CN113630243B - Authentication key negotiation method with anti-key exposure characteristic in Internet of vehicles environment - Google Patents

Abstract

The invention discloses an authentication key negotiation method with anti-key exposure characteristic in a car networking environment, which is named as a KERAKA method. In the invention, the vehicle can establish the session key with any edge node by only one time of registration, and the method is different from the traditional scheme in that a main public key of the Internet of vehicles system is not required to be set in the initialization stage so as to reduce the storage cost and improve the safety. In addition, the present invention has a key exposure resistance function. Specifically, the private key of the user is updated periodically with the help of the authorization server at each time period, and thus, even if the private key of the user is exposed at the current time period, the security of the private key of the previous or subsequent time period is not affected. Compared with the existing scheme, the method has obvious advantages in the aspects of safety performance and calculation cost, and is more suitable for complex and changeable Internet of vehicles environments.

Description

Authentication key negotiation method with anti-key exposure characteristic in Internet of vehicles environment

Technical Field

The technical field of the invention relates to research of an efficient and safe authentication key negotiation mechanism in an Internet of vehicles environment, in particular to an authentication key negotiation method with anti-key exposure characteristic based on edge calculation in the Internet of vehicles environment.

Background

In the internet of vehicles environment, security and privacy are two major issues that need to be addressed. On the one hand, the communication channel is vulnerable to illegal attacks, such as replay attacks, forgery attacks, etc., due to the openness of the wireless network. On the other hand, with the improvement of safety awareness of people, privacy protection is also becoming more important, and personal sensitive information of the car owners, such as identity information, form routes and the like, should be ensured not to be revealed. In order to protect confidentiality and integrity of the communication information. One possible approach is to encrypt the data prior to its transmission, however, sharing the encryption key in advance can be very costly, especially in complex and diverse internet of vehicles environments. In order to reduce the overhead, the learner then proposes an authentication key agreement method (Authenticated key agreement, AKA), i.e. the two parties together establish a temporary session key by mutual authentication prior to communication.

Dang et al in Efficient identity-based authenticated key agreement protocol with provable security for vehicular ad hoc networks designed an identity-based authentication key agreement protocol for the Internet of vehicles and demonstrated its security in eCK (extended Canetti-Krawczyk) model. However, li et al in A Provably Secure and Lightweight Identity-Based Two-Party Authenticated Key Agreement Protocol for Vehicular Ad Hoc Networks disclose that a man-in-the-middle attack exists in Dang et al's solution and designed a lightweight identity-Based Two-way AKA protocol for the Internet of vehicles. Furthermore, they claim that their solutions can provide strong security and better performance under the eCK model than most other existing solutions. Nevertheless, the above solution cannot be directly applied to an internet of vehicles architecture based on edge calculation or fog calculation.

In recent years, some scholars have proposed an AKA protocol based on fog calculation in an internet of vehicles environment. For example, wazid et al, AKM-IoV: authenticated key management protocol in fog computing-based Internet of vehicles deployment, propose an AKA protocol based on the IoV deployment environment of fog computing. The scheme establishes three session keys respectively located between the fog node and the vehicle, between a roadside unit (RSU) and the fog node, and between the fog node and the cloud server. However, saleem et al, comments on AKM-IoV: authenticated Key Management Protocol in Fog Computing-Based Internet of Vehicles Deployment, indicate that the Wazid et al solution is subject to a counterfeit attack. In order to improve efficiency, ma et al in An efficient and provably secure authenticated key agreement protocol for fog-based vehicular ad-hoc networks designed a provably secure AKA protocol for fog-calculation based internet of vehicles, wherein session keys are negotiated by the vehicle, fog node and cloud server together. However, the document Security-enhanced thread-party pairwise secret key agreement protocol for fog-based vehicular ad-hoc communications states that some Security attacks exist in the Ma et al solution, such as internal attacks, smart card theft attacks, known session-specific temporary information attacks, etc., and proposes an improved three-party key agreement scheme in a fog-based internet of vehicles communication environment.

However, in the proposed authentication key agreement scheme in the internet of vehicles environment, the problem of user key exposure is hardly considered, and in fact, the user key is likely to be compromised due to a low security setting or a shallow security awareness of the user. Once the user's key is known by the adversary, all security objectives will be destroyed and the entire internet of vehicles system will be destroyed once. Also, in most cases, the exposure of the key is difficult for the user to perceive, and as such, the duration of the hazard caused by the exposure of the key may be long, with serious and irreparable consequences. Therefore, we should actively prevent the user key exposure problem. It is necessary to design an AKA protocol based on edge computation with anti-key exposure for the internet of vehicles.

Disclosure of Invention

The invention aims to solve the defects in the prior art and provide an authentication key negotiation method with anti-key exposure characteristic in the environment of the Internet of vehicles.

The aim of the invention can be achieved by adopting the following technical scheme:

an authentication key negotiation method with anti-key exposure characteristic in an internet of vehicles environment, the authentication key negotiation method comprises the following steps:

s1, initializing a vehicle networking system by a trusted center TA, and publishing a public parameter params of the vehicle networking system;

s2, edge node EN _j Registering with the trusted center TA to obtain a key pair

Wherein j represents the number of the edge node, +.>

Representing edge node EN _j Is->

Representing edge node EN _j Is a second private key of (a);

s3, vehicle V _i Registering with a trusted center TA to obtain a pseudonymous identity PID _i And an initial key SK at time period "0 _i,0 Wherein i represents the number of the vehicle;

s4, at the initial moment of the time period t, the vehicle V _i Requesting an update key from the authorization server DS, after the authorization server DS receives the request, calculating the assistance key SK for the time period t _d,t And returned to vehicle V _i The method comprises the steps of carrying out a first treatment on the surface of the Vehicle V _i Assistance key SK _d,t With the aid of which the key SK for the current time period t is calculated _i,t ；

S5, vehicle V _i Off-line calculation of authentication request parameters (R ₁ ,R ₂ ,E)；

S6, in the time period t, the vehicle V _i And edge node EN _j Mutual authentication, if the mutual authentication is successful, a common temporary session key VEK is established _i,t 。

Further, the step S1 is as follows:

s11, selecting a multiplication loop group G with two steps q ₁ And G ₂ Where q is a prime number of length 160 bits and G is group G ₁ Generates a bilinear map e: G ₁ ×G ₁ →G ₂ Representing the multiplication of two from the cyclic group G ₁ Is mapped to a group element from group G by a bilinear pairing operation ₂ Group elements of (2);

s12, selecting two random numbers alpha,

as master key for a vehicle networking system, +.>

An integer group representing modulo q and sending β secretly to the authorization server DS via a secure channel;

s13, firstly selecting a symmetrical encryption algorithm, namely E _k (·)/D _k (. Cndot.) wherein E _k (. Cndot.) represents the encryption algorithm with a key, D _k (. Cndot.) represents a decryption algorithm, k represents a key; then 5 hash functions are selected, and the following five conditions are respectively satisfied: h is a ₁ (·),h ₂ (·):{0,1} ^* →G ₁ ，

h ₄ (·):G ₂ →{0,1} ^* ，h ₅ (·):{0,1} ^* ×G ₁ ×G ₁ ×G ₁ ×G ₂ →Z _q ^* Wherein h is ₁ (·)、h ₂ (. Cndot.) represents a string {0,1}, which is composed of 0 and 1 of arbitrary length ^* Mapping to group G ₁ Element h of (2) ₃ (. Cndot.) represents group G ₁ 、G ₂ Character string {0,1} consisting of elements of (1) and 0 and 1 of arbitrary length ^* Is mapped to an element in an integer group of modulo q, h ₄ (. Cndot.) represents group G ₂ The elements in (a) are mapped into character strings {0,1}, which are composed of 0 and 1 with arbitrary length ^* ，h ₅ (. Cndot.) represents a string {0,1}, which is composed of 0 and 1 of arbitrary length ^* Group G ₁ Element and group G of (3) ₂ The concatenation of the elements in (a) is mapped to the elements in the integer group of modulo q;

s14, the trusted center TA issues common parameters as follows: params (G) ₁ ,G ₂ ,g,e,h ₁ ,h ₂ ,h ₃ ,h ₄ ,h ₅ ,E _k (·)/D _k (·))。

Further, the step S2 is as follows:

s21, edge node EN _j Identity identification EID of oneself _j Sending the data to a trusted center TA through a secure channel;

s22, the trusted center TA receives the edge node EN _j After registration request of (1), according to the received identity identification EID _j Computing edge node EN _j Key pair of (2)Wherein->

h ₁ (EID _j ) Representing the edge node EN _j Identity identification EID of (a) _j Mapping to group G ₁ Is then added with the key pair->

Returned to the edge node EN _j 。

Further, the step S3 is as follows:

s31, vehicle V _i First, the true identity ID of the user is used for identifying the user _i Transmitting the data to a trusted center TA through a secure channel;

s32, the trusted center TA receives the vehicle V _i After registration request of (a) calculating vehicle V _i PID of pseudonymous identity _i ＝E _α (ID _i ) And the key SK of the vehicle at an initial period of "0 _i,0 ＝[h ₁ (PID _i )] ^α ·[h ₂ (PID _i ||0)] ^β Where α is the master key of the Internet of vehicles system, E _α (ID _i ) Denoted alpha vs. vehicle V _i Is the true identity ID of (2) _i Encryption is carried out, h ₁ (PID _i ) Indicating the PID _i Mapping to a group G ₁ Group element of (h) ₂ (PID _i ||0) indicates that PID is to be performed _i Splice mapping with "0" to one from group G ₁ The symbol "·" represents a multiplication operation, "|" represents a string join operation, and will be (PID _i ,SK _i,0 ) Returned to the vehicle V _i 。

Further, the step S4 is as follows:

s41, at the initial time of the time period t, the vehicle V _i Requesting an update key from the authorization server DS, which, upon receipt of the request, calculates the assistance of the time period tKey SK _d,t ＝[h ₂ (PID _i ||t)] ^β ·[h ₂ (PID _i ||t-1)] ^-β Will then assist the key SK _d,t To vehicle V _i ；

S42, vehicle V _i After receiving the helper key, the key SK for time period t is calculated _i,t ＝SK _i,t-1 ·SK _d,t ＝[h ₁ (PID _i )] ^α ·[h ₂ (PID _i ||t)] ^β And (SK) _i,t-1 ,SK _d,t ) Permanent deletion of SK _i,t-1 Representing vehicle V _i A key at time period t-1.

Further, the step S5 is as follows:

vehicle calculation offline parameter (R) ₁ ,R ₂ E) is as follows: first offline parameter R ₁ ＝h ₁ (PID _i ) Second offline parameter R ₂ ＝h ₂ (PID _i ||t), third offline parameter e=e (SK _i,t ,h ₁ (EID _j ) Where "|" denotes a string connection operation, h ₁ (PID _i ) Representing the vehicle V _i PID of pseudonymous identity _i Mapping to a group G ₁ Group element of (h) ₂ (PID _i I t) represents the PID to be used _i And time period t as one from group G ₁ Group elements of SK _i,t Representing vehicle V _i Key at time period t, EID _j Representing edge node EN _j Identity of (h) ₁ (EID _j ) Representing EID _j Mapping to group G ₁ Group element, e (SK) _i,t ,h ₁ (EID _j ) Representing two from group G ₁ Group element (SK) _i,t ,h ₁ (EID _j ) Mapping to a group G by bilinear pairing operation ₂ Is a group element of (a) in the group of (b) elements.

Further, the step S6 is as follows:

s61, vehicle V _i Randomly selecting two integers omega, u epsilon Z _q ^* Calculate authentication request parameters (A, U ₁ ,U ₂ ,η,MAC ₁ ) The following are provided: first confirmationCertificate request parameter a=g ^ω Second authentication request parameter U ₁ ＝R ₁ ^u Third authentication request parameter

Sharing parameter TK _i,t ＝E ^u Fourth authentication request parameter->

Verification code MAC ₁ ＝h ₅ (TK _i,t ||η||U ₁ ||U ₂ I A I t), then authenticate message Mess ₁ ＝{η,U ₁ ,U ₂ ,A,MAC ₁ T is issued to edge node EN _j Wherein i represents the number of the vehicle, the symbol +.>

Representing a string exclusive or operation, "||" representing a string join operation, h ₄ (TK _i,t ) Representing the to-be-shared parameter TK _i,t Mapping into character strings with the length of 32 bits, and h ₅ (TK _i,t '||η||U ₁ ||U ₂ I A I t indication) parameters (TK) _i,t ',η,U ₁ ,U ₂ The concatenation of A, t) maps to an element in an integer group of modulo q;

s62, edge node EN _j Receiving authentication message ₁ Then, the sharing parameters are calculated first

Verification code MAC ₁ '＝h ₅ (TK _i,t '||η||U ₁ ||U ₂ I A I t), wherein->

The representation will come from group G ₁ Is->

Mapping to a group G by bilinear pairing operation ₂ Group element of->

The representation will come from group G ₁ Is->

Mapping to a group G by bilinear pairing operation ₂ Is used to represent the multiplication; then verify the MAC ₁ ' and received MAC ₁ If the verification is equal, if not, the verification fails; if equal, edge node EN _j Then the next operation is performed and an integer b epsilon Z is randomly selected _q ^* Calculate the parameter b=g ^b Vehicle V is restored _i Is->

Computing session key VEK _i,t ＝h ₃ (TK _i,t '||t||PID _i ||EID _j ||A ^b ) Verification code MAC ₂ ＝h ₃ (VEK _i,t ||TK _i,t '||PID _i I B), wherein h ₃ (TK _i,t '||t||PID _i ||EID _j ||A ^b ) Representing the parameters (TK _i,t ',t,PID _i ,EID _j ,A ^b ) Is mapped to an element in an integer group of modulo q, h ₃ (VEK _i,t ||TK _i,t '||PID _i The expression of the parameter (VEK) _i,t ,TK _i,t ',PID _i The concatenation of B) is mapped to an element in an integer group of modulo q; finally, edge node EN _j Will authenticate the message ₂ ＝{B,MAC ₂ Is sent to vehicle V _i ；

S63, vehicle V _i Receiving authentication message ₂ After that, the session key VEK is calculated first _i,t '＝h ₃ (TK _i,t ||t||PID _i ||EID _j ||B ^ω ) Verification code MAC' ₂ ＝h ₃ (VEK _i,t '||TK _i,t ||PID _i I B) and then verify MAC' ₂ And received MAC ₂ If the two types of data are matched, if the two types of data are not matched, authentication fails; otherwise, vehicle V _i And edge node EN _j Mutually authenticated VEK _i,t I.e. the established session key.

Compared with the prior art, the invention has the following advantages and effects:

1) The invention does not need a third party to participate in the authentication process, so that the trusted center TA does not need to be always in an online state.

2) In the invention, the vehicle only needs to register once and store a key, and can establish a session key with any edge node; in addition, unlike the conventional scheme, a main public key of the internet of vehicles system is not required to be set in an initialization stage, so that storage overhead is reduced and safety is improved.

3) In the present invention, the vehicle periodically updates the key of each period with the help of the authorization server DS to achieve the anti-key exposure characteristic, that is, the security of the key of the previous or subsequent period is not affected even if the key of the vehicle is exposed in the current period.

4) Based on the CDH difficult problem, the invention proves that the invention has the anti-key exposure safety under the random language model, and meets the characteristics of privacy protection, session key safety and the like; performance analysis shows that compared with the existing authentication key negotiation scheme in the Internet of vehicles environment, the method has lower calculation cost and higher security performance under the condition that the communication cost is not obviously increased.

Drawings

Fig. 1 is a schematic flow diagram of an authentication key negotiation method with anti-key exposure property in an internet of vehicles environment according to an embodiment of the present invention;

fig. 2 is an application system design diagram of an authentication key negotiation method with anti-key exposure property in an internet of vehicles environment according to an embodiment of the present invention.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are some embodiments of the present invention, but not all embodiments of the present invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.

Examples

In recent years, with the rapid development of intelligent traffic systems, the internet of vehicles has become a research hotspot, and has important significance for improving traffic efficiency and safety, but at the same time, has faced some challenges. On the one hand, in the internet of vehicles, information is transmitted on a public channel, so that the internet of vehicles is easy to attack by illegal users, such as counterfeiting attack, impersonation attack, replay attack and the like. Therefore, how to protect the privacy and safety of users is the key point of research; on the other hand, due to the characteristic of rapid movement of the vehicle, the designed scheme meets the communication safety requirement and has the characteristics of high efficiency, flexibility, low delay and the like. Authentication key agreement protocols are important mechanisms for protecting data transmission, and some scholars have proposed authentication key agreement protocols suitable for the internet of vehicles environment. However, none of these protocols take into account the user key exposure problem. Anti-key exposure is an important security goal in authentication schemes, once the user key is exposed, other security requirements cannot be met.

Aiming at the problems, the invention mainly researches an authentication key negotiation mechanism in the environment of the Internet of vehicles, and provides an authentication key negotiation method with anti-key exposure characteristic in the environment of the Internet of vehicles, which is named as a KERAKA method. In the invention, the vehicle only needs to register once, and can establish a session key with any edge node by storing a key; unlike the conventional scheme, a main public key of the internet of vehicles system is not required to be set in an initialization stage, so that storage overhead is reduced and safety is improved. In addition, the present invention has a key exposure resistance function. Specifically, the private key of the user is updated periodically with the help of the authorization server at each time period, and thus, even if the user is exposed to the key at the current time period, the security of the key at the previous or subsequent time period is not affected. Compared with the existing scheme, the method has obvious advantages in the aspects of safety performance and calculation communication cost, and is more suitable for complex and changeable Internet of vehicles environments.

The following describes in detail a specific procedure of an authentication key negotiation method with anti-key exposure property in an internet of vehicles environment disclosed in this embodiment with reference to fig. 1. The method comprises the following steps:

s1, initializing a vehicle networking system through a trusted center TA, and publishing a public parameter params of the vehicle networking system.

In a specific application, the initializing of the internet of vehicles system through the registry mainly comprises the following steps:

(1) Selecting a multiplication loop group G with two steps q ₁ And G ₂ Where q is a prime number of length 160 bits and G is group G ₁ Generates a bilinear map e: G ₁ ×G ₁ →G ₂ Representing the multiplication of two from the cyclic group G ₁ Is mapped to a group element from group G by a bilinear pairing operation ₂ Group elements of (2);

(2) Two random numbers alpha are selected and the result is that,

as master key for a vehicle networking system, +.>

An integer group representing modulo q and sending β secretly to the authorization server DS via a secure channel;

(3) Selecting a symmetric encryption algorithm, denoted E _k (·)/D _k (. Cndot.) wherein E _k (. Cndot.) represents the encryption algorithm with a key, D _k (. Cndot.) represents a decryption algorithm, k represents a key; then 5 hash functions are selected, and the following five conditions are respectively satisfied: h is a ₁ (·),h ₂ (·):{0,1} ^* →G ₁ ，

h ₄ (·):G ₂ →{0,1} ^* ，h ₅ (·):{0,1} ^* ×G ₁ ×G ₁ ×G ₁ ×G ₂ →Z _q ^* Wherein h is ₁ (·)、h ₂ (. Cndot.) represents a string {0,1}, which is composed of 0 and 1 of arbitrary length ^* Mapping to group G ₁ Element h of (2) ₃ (. Cndot.) represents group G ₁ 、G ₂ Character string {0,1} consisting of elements of (1) and 0 and 1 of arbitrary length ^* Is mapped to an element in an integer group of modulo q, h ₄ (. Cndot.) represents group G ₂ The elements in (a) are mapped into character strings {0,1}, which are composed of 0 and 1 with arbitrary length ^* ，h ₅ (. Cndot.) represents a string {0,1}, which is composed of 0 and 1 of arbitrary length ^* Group G ₁ Element and group G of (3) ₂ The concatenation of the elements in (a) is mapped to the elements in the integer group of modulo q;

(4) The trusted center TA issues common parameters as follows: params (G) ₁ ,G ₂ ,g,e,h ₁ ,h ₂ ,h ₃ ,h ₄ ,h ₅ ,E _k (·)/D _k (·))；

S2, edge node EN _j Registering with the trusted center TA to obtain a key pair

Wherein j represents the number of the edge node, +.>

Representing edge node EN _j Is->

Representing edge node EN _j Is a second private key of (a);

in a specific application, the edge node EN _j Identity identification EID of oneself _j Sending the data to a trusted center TA through a secure channel; trusted center TA receives edge node EN _j After registration request of (1), according to the received identity identification EID _j Computing edge node EN _j Key pair of (2)

Wherein->

h ₁ (EID _j ) Representing the edge node EN _j Identity identification EID of (a) _j Mapping to group G ₁ Elements of (a) and (b); subsequently the key pair->

Returned to the edge node EN _j ；

S3, vehicle V _i Registering with a trusted center TA to obtain a pseudonymous identity PID _i And an initial key SK at time period "0 _i,0 Wherein i represents the number of the vehicle;

in a specific application, vehicle V _i First, the true identity ID of the user is used for identifying the user _i Transmitting the data to a trusted center TA through a secure channel; the trusted center TA receives the vehicle V _i After registration request of (a) calculating a pseudonymous identity PID of the vehicle _i ＝E _α (ID _i ) The pseudonymous identity is to hide the true identity of the vehicle from the edge node, calculate the key SK of the vehicle for an initial period of "0" _i,0 ＝[h ₁ (PID _i )] ^α ·[h ₂ (PID _i ||0)] ^β Where α is the master key of the Internet of vehicles system, E _α (ID _i ) Denoted alpha vs. vehicle V _i Is the true identity ID of (2) _i Encryption is carried out, h ₁ (PID _i ) Indicating the PID _i Mapping to a group G ₁ Group element of (h) ₂ (PID _i ||0) indicates that PID is to be performed _i Splice mapping with "0" to one from group G ₁ The symbol "·" represents a multiplication operation, "|" represents a string join operation, and will be (PID _i ,SK _i,0 ) Returned to the vehicle V _i 。

S4, at the initial moment of the time period t, the vehicle V _i Requesting an update key from the authorization server DS, after the authorization server DS receives the request, calculating the assistance key SK for the time period t _d,t And returned to vehicle V _i The method comprises the steps of carrying out a first treatment on the surface of the Vehicle V _i Assistance key SK _d,t With the aid of which the key SK for the current time period t is calculated _i,t Wherein i represents the number of the vehicle;

in a specific application, at the initial moment of the time period t, the vehicle V _i Requesting an update key from the authorization server DS, after the authorization server DS receives the request, calculating the assistance key SK for the time period t _d,t ＝[h ₂ (PID _i ||t)] ^β ·[h ₂ (PID _i ||t-1)] ^-β And will assist the key SK _d,t To vehicle V _i The method comprises the steps of carrying out a first treatment on the surface of the Vehicle V _i After receiving the helper key, the key SK for time period t is calculated _i,t ＝SK _i,t-1 ·SK _d,t ＝[h ₁ (PID _i )] ^α ·[h ₂ (PID _i ||t)] ^β And (SK) _i,t-1 ,SK _d,t ) Permanent deletion of SK _i,t-1 Representing vehicle V _i The key in time period t-1, symbol "·" represents multiplication operation, "||" represents string connection operation;

s5, in order to reduce the delay, in the vehicle V _i To edge node EN _j Before requesting service, three parameters are calculated offline: first offline parameter R ₁ ＝h ₁ (PID _i ) Second offline parameter R ₂ ＝h ₂ (PID _i ||t), third offline parameter e=e (SK _i,t ,h ₁ (EID _j ) A) is provided; where i denotes the number of the vehicle, "||" denotes the character string connection operation, h ₁ (PID _i ) Representing the vehicle V _i PID of pseudonymous identity _i Mapping to a group G ₁ Group element of (h) ₂ (PID _i I t) represents the PID to be used _i And time period t as one from group G ₁ Group elements of SK _i,t Representing vehicle V _i Key at time period t, EID _j Representing edge node EN _j Identity of (h) ₁ (EID _j ) Representing EID _j Mapping to a group G ₁ Group element, e (SK) _i,t ,h ₁ (EID _j ) Representing two from group G ₁ Group element (SK) _i,t ,h ₁ (EID _j ) Mapping to a group G by bilinear pairing operation ₂ Is a group of (3)An element.

S6, in the time period t, the vehicle V _i And edge node EN _j After successful mutual authentication, a common temporary session key VEK is established _i,t ；

In a specific application, the authentication key negotiation steps are as follows:

(1) Vehicle V _i Randomly selecting two integers omega, u epsilon Z _q ^* Calculate authentication request parameters (A, U ₁ ,U ₂ ,η,MAC ₁ ) The following are provided: first authentication request parameter a=g ^ω Second authentication request parameter U ₁ ＝R ₁ ^u Third authentication request parameter

Sharing parameter TK _i,t ＝E ^u Fourth authentication request parameter->

Verification code MAC ₁ ＝h ₅ (TK _i,t ||η||U ₁ ||U ₂ I A I t), then authenticate message Mess ₁ ＝{η,U ₁ ,U ₂ ,A,MAC ₁ T is issued to edge node EN _j Wherein i represents the number of the vehicle, the symbol +.>

Representing a string exclusive or operation, "||" representing a string join operation, h ₄ (TK _i,t ) Representing the to-be-shared parameter TK _i,t Mapping into character strings with the length of 32 bits, and h ₅ (TK _i,t '||η||U ₁ ||U ₂ I A I t indication) parameters (TK) _i,t ',η,U ₁ ,U ₂ The concatenation of A, t) maps to an element in an integer group of modulo q;

(2) Edge node EN _j Receiving authentication message ₁ Then, the sharing parameters are calculated first

Verification code MAC ₁ '＝h ₅ (TK _i,t '||η||U ₁ ||U ₂ I A I t), wherein->

The representation will come from group G ₁ Is->

Mapping to a group G by bilinear pairing operation ₂ Group element of->

The representation will come from group G ₁ Is->

Mapping to a group G by bilinear pairing operation ₂ Is used to represent the multiplication; then verify the MAC ₁ ' and received MAC ₁ If the verification is equal, if not, the verification fails, and the program is terminated; if equal, edge node EN _j Then the next operation is performed and an integer b epsilon Z is randomly selected _q ^* Calculate the parameter b=g ^b Vehicle V is restored _i Is->

Computing session key VEK _i,t ＝h ₃ (TK _i,t '||t||PID _i ||EID _j ||A ^b ) Verification code MAC ₂ ＝h ₃ (VEK _i,t ||TK _i,t '||PID _i I B), wherein h ₃ (TK _i,t '||t||PID _i ||EID _j ||A ^b ) Representing the parameters (TK _i,t ',t,PID _i ,EID _j ,A ^b ) Is mapped to an element in an integer group of modulo q, h ₃ (VEK _i,t ||TK _i,t '||PID _i The expression of the parameter (VEK) _i,t ,TK _i,t ',PID _i The concatenation of B) is mapped to an element in an integer group of modulo q; finally, edge node EN _j Will authenticate the message ₂ ＝{B,MAC ₂ Is sent to vehicle V _i ；

(3) Vehicle V _i Receiving authentication message ₂ After that, the session key VEK is calculated first _i,t '＝h ₃ (TK _i,t ||t||PID _i ||EID _j ||B ^ω ) Verification code MAC' ₂ ＝h ₃ (VEK _i,t '||TK _i,t ||PID _i I B) and then verify MAC' ₂ And received MAC ₂ Whether there is a match. If the authentication is not matched, the authentication fails; otherwise, vehicle V _i And edge node EN _j Mutually authenticated VEK _i,t I.e. the established session key.

In a car networking environment, a specific example of implementing an authentication key agreement (keyaka) mechanism with anti-key exposure features is shown in fig. 2. The diagram contains four entities, each performing the following operations:

(1) Trusted center (TA): is fully trusted, typically a government agency, responsible for registration of vehicles and edge nodes, possibly tracking the true identity of the vehicle;

(2) Authorization server (DS): at the initial moment of each time period, helping the vehicle to update the private key and realizing anti-key exposure;

(3) Edge Node (EN) _j ): establishing a session key with the vehicle and providing services for the session key;

(4) Vehicle (V) _i ): a session key is established with the edge node and a service is requested from it.

From the aspect of functions, the present embodiment further compares the proposed authentication key agreement (keyaka) method with anti-key exposure characteristics in the internet of vehicles environment with documents [1-5], and the results are shown in table 1. Wherein Fun1 represents vehicle anonymity; fun2 represents traceability; fun3 represents mutual authentication; fun4 denotes session key security; fun5 represents the forward security of the session key; fun6 anti-key exposure property; fun7 indicates that the counterfeit attack can be resisted; fun8 indicates that man-in-the-middle attacks can be resisted.

TABLE 1 functional comparison of the invention with related schemes

Scheme for the production of a semiconductor device

Fun1

Fun2

Fun3

Fun4

Fun5

Fun6

Fun7

Fun8

Document [1]]

√

×

√

√

√

×

√

√

Document [2]]

√

×

√

√

√

×

√

√

Document [3]

×

×

×

√

√

×

√

×

Document [4]]

×

×

×

√

√

×

√

√

Document [5]]

√

√

√

√

√

×

√

√

The invention is that

√

√

√

√

√

√

√

√

As can be seen from table 1, the references [1-4] do not achieve traceability, i.e. the trusted center cannot track the true identity of the malicious vehicle after serious accident caused by the malicious vehicle; the documents [3-4] cannot realize vehicle anonymity and mutual authentication at the same time, because the true identity of the vehicle is directly transmitted on a public channel, and the two communication parties do not perform mutual authentication before calculating a session key; none of the documents [1-5] supports the anti-key exposure property, and only the present invention satisfies all of the above functions, so the present invention has a richer function and a stronger security property.

Among these, the authors, names and outlets of the document [1] are in particular He D, kumar N, khan M K, et al efficiency private-aware authentication scheme for mobile cloud computing services, IEEE Systems Journal,2018,12 (2): 1621-1631.

The authors, names and sources of document [2] are specifically Jia X, he D, kumar N, et al A provably secure and efficient identity-based anonymous authentication scheme for mobile edge computer Systems Journal,2019,14 (1): 560-571.

The authors, names and sources of document [3] are specifically Dang L, xu J, cao X, et al efficiency identity-based authenticated key agreement protocol with provable security for vehicular ad hoc networks, international Journal of Distributed Sensor Networks,2018,14 (4): 1550147718772545.

The authors, literature names and sources of literature [4] are in particular Li Q, hsu C F, raymond Choo K K, et al A Provably Secure and Lightweight Identity-base Two-Party Authenticated Key Agreement Protocol for Vehicular Ad Hoc networks.security and Communication Networks,2019,2019.

The authors, names and sources of document [5] are specifically Xu C, liu H, zhang Y, et al Mutual authentication for vehicular network in complex and uncertain driving. Neurol Computing and Applications,2020,32 (1): 61-72.

In summary, in order to resist the vehicle key exposure attack, the invention constructs an authentication key negotiation method with the key exposure resistance characteristic in the vehicle networking environment, which is named as a KERAKA method. The invention does not need a third party to participate in the authentication process, so that the trusted center TA does not need to be always in an online state. In the invention, the vehicle only needs to register once and store one key, so that the session key can be established with any edge node. In addition, compared with the traditional scheme, the method and the system have the advantages that in the initializing step of the Internet of vehicles system, a main public key of the Internet of vehicles system is not required to be set, so that the storage cost is reduced, and the safety of the Internet of vehicles system is improved. More importantly, the invention ensures that the key exposure attack of the vehicle can be resisted by updating the key of the vehicle at regular intervals, namely the key exposure of the vehicle in the current time period does not influence the security of the key in the time period before or after the current time period. Based on the CDH difficulty problem, the invention proves that the invention has the anti-key exposure characteristic under the random language machine model and meets the common security characteristic in the authentication key negotiation scheme. Meanwhile, efficiency analysis shows that compared with the existing literature, the method has obvious advantages and is more suitable for complex and changeable Internet of vehicles environments.

The above examples are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above examples, and any other changes, modifications, substitutions, combinations, and simplifications that do not depart from the spirit and principle of the present invention should be made in the equivalent manner, and the embodiments are included in the protection scope of the present invention.

Claims (3)

1. An authentication key negotiation method with anti-key exposure characteristic in an internet of vehicles environment is characterized by comprising the following steps:

s1, initializing a vehicle networking system by a trusted center TA, and publishing a public parameter params of the vehicle networking system; the process is as follows:

s11, selecting a multiplication loop group G with two steps q ₁ And G ₂ Where q is a prime number of length 160 bits and G is group G ₁ Generates a bilinear map e: G ₁ ×G ₁ →G ₂ Representing the multiplication of two from the cyclic group G ₁ Is mapped to a group element from group G by a bilinear pairing operation ₂ Group elements of (2);

s12, selecting two random numbers

As master key for a vehicle networking system, +.>

An integer group representing modulo q and sending β secretly to the authorization server DS via a secure channel;

s13, firstly selecting a symmetrical encryption algorithm, namely E _k (·)/D _k (. Cndot.) wherein E _k (. Cndot.) represents the encryption algorithm with a key, D _k (. Cndot.) represents a decryption algorithm, k represents a key; then 5 hash functions are selected, and the following five conditions are respectively satisfied: h is a ₁ (·),h ₂ (·):{0,1} ^* →G ₁ ，

h ₄ (·):G ₂ →{0,1} ^* ，/>

Wherein h is ₁ (·)、h ₂ (. Cndot.) represents a string {0,1}, which is composed of 0 and 1 of arbitrary length ^* Mapping to group G ₁ Element h of (2) ₃ (. Cndot.) represents group G ₁ 、G ₂ Character string {0,1} consisting of elements of (1) and 0 and 1 of arbitrary length ^* Is mapped to an element in an integer group of modulo q, h ₄ (. Cndot.) represents group G ₂ The elements in (a) are mapped into character strings {0,1}, which are composed of 0 and 1 with arbitrary length ^* ，h ₅ (. Cndot.) represents a string {0,1}, which is composed of 0 and 1 of arbitrary length ^* Group G ₁ Element and group G of (3) ₂ The concatenation of the elements in (a) is mapped to the elements in the integer group of modulo q;

s14, the trusted center TA issues common parameters as follows: params (G) ₁ ,G ₂ ,g,e,h ₁ ,h ₂ ,h ₃ ,h ₄ ,h ₅ ,E _k (·)/D _k (·))；

S2, edge node EN _j Registering with the trusted center TA to obtain a key pair

Wherein j represents the number of the edge node, +.>

Representing edge node EN _j Is->

Representing edge node EN _j Is a second private key of (a);

s3, vehicle V _i Registering with a trusted center TA to obtain a pseudonymous identity PID _i And an initial key SK at time period "0 _i,0 Wherein i represents the number of the vehicle; the process is as follows:

s31, vehicle V _i First, the true identity ID of the user is used for identifying the user _i Transmitting the data to a trusted center TA through a secure channel;

s32, the trusted center TA receives the vehicle V _i After registration request of (a) calculating vehicle V _i PID of pseudonymous identity _i ＝E _α (ID _i ) And the key SK of the vehicle at an initial period of "0 _i,0 ＝[h ₁ (PID _i )] ^α ·[h ₂ (PID _i ||0)] ^β Where α is the master key of the Internet of vehicles system, E _α (ID _i ) Denoted alpha vs. vehicle V _i Is the true identity ID of (2) _i Encryption is carried out, h ₁ (PID _i ) Indicating the PID _i Mapping to a group fromG ₁ Group element of (h) ₂ (PID _i ||0) indicates that PID is to be performed _i Splice mapping with "0" to one from group G ₁ The symbol "·" represents a multiplication operation, "|" represents a string join operation, and will be (PID _i ,SK _i,0 ) Returning to the vehicle Vi;

s4, at the initial moment of the time period t, the vehicle V _i Requesting an update key from the authorization server DS, after the authorization server DS receives the request, calculating the assistance key SK for the time period t _d,t And returned to vehicle V _i The method comprises the steps of carrying out a first treatment on the surface of the Vehicle V _i Assistance key SK _d,t With the aid of which the key SK for the current time period t is calculated _i,t The method comprises the steps of carrying out a first treatment on the surface of the The process is as follows:

s41, at the initial time of the time period t, the vehicle V _i Requesting an update key from the authorization server DS, after the authorization server DS receives the request, calculating the assistance key SK for the time period t _d,t ＝[h ₂ (PID _i ||t)] ^β ·[h ₂ (PID _i ||t-1)] ^-β Will then assist the key SK _d,t To vehicle V _i ；

S42, vehicle V _i After receiving the helper key, the key SK for time period t is calculated _i,t ＝SK _i,t-1 ·SK _d,t ＝[h ₁ (PID _i )] ^α ·[h ₂ (PID _i ||t)] ^β And (SK) _i,t-1 ,SK _d,t ) Permanent deletion of SK _i,t-1 Representing vehicle V _i A key at time period t-1;

s5, vehicle V _i Off-line calculation of authentication request parameters (R ₁ ,R ₂ E), first offline parameter R ₁ ＝h ₁ (PID _i ) Second offline parameter R ₂ ＝h ₂ (PID _i ||t), third offline parameter e=e (SK _i,t ,h ₁ (EID _j ) Where "|" denotes a string connection operation, h ₁ (PID _i ) Representing the vehicle V _i PID of pseudonymous identity _i Mapping to a group G ₁ Group element of (h) ₂ (PID _i I t) represents the PID to be used _i And time period tThe mapping is from group G ₁ Group elements of SK _i,t Representing vehicle V _i Key at time period t, EID _j Representing edge node EN _j Identity of (h) ₁ (EID _j ) Representing EID _j Mapping to group G ₁ Group element, e (SK) _i,t ,h ₁ (EID _j ) Representing two from group G ₁ Group element (SK) _i,t ,h ₁ (EID _j ) Mapping to a group G by bilinear pairing operation ₂ Group elements of (2);

s6, in the time period t, the vehicle V _i And edge node EN _j Mutual authentication, if the mutual authentication is successful, a common temporary session key VEK is established _i,t 。

2. The authentication key agreement method with anti-key exposure property in the internet of vehicles environment according to claim 1, wherein the step S2 process is as follows:

s21, edge node EN _j Identity identification EID of oneself _j Sending the data to a trusted center TA through a secure channel;

s22, the trusted center TA receives the edge node EN _j After registration request of (1), according to the received identity identification EID _j Computing edge node EN _j Key pair of (2)

Wherein->

h ₁ (EID _j ) Representing the edge node EN _j Identity identification EID of (a) _j Mapping to group G ₁ Is then added with the key pair->

Returned to the edge node EN _j 。

3. The authentication key agreement method with anti-key exposure property in the internet of vehicles environment according to claim 1, wherein the step S6 process is as follows:

s61, vehicle V _i Randomly selecting two integers omega, u epsilon Z _q ^* Calculate authentication request parameters (A, U ₁ ,U ₂ ,η,MAC ₁ ) The following are provided: first authentication request parameter a=g ^ω Second authentication request parameter U ₁ ＝R ₁ ^u Third authentication request parameter

Sharing parameter TK _i,t ＝E ^u Fourth authentication request parameter->

Verification code MAC ₁ ＝h ₅ (TK _i,t ||η||U ₁ ||U ₂ I A I t), then authenticate message Mess ₁ ＝{η,U ₁ ,U ₂ ,A,MAC ₁ T is issued to edge node EN _j Wherein i represents the number of the vehicle, the symbol

Representing a string exclusive or operation, "||" representing a string join operation, h ₄ (TK _i,t ) Representing the to-be-shared parameter TK _i,t Mapping into character strings with the length of 32 bits, and h ₅ (TK _i,t '||η||U ₁ ||U ₂ I A I t indication) parameters (TK) _i,t ',η,U ₁ ,U ₂ The concatenation of A, t) maps to an element in an integer group of modulo q;

s62, edge node EN _j Receiving authentication message ₁ Then, the sharing parameters are calculated first

Verification code MAC ₁ '＝h ₅ (TK _i,t '||η||U ₁ ||U ₂ I A I t), wherein->

The representation will come from group G ₁ Is->

Mapping to a group G by bilinear pairing operation ₂ Group element of->

The representation will come from group G ₁ Is->

Mapping to a group G by bilinear pairing operation ₂ Is used to represent the multiplication; then verify the MAC ₁ ' and received MAC ₁ If the verification is equal, if not, the verification fails; if equal, edge node EN _j Then the next operation is performed and an integer b epsilon Z is randomly selected _q ^* Calculate the parameter b=g ^b Vehicle V is restored _i Is->

Computing session key VEK _i,t ＝h ₃ (TK _i,t '||t||PID _i ||EID _j ||A ^b ) Verification code MAC ₂ ＝h ₃ (VEK _i,t ||TK _i,t '||PID _i I B), wherein h ₃ (TK _i,t '||t||PID _i ||EID _j ||A ^b ) Representing the parameters (TK _i,t ',t,PID _i ,EID _j ,A ^b ) Is mapped to an element in an integer group of modulo q, h ₃ (VEK _i,t ||TK _i,t '||PID _i The expression of the parameter (VEK) _i,t ,TK _i,t ',PID _i The concatenation of B) is mapped to an element in an integer group of modulo q; finally, edge node EN _j Will authenticate the message ₂ ＝{B,MAC ₂ Is sent to vehicle V _i ；

S63, vehicle V _i Receiving authentication message ₂ After that, the session key VEK is calculated first _i,t '＝h ₃ (TK _i,t ||t||PID _i ||EID _j ||B ^ω ) Verification code MAC' ₂ ＝h ₃ (VEK _i,t '||TK _i,t ||PID _i I B) and then verify MAC' ₂ And received MAC ₂ If the two types of data are matched, if the two types of data are not matched, authentication fails; otherwise, vehicle V _i And edge node EN _j Mutually authenticated VEK _i,t I.e. the established session key.

Images