CN116015807A - Lightweight terminal security access authentication method based on edge calculation - Google Patents
Lightweight terminal security access authentication method based on edge calculation Download PDFInfo
- Publication number
- CN116015807A CN116015807A CN202211619939.7A CN202211619939A CN116015807A CN 116015807 A CN116015807 A CN 116015807A CN 202211619939 A CN202211619939 A CN 202211619939A CN 116015807 A CN116015807 A CN 116015807A
- Authority
- CN
- China
- Prior art keywords
- terminal
- edge
- authentication
- equipment
- key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
- Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security
Abstract
The invention relates to the technical field of terminal security authentication, and discloses a lightweight terminal security access authentication method based on edge calculation, which is characterized in that as more and more embedded power terminals are paved in the edge calculation scene of a power distribution internet of things, a traditional terminal identity authentication mechanism is not applicable any more, so that a lightweight terminal authentication mechanism is designed for a mass resource-limited power terminal, and the authentication process is realized only by a hash function, an exclusive-or operation and a hash message authentication code, and is lightweight calculation operation, so that the authentication method is suitable for resource-limited terminal equipment and edge equipment. The method comprises two stages of registration and authentication, wherein the registration stage is a one-time process, and each terminal only needs to be completed once; the authentication stage is initiated by the terminal, the edge equipment responds, the bidirectional authentication and key negotiation of the terminal and the edge equipment are realized in four-wheel communication, the requirement of lightweight calculation of the terminal is fully met, the deployment is easy, and the authentication requirement of heterogeneous access of a large number of power terminals is met.
Description
Technical Field
The invention relates to the technical field of terminal security authentication, in particular to a lightweight terminal security access authentication method based on edge calculation.
Background
With the development of the technology of the electric power internet of things, an information system of a power grid aggregates a large number of electric power terminal equipment with sensing, communication and calculation functions, and mass data are generated, transmitted and processed, so that edge calculation is introduced as supplementary auxiliary cloud platform processing data, and the safety communication between a terminal and an edge device also generates new challenges. The power terminal is mostly embedded equipment with limited resources, the traditional PKI technology such as excessive expenditure is not suitable for being applied to an edge computing scene, meanwhile, the power terminal is often the primary target of a malicious attacker, and the attacker is likely to realize malicious attack by tampering terminal measurement information, so that the significance of providing an authentication protocol meeting the safety requirements and the light weight requirements is great.
At present, terminal identity authentication methods are various in types, and a hardware fingerprint technology utilizes randomness difference generated in a chip processing process as authentication credentials, and cannot be copied due to the randomness difference; the blockchain technology has natural advantages in the safety field, and the characteristics of decentralization, data non-falsification, traceability and the like provide a new idea for terminal identity authentication; the trusted computing technology realizes the trust between the layers by establishing a trust root and a trust chain and authenticating the layers by layers, and finally extends to the whole network system; the secret sharing technology divides the secret key of the node to be authenticated into a plurality of parts to be respectively stored in other nodes, and the secret key can be recovered to finish authentication after the number of the nodes reaches a certain number; the asymmetric encryption technology utilizes the unique correspondence property of the public key and the private key to realize the authentication of the terminal.
However, most of the existing terminal authentication mechanisms have the problems of difficult deployment, limited application scenarios, large communication calculation consumption and the like, and cannot be directly applied to the electric power internet of things edge calculation scenarios. The hardware fingerprint technology is easy to be influenced by the environment, has defects in practical application, and needs additional acquisition equipment and complex early-stage work; the blockchain technology is still in a development stage, cannot effectively deploy applications, and has higher requirements on computing storage resources; the trusted computing authentication is complex and is not suitable for the embedded device of the edge computing environment; the asymmetric encryption technology has higher demand on computing resources, and most of embedded terminal equipment has limited computing resources, so that the authentication demand of heterogeneous access of massive power terminals is difficult to meet.
Disclosure of Invention
The invention provides a lightweight terminal security access authentication method based on edge calculation, which solves the technical problem that the authentication requirement of heterogeneous access of a large number of power terminals is difficult to meet.
In view of the above, the invention provides a lightweight terminal security access authentication method based on edge calculation, which comprises the following steps:
registering with the edge equipment through the terminal equipment;
calculating an authentication parameter and a message authentication code through the terminal equipment and initiating authentication to the edge equipment;
authenticating the terminal equipment through the edge equipment, if the authentication is passed, calculating authentication parameters and a message authentication code, and feeding back an authentication response to the terminal equipment;
authenticating the edge equipment through the terminal equipment, if the authentication is passed, calculating a verification parameter and a message authentication code, and initiating key negotiation to the edge equipment;
verifying the key negotiation parameters through the edge equipment, if the key negotiation parameters pass the verification, calculating a negotiation key and feeding back a negotiation response to the terminal equipment;
and verifying the message authentication code through the terminal equipment, if the verification is passed, finishing key negotiation, and accessing the terminal equipment to the edge equipment.
Preferably, the step of registering with the edge device by the terminal device specifically includes:
the terminal equipment sends a unique terminal identity ID to the edge equipment through a secure channel;
after receiving a terminal identity ID sent by a terminal device through an edge device, generating a random number x, and calculating a pre-shared secret key PSK, wherein PSK=H (ID|x), H (·) represents a hash function, |is a splicing operator, and PSK is a digest value of a corresponding input parameter calculated by the hash function;
the method comprises the steps that edge equipment locally stores a terminal identity ID and a pre-shared key PSK, and constructs mapping binding between the terminal identity ID and the corresponding pre-shared key PSK, and the edge equipment sends the pre-shared key PSK to the terminal equipment through a secure channel;
and after receiving the pre-shared key PSK sent by the edge equipment through the terminal equipment, storing the pre-shared key PSK and the terminal identity ID to the local.
Preferably, the step of calculating the authentication parameter and the message authentication code by the terminal device and initiating authentication to the edge device specifically includes:
generating a random number r by a terminal device 1 And a current timestamp T 1 Calculate the authentication parameter f 1 ＝r 1 PSK, message authentication code M 1 ＝HMAC PSK (ID‖H(r 1 )||T 1 ) Terminal identity ID and authentication parameter f 1 Message authentication code M 1 Time stamp T 1 And the spliced pieces are sent to edge equipment.
Preferably, the terminal device is authenticated by the edge device, and if the authentication is passed, the steps of calculating an authentication parameter and a message authentication code and feeding back an authentication response to the terminal device specifically include:
timestamp T by edge device 1 Performing time stamp verification, if the verification is passed, searching a corresponding pre-shared key PSK based on the received terminal identity ID, and restoring a random number r 1 ′＝f 1 PSK, calculate authentication parameter M 1 ′＝HMAC PSK (ID||H(r′ 1 )||T 1 ) The authentication parameter M obtained by calculation 1 ' and received M 1 Comparing, if the comparison is the same, the edge equipment passes the authentication of the terminal equipment;
generation of random number r by edge device 2 And a current timestamp T 2 Calculate the authentication parameter f 2 ＝r 2 ⊕H(r 1 ′‖T 2 ) Computing messagesAuthentication code M 2 ＝HMAC PSK (H(r 2 )||T 2 ) Will authenticate the parameter f 2 Message authentication code M 2 With time stamp T 2 And the terminal equipment is sent after being spliced.
Preferably, the terminal device authenticates the edge device, and if the authentication passes, the steps of calculating the verification parameter and the message authentication code, and initiating key negotiation to the edge device specifically include:
timestamp T by a terminal device 2 Performing verification, and if the verification is passed, restoring the random number r 2 ′＝H(r 1 ||T 2 )⊕f 2 Calculate the authentication parameter M 2 ′＝HMAC PSK (H(r′ 2 )||T 2 ) The authentication parameter M obtained by calculation 2 ' and received authentication code M 2 Comparing, if the comparison is the same, the terminal equipment passes the authentication of the edge equipment;
generating a random number r by a terminal device 3 And a current timestamp T 3 Calculating a negotiation key SK T ＝H(ID||r 1 ⊕r 2 ′⊕r 3 ) Calculate the negotiation parameter f 3 ＝r 3 PSK, calculating message authentication code
The parameter f will then be negotiated 3 Message authentication code M 3 With time stamp T 3 And the spliced pieces are sent to edge equipment.
Preferably, the edge device verifies the key negotiation parameters, and if the verification is passed, the step of calculating the negotiation key and feeding back the negotiation response to the terminal device specifically includes:
by edge device time stamp T 3 Performing verification, and if the verification is passed, restoring the random number r' 3 ＝f 3 PSK, calculation of negotiation key SK E ＝H(ID||r 1 ′⊕r 2 ⊕r 3 ') calculating negotiation parameters
The calculated negotiation parameters M' 3 Authentication code M with received message 3 Comparing, if the comparison is the same, negotiating and verifying the terminal equipment by the edge equipment;
computing message authentication codes by edge devices
Generating a current timestamp T 4 And the message authentication code M 4 With time stamp T 4 And the terminal equipment is sent after being spliced.
Preferably, the terminal device verifies the message authentication code, and if the verification is passed, the key negotiation is completed, and the step of accessing the terminal device to the edge device specifically includes:
calculating verification parameters by a terminal device
The verification parameter M obtained by calculation 4 ' and received message authentication code M 4 And (3) comparing, wherein if the comparison is the same, the key negotiation is completed, and the terminal equipment is successfully accessed to the edge equipment.
Preferably, after the key negotiation is completed between the terminal device and the edge device, the generated negotiation key parameters are destroyed.
From the above technical scheme, the invention has the following advantages:
the invention provides a lightweight terminal security access authentication method based on edge calculation, which comprises the following steps: registering with the edge equipment through the terminal equipment; calculating an authentication parameter and a message authentication code through the terminal equipment and initiating authentication to the edge equipment; authenticating the terminal equipment through the edge equipment, if the authentication is passed, calculating authentication parameters and a message authentication code, and feeding back an authentication response to the terminal equipment; authenticating the edge equipment through the terminal equipment, if the authentication is passed, calculating a verification parameter and a message authentication code, and initiating key negotiation to the edge equipment; verifying the key negotiation parameters through the edge equipment, if the verification is passed, calculating a negotiation key and feeding back a negotiation response to the terminal equipment; and verifying the message authentication code through the terminal equipment, if the verification is passed, finishing key negotiation, and accessing the terminal equipment to the edge equipment. The method comprises two stages of registration and authentication, wherein the registration stage is a one-time process, and each terminal only needs to be completed once; the authentication stage is initiated by the terminal, the edge equipment responds, the bidirectional authentication and key negotiation of the terminal and the edge equipment are realized in four-wheel communication, the requirement of lightweight calculation of the terminal is fully met, the deployment is easy, and the authentication requirement of heterogeneous access of a large number of power terminals is met.
Drawings
FIG. 1 is a diagram of an overall authentication architecture according to an embodiment of the present invention;
fig. 2 is a flowchart of a lightweight terminal security access authentication method based on edge calculation according to an embodiment of the present invention;
fig. 3 is a flowchart of a secure access authentication of a terminal device according to an embodiment of the present invention.
Detailed Description
In order to make the present invention better understood by those skilled in the art, the following description will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings, and it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Referring to fig. 1, fig. 1 illustrates an overall authentication architecture designed by the method. With the development of edge computing, a large number of edge devices are paved, a large number of embedded terminals with limited resources are accessed to the edge devices, and the traditional authentication mechanism is not friendly to the embedded terminals, so the invention designs a lightweight terminal authentication method, adopts hash functions, exclusive or operation and hash message authentication codes to realize bidirectional authentication and key negotiation, fully considers challenges and opportunities brought by the edge devices, aims to overcome the problems brought by the edge computing, and exerts the advantages of local autonomy.
For easy understanding, please refer to fig. 2, the method for authenticating the secure access of the lightweight terminal based on edge calculation provided by the invention comprises the following steps:
s1, registering to the edge equipment through the terminal equipment.
The specific registration process is as follows:
after the communication link is established between the terminal equipment T and the edge equipment E, the terminal equipment T firstly initiates a registration request to the edge equipment E, wherein the registration request comprises a registration identifier and an identity identifier ID, and a registration request data packet is sent to the edge equipment E through a secure channel;
the registration identifier can be set into a specific data message according to different protocols and placed on a specific data bit so as to enable the edge equipment to be correctly identified; the identity ID needs to have uniqueness, and can be used for designing identity for terminal equipment by using various factors, such as serial numbers, equipment numbers and the like, and can also be used as identity by using a hash value obtained by calculating related information through a hash function. For example, the device number of a certain terminal device is GB00000011, the identity of the terminal device may be set to be the hash value H of the device number (GB 00000011).
(1.2) after the edge device E receives the registration request packet sent by the terminal device T, determining that the edge device E is a terminal registration request according to the registration identifier, and immediately starting a registration process: a random number x is first generated, and then a pre-shared key psk=h (id||x) is calculated. The edge device E locally saves the terminal identity ID and the pre-shared key PSK and ensures that the identity corresponds to the pre-shared key. The edge device E sends the pre-shared key PSK to the terminal device T through a secure channel;
h (-) involved in the process of calculating the pre-shared secret key represents a hash function, different algorithms can be selected according to different requirements, and a national secret SM3 algorithm can be selected; and the I is a splicing operator and is used for splicing two strings of data. The identity mark corresponds to the pre-shared secret key, namely the pre-shared secret key corresponding to the identity mark can be found through the terminal identity mark, and the data can be stored in a database mode.
And (1.3) after the terminal equipment T receives the pre-shared key PSK sent by the edge equipment E, the pre-shared key PSK is stored locally together with the identity ID.
The registration process is only required to be performed once, the terminal equipment T does not need to be repeatedly registered, but all the terminal equipment needs to be registered in advance to continue the subsequent access authentication and key negotiation process.
S2, calculating an authentication parameter and a message authentication code through the terminal equipment and initiating authentication to the edge equipment.
As shown in fig. 3, fig. 3 illustrates a bidirectional authentication flow chart of the terminal device. The authentication process is automatically started whenever the terminal needs to access the edge device, and the terminal device T sends an authentication request to the edge device E first, since the authentication process is initiated by the terminal device T. The method comprises the following specific steps: the terminal device T first generates a random number r 1 And a current timestamp T 1 And then based on the pre-shared key PSK and r 1 Calculating authentication parameter f 1 ＝r 1 PSK based on self-identity ID, pre-shared key PSK, r 1 With time stamp T 1 Calculating message authentication code M 1 ＝HMAC PSK (ID||H(r 1 )||T 1 ) Then the authentication label Tag, the terminal identity ID and the authentication parameter f 1 Message authentication code M 1 Time stamp T 1 And the spliced pieces are sent to the edge equipment E:
T→E:Msg1＝{Tag‖ID||f 1 ‖M 1 ||T 1 }
wherein +.is exclusive-or operation, the random number r in the above step 1 Exclusive-or operation is carried out with the pre-shared key PSK, and based on the characteristics of the exclusive-or operation, the random number r 1 The length of (2) should be the same as the pre-shared key PSK, and the PSK length depends on the output length of the hash function, for example, the national secret SM3 algorithm, since its output length is 256 bits, the random number r 1 The length should be selected to be 256 bits, and stored in 16-ary number formThen 64 bits (the random number appearing subsequently is also set to 256 bits); similarly, the length of the identity identifier ID is identical to the output length of the hash function, and 256 bits are taken; because of the lightweight nature of the present invention, the time interval for each calculation of the communication is relatively short, so the timestamp T 1 Should be accurate to the millisecond level in order to properly calculate the message delay; hash message authentication code M 1 Is calculated by using an HMAC function, and the HMAC function has the following calculation formula:
HMAC k (x)＝H[(k + ⊕opad)||H[(k + ⊕ipad)||x]]
where k is a symmetric key or a pre-shared key, opad is a bit string with 0x36 repeated b/8 times, ipad is a bit string with 0x5c repeated b/8 times, b is the length of opad or ipad, k + The key k is padded with a bit string of 0 to length b in the header, x is the input message, and can be any length. Since the PSK (i.e., k) length takes 256 bits in this example, b=256. The output length of the HMAC function depends on the hash function output length and so still takes 256 bits.
The authentication identification Tag can be set into a specific data message according to different protocols and placed on a specific data bit so as to enable the edge equipment to identify correctly; the length of each segment of data in the authentication request data packet (Msg 1) is fixed (256 bits except Tag), so that although the data are spliced into a string of data, the data can be split according to the length of each segment of data, the data packet can be conveniently split by the edge device without adding a separation mark, and similarly, the data packet related later can also be provided with a splitting parameter according to the splitting parameter.
And S3, authenticating the terminal equipment through the edge equipment, if the authentication is passed, calculating an authentication parameter and a message authentication code, and feeding back an authentication response to the terminal equipment.
After receiving the terminal access request (Msg 1), the edge device E first identifies the authentication identifier Tag, and then starts an authentication procedure: the first step is to perform time stamp verification, namely generating a current time stamp T 2 Judging |T 2 -T 1 If not, the time stamp verification fails and the terminal equipment T is refused to access; if true, the following steps are performed: based on received terminalThe terminal identity ID searches a corresponding pre-shared key PSK in a local database, and according to the pre-shared key PSK and the received authentication parameter f 1 Reducing random number r 1 ′＝f 1 PSK, then based on the pre-shared key PSK, the received ID, the recovered random number r 1 ' and received timestamp T 1 To calculate the authentication parameter M 1 ′＝HMAC PSK (ID||H(r 1 ′)||T 1 ) M is calculated 1 ' and received M 1 Comparing, if the authentication is different, the authentication is not passed, and rejecting the access of the terminal equipment T; if the authentication is the same, the edge equipment E authenticates the terminal equipment T. Edge device E generates a random number r 2 Using time stamps T 2 And the reduced random number r 1 ' calculate authentication parameter f 2 ＝r 2 ⊕H(r 1 ′||T 2 ) Based on pre-shared key PSK, r 2 With time stamp T 2 Calculating message authentication code M 2 ＝HMAC PSK (H(r 2 )||T 2 ) The authentication parameter f is then set 2 Message authentication code M 2 With time stamp T 2 And the terminal equipment T is sent after being spliced.
E→T:Msg2＝{f 2 ||M 2 ||T 2 }
When the time stamp verification is performed, the absolute value |T of the time stamp difference value is judged 2 -T 1 Whether or not is less than a preset acceptable maximum delay time interval Δt, Δt=1000 ms can be generally set and is common throughout the process; to facilitate the calculation of the correct timestamp difference, the terminal device T needs to be clock synchronized with the edge device E.
And S4, authenticating the edge equipment through the terminal equipment, if the authentication is passed, calculating the verification parameter and the message authentication code, and initiating key negotiation to the edge equipment.
After receiving the authentication response (Msg 2) returned by the edge device E, the terminal device T performs time stamp verification to generate a current time stamp T 3 Judging |T 3 -T 2 If not, the time stamp verification fails, the authentication of the edge equipment E is not passed, and the access process is carried outInterrupting; if true, the following steps are performed: based on the received authentication parameter f 2 With time stamp T 2 Reducing random number r 2 ′＝H(r 1 ||T 2 )⊕f 2 Based on pre-shared key PSK, r 2 ' and received timestamp T 2 Calculating authentication parameters M 2 ′＝HMAC PSK (H(r 2 ′)||T 2 ) M is calculated 2 ' and received M 2 Comparing, if the authentication is different, the authentication is not passed, and interrupting the access process; if the authentication is the same, the terminal equipment T passes the authentication of the edge equipment E. Terminal device T generates random number r 3 Based on self identity ID, r 1 、r 2 ' and r 3 Computing a negotiation key SK T ＝H(ID||r 1 ⊕r 2 ′⊕r 3 ) Followed by a pre-shared key PSK with r 3 Calculating negotiation parameters f 3 ＝r 3 PSK and then based on the negotiation key SK T 、r 3 With time stamp T 3 Calculating message authentication codes
Finally the terminal device T will negotiate the parameter f 3 Message authentication code M 3 With time stamp T 3 And the spliced pieces are sent to the edge equipment E.
T→E:Msg3＝{f 3 ‖M 3 ‖T 3 }
Negotiating a key SK T The calculation of (2) is mainly based on the random numbers and the terminal identity ID generated by the two parties respectively and is used as a communication key between the terminal equipment T and the edge equipment E after authentication is completed.
S5, verifying the key negotiation parameters through the edge equipment, if the key negotiation parameters pass the verification, calculating the negotiation key and feeding back a negotiation response to the terminal equipment.
Wherein, after receiving the terminal key agreement (Msg 3), the edge device E performs time stamp verification to generate the current time stamp T 4 Judging |T 4 -T 3 If not, the time stamp verification fails and the terminal equipment T is refused to access; if true, the following steps are performed: base groupUpon receiving the negotiation parameter f 3 Restoring the random number r3' =f with the pre-shared key PSK 3 PSK based on terminal identity ID, r1', r 2 Negotiating keys with r3' computation
Based on negotiation key SK E 、r 3 ' and received timestamp T 3 Calculate negotiation parameters->
M is calculated 3 ' and received M 3 Comparing, if the verification is not passed, rejecting the access of the terminal equipment T; if the two types of the terminal equipment T are the same, the edge equipment E negotiates and verifies the terminal equipment T. The edge device E is based on the negotiation key SK E With time stamp T 4 Calculating a message authentication code->
The edge device E then sends the message authentication code M 4 With time stamp T 4 And the terminal equipment T is sent after being spliced.
E→T:Msg4＝{M 4 ||T 4 }
Negotiating a key SK E The calculation of (1) is mainly based on random numbers generated by the two parties respectively, and is used as a communication key between the terminal equipment T and the edge equipment E after authentication is completed, and SK is correctly generated E With the negotiation key SK generated in the above S4 T The same; negotiating a key SK E With SK T Can be regarded as a symmetric encryption key, since the length of the negotiation key is consistent with the output length of the hash function and is 256 bits, a symmetric encryption algorithm with the set key length of 256 bits is required to be selected, or part of the length of the negotiation key can be intercepted as a communication key, for example, the negotiation key SK is taken E With SK T The first half of (a) 128 bits are used as a communication key, the symmetric encryption algorithm may be the national encryption SM4 algorithm.
And S6, verifying the message authentication code through the terminal equipment, if the verification is passed, completing key negotiation, and accessing the terminal equipment to the edge equipment.
Wherein, after receiving the negotiation response (Msg 4) returned by the edge device E, the terminal device T calculates the negotiation key SK based on itself T With received time stamp T 4 Calculating verification parameters
M is calculated 4 ' and received M 4 Comparing, if the key agreement verification is not passed, interrupting the access process; if the key agreement is the same, the terminal equipment T successfully accesses the edge equipment E, and normal communication can be started.
In one example, after disconnecting from the edge device E, the terminal device T needs to re-authenticate if it is to be accessed again, i.e. repeat the above steps S2-S6.
Meanwhile, if any one of the authentication or verification processes in the above steps S2 to S6 cannot pass, the edge device denies the access of the terminal device or the terminal device interrupts the authentication process.
It should be noted that, the lightweight terminal security access authentication method based on edge calculation provided by the invention provides an authentication mechanism, which is suitable for the power terminal access authentication scene with limited mass resources under edge calculation, and adopts a lightweight terminal authentication mechanism, namely, the authentication process is only realized by a hash function, an exclusive-or operation and a hash message authentication code, and the hash message authentication code operation only comprises the hash function and the exclusive-or operation, so that the whole authentication process can be realized only based on two calculation operations of the hash function and the exclusive-or operation, the budget rate of the hash function is much lighter than that of the traditional symmetric asymmetric encryption, the exclusive-or operation is used as bit operation, and the calculation consumption is negligible compared with the hash function. Therefore, the terminal authentication mechanism designed by the invention has extremely small requirement on computing resources and is suitable for embedded terminals.
After the key negotiation is completed between the terminal equipment and the edge equipment, the generated negotiation key parameters are destroyed, so that the generated negotiation key only acts on the communication process after the authentication process, and different negotiation keys can be generated in the next authentication process. The calculation of the negotiation key has three random numbers to participate, so that the used negotiation key cannot be reversely deduced according to the current negotiation key, even if the negotiation key is obtained by cracking, an attacker cannot obtain more correct historical negotiation keys to decrypt more communication contents based on the key, and the independence of communication after each authentication is ensured. The invention has the safety characteristic of forward safety.
The invention resists replay attack by random number, time stamp and other factors, thereby effectively improving the security. The invention has the time stamp information in each communication package sending process, the receiver needs to verify the time stamp, and the time stamp also participates in the calculation of the message authentication code, even if the tampered time stamp passes the time stamp verification, the verification of the message authentication code can not pass, so the invention can resist replay attack.
In one embodiment, step S1 specifically includes:
s101, terminal equipment sends a unique terminal identity ID to edge equipment through a secure channel;
s102, after receiving a terminal identity ID sent by a terminal device through an edge device, generating a random number x, and calculating a pre-shared secret key PSK, wherein PSK=H (ID||x), H (·) represents a hash function, ||is a splicing operator, and PSK is a summary value calculated by the hash function for corresponding input parameters;
s103, the edge equipment locally stores the terminal identity ID and the pre-shared key PSK, constructs mapping binding between the terminal identity ID and the corresponding pre-shared key PSK, and sends the pre-shared key PSK to the terminal equipment through a secure channel;
and S104, after receiving the pre-shared key PSK sent by the edge equipment through the terminal equipment, storing the pre-shared key PSK and the terminal identity ID to the local.
In a specific embodiment, step S2 specifically includes:
through terminal equipmentGenerating random number r 1 And a current timestamp T 1 Calculate the authentication parameter f 1 ＝r 1 PSK, message authentication code M 1 ＝HMAC PSK (ID||H(r 1 )||T 1 ) Terminal identity ID and authentication parameter f 1 Message authentication code M 1 Time stamp T 1 And the spliced pieces are sent to edge equipment.
In a specific embodiment, step S3 specifically includes:
s301, timestamp T by edge device 1 Performing time stamp verification, if the verification is passed, searching a corresponding pre-shared key PSK based on the received terminal identity ID, and restoring a random number r 1 ′＝f 1 PSK, calculate authentication parameter M 1 ′＝HMAC PSK (ID||H(r′ 1 )||T 1 ) The authentication parameter M obtained by calculation 1 ' and received M 1 Comparing, if the comparison is the same, the edge equipment passes the authentication of the terminal equipment;
s302, generating a random number r through edge equipment 2 And a current timestamp T 2 Calculating authentication parameters
Calculating message authentication code M 2 ＝HMAC PSK (H(r 2 )||T 2 ) Will authenticate the parameter f 2 Message authentication code M 2 With time stamp T 2 And the terminal equipment is sent after being spliced.
In a specific embodiment, step S4 specifically includes:
s401, timestamp T through terminal equipment 2 Performing verification, and if the verification is passed, restoring the random number r 2 ′＝H(r 1 ||T 2 )⊕f 2 Calculate the authentication parameter M 2 ′＝HMAC PSK (H(r′ 2 )||T 2 ) The authentication parameter M obtained by calculation 2 ' and received authentication code M 2 Comparing, if the comparison is the same, the terminal equipment passes the authentication of the edge equipment;
s402, generating a random number r through terminal equipment 3 And a current timestamp T 3 Calculating a negotiation key SK T ＝H(ID||r 1 ⊕r 2 ′⊕r 3 ) Calculating negotiation parameters f 3 ＝r 3 PSK, calculating message authentication code
The parameter f will then be negotiated 3 Message authentication code M 3 With time stamp T 3 And the spliced pieces are sent to edge equipment.
In a specific embodiment, step S5 specifically includes:
s501, timestamp T by edge device 3 Performing verification, and if the verification is passed, restoring the random number r' 3 ＝f 3 PSK, calculation of negotiation key SK E ＝H(ID||r 1 ′⊕r 2 ⊕r 3 ') calculating negotiation parameters
The calculated negotiation parameters M' 3 Authentication code M with received message 3 Comparing, if the comparison is the same, negotiating and verifying the terminal equipment by the edge equipment;
s502, calculating a message authentication code through the edge device
Generating a current timestamp T 4 And the message authentication code M 4 With time stamp T 4 And the terminal equipment is sent after being spliced.
In a specific embodiment, step S6 specifically includes:
calculating verification parameters by a terminal device
The verification parameter M obtained by calculation 4 ' and received message authentication code M 4 And (3) comparing, wherein if the comparison is the same, the key negotiation is completed, and the terminal equipment is successfully accessed to the edge equipment.
In the several embodiments provided by the present invention, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of elements is merely a logical functional division, and there may be additional divisions of actual implementation, e.g., multiple elements or components may be combined or integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.
The above embodiments are only for illustrating the technical solution of the present invention, and are not limiting; although the invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims (8)
1. The lightweight terminal security access authentication method based on edge calculation is characterized by comprising the following steps:
registering with the edge equipment through the terminal equipment;
calculating an authentication parameter and a message authentication code through the terminal equipment and initiating authentication to the edge equipment;
authenticating the terminal equipment through the edge equipment, if the authentication is passed, calculating authentication parameters and a message authentication code, and feeding back an authentication response to the terminal equipment;
authenticating the edge equipment through the terminal equipment, if the authentication is passed, calculating a verification parameter and a message authentication code, and initiating key negotiation to the edge equipment;
verifying the key negotiation parameters through the edge equipment, if the key negotiation parameters pass the verification, calculating a negotiation key and feeding back a negotiation response to the terminal equipment;
and verifying the message authentication code through the terminal equipment, if the verification is passed, finishing key negotiation, and accessing the terminal equipment to the edge equipment.
2. The method for authenticating the secure access of the lightweight terminal based on the edge calculation according to claim 1, wherein the step of registering with the edge device through the terminal device specifically comprises:
the terminal equipment sends a unique terminal identity ID to the edge equipment through a secure channel;
after receiving a terminal identity ID sent by a terminal device through an edge device, generating a random number x, and calculating a pre-shared secret key PSK, wherein PSK=H (ID|x), H (·) represents a hash function, |is a splicing operator, and PSK is a digest value of a corresponding input parameter calculated by the hash function;
the method comprises the steps that edge equipment locally stores a terminal identity ID and a pre-shared key PSK, and constructs mapping binding between the terminal identity ID and the corresponding pre-shared key PSK, and the edge equipment sends the pre-shared key PSK to the terminal equipment through a secure channel;
and after receiving the pre-shared key PSK sent by the edge equipment through the terminal equipment, storing the pre-shared key PSK and the terminal identity ID to the local.
3. The method for authenticating a lightweight terminal security access based on edge computation according to claim 2, wherein the step of computing the authentication parameter and the message authentication code by the terminal device and initiating authentication to the edge device specifically comprises:
generating a random number r by a terminal device 1 And a current timestamp T 1 Calculating authentication parameters
Message authentication code M 1 ＝HMAC PSK (ID||H(r 1 )||T 1 ) Terminal identity ID and authentication parameter f 1 Message authentication code M 1 Time stamp T 1 And the spliced pieces are sent to edge equipment.
4. The method for authenticating a lightweight terminal security access based on edge calculation according to claim 3, wherein the step of authenticating the terminal device by the edge device, calculating an authentication parameter and a message authentication code if the authentication is passed, and feeding back an authentication response to the terminal device specifically comprises:
timestamp T by edge device 1 Performing time stamp verification, if the verification is passed, searching a corresponding pre-shared key PSK based on the received terminal identity ID, and restoring the random number
Calculating authentication parameters M 1 ′＝HMAC PSK (ID||H(r′ 1 )||T 1 ) The authentication parameter M obtained by calculation 1 ' and received M 1 Comparing, if the comparison is the same, the edge equipment passes the authentication of the terminal equipment;
generation of random number r by edge device 2 And a current timestamp T 2 Calculating authentication parameters
Calculating message authentication code M 2 ＝HMAC PSK (H(r 2 )||T 2 ) Will authenticate the parameter f 2 Message authentication code M 2 With time stamp T 2 And the terminal equipment is sent after being spliced.
5. The method for authenticating a lightweight terminal security access based on edge computation according to claim 4, wherein the step of authenticating an edge device by the terminal device, calculating a verification parameter and a message authentication code if the authentication is passed, and initiating key agreement to the edge device specifically comprises:
timestamp T by a terminal device 2 Performing verification, and if the verification is passed, restoring the random number
Calculating authentication parameters M 2 ′＝HMAC PSK (H(r′ 2 )||T 2 ) The authentication parameter M obtained by calculation 2 ' and received authentication code M 2 Comparing, if the comparison is the same, the terminal equipment passes the authentication of the edge equipment;
generating a random number r by a terminal device 3 And a current timestamp T 3 Calculating a negotiation key
Calculate negotiation parameters->
Calculating a message authentication code->
The parameter f will then be negotiated 3 Message authentication code M 3 With time stamp T 3 And the spliced pieces are sent to edge equipment.
6. The method for authenticating a lightweight terminal security access based on edge computing as recited in claim 5, wherein verifying the key negotiation parameters by the edge device, and if the verification is passed, the steps of computing the negotiation key and feeding back the negotiation response to the terminal device specifically include:
by edge device time stamp T 3 Performing verification, and if the verification is passed, restoring the random number
Calculate negotiation key->
Calculate negotiation parameters->
The calculated negotiation parameters M' 3 Authentication code M with received message 3 Comparing, if the comparison is the same, negotiating and verifying the terminal equipment by the edge equipment;
computing message authentication codes by edge devices
Generating a current timestamp T 4 And the message authentication code M 4 With time stamp T 4 And the terminal equipment is sent after being spliced.
7. The method for authenticating a lightweight terminal security access based on edge computation according to claim 6, wherein the step of verifying the message authentication code by the terminal device, and if the verification is passed, completing key agreement, and accessing the terminal device to the edge device specifically comprises:
calculating verification parameters by a terminal device
The verification parameter M obtained by calculation 4 ' and received message authentication code M 4 And (3) comparing, wherein if the comparison is the same, the key negotiation is completed, and the terminal equipment is successfully accessed to the edge equipment.
8. The edge computing-based lightweight terminal security access authentication method according to claim 1 or 7, wherein the generated negotiation key parameters are destroyed after the key negotiation is completed between the terminal device and the edge device.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211619939.7A CN116015807A (en) | 2022-12-15 | 2022-12-15 | Lightweight terminal security access authentication method based on edge calculation |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211619939.7A CN116015807A (en) | 2022-12-15 | 2022-12-15 | Lightweight terminal security access authentication method based on edge calculation |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116015807A true CN116015807A (en) | 2023-04-25 |
Family
ID=86022505
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211619939.7A Pending CN116015807A (en) | 2022-12-15 | 2022-12-15 | Lightweight terminal security access authentication method based on edge calculation |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116015807A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116684870A (en) * | 2023-08-03 | 2023-09-01 | 中国电力科学研究院有限公司 | Access authentication method, device and system of electric power 5G terminal |
| CN116743461A (en) * | 2023-06-15 | 2023-09-12 | 上海银满仓数字科技有限公司 | Commodity data encryption method and device based on time stamp |
-
2022
- 2022-12-15 CN CN202211619939.7A patent/CN116015807A/en active Pending
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116743461A (en) * | 2023-06-15 | 2023-09-12 | 上海银满仓数字科技有限公司 | Commodity data encryption method and device based on time stamp |
| CN116743461B (en) * | 2023-06-15 | 2023-12-22 | 上海银满仓数字科技有限公司 | Commodity data encryption method and device based on time stamp |
| CN116684870A (en) * | 2023-08-03 | 2023-09-01 | 中国电力科学研究院有限公司 | Access authentication method, device and system of electric power 5G terminal |
| CN116684870B (en) * | 2023-08-03 | 2023-10-20 | 中国电力科学研究院有限公司 | Access authentication method, device and system of electric power 5G terminal |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Wazid et al. | Design of secure key management and user authentication scheme for fog computing services | |
| CN108092776B (en) | System based on identity authentication server and identity authentication token | |
| US9621545B2 (en) | System and method for connecting client devices to a network | |
| US8793497B2 (en) | Puzzle-based authentication between a token and verifiers | |
| CN103118027B (en) | The method of TLS passage is set up based on the close algorithm of state | |
| US8595501B2 (en) | Network helper for authentication between a token and verifiers | |
| CN116015807A (en) | Lightweight terminal security access authentication method based on edge calculation | |
| US20210167963A1 (en) | Decentralised Authentication | |
| US9398024B2 (en) | System and method for reliably authenticating an appliance | |
| EP4231680A1 (en) | Identity authentication system, method and apparatus, device, and computer readable storage medium | |
| WO2014069985A1 (en) | System and method for identity-based entity authentication for client-server communications | |
| CN113395166B (en) | Edge computing-based power terminal cloud edge terminal collaborative security access authentication method | |
| CN111654481B (en) | Identity authentication method, identity authentication device and storage medium | |
| WO2023124958A1 (en) | Key update method, server, client and storage medium | |
| CN114070559A (en) | Industrial Internet of things session key negotiation method based on multiple factors | |
| KR20120091618A (en) | Digital signing system and method using chained hash | |
| CN111224784A (en) | Role separation distributed authentication and authorization method based on hardware trusted root | |
| Ma et al. | A robust authentication scheme for remote diagnosis and maintenance in 5G V2N | |
| Liou et al. | T-auth: A novel authentication mechanism for the IoT based on smart contracts and PUFs | |
| CN116388995A (en) | Lightweight smart grid authentication method based on PUF | |
| CN112468983B (en) | Low-power-consumption access authentication method for intelligent equipment of power internet of things and auxiliary device thereof | |
| KR101256114B1 (en) | Message authentication code test method and system of many mac testserver | |
| JP2004274134A (en) | Communication method, communication system using the communication method, server and client | |
| US20230198968A1 (en) | System and method for field provisioning of credentials using qr codes | |
| CN116318748A (en) | Trusted time authentication method based on verification loop |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |