symmetric key between access point and user, for communication session backward; Now, user's success access of radio network;

Step 5, when the access point place has two or more signatures to need authentication, access point carries out the batch signature verification to these signatures.Our batch signature verification technique, when greatly having reduced a large amount of time consumed of signing of checking, has also reduced the disconnecting rate that signature verification this potential bottleneck problem in access point place causes.

If step 6 authority of law wants to follow the trail of the user responsible to ad-hoc communication session, only need obtain group's private key from Virtual network operator, and it is right to obtain the mapping of member's key and subscriber identity information from the customer group manager; Utilize group's private key and above-mentioned mapping to determining the user.

Described step 4 comprises the following steps:

A, access point are periodically broadcasted the beacon message of this access point digital signature, thereby announce that its service exists;

B, after the user receives beacon message, can be according to beacon message, the validity of proving time stamp, the certificate expired time of access point with and the reliability of PKI.If these checkings have any one not pass through, the user will can not link this access point; If these checkings are all passed through, the user generates solicited message, and utilizes the member's key of oneself to carry out group's signature to it, and clean culture replies to access point;

C, after access point is received the above-mentioned information that the user sends, by the freshness of first inspection message (message freshness, lower with).Subsequently, check whether this user exists in its list of cancelling the user.If exist, refusal link; If do not exist, calculate the symmetric key shared with it and send response message to the user;

D, user, after receiving the information that above-mentioned access point sends, can verify the validity of this information.If information is invalid, refusal link; If effectively, this links successfully and sets up.

Described step 6 comprises the following steps:

(1) authority of law requires to follow the trail of the user responsible to ad-hoc communication session;

(2) Virtual network operator link Network Based and session identification find corresponding session authentication information from the network log file;

(3) Virtual network operator carries out linear encryption to first three element of the digital signature in above-mentioned session authentication information, and obtains member's key of this user with group's private key.After this, the net operation business reports to authority of law to member's key of this user who obtains;

(4) authority of law sends member's key of this user who obtains from Virtual network operator to the customer group manager;

(5) the customer group manager is according to member's key of this user who obtains from authority of law, and member's key of storing at oneself and the mapping centering of subscriber identity information are searched, and a subscriber identity information of finding is replied to authority of law.

Method for network authorization of the present invention has following six stages: system made, add new user, cancel the user, authentication and cipher key change, batch signature verification, user tracking mutually.In the system made stage, Virtual network operator and each customer group manager be the generating unit PKI that hives off separately.Group's PKI is assigned to each access point.System enters and adds the new user stage when having new user to enter group, and enters and cancel user's stage when one or more users are cancelled.In mutually authentication and cipher key exchange phase, as a user wants to be linked to an access point, he/her need and access point between mutually authenticate and cipher key change, then set up a shared symmetric key.In the batch signature verification stage, but the many requests that receive of access point simultaneous verification, rather than process individually each request.In the user tracking stage, Virtual network operator and customer group manager help authority of law to follow the trail of one particular network are linked to responsible user.

Another object of the present invention is achieved through the following technical solutions: but a kind of Verification System that realizes the Radio Access Network authentication method of accountability and secret protection, it is characterized in that, comprising: user and authority of law in Virtual network operator, access point, customer group manager, group; Described Virtual network operator is to hive off PKI receive group's PKI from the customer group manager of customer group manager sending part, and Virtual network operator is also to access point broadcast group PKI; In access point and group, the user authenticates and cipher key change mutually, and in the group, the user also obtains the member's key and group's PKI for access network from the customer group manager; Authority of law obtains group's private key from Virtual network operator, and it is right to obtain the mapping of member's key and subscriber identity information from the customer group manager.

Key management model in Verification System of the present invention relates to four typical network entities altogether: user in Virtual network operator, access point, customer group manager and group.In the present invention, the user is not directly registered to Virtual network operator, but represents that by the customer group manager all its users inside the group are to the Virtual network operator subscription service.Group's PKI of Virtual network operator generated group private key and part, but group's private key is maintained secrecy.When receiving a gerentocratic registration request of group, the network operation chamber of commerce is distributed to this customer group manager to the partial group PKI.Then, group's manager's generated group PKI it is returned to Virtual network operator.Finally, Virtual network operator sends to each access point to group's PKI.If want access network, each user need to ask its member's key and group's PKI to its crowd of managers.

This key managing project has several outstanding features, and at first, for the purpose of controlling access, the user who has effective member's key that each is legal can generate an effectively access certificate, for example group's signature of new access request.The available group of each access point PKI is verified this access certificate.Therefore, access security is guaranteed.The second, the mapping of the present invention's handle group's private key and member's key and subscriber identity information is to being kept at respectively in two autonomous entity items: group's user administrator and Virtual network operator.Wherein Virtual network operator has group private key, but do not know to shine upon right.And the group manager knows that mapping is right, but do not know group private key.Suppose that the group manager can not gang up with Virtual network operator here.This hypothesis is reasonably, because customer group manager and Virtual network operator be substantially from different groups, and the conflict of interest is even arranged between them.This has caused customer group manager and network operation commercial city to can not determine that specific user's identity information can not utilize user's access authentication to invade user's privacy.Therefore, user's privacy has obtained reinforcement.

Finally, under Virtual network operator and the gerentocratic common help of customer group, there is and only have authority of law to track the corresponding network user according to communication linkage arbitrarily.Therefore, when service dispute or swindle occur, authority of law can be determined accurately needs responsible user, and pursues its responsibility.So user's accountability also can realize.Simultaneously, whole cipher key management procedures can complete when system made, so this can not bring thereafter any calculating and the expense of communicating by letter.

Developed new short group's signature (Short group signature, lower same) scheme by revising key schedule.Novel group signature be integrated in the design of of the present invention authentication and IKMP thereafter.In addition, in order to realize high efficiency, based on novel group's signature, novel batch signature verification method has been proposed.In order to cancel a user who is broken, adopted Verifier-Local Revocation(local verification to revoke) method.This method is based on novel group signature scheme design.In addition, for the renewal of back-up system and large-scale user cancel, some additional mechanism also have been incorporated in the present invention.

But the efficient wireless access network system of accountability of the present invention and secret protection, comprise: in the system made stage, customer group manager registers at the Virtual network operator place, Virtual network operator generated group private key and partial group PKI, and the partial group PKI is issued to the customer group manager; After customer group manager's generated group PKI, return to Virtual network operator, subsequently Virtual network operator by group's public key broadcasts to each access point.Adding the new user stage, user and customer group manager contact to be authenticated, and after this user will obtain the member's key and group PKI that is used for access network.If find, the user is broken, customer group manager will be broken the user to these and be considered as the user that need cancel, and the list of cancelling the user is sent to Virtual network operator, Virtual network operator is broadcast to each access point on this list after digital signature, to cancel, be broken the user.If the user wants access network, at first need to guarantee to lay oneself open in the communication range of an access point; After with this access point, carrying out authentication mutually and cipher key change, can set up a shared symmetric key between access point and user, for communication session backward.If authority of law wants to follow the trail of the user responsible to ad-hoc communication session, only need obtain group's private key from Virtual network operator, and it is right to obtain the mapping of member's key and subscriber identity information from the customer group manager; Utilize group's private key and above-mentioned mapping to determining the user.

But the present invention is the first system of simultaneously supporting Radio Access Network accountability, fail safe, privacy and high efficiency.In the past system do not accomplish a bit, but guarantee the privacy of system when accountability is provided.But in the present invention, Virtual network operator has group private key, but do not know that the mapping of member's key and subscriber identity information is right; And the customer group manager knows that the mapping of member's key and subscriber identity information is right, but there is no group private key; This has guaranteed privacy.And, under the requirement of authority of law, Virtual network operator and customer group manager can provide information jointly, to find out responsible user, but this provides accountability.The renewal of back-up system of the present invention and large-scale user cancel, and this has guaranteed the high efficiency of system.In addition, another characteristics of the present invention are not rely on any third party trusty.In the present invention, the degree of belief of each entity item is limited, and this makes system avoided the problem of managing on behalf of another and single point failure problem.

Operation principle of the present invention: but the present invention proposes the Radio Access Network Verification System of a kind of accountability and secret protection.In this system, have six stages, be respectively system made, add new user, cancel the user, mutually authentication and cipher key change and, batch signature verification, user tracking.At first, system needs initialization, and this is the stage of system made.In this stage, system completes the task of group public key distribution.After system is successfully set up, each access point divides a group's PKI.After this, if will add new user, enter and add new user's stage; If cancel the user, enter and cancel user's stage.When the user wants to be linked to access point, need mutually authenticate and cipher key change with this access point, at this moment enter mutual authentication and cipher key exchange phase.And, when authority of law need to be followed the trail of a specific user, system enters the user tracking stage.The present invention is not relating under a third-party prerequisite trusty, but has guaranteed fail safe, privacy accountability and the high efficiency of system simultaneously.At first, for the purpose of controlling access, the user who has effective member's key that each is legal can generate an effectively access certificate, for example group's signature of new access request.The available group of each access point PKI is verified this access certificate.Therefore, access security is guaranteed.The second, the present invention the mapping between member's key and subscriber identity information to and group private key be kept at respectively in two autonomous entity items: customer group manager and Virtual network operator.Wherein Virtual network operator has group private key, but does not know that the mapping between member's key and subscriber identity information is right.And the customer group manager knows that mapping is right, but do not know group private key.Suppose that the group manager can not gang up with Virtual network operator here.This hypothesis is reasonably, because customer group manager and Virtual network operator be substantially from different groups, and the conflict of interest is even arranged between them.This has caused customer group manager and network operation commercial city to can not determine that specific user's identity information can not utilize user's access authentication to invade user's privacy.Therefore, the privacy of system is guaranteed.The 3rd, under Virtual network operator and the gerentocratic common help of customer group, there is and only have authority of law to track the corresponding network user according to communication linkage arbitrarily.Therefore, when service dispute or swindle occur, authority of law can be determined accurately needs responsible user, and pursues its responsibility.So user's accountability also can realize.Simultaneously, whole cipher key management procedures can complete when system made, so this can not bring any calculating and the expense of communicating by letter at the During Process of Long-term Operation of system thereafter.Finally, developed different short group signature schemes by revising key schedule.Novel group signature be integrated in the design of of the present invention authentication and IKMP thereafter.In addition, based on novel group's signature, novel batch signature verification method has been proposed.In order to cancel a user who is broken, adopted Verifier-Local Revocation(local verification to revoke) method.This method is based on novel group signature scheme design.In addition, for the renewal of back-up system and large-scale user cancel, some additional mechanism also have been incorporated in the present invention.Therefore, the high efficiency of system is guaranteed.

The present invention has following advantage and effect with respect to prior art:

1, the present invention does not rely on any third party trusty, and the degree of belief of each entity item is limited, and this has been avoided the problem of managing on behalf of another and single point failure problem.

2, the present invention is specially adapted to Radio Access Network, the integration of its new group's signature algorithm based on responsibility separation principle and attainable batch signature verification.

3, the present invention, by realizing mutual authentication and Key Establishing clear and definite between user and access point, has guaranteed the fail safe of system.

4, the present invention, by realizing the anonymous authentication on one direction between user and access point, has guaranteed user's anonymity and Unlinkability.

5, the present invention does not lose privacy when but accountability is provided.Because Virtual network operator has group private key, but do not know to shine upon right, and the customer group manager knows that mapping is right, but there is no group private key, and this has guaranteed privacy.And, under the needs of authority of law, Virtual network operator and customer group manager can provide information jointly, to find out responsible user, but this has guaranteed accountability.

6, the present invention is by adopting Verifier-Local Revocation(local verification to revoke) method and some additional mechanisms, the renewal of back-up system and large-scale user cancel, and have guaranteed the high efficiency of system.

7, the present invention allows new user's dynamic appending and the Dynamic Revocation that is broken the user.But the present invention is the first system of simultaneously supporting Radio Access Network accountability, fail safe, privacy and high efficiency.

The accompanying drawing explanation

Fig. 1 is flow chart of the present invention

Fig. 2 is trust of the present invention and key management model schematic diagram.

Embodiment

Below in conjunction with embodiment and accompanying drawing, the present invention is described in further detail, but embodiments of the present invention are not limited to this.

Embodiment

Existing wireless access Verification System relates to the tripartite: a wireless roaming user U, access points AP and Virtual network operator NO.The AP of some is deployed in the different location of coverage, to cover whole zone, and provides services on the Internet to the network user.The user can access this network anywhere with their mobile device.

Fig. 2 is Radio Access Network Verification System of the present invention, and the key management model in Verification System of the present invention relates to four typical network entities altogether: user in Virtual network operator, access point, customer group manager and group.In the present invention, the user is not directly registered to Virtual network operator, but represents that by the customer group manager all its users inside the group are to the Virtual network operator subscription service.Group's PKI of Virtual network operator generated group private key and part, but group's private key is maintained secrecy.When receiving a gerentocratic registration request of group, the network operation chamber of commerce is distributed to this customer group manager to the partial group PKI.Then, group's manager's generated group PKI it is returned to Virtual network operator.Finally, Virtual network operator sends to each access point to group's PKI.If want access network, each user need to ask its member's key and group's PKI to its crowd of managers.

This key managing project has several outstanding features.At first, for the purpose of controlling access, the user who has effective member's key that each is legal can generate an effectively access certificate, for example group's signature of new access request.The available group of each access point PKI is verified this access certificate.Therefore, access security is guaranteed.The second, the mapping of the present invention's handle group's private key and member's key and subscriber identity information is to being kept at respectively in two autonomous entity items: group manager and Virtual network operator.Wherein Virtual network operator has group private key, but do not know to shine upon right.And the group manager knows that mapping is right, but do not know group private key.Suppose that group reason person can not gang up with Virtual network operator here.This hypothesis is reasonably, because customer group manager and Virtual network operator be substantially from different groups, and the conflict of interest is even arranged between them.This has caused customer group manager and network operation commercial city to can not determine that specific user's identity information can not utilize user's access authentication to invade user's privacy.Therefore, user's privacy has obtained reinforcement.

Finally, under Virtual network operator and the gerentocratic common help of customer group, there is and only have authority of law to track the corresponding network user according to communication linkage arbitrarily.Therefore, when service dispute or swindle occur, authority of law can be determined accurately needs responsible user, and pursues its responsibility.So user's accountability also can realize.Simultaneously, whole cipher key management procedures can complete when system made, so this can not bring thereafter any calculating and the expense of communicating by letter.

The present invention has developed new short group's signature (short group signature) scheme by revising key schedule.Novel group signature be integrated in the design of of the present invention authentication and IKMP thereafter.In addition, in order to realize high efficiency, based on novel group's signature, novel batch signature verification method has been proposed.In order to cancel a user who is broken, adopted Verifier-Local Revocation(local verification to revoke) method.This method is based on novel group signature scheme design.In addition, for the renewal of back-up system and large-scale user cancel, some additional mechanism also have been incorporated in the present invention.

The present invention was comprised of following six stages: system made, add new user, cancel the user, authentication and cipher key change, batch signature verification and user tracking mutually.In the system made stage, Virtual network operator and each customer group manager be the generating unit PKI that hives off separately.Group's PKI is assigned to each access point.System enters and adds the new user stage when having new user to enter group, and enters and cancel user's stage when one or more users are cancelled.In mutually authentication and cipher key exchange phase, as a user wants to be linked to an access point, he/her need and access point between mutually authenticate, then set up a shared symmetric key.In the batch signature verification stage, but the many requests that receive of access point simultaneous verification, rather than process individually each request.In the user tracking stage, Virtual network operator and customer group manager help authority of law to follow the trail of one particular network are linked to responsible user.

As shown in Figure 1, realize that six stages of authentication method of Radio Access Network Verification System of the present invention are specific as follows:

A. system made stage

What Virtual network operator was responsible for is group's private key of all customer groups and the generating run of partial group PKI.The detailed process of network operators handle is as follows:

1. select a random generator g ₂∈ G ₂, and calculate g ₁=ψ (g ₂).

2. choose at random

s ₁, s ₂∈ Z _pAnd u is set, v ∈ G ₁, s ₁u=s ₂V=η, can obtain u=s ₁ ⁽¹⁾η, v=s ₂ ⁽¹⁾η.S wherein ₁ ⁽¹⁾S ₁Inverse, s ₂ ⁽¹⁾S ₂Inverse.

3. by group's private key gsk=(s ₁, s ₂) maintain secrecy.

4. random selection

And h is set ₁, h ₂∈ G ₂, h ₁=s ₁H ₀, h ₂=s ₂H ₀.

5. once Virtual network operator receives that group identity is grp _iGroup manager GM _jRegistration information, Virtual network operator need be to group manager GM _jAuthenticated.Trusting relationship between group manager and the Virtual network operator of this authentication based on having established.This trusting relationship may be set up when I contact.Then Virtual network operator is selected j ∈ Z at random _pGroup's index storage pairing (j, grp as this customer group _j).Next Virtual network operator sends information (j, g to the group manager ₁, g ₂, η, u, v), (g wherein ₁, g ₂, η, u, v) and be the partial group PKI.In the present invention, Virtual network operator is used a secure transfer protocol (as wired Transport Layer Security) and group manager GM _jCommunicate.Imagination strong Diffie-Hellman (SDH) is at (G ₁, G ₂) on keep, and linear Diffie-Hellman is at G ₁On keep.

In order to improve the efficiency of proposed system, Virtual network operator is distributed to the system parameters h of each group ₀With partial group PKI (g ₁, g ₂, be η) the same.In order to realize non-repudiation, in above-mentioned the 5th step, Virtual network operator under the standard digital signature scheme to information (j, g ₁, g ₂, η, u, v) and signature.Relevant digital signature scheme has RSA and ECDSA.It should be noted that crowd manager is after the registration of Virtual network operator place, Virtual network operator can send to the group manager its PKI.Therefore, do not need PKI system (PKI).Suppose that the present invention has used ECDSA-160.The public/private key of the digital signature of this Virtual network operator is to being defined as (OPK, OSK).

Each crowd of manager GM _jReceiving (j, g ₁, g ₂, η, u, v) after, incite somebody to action generated group PKI in accordance with the following steps:

1. select at random a digital gamma ∈ Z _p, and w is set _j=γ g ₂.

2. return information (j, gpk _j) give Virtual network operator, its group of PKIs are gpk _j=(g ₁, g ₂, η, u, v, w _j).Similarly, in order to realize non-repudiation, group the manager according to ECDSA-160 to information (j, gpk _j) carry out digital signature.

Once Virtual network operator receives (j, gpk _j) after, will in his/her local record, store j and w _jBetween pairing.Finally, Virtual network operator is by { g ₁, g ₂, η, u, v, h ₀, h ₁, h ₂And mapping (j, w _j) send to each access point.In addition, Virtual network operator (is designated as AP to each access point _k) give a public/private key pair, be expressed as (PPK _k, PSK _k).Each access point has also obtained the subsidiary public key certificate by the Virtual network operator digital signature, for the authenticity of verification key.The certificate of a simple form consists of the following components: Cert _k={ AP _k, PPK _k, ExpT, SIG _OSK{ h (AP _k|| PPK _k|| ExpT) } }.Wherein h (.) means the hash function operation, and as SHA-1, ExpT is the certificate expired time, SIG _OSK{ h (AP _k|| PPK _k|| ExpT) } be that commercial its private key OSK of network operation is at h (AP _k|| PPK _k|| ExpT) upper digital signature generates.

B. add new user's stage

Before access network, a network user must I be authenticated to group manager contact.To each identity, be grp _jCustomer group, an identity is UID _iUser i be endowed as follows random member's key and group PKI:

1. group manager GM _jThe random x that selects _i∈ Z _p, and calculate with γ

GM _jIn his/her record, storage is to (A _i, UID _i).

2. group manager GM _jBy a secure transfer protocol (as wired Transport Layer Security) to user i transmission information (j, gpk _j, msk[i]).Now member's key of user i is msk[i]=(A _i, x _i).

It should be noted that in the environment of above two steps:

● group manager GM _jMapping (the A that only retains member's key and subscriber identity information _i, UID _i), and do not retain crowd private key gsk.

● Virtual network operator is only known crowd private key gsk and is not known mapping (A _i, UID _i).

3. only have Virtual network operator to know mapping (j, grp _j).Certainly, each user and each crowd of managers can only calculate his/her group's index and the mapping of group's identity.

C. cancel user's stage

Customer group manager GM _jOnce find some users 1 ..., r} is broken, will be broken the user to these and be considered as the user that need cancel, and cancelling user's list URL _J={ A ₁... A _rSend to Virtual network operator.Then, Virtual network operator is at URL _JUpper digital signature also is broadcasted to each access point.

D. mutually authenticate and cipher key exchange phase

A network user i, if want access network, need to be at an access point AP _kDirect communications range in, and mutually authenticate and cipher key change according to following steps:

1. access point AP _kSelect a random number r _P∈ Z _pAnd generation r _PG ₁.Next AP _kAccording to ECDSA-160 to r _PG ₁And timestamp ts ₁Carry out digital signature.Then, AP _kBroadcast following message as the beacon message of periodically announcing that its service exists:

r _P·g ₁,ts ₁,SIG _PSK{r _P·g ₁||ts ₁},Cert _k (M1)

2., once user i receives (M1), will carry out following operation:

A. the review time is stabbed ts ₁Validity to prevent Replay Attack.Check Cert with OPK _kCome reliability and the AP of verification public key _kThe certificate expired time.Then pass through PPK _kChecking SIG _PSK{ r _PG ₁|| ts ₁.And if only if, and they are all effectively, just can carry out next step.

B. select a random number r _U∈ Z _pWith an interim identity another name alias, then calculate r _UG ₁.

C. generated group signature sigma on information M.M={alias now, j, r _PG ₁, r _UG ₁, ts ₂.Give grouping PKI gpk _j=(g ₁, g ₂, η, u, v, w _j), member's key msk[i]=(A _i, x _i), and information M, group's signature sigma can be calculated according to following steps:

select at random α, β ∈ Z _p.

calculate A _iEncryption and (T ₁, T ₂, T ₃), wherein:

T ₁=αu,T ₂=βv,T ₃=A _i+(α+β)η (1)

δ=α x is set _i, μ=β x _i.

choose at random blind value r _α, r _β, r _x, r _δ, r _μ∈ Z _p.Arrange

$R_1=r_{a}u,R_2=r_{\mathrm{\β}}v,R_3=\hat{e}{(T_3,g_2)}^{r_x}\hat{e}(\mathrm{\η},(-r_a-r_{\mathrm{\β}})w_j+(-r_{\mathrm{\δ}}-r_{\mathrm{\μ}})g_2),R_4=r_x{T}_1-r_{\mathrm{\δ}}u,R_5=r_x{T}_2-r_{\mathrm{\μ}}v$

calculates c by above value and M:

c=H(M,T ₁,T ₂,T ₃,R ₁,R ₂,R ₃,R ₄,R ₅)

wherein h (.) is that an Output rusults scope is Z _pHash function.

arrange: s _α=r _α+ c α, s _β=r _β+ c β, s _x=r _x+ cx _i, s _δ=r _δ+ c δ, s _μ=r _μ+ c μ.

last, the value obtained more than merging forms group's signature:

σ=(T ₁,T ₂,T ₃,c,s _α,s _β,s _x,s _δ,s _μ)

D. with AP _kGenerate shared key: SK _k=r _U(r _PG ₁).

E. clean culture replies to AP _k

alias,j,r _P·g ₁,r _U·g ₁,ts ₂,σ (M2)

It should be noted that user i also can select to use AP _kPKI PPK _kGive information { alias, j, r _PG ₁, r _UG ₁, ts ₂Encryption, then generated group signature sigma on encrypted information.Subsequently, user i is to AP _kClean culture encrypted information and group's signature sigma, rather than information (M2).Clearly, in this case, only have Virtual network operator and AP _kCan be by using AP _kPrivate key PSK _kObtain:

{alias,j,r _P·g ₁,r _U·g ₁,ts ₂}

3. after receiving information (M2), AP _kCarry out following steps and carry out authenticated user i:

A. check r _PG ₁And ts ₂Validity to guarantee the freshness of (M2).

B. select group's PKI gpk according to index j _j, then carry out group signature verification operations.At first recalculate challenger c, then according to following steps reconstruct

arrange

${\tilde{R}}_1=-c{T}_1+s_{\mathrm{\α}}u,{\tilde{R}}_2=-c{T}_2+s_{\mathrm{\β}}v,{\tilde{R}}_3=\hat{e}(s_x{T}_3,g_2)\hat{e}(c{T}_3,w_j)\hat{e}{(\mathrm{\η},w_j)}^{-s_{\mathrm{\α}}-s_{\mathrm{\β}}}\·\hat{e}{(\mathrm{\η},g_2)}^{-s_{\mathrm{\δ}}-s_{\mathrm{\μ}}}\hat{e}{(g_1,g_2)}^{-c}$

arrange ${\tilde{R}}_4=s_x{T}_1-s_{\mathrm{\δ}}u,{\tilde{R}}_5=s_x{T}_2-s_{\mathrm{\μ}}v.$

if and only if that c equals

The time accept this information.

C. select to cancel user list URL according to index j _j, then carry out and cancel inspection as follows: for each, cancel mark A _i∈ URL _j, AP _kCheck A _iWhether by the (T of σ ₁, T ₂, T ₃) coding.Check whether equation is set up:

$\hat{e}(T_3-A_i,h_0)=\hat{e}(T_1,h_1)\hat{e}(T_2,h_2)---\left(2\right)$

Because

$\hat{e}(T_3-A_i,h_0)=\hat{e}((\mathrm{\α}+\mathrm{\β})\mathrm{\η},h_0)=\hat{e}(\mathrm{\α}\·\mathrm{\η}+\mathrm{\β}\·\mathrm{\η},h_0)$

$=\hat{e}(\mathrm{\α}\·\mathrm{\η},h_0)\hat{e}(\mathrm{\β}\·\mathrm{\η},h_0)=\hat{e}(\mathrm{\α}\·s_1\·u,h_0)\hat{e}(\mathrm{\β}\·s_2\·v,h_0)$

$=\hat{e}(\mathrm{\α}\·u_1,s_1\·h_0)\hat{e}(\mathrm{\β}\·v,s_2\·h_0)=\hat{e}(T_1,h_1)\hat{e}\left(T_2{h}_2\right),$

If coding is not from (T ₁, T ₂, T ₃) URL cancel mark, the signer of σ is not cancelled.

If all success of all above inspections, AP _kWill be considered as access request effectively and the user changes without being authorized to, and make the user and set up a shared symmetric key SK _kConclusion.Although AP _kDo not know which user this is actually.It should be noted that UID _iRevealed or propagated never in the process of agreement operation.

4.AP _kUtilize (r _UG ₁, r _P) information, calculate and share symmetric key SK _k=r _P(r _UG ₁) and send following information (M3) and give user i:

$\mathrm{alias},{\mathrm{AP}}_k,r_U\·g_1,E_{{\mathrm{SK}}_k}({\mathrm{AP}}_k,r_U\·g_1,r_P\·g_1),\left(M3\right)$

E wherein _K(X) encrypted information X with symmetric key K.

5. after having received (M3), user i deciphering is also verified SK with symmetric key _k.If be (M3) effectively, user i can think AP _kWith him/her, set up a shared key.Otherwise user i can refuse link.Above agreement not only makes the explicit mutual authentication between an access point and legitimate network user feasible, also makes monolateral user anonymity user rs authentication become possibility.Once agreement is successfully completed, can set up a shared symmetric key between access point and user.This key can be used for communication session backward.This session is by (alias, AP _k, r _UG ₁) uniquely identified.

The computing cost of an access point digital signature of checking is mainly caused by 13 scalar multiplications (scalar multiplications, lower same) and 5 pairings (pairing, lower same) operation.Obviously, the expense that wherein computing cost of matching operation operates far above scalar multiplication.

E. signature verification stage in batches

Calculate R ₃It is the part of consumes resources in proof procedure.Because each R ₃All in the checking equation by Hash, being difficult to see this if therefore do not contemplate can be batch processing.σ=(T is set ₁, T ₂, T ₃, R ₃, c, s _α, s _β, s _x, s _δ, s _μ).That is to say R ₃A part as σ is transmitted.In the system made stage, NO selects a random number ε ∈ Z _p, and ε (as the part of group's PKI) is transferred to each crowd of managers and each AP.Arrange

$c={\mathrm{\ϵ}}^{H(M,T_1,T_2,T_3,R_1,R_2,R_3,R_4,R_5)}\mathrm{mod}p$

Here<M ¹, σ ¹,<M ², σ ²...,<M ⁿ, σ ⁿMean respectively to come from n different user U of same customer group ₁, U ₂..., U _nThe access request information be labeled as.AP _kCheck whether following equation is set up:

If this equation is set up, AP _kCheck whether following equation is set up:

Therefore, for current inspection, AP _kOnly need to check whether following equation is set up: $\underset{i=1}{\overset{n}{\mathrm{\&Pi;}}}{R}_3^i=\hat{e}({\mathrm{\&Sigma;}}_{i=1}^n(s_x^i{T}_3^i-c^i{g}_1-(s_{\mathrm{\&delta;}}^i+s_{\mathrm{\&mu;}}^i)\mathrm{\&eta;}),g_2)\hat{e}({\mathrm{\&Sigma;}}_{i=1}^n{c}^i{T}_3^i-(s_{\mathrm{\&alpha;}}^i+s_{\mathrm{\&beta;}}^i)\mathrm{\&eta;}),w_j).$

Above batch of checking equation set up, and reason is:

$\underset{i=1}{\overset{n}{\mathrm{\&Pi;}}}{\tilde{R}}_3^i=\underset{i=1}{\overset{n}{\mathrm{\&Pi;}}}\hat{e}(s_x^i{T}_3^i,g_2)\hat{e}(c^i{T}_3^i,w_j)\&CenterDot;\hat{e}((-s_{\mathrm{\&alpha;}}^i-s_{\mathrm{\&beta;}}^i)\mathrm{\&eta;},w_j)\hat{e}((-s_{\mathrm{\&delta;}}^i-s_{\mathrm{\&mu;}}^i)\mathrm{\&eta;},g_2)\hat{e}((-c^i)g_1,g_2)$

$=\hat{e}(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{s}_x^i{T}_3^i,g_2)\hat{e}(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}{c}^i{T}_3^i,w_j)\&CenterDot;\hat{e}(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}(-s_{\mathrm{\&alpha;}}^i-s_{\mathrm{\&beta;}}^i)\mathrm{\&eta;},w_j)\hat{e}(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}(-s_{\mathrm{\&delta;}}^i-s_{\mathrm{\&mu;}}^i)\mathrm{\&eta;},g_2)\hat{e}(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}(-c^i)g_1,g_2)$

$=\hat{e}\left(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}\right(s_x^i{T}_3^i-c^i{g}_1-(s_{\mathrm{\&delta;}}^i+s_{\mathrm{\&mu;}}^i)\mathrm{\&eta;},g_2)\hat{e}(\underset{i=1}{\overset{n}{\mathrm{\&Sigma;}}}(c^i{T}_3^i-(s_{\mathrm{\&alpha;}}^i+s_{\mathrm{\&beta;}}^i)\mathrm{\&eta;}),w_j).$

All signature sigma ¹, σ ²..., σ ⁿWhen above two inspections that and if only if are all correct just effectively.In above-mentioned batch checking equation, verify that the calculating of n signature consumes mainly from 2 pairings and 13n scalar multiplication operation.Thereby this has greatly reduced the time that a large amount of signatures of checking consume, and has also reduced the disconnecting rate caused by this potential bottleneck problem of AP place signature verification simultaneously.Should be noted that proposed method inherited all security features of short group signature (SGS) technology, in addition, the method is also supported batch checking.

If a negative value is returned in batch checking, will use " dividing and rule " method of a recurrence.That is to say, simply set is divided into to two equal portions, then these two equal portions are verified separately again.When this process finishes, AP exports the index of each invalid signature.Here imagine: the invalid existing probability that contracts out is very little.

F. user tracking stage

When authority of law is wanted to follow the trail of the user responsible to ad-hoc communication session, will carry out following step:

1. Virtual network operator, based on link and session identification, finds corresponding session authentication information (M2) from the network log file.

2. Virtual network operator is first three element (T of group's signature sigma ₁, T ₂, T ₃) be considered as a linear encryption, and with group's private key (s ₁, s ₂) obtain user's A _i, as shown in equation (3).Then Virtual network operator is to authority of law report (A _i, j).

A _i=T ₃-(s ₁·T ₁+s ₂·T ₂) (3)

Because:

T ₃-(s ₁·T ₁+s ₂·T ₂)=A _i+(α+β)η-(s ₁·T ₁+s ₂·T ₂)

=A _i+α·η+β·η-s ₁·α·u-s ₂·β·v=A _i

Authority of law is to customer group manager GM _jSend A _i.GM _jCan check record (A _i, UID _i) find corresponding identity UID _i, then UID _iReply to authority of law.On this step, only have the authority of law can be by Virtual network operator and the gerentocratic help of customer group, in examination, confirm need be responsible to ad-hoc communication session the user.

Relevant technical term is as follows:

G ₂Mean G ₂Random generator;

G ₁Mean circled addition group 1;

G ₂Mean circled addition group 2;

G _TMean and G ₁And G ₂The circulation multiplicative group that has same Prime Orders;

ψ means from G ₂To G ₁Isomorphism mapping;

Gsk means group private key;

Grp _iThe identity that means group manager i;

GM _jMean group manager j;

Z _pMean to be less than or equal to the integer field of p;

(OPK, OSK) means the public/private key pair that the Virtual network operator digital signature is used;

(PPK _k, PSK _k) mean that Virtual network operator gives the public/private key pair of each access point;

UID _iThe identity that means user i;

Msk[i] mean member's key of member i;

Mean computable bilinear map G ₁* G ₂→ G _T.

Above-described embodiment is preferably execution mode of the present invention; but embodiments of the present invention are not restricted to the described embodiments; other any do not deviate from change, the modification done under Spirit Essence of the present invention and principle, substitutes, combination, simplify; all should be equivalent substitute mode, within being included in protection scope of the present invention.

Claims (4)

1. but the Radio Access Network authentication method of an accountability and secret protection, is characterized in that, comprises the following steps:

Step 1, customer group manager register at the Virtual network operator place, Virtual network operator generated group private key and partial group PKI, and the partial group PKI is issued to the customer group manager; Issue Virtual network operator after customer group manager's generated group PKI, group's public key broadcasts that the Virtual network operator handle is received from the customer group manager is to access point;

Step 2, user and customer group manager contact to be authenticated, and customer group manager will send member's key and the group's PKI for access network to it, and now the user successfully adds customer group, becomes user in the group;

If step 3 finds that the user is broken, the customer group manager will be broken the user to these and be considered as the user that need cancel, and the list list of cancelling the user is sent to Virtual network operator, Virtual network operator is broadcast to access point by described list, to cancel the described user of being broken;

User in the communication range of step 4, access point with described access point authenticates mutually and cipher key change after, set up shared symmetric key, described symmetric key is for communication session, now the successful access of radio network of user;

Step 5, when the access point place has two or more signatures to need authentication, access point carries out the batch signature verification to these signatures;

If step 6 authority of law need to be followed the trail of the user responsible to ad-hoc communication session, only need obtain group private key from Virtual network operator, and it is right to obtain the mapping of member's key of the user responsible to ad-hoc communication session and subscriber identity information from the customer group manager, utilize the described group's private key obtained with mapping to determining the user responsible to ad-hoc communication session.

2. but the Radio Access Network authentication method of accountability according to claim 1 and secret protection, is characterized in that, described step 4 comprises the following steps:

1. access point is periodically broadcasted the beacon message with this access point digital signature, to mean that described access point is in service state;

2. after the user receives described beacon message, according to the authenticity of the PKI of certificate expired time of the validity of described beacon message proving time stamp, access point and access point; If the authenticity any one of the certificate expired time of the validity of timestamp, access point or PKI is not by checking, the user refuses to receive the corresponding access point of beacon message; If the authenticity of the PKI of the certificate expired time of the validity of timestamp, access point and access point is all by checking, the user generates solicited message, and utilizes the member's key of oneself to carry out group's signature to it, and clean culture replies to access point;

3. access point receives that step that the user sends is 2. after described solicited message, and whether the freshness of first inspection message, reexamine this user and be present in the list list of cancelling the user; If exist, refusal link; Otherwise, calculate the symmetric key shared with the user and send response message to the user;

4. the user, after receiving the information that the access point of step described in 3. send, verifies that whether this information is effective, if information is invalid, and refusal link; Otherwise, establish the link.

3. but the Radio Access Network authentication method of accountability according to claim 1 and secret protection, is characterized in that, described step 6 comprises the following steps:

A, authority of law require Virtual network operator and customer group manager to follow the trail of the user responsible to ad-hoc communication session;

B, Virtual network operator link Network Based and session identification find corresponding session authentication information from the network log file;

C, Virtual network operator carry out linear encryption to first three element of the digital signature in the described session authentication information of step B, and obtain member's key of this user with group's private key; After this, the net operation business reports to authority of law to member's key of this user who obtains;

D, authority of law send the member's key obtained from Virtual network operator to the customer group manager;

E, customer group manager are according to the member's key obtained from authority of law, and member's key of storing at oneself and the mapping centering of subscriber identity information are searched, and a subscriber identity information of finding is replied to authority of law.

4. but a Verification System that realizes the Radio Access Network authentication method of the described accountability of claim 1 and secret protection, is characterized in that, comprising: user and authority of law in Virtual network operator, access point, customer group manager, group; Described Virtual network operator is to hive off PKI receive group's PKI from the customer group manager of customer group manager sending part, and Virtual network operator is also to access point broadcast group PKI; In access point and group, the user authenticates and cipher key change mutually, and in the group, the user also obtains the member's key and group's PKI for access network from the customer group manager; Authority of law obtains group's private key from Virtual network operator, and it is right to obtain the mapping of member's key and subscriber identity information from the customer group manager.

Images