CN117376015A - Safety authentication method for home robot - Google Patents

Safety authentication method for home robot Download PDF

Info

Publication number
CN117376015A
CN117376015A CN202311554807.5A CN202311554807A CN117376015A CN 117376015 A CN117376015 A CN 117376015A CN 202311554807 A CN202311554807 A CN 202311554807A CN 117376015 A CN117376015 A CN 117376015A
Authority
CN
China
Prior art keywords
robot
server
information
authentication
prey
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202311554807.5A
Other languages
Chinese (zh)
Inventor
李磊
周婉婷
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Yangtze River Delta Research Institute of UESTC Huzhou
Original Assignee
Yangtze River Delta Research Institute of UESTC Huzhou
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Yangtze River Delta Research Institute of UESTC Huzhou filed Critical Yangtze River Delta Research Institute of UESTC Huzhou
Priority to CN202311554807.5A priority Critical patent/CN117376015A/en
Publication of CN117376015A publication Critical patent/CN117376015A/en
Pending legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Algebra (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Physics (AREA)
  • Pure & Applied Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Small-Scale Networks (AREA)

Abstract

The invention discloses a safety authentication method for a home robot, which is applied to the field of robot safety and aims at the safety problems of privacy protection and data safety faced by the home robot; the robot stage firstly completes identity registration in a server, and after the identity registration process is completed, relevant information such as the ID, public key and the like of the robot node is stored in the server; the ID of the server, the public key and other related information are also stored in the robot node and are used for realizing subsequent identity verification and key exchange; after mutual authentication, the server and the robot node establish a session key using the disclosed information to ensure the security of communication; the invention solves the problem of safety authentication under emergency condition by adopting the method of prefabricating information, and eliminates corresponding potential safety hazards.

Description

Safety authentication method for home robot
Technical Field
The invention belongs to the field of robot safety, and particularly relates to an identity authentication technology.
Background
The home robot is a service robot used in a home environment or the like to meet the living needs of a user, and is mainly a robot for home service, and the types thereof may be classified into a housekeeping robot, an educational robot, an entertainment robot, a disabled-in-life robot, a home security robot, a chef robot, a transfer robot, and the like. With the continuous progress of technology and the rapid development of artificial intelligence, home robots become an indispensable part of our lives. From simple household assistants to intelligent robots that can accompany us, they have gradually incorporated our daily lives. However, as the application scope of artificial intelligence expands, we also need to pay more attention to privacy protection and data security.
First, privacy protection is an indispensable aspect in the development of home robots. As home robots need to interact with users, they collect and store a large amount of user data, including information such as voice recognition, facial recognition, and living habits. These data are very sensitive to the user and thus protecting user privacy becomes particularly important. In the design stage of the home robot, consideration of privacy protection should be paid attention to, and personal information of a user is ensured not to be revealed through an encryption algorithm, a secure transmission protocol and other modes. Meanwhile, a corresponding privacy policy is formulated, so that the user is clearly informed of how to collect, use and protect personal information of the user, and the trust degree of the user on the home robot is improved.
Second, data security is also an important issue in the development of home robots. The home robot needs to rely on a large amount of data support while continuously learning and adapting to the needs of the user. However, these data often contain personal information and behavior habits of the user, which, once obtained by a hacker, pose a serious threat to the user's privacy and security. Therefore, when designing the software and hardware of the home robot, technologies and measures with higher security should be adopted to reduce the risk of data theft. Meanwhile, perfect data security management policies are formulated, and the processes of data acquisition, storage and use are supervised and standardized, so that the data is ensured not to be abused and leaked.
Summarizing, with the development of home robots, we have to emphasize privacy protection and data security even more. When designing and developing a home robot, consideration must be paid to privacy and safety, and corresponding technical and policy measures are taken to ensure that personal information and data of a user are protected. Meanwhile, intelligent privacy protection and data security functions are required to be continuously advanced so as to meet the requirements of users on privacy and security. Only on the premise of protecting user privacy and data safety, the home robot can better provide intelligent service for human beings and is in a wider future.
The home robot scene presents high interconnection interoperability, but the security of equipment and a network is imperfect and is easy to suffer various network attacks and threats. Once a security accident occurs, serious consequences such as information leakage and property loss of users may be caused, and the occurrence frequency of such accidents is in an ascending trend. The problem of security authentication of home robots is an important security issue. When the robot transmits data or processes sensitive information, a user can confirm through an authentication mechanism, so that the data is ensured to be accessed by authorized personnel only. But due to the complexity of robotic systems, it is often vulnerable to hacking and security vulnerabilities. The application field of the home robot is easy to be an important attacked object, such as eavesdropping attack, counterfeit attack, counterfeiting attack, man-in-the-middle attack and the like.
The application of PKI system in Internet is very mature, SSL/TLS is the most popular security protocol in the current Internet network communication, and the identity authentication and key agreement between the client and the server are solved. However, PKI is applied to the field of internet of things and robots, and many problems need to be solved, wherein the most important problem is that communication overhead is too high. The communication protocol in the field of robot networking is basically characterized by low-power consumption communication, and moreover, the resources of the Internet of things equipment are often limited, so that the existing PKI system is difficult to load.
Disclosure of Invention
In order to solve the technical problems, the invention provides a safety authentication method for a home robot.
The invention adopts the technical scheme that: a security authentication method facing to a home robot is based on an intelligent home network model comprising the following steps: the system comprises a server A and a robot node B, wherein the server A and the robot node B perform data interaction based on an authentication protocol;
the authentication protocol comprises a registration stage and an authentication stage;
the implementation process of the registration stage comprises the following steps:
at this stage, server a selects the non-singular elliptic curve E:
s12, server A system master key k A Calculate the master public key P A ；
S13, the robot B generates a private key k thereof B And calculates its public key P B Generates its identification ID B Transmitting public key P B Identification ID B Giving the server A;
s14, the server A receives the corresponding information and generates preset information; the preset information includes two parts: preX and PreY; preX is mainly used for assisting security authentication, and comprises a large prime number mi; preY is mainly used for emergency authentication in special cases and comprises a plurality of groups of data, wherein the data form is an index i, a preset encryption key PreY_ki and preset data information PreY_di;
s15, the server A sends parameters (PreX, preY) to the robot B through the safety channel, and the robot B stores corresponding information;
the authentication phase comprises the following steps:
s21, calculating a signature value by the server A;
s22, the server A obtains initialization parameters in a registration stage, calculates a timestamp STAMP1 and a signature Ca of the server A, namely verification information CKA, at the beginning of authentication, and sends corresponding information to the robot B after the calculation is finished;
s23, after the robot B receives the data, the robot B firstly checks whether the received time STAMP information STAMP1 is legal or not; if not, then robot B refuses the session;
s24, if the time stamp is checked successfully, the robot B starts signature calculation, and the calculation result is CCb;
s25, checking whether CCb is equal to CKA by the robot B; if the two values are equal, the robot B successfully verifies the identity of the server A; if CCb is equal to CKA and not equal, the authentication of the server A fails, and the robot B refuses the subsequent session and closes the connection;
s26, after mutual authentication, the server A and the robot B establish a session by using the disclosed informationA key to ensure the security of subsequent communications; after the calculation is finished, the server A and the robot B start to carry out encryption communication by using the symmetric keys, wherein the encryption keys are respectively as follows: SK (SK) A And SK B 。SK A And SK B The two are equal;
s27, in the case of emergency communication, preY information is adopted; the encryption key PreY_ki in the PreY is started to the other party by adopting the preset information PreY_di of the encryption PreY and combining the index i; if the opposite party can successfully decrypt the received data by using the local preset information and compare the received data with the local preset information, and if the received data passes the local preset information, the authentication of the opposite party is proved to be successful.
The invention has the beneficial effects that: (1) The invention provides a safety authentication method for a home robot, which comprises the steps that firstly, identity registration is completed in a server in a robot stage, and after the identity registration process is completed, related information such as an ID (identity), a public key and the like of a robot node is stored in the server; similarly, the ID, public key and other related information of the server are also stored in the robot node for realizing subsequent identity verification and key exchange; (2) After mutual authentication, the server and the robot node establish a session key using the disclosed information to ensure the security of communication; (3) The invention solves the problem of safety authentication under emergency condition by adopting the method of prefabricating information, and eliminates corresponding potential safety hazards.
Drawings
FIG. 1 is a schematic diagram of a network connection;
fig. 2 is a protocol flow diagram.
Detailed Description
The present invention will be further explained below with reference to the drawings in order to facilitate understanding of technical contents of the present invention to those skilled in the art.
Home robots are vulnerable to various network attacks that can have serious consequences, with the main attack types including:
(1) Eavesdropping attack: an attacker intercepts, deletes or modifies data transmitted between two devices without being discovered, and attempts to obtain useful information. Eavesdropping attacks bring about privacy disclosure risks to communication entities, and attackers can also initiate other attacks according to sniffed session data. The attack mode is usually realized by utilizing loopholes or design defects of a network communication protocol without cracking a network encryption mechanism. The eavesdropping attack is high in concealment, and communication parties cannot easily perceive that a third party is monitoring and stealing information. Secondly, the eavesdropping attack does not destroy network communication and does not affect information exchange of two communication parties, so that the eavesdropping attack is difficult to detect.
(2) Counterfeit and counterfeit identity attacks: an attacker can disguise that other legal nodes communicate with other communication entities by intercepting information, so that sensitive information in a network is obtained; or the attacker establishes with other nodes to carry out key negotiation and establishes secure connection by forging corresponding identity credentials. This attack is typically the first step of other attacks to mask the true identity and gain access to the target system.
(3) Replay attack: an attacker captures sensitive information in network communications, such as authentication request messages, and attempts to masquerade as a legitimate node establishing a connection through identity authentication by resending the overheard information to the legitimate node. The attack uses the imperfection of network protocol or application program to the message time sequence and the identity verification to realize the unauthorized access.
(4) Man-in-the-middle attack: the attacker creates independent contacts with both ends of the communication and exchanges data received by them, so that both ends of the communication consider that they are talking directly to each other via a secure connection, but in fact the whole session is completely controlled by the attacker. The attack mode utilizes security holes of network facilities or protocols to impersonate both communication parties to realize interception or tampering of messages.
In order to cope with the corresponding attack, the technical scheme of the invention is as follows:
it is assumed that both communication parties are a server a and a robot B, respectively, as shown in fig. 1. And A and B perform identity authentication and key exchange. As shown in fig. 2, mainly includes two procedures of registration and authentication.
The specific process of registration is as follows:
at this stage, server a selects the non-singular elliptic curve E:
s12, the server A generates a system master key k A By calculating the master public key P A ；
S13, the robot B generates a private key k thereof B And calculates its public key P B Generates its identification ID B Transmitting public key P B Identification ID B Giving the server A;
s14, the server A receives the corresponding information and generates preset information; the preset information includes two parts: preX and PreY. PreX is mainly used for assisting security authentication, including large prime numbers mi and the like; preY is mainly used for emergency authentication in special cases and comprises a plurality of groups of data, wherein the data form is an index i, a preset encryption key PreY_ki and preset data information PreY_di.
S15, the server A sends parameters (PreX, preY) to the robot B through the secure channel, and the person B stores corresponding information.
After the identity registration process is completed, robot B's public key P B And D B At server a. Likewise, the public key P of the server A And D A Stored at the robotic node B for subsequent authentication.
At this stage, the server (a) and the robot node (B) perform two-way identity authentication, specifically including the following procedures:
s21, the server A calculates a signature value
S22, the server A obtains initialization parameters in a registration stage, calculates a timestamp STAMP1 and a signature Ca of the server A, namely verification information CKA, at the beginning of authentication, and sends corresponding information to the server B after the calculation is completed.
S23, after the B receives data, the B firstly checks whether the received time stamp information is legal or not; if not, B refuses the session; the method for judging whether the time stamp is legal is as follows:
first B check STAMP last A Whether or not present. If yes, B checks STAMP last 4 Whether or not to equal STAMP 1 . If the two types of the session requests are equal, the session requests are considered as replay attacks and refused;
next, B checks that Δt is less than or equal to Δt 1 Whether or not it is true, e.g.If not, the session request is considered as replay attack and refused;
Δt＝STAMP ct -STAMP 1 (1)
assuming both checks are successful, B will STAMP last Updated to STAMP 1 And preserve STAMP last Δt 2 Discarding after the time; otherwise the connection is disconnected.
S24, if the time stamp is checked successfully, the signature calculation is started by the B, and the calculation result is CCb;
s25, B checks if CCb is equal to CKa. If the two values are equal, B successfully verifies the identity of A. If CCb is equal to CKa and not equal, a fails authentication, B denies the subsequent session and closes the connection.
S26, after mutual authentication, a and B establish a session key using the disclosed information to ensure security of subsequent communications. After the calculation is finished, the A and the B start to carry out encryption communication by using the symmetric keys, wherein the encryption keys are respectively: SK (SK) A And SK B 。SK A And SK B Equal to each other:
s27, in case of emergency communication, preY information will be used. The encryption key prey_ki in PreY is started to the other party in association with index i by using preset information prey_di of encryption PreY. If the opposite party can successfully decrypt the received data by using the local preset information and compare the received data with the local preset information, and if the received data passes the local preset information, the authentication of the opposite party is proved to be successful.
Those of ordinary skill in the art will recognize that the embodiments described herein are for the purpose of aiding the reader in understanding the principles of the present invention and should be understood that the scope of the invention is not limited to such specific statements and embodiments. Various modifications and variations of the present invention will be apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims (3)

1. The home robot-oriented security authentication method is characterized in that the intelligent home network model comprises the following steps: the system comprises a server A and a robot node B, wherein the server A and the robot node B perform data interaction based on an authentication protocol;
the authentication protocol comprises a registration stage and an authentication stage;
the implementation process of the registration stage comprises the following steps:
s11, in the registration stage, the server A selects a non-singular elliptic curve E:
s12, server A system master key k A Calculate the master public key P A ；
S13, the robot B generates a private key k thereof B And calculates its public key P B Generates its identification ID B Transmitting public key P B Identification ID B Giving the server A;
s14, the server A receives the corresponding information and generates preset information; the preset information includes two parts: preX and PreY; preX is mainly used for assisting security authentication, and comprises a large prime number mi; preY is mainly used for emergency authentication in special cases and comprises a plurality of groups of data, wherein the data form is an index i, a preset encryption key PreY_ki and preset data information PreY_di;
s15, the server A sends parameters (PreX, preY) to the robot B through the safety channel, and the robot B stores corresponding information;
the authentication phase comprises the following steps:
s21, calculating a signature value by the server A;
s22, the server A obtains initialization parameters in a registration stage, calculates a timestamp STAMP1 and a signature Ca of the server A, namely verification information CKA, at the beginning of authentication, and sends corresponding information to the robot B after the calculation is finished;
s23, after the robot B receives the data, the robot B firstly checks whether the received time STAMP information STAMP1 is legal or not; if not, then robot B refuses the session;
s24, if the time stamp is checked successfully, the robot B starts signature calculation, and the calculation result is CCb;
s25, checking whether CCb is equal to CKA by the robot B; if the two values are equal, the robot B successfully verifies the identity of the server A; if CCb is equal to CKA and not equal, the authentication of the server A fails, and the robot B refuses the subsequent session and closes the connection;
s26, after mutual authentication, the server A and the robot B establish a session key by using the disclosed information so as to ensure the safety of subsequent communication; after the calculation is finished, the server A and the robot B start to carry out encryption communication by using the symmetric keys, wherein the encryption keys are respectively as follows: SK (SK) A And SK B ；SK A And SK B The two are equal;
s27, in the case of emergency communication, preY information is adopted; the encryption key PreY_ki in the PreY is started to the other party by adopting the preset information PreY_di of the encryption PreY and combining the index i; if the opposite party can successfully decrypt the received data by using the local preset information and compare the received data with the local preset information, and if the received data passes the local preset information, the authentication of the opposite party is proved to be successful.
2. The home robot-oriented security authentication method of claim 1, wherein the public key P of the robot B after the identity registration process is completed B And D B Stored in server a; likewise, the public key P of the server A And D A Stored at the robotic node B.
3. The home robot-oriented security authentication method according to claim 2, wherein the step S23 of judging whether the time stamp is legal is:
first B check STAMP last A Whether or not present. If yes, B checks STAMP last A Whether or not to equal STAMP 1 The method comprises the steps of carrying out a first treatment on the surface of the If the two types of the session requests are equal, the session requests are considered as replay attacks and refused;
next, B checks that Δt is less than or equal to Δt 1 If not, the session request is considered as replay attack and refused;
Δt＝STAMP ct -STAMP 1
assuming that both checks are successful, B will STAMP last Updated to STAMP 1 And preserve STAMP last Δt 2 Discarding after the time; otherwise, it isDisconnecting the connection.
CN202311554807.5A 2023-11-21 2023-11-21 Safety authentication method for home robot Pending CN117376015A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202311554807.5A CN117376015A (en) 2023-11-21 2023-11-21 Safety authentication method for home robot

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202311554807.5A CN117376015A (en) 2023-11-21 2023-11-21 Safety authentication method for home robot

Publications (1)

Publication Number Publication Date
CN117376015A true CN117376015A (en) 2024-01-09

Family

ID=89402434

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202311554807.5A Pending CN117376015A (en) 2023-11-21 2023-11-21 Safety authentication method for home robot

Country Status (1)

Country Link
CN (1) CN117376015A (en)

Similar Documents

Publication Publication Date Title
CN110234111B (en) Two-factor authentication key agreement protocol suitable for multi-gateway wireless sensor network
CN112235235B (en) SDP authentication protocol implementation method based on cryptographic algorithm
CN109327313A (en) A kind of Bidirectional identity authentication method with secret protection characteristic, server
CN103701792B (en) Credibility authorization method, system, credibility security management center and server
CN104767731A (en) Identity authentication protection method of Restful mobile transaction system
CN113872944A (en) Block chain-oriented zero-trust security architecture and cluster deployment framework thereof
CN113572765B (en) Lightweight identity authentication key negotiation method for resource-limited terminal
CN110505055A (en) Based on unsymmetrical key pond to and key card outer net access identity authentication method and system
CN113473458A (en) Equipment access method, data transmission method and computer readable storage medium
CN110730071A (en) Power distribution communication equipment safety access authentication method, device and equipment
CN110519222A (en) Outer net access identity authentication method and system based on disposable asymmetric key pair and key card
CN116707807B (en) Distributed zero-trust micro-isolation access control method and system
CN105790932B (en) A kind of encryption method by using based on machine code
Xia et al. An identity authentication scheme based on SM2 algorithm in UAV communication network
CN107979466A (en) The safe Enhancement Method of iSCSI protocol based on Diffie-Hellman agreements
CN114254352A (en) Data security transmission system, method and device
CN117376015A (en) Safety authentication method for home robot
EP1530343A1 (en) Method and system for creating authentication stacks in communication networks
WO2013152653A1 (en) Air interface security method and device
CN114466353A (en) App user ID information protection device and method, electronic equipment and storage medium
CN101026454A (en) Safety interacting method for user terminal access softswitch system
JP2005516471A (en) Protecting data traffic in a mobile network environment
CN113783693A (en) Key agreement and authentication method based on limited application protocol CoAP
Sameni et al. Analysis of Attacks in Authentication Protocol IEEE 802.16 e
CN114218555B (en) Method and device for enhancing password security strength of password management APP (application) password and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication