CN118075734B - Security lightweight group authentication system and method based on smart grid end-to-end communication - Google Patents
Security lightweight group authentication system and method based on smart grid end-to-end communication Download PDFInfo
- Publication number
- CN118075734B CN118075734B CN202410459105.7A CN202410459105A CN118075734B CN 118075734 B CN118075734 B CN 118075734B CN 202410459105 A CN202410459105 A CN 202410459105A CN 118075734 B CN118075734 B CN 118075734B
- Authority
- CN
- China
- Prior art keywords
- amf
- key
- user equipment
- group
- users
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 55
- 230000006854 communication Effects 0.000 title claims abstract description 27
- 238000004891 communication Methods 0.000 title claims abstract description 26
- 238000004364 calculation method Methods 0.000 claims abstract description 17
- 230000008569 process Effects 0.000 claims description 29
- 238000012795 verification Methods 0.000 claims description 19
- 230000004044 response Effects 0.000 claims description 9
- 238000012790 confirmation Methods 0.000 claims description 6
- 239000004973 liquid crystal related substance Substances 0.000 claims description 6
- JXASPPWQHFOWPL-UHFFFAOYSA-N Tamarixin Natural products C1=C(O)C(OC)=CC=C1C1=C(OC2C(C(O)C(O)C(CO)O2)O)C(=O)C2=C(O)C=C(O)C=C2O1 JXASPPWQHFOWPL-UHFFFAOYSA-N 0.000 claims description 3
- 239000000654 additive Substances 0.000 claims description 3
- 230000000996 additive effect Effects 0.000 claims description 3
- 230000008859 change Effects 0.000 claims description 3
- 238000007689 inspection Methods 0.000 claims description 3
- 238000005304 joining Methods 0.000 claims description 3
- 238000010586 diagram Methods 0.000 description 8
- 230000006870 function Effects 0.000 description 8
- 238000004590 computer program Methods 0.000 description 7
- 238000012545 processing Methods 0.000 description 4
- 230000002776 aggregation Effects 0.000 description 3
- 238000004220 aggregation Methods 0.000 description 3
- 238000011161 development Methods 0.000 description 3
- 238000003860 storage Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 239000013307 optical fiber Substances 0.000 description 2
- 206010063385 Intellectualisation Diseases 0.000 description 1
- 230000004075 alteration Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 239000000126 substance Substances 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
- H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
- H02J13/00—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network
- H02J13/00006—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network characterised by information or instructions transport means between the monitoring, controlling or managing units and monitored, controlled or operated power network element or electrical equipment
- H02J13/00028—Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network; Circuit arrangements for providing remote control of switching means in a power distribution network, e.g. switching in and out of current consumers by using a pulse code signal carried by the network characterised by information or instructions transport means between the monitoring, controlling or managing units and monitored, controlled or operated power network element or electrical equipment involving the use of Internet protocols
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/009—Security arrangements; Authentication; Protecting privacy or anonymity specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/03—Protecting confidentiality, e.g. by encryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/041—Key generation or derivation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
- H04W12/0431—Key distribution or pre-distribution; Key agreement
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
- H04W12/122—Counter-measures against attacks; Protection against rogue devices
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
- Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Power Engineering (AREA)
- Mobile Radio Communication Systems (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention relates to a safety lightweight group authentication system and method based on smart grid end-to-end communication, comprising user equipment, an AMF and a 5G base station; the user equipment is connected with the AMF unit through a 5G base station; the AMF distributes the public key and the private key to the user equipment to provide anonymous identity protection for the user equipment, then verifies the user equipment through an aggregate signature scheme, and finally negotiates a session key through the ECDH. The invention effectively improves the end-to-end communication safety and authentication efficiency in the intelligent power grid, and simultaneously reduces the calculation and communication expenditure of equipment and a server.
Description
Technical Field
The invention relates to the technical field of power communication, in particular to a safety lightweight group authentication system and method based on smart grid end-to-end communication.
Background
With the continuous development of technology, electric power resources are closely related to life of people, and play a vital role in modern times. However, as demand increases, the grid becomes more and more complex, resulting in significant changes to the power system. How to ensure the reliability of electric power has become an urgent problem to be solved. At the same time, the advent of smart grids has led to the development of power systems towards intellectualization and modernization, which is the result of technological development reaching a certain stage. The method can provide a comprehensive, real-time and efficient flexible processing method for related services in the power system, realize new application in the power service, and construct a complex multi-mode system based on the power system. In a traditional relay protection service scenario, both ends of the power device use optical fibers to transmit data. However, as more and more power supply devices are connected, the cost of the optical fiber structure is high, the scalability is low, and the high reliability and low delay characteristics of the 5G wireless communication technology are key to solving the above problems.
Disclosure of Invention
In order to solve the problems, the invention aims to provide a safety lightweight group authentication system and method based on smart grid end-to-end communication, which effectively improve the end-to-end communication safety and authentication efficiency in the smart grid and reduce the calculation and communication costs of equipment and servers.
In order to achieve the above purpose, the present invention adopts the following technical scheme:
A security lightweight group authentication system based on smart grid end-to-end communication comprises user equipment, an AMF and a 5G base station; the user equipment is connected with the AMF unit through a 5G base station; the AMF distributes the public key and the private key to the user equipment to provide anonymous identity protection for the user equipment, then verifies the user equipment through an aggregate signature scheme, and finally negotiates a session key through the ECDH.
A secure lightweight group authentication method based on smart grid end-to-end communication comprises the following steps:
S1, generating a q-order additive circulation group G by inputting a safety parameter K through an AMF, wherein P is a generator of a group G; AMF random selection Computing system public key as master keyAnd selecting a secure hash function:， Finally, the AMF unit outputs the system parameters = { q, G, P, ,,-Secret and save key s;
step S2, the user equipment firstly executes a 5G-AKA or EAP-AKA protocol to finish user authentication, saves the real identities of all the user equipment through an AMF, stores the real identities in a user equipment identification list, and registers the temporary identities of the user equipment through the AMF;
Step S3, after the user registration is completed, using their temporary identity to perform end-to-end discovery, mutually discovering each user through the end-to-end discovery process Finally, an end-to-end conversation list is obtained;
Step S4, after obtaining the end-to-end session list, the user equipment sends session request information to the AMF, when the AMF receives all the requests, it checks whether the user identity in the request information is legal registered identity, if not, it will reject the end-to-end session request, if the verification is successful, the AMF will create an end-to-end group session for all legal users, and generate a session identifier . AMF then forms a set of ring structures=,,...,Based on the identity of the user,AndLogically respectivelyIs then AMF broadcast,}；
And S5, after receiving the session response message of the AMF, the users start mutual authentication and key negotiation, and finally, the users in the group carry out secure communication.
Further, the step S2 specifically includes:
Step S2.1: first a secret value is selected Calculating intermediate parametersTemporary identificationWhereinFor the private identification of the user,As a function of the hash-up,System parameters output for AMF units will then {-Send to AMF;
step S2.2: AMF receipt of Transmitted {After } calculateAnd inquires whether the user equipment identification list containsIf not, the execution is terminated, otherwise, { is saved in the temporary identification index database,AMF generates a message={,}, WhereinIs temporary identity validity period whenAt the time of expiration of the time period,AMF random selection of secret valueAnd calculate,,Send {To (V)Wherein, the method comprises the steps of,、All are calculated intermediate process quantities;
Step S2.3: when (when) Received {When } calculate the partial private key，WhereinTo calculate the intermediate process quantity to verify the formulaIf not, the part of the private key is re-requested, and if so, the part of the private key is accepted; Randomly selecting secret values Calculation ofFinally, setting the public key of the user equipment) And private key);
Further, the step S3 specifically includes:
First, user equipment Selecting random numbersCalculation ofAnd generates request information={,,,}, WhereinRepresenting a time stamp, calculating，WhereinTo calculate the intermediate process quantity, a signature is obtainedFinally broadcast {}；
Adjacent users receive usersAfter broadcasting a message, verify the equationWhether or not to establish; if the formula is true, thenAdding into the end-to-end dialogue list, and storing; Setting n end-to-end users,，...，) Through the above end-to-end discovery process, each user finally obtains an end-to-end session list l=,,...,}。
Further, the step S5 specifically includes:
step S5.1 user equipment Generating a message) And randomly select a response valueAnd calculate，，Wherein、To calculate the intermediate process quantity, the user equipmentGenerating signaturesThen toAndWherein (i+1) mod n represents the result of adding 1 to i and then adding n to the remainder, and is a numerical result, and sends a message,,,}, WhereinIs thatAnd adds a timestamp to prevent the message from being replayed;
Step S5.2 when When receiving the messages sent by two adjacent users, it first verifiesIf it is equal, then proceed and verifyWhether it is a legal registered identity, if so, it will verify whether the time stamp is within the specified time, and if so, it will verify the signature information,Verification of,If it passes the verification, thenWill calculate,To calculate the intermediate process quantity, where (i+1) mod n represents the result of adding 1 to i and then taking the remainder of n, is a numerical result, at which time messages are broadcast to other users,,,};
Step S5.3: when the user equipmentUpon receipt of the broadcast request,First verifyIf it is equal, then proceed and verifyWhether it is a legal registered identity, if so, verifying whether the time stamp is within a specified time, if so, waiting for verification to passCollecting the remaining broadcast messages, when the number of last received messages is less than n-1, or the identity is not in the previously formed end-to-end group,The negotiation will be exited. At this time, the liquid crystal display device,All signatures in the end-to-end group are received and an aggregate signature is generatedWherein,Then verify the signature. If the signature is verified, it is accepted; otherwise, it may verify each received message once to collect the correct signature, or simply choose to discard the signature, at which point,Will calculate the session key The members of the group have generated the same session key. At this time, the liquid crystal display device,Using session keysCalculation ofAnd then generate a message,,And } wherein,To calculate the intermediate process quantity and send the message to the AMF;
step S5.4: when AMF receives the transmitted message, it verifies If it is within the specified range, the AMF will waitThe method comprises the steps of collecting the rest information and verifying whether the received hash values are equal, if so, the group equipment is provided with an equal session key, the AMF sends a confirmation information to all users, when the users receive the confirmation information, the users start to communicate, and finally, the users in the group perform secure communication.
Further, the new user joins the group, specifically as follows:
1) First, from In selecting two usersAndJoining a new group, the grouping beingAnd；
2）AndReselection response value,Calculation of，，，And a signature value; due to the original groupHas been negotiated, so authentication negotiation is not required; the key of the group is; New groupThe identity verification process is executed to finally obtainIs a key to a key (a);
3） And Using the original keyEncryption keyAnd send it to other members of the original group; And The key will be usedEncrypted keySending to other members of the new group;
4) Combining the two combinations into The new group key at this time is。
Further, the user leaves the group, specifically as follows:
let u= Is the current group, and V =Is a leaving member set in whichThe remaining set of members at this time can be expressed as a=；
1) Each memberInspection ofLeft member of (2)Or right memberWhether or not it has left; if it isOr (b)ThenRequiring re-selection of secret values, re-computationAnd signing and sending it to setting a;
2) If a member Does not change, thenSimply propagate their previous calculationsAnd signing to set a;
3) Upon receiving all values And after signing, each memberThe aggregate signature is verified. After verification is successful, the relevant parties can continue to calculate using the same procedure as before.
The invention has the following beneficial effects:
1. the invention realizes identity privacy protection, mutual authentication and aggregation signature, and has resistance to various attacks. Identity privacy protection, mutual authentication and aggregation signature are realized, malicious attacks are effectively resisted, and safety is ensured;
2. The invention can reduce the workload of the verifier and improve the verification efficiency by using signature aggregation.
Drawings
FIG. 1 is a flow chart of an authentication process of the present invention;
FIG. 2 is a diagram of communication overhead according to an embodiment of the present invention;
FIG. 3 is a diagram of a system architecture according to an embodiment of the present invention.
Detailed Description
The invention is described in further detail below with reference to the attached drawings and specific examples:
1-3, the invention provides a security lightweight group authentication system based on smart grid end-to-end communication, which comprises user equipment, an AMF and a 5G base station; the user equipment is connected with the AMF unit through a 5G base station; the AMF distributes the public key and the private key to the user equipment to provide anonymous identity protection for the user equipment, then verifies the user equipment through an aggregate signature scheme, and finally negotiates a session key through the ECDH.
The communication scenario of the present invention includes end-to-end one-to-one communication and end-to-end group communication, wherein the AMF is responsible for handling all transactions in the end-to-end communication process, and all power consumer devices are equipped with PUF modules.
In this embodiment, there is also provided a secure lightweight group authentication method based on smart grid end-to-end communication, including the steps of:
S1, generating a q-order additive circulation group G by inputting a safety parameter K through an AMF, wherein P is a generator of a group G; AMF random selection Computing system public key as master keyAnd selecting a secure hash function:， Finally, the AMF unit outputs the system parameters = { q, G, P, ,,-Secret and save key s;
step S2, the user equipment firstly executes a 5G-AKA or EAP-AKA protocol to finish user authentication, saves the real identities of all the user equipment through an AMF, stores the real identities in a user equipment identification list, and registers the temporary identities of the user equipment through the AMF;
Step S3, after the user registration is completed, using their temporary identity to perform end-to-end discovery, mutually discovering each user through the end-to-end discovery process Finally, an end-to-end conversation list is obtained;
Step S4, after obtaining the end-to-end session list, the user equipment sends session request information to the AMF, when the AMF receives all the requests, it checks whether the user identity in the request information is legal registered identity, if not, it will reject the end-to-end session request, if the verification is successful, the AMF will create an end-to-end group session for all legal users, and generate a session identifier . AMF then forms a set of ring structures=,,...,Based on the identity of the user,AndLogically respectivelyIs then AMF broadcast,}；
And S5, after receiving the session response message of the AMF, the users start mutual authentication and key negotiation, and finally, the users in the group carry out secure communication.
In this embodiment, step S2 specifically includes:
Step S2.1: first a secret value is selected Calculating intermediate parametersTemporary identificationWhereinFor the private identification of the user,As a function of the hash-up,System parameters output for AMF units will then {-Send to AMF;
step S2.2: AMF receipt of Transmitted {After } calculateAnd inquires whether the user equipment identification list containsIf not, the execution is terminated, otherwise, { is saved in the temporary identification index database,AMF generates a message={,}, WhereinIs temporary identity validity period whenAt the time of expiration of the time period,AMF random selection of secret valueAnd calculate,,Send {To (V)Wherein, the method comprises the steps of,、All are calculated intermediate process quantities;
Step S2.3: when (when) Received {When } calculate the partial private key，WhereinTo calculate the intermediate process quantity to verify the formulaIf not, the part of the private key is re-requested, and if so, the part of the private key is accepted; Randomly selecting secret values Calculation ofFinally, setting the public key of the user equipment) And private key);
In this embodiment, the step S3 specifically includes:
First, user equipment Selecting random numbersCalculation ofAnd generates request information={,,,}, WhereinRepresenting a time stamp, calculating，WhereinTo calculate the intermediate process quantity, a signature is obtainedFinally broadcast {}；
Adjacent users receive usersAfter broadcasting a message, verify the equationWhether or not to establish; if the formula is true, thenAdding into the end-to-end dialogue list, and storing; Setting n end-to-end users,，...，) Through the above end-to-end discovery process, each user finally obtains an end-to-end session list l=,,...,}。
In this embodiment, step S5 specifically includes:
step S5.1 user equipment Generating a message) And randomly select a response valueAnd calculate，，Wherein、To calculate the intermediate process quantity, the user equipmentGenerating signaturesThen toAndWherein (i+1) mod n represents the result of adding 1 to i and then adding n to the remainder, and is a numerical result, and sends a message,,,}, WhereinIs thatAnd adds a timestamp to prevent the message from being replayed;
Step S5.2 when When receiving the messages sent by two adjacent users, it first verifiesIf it is equal, then proceed and verifyWhether it is a legal registered identity, if so, it will verify whether the time stamp is within the specified time, and if so, it will verify the signature information,Verification of,If it passes the verification, thenWill calculate,To calculate the intermediate process quantity, where (i+1) mod n represents the result of adding 1 to i and then taking the remainder of n, is a numerical result, at which time messages are broadcast to other users,,,};
Step S5.3: when the user equipmentUpon receipt of the broadcast request,First verifyIf it is equal, then proceed and verifyWhether it is a legal registered identity, if so, verifying whether the time stamp is within a specified time, if so, waiting for verification to passCollecting the remaining broadcast messages, when the number of last received messages is less than n-1, or the identity is not in the previously formed end-to-end group,The negotiation will be exited. At this time, the liquid crystal display device,All signatures in the end-to-end group are received and an aggregate signature is generatedWherein,Then verify the signature. If the signature is verified, it is accepted; otherwise, it may verify each received message once to collect the correct signature, or simply choose to discard the signature, at which point,Will calculate the session key The members of the group have generated the same session key. At this time, the liquid crystal display device,Using session keysCalculation ofAnd then generate a message,,And } wherein,To calculate the intermediate process quantity and send the message to the AMF;
step S5.4: when AMF receives the transmitted message, it verifies If it is within the specified range, the AMF will waitThe method comprises the steps of collecting the rest information and verifying whether the received hash values are equal, if so, the group equipment is provided with an equal session key, the AMF sends a confirmation information to all users, when the users receive the confirmation information, the users start to communicate, and finally, the users in the group perform secure communication.
In this embodiment, the new user joins the group as follows:
1) First, from In selecting two usersAndJoining a new group, the grouping beingAnd；
2）AndReselection response value,Calculation of，，，And a signature value; due to the original groupHas been negotiated, so authentication negotiation is not required; the key of the group is; New groupThe identity verification process is executed to finally obtainIs a key to a key (a);
3） And Using the original keyEncryption keyAnd send it to other members of the original group; And The key will be usedEncrypted keySending to other members of the new group;
4) Combining the two combinations into The new group key at this time is。
In this embodiment, the user leaves the group as follows:
let u= Is the current group, and V =Is a leaving member set in whichThe remaining set of members at this time can be expressed as a=；
1) Each memberInspection ofLeft member of (2)Or right memberWhether or not it has left; if it isOr (b)ThenRequiring re-selection of secret values, re-computationAnd signing and sending it to setting a;
2) If a member Does not change, thenSimply propagate their previous calculationsAnd signing to set a;
3) Upon receiving all values And after signing, each memberThe aggregate signature is verified. After verification is successful, the relevant parties can continue to calculate using the same procedure as before.
It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The above description is only a preferred embodiment of the present invention, and is not intended to limit the invention in any way, and any person skilled in the art may make modifications or alterations to the disclosed technical content to the equivalent embodiments. However, any simple modification, equivalent variation and variation of the above embodiments according to the technical substance of the present invention still fall within the protection scope of the technical solution of the present invention.
Claims (6)
1. A security lightweight group authentication method based on smart grid end-to-end communication is characterized in that a system is provided and comprises user equipment, an AMF and a 5G base station; the user equipment is connected with the AMF unit through the 5G base station; the AMF distributes the public key and the private key to the user equipment to provide anonymous identity protection for the user equipment, then verifies the user equipment through an aggregate signature scheme, and finally negotiates a session key through the ECDH;
The specific authentication method comprises the following steps:
S1, generating a q-order additive circulation group G by inputting a safety parameter K through an AMF, wherein P is a generator of a group G; AMF random selection Computing system public key as master keyAnd selecting a secure hash function:， Finally, the AMF unit outputs the system parameters = { q, G, P, ,,-Secret and save key s;
step S2, the user equipment firstly executes a 5G-AKA or EAP-AKA protocol to finish user authentication, saves the real identities of all the user equipment through an AMF, stores the real identities in a user equipment identification list, and registers the temporary identities of the user equipment through the AMF;
Step S3, after the user registration is completed, using their temporary identity to perform end-to-end discovery, mutually discovering each user through the end-to-end discovery process Finally, an end-to-end conversation list is obtained;
Step S4, after obtaining the end-to-end session list, the user equipment sends session request information to the AMF, when the AMF receives all the requests, it checks whether the user identity in the request information is legal registered identity, if not, it will reject the end-to-end session request, if the verification is successful, the AMF will create an end-to-end group session for all legal users, and generate a session identifier ; AMF then forms a set of ring structures=,,...,Based on the identity of the user,AndLogically respectivelyIs then AMF broadcast,}；
And S5, after receiving the session response message of the AMF, the users start mutual authentication and key negotiation, and finally, the users in the group carry out secure communication.
2. The authentication method according to claim 1, wherein the step S2 is specifically:
Step S2.1: first a secret value is selected Calculating intermediate parametersTemporary identificationWhereinFor the private identification of the user,As a function of the hash-up,System parameters output for AMF units will then {-Send to AMF;
step S2.2: AMF receipt of Transmitted {After } calculateAnd inquires whether the user equipment identification list containsIf not, the execution is terminated, otherwise, { is saved in the temporary identification index database,AMF generates a message={,}, WhereinIs temporary identity validity period whenAt the time of expiration of the time period,AMF random selection of secret valueAnd calculate,,Send {To (V)Wherein, the method comprises the steps of,、All are calculated intermediate process quantities;
Step S2.3: when (when) Received {When } calculate the partial private key，WhereinTo calculate the intermediate process quantity to verify the formulaIf not, the part of the private key is re-requested, and if so, the part of the private key is accepted; Randomly selecting secret values Calculation ofFinally, setting the public key of the user equipment) And private key)。
3. The authentication method according to claim 2, wherein the step S3 is specifically:
First, user equipment Selecting random numbersCalculation ofAnd generates request information={,,,}, WhereinRepresenting a time stamp, calculating，WhereinTo calculate the intermediate process quantity, a signature is obtainedFinally broadcast {}；
Adjacent users receive usersAfter broadcasting a message, verify the equationWhether or not to establish; if the formula is true, thenAdding into the end-to-end dialogue list, and storing; Setting n end-to-end users,，...，) Through the above end-to-end discovery process, each user finally obtains an end-to-end session list l=,,...,}。
4. The authentication method according to claim 3, wherein the step S5 is specifically:
step S5.1 user equipment Generating a message) And randomly select a response valueAnd calculate，，Wherein、To calculate the intermediate process quantity, the user equipmentGenerating signaturesThen toAndWherein (i+1) mod n represents the result of adding 1 to i and then adding n to the remainder, and is a numerical result, and sends a message,,,}, WhereinIs thatAnd adds a timestamp to prevent the message from being replayed;
Step S5.2 when When receiving the messages sent by two adjacent users, it first verifiesIf it is equal, then proceed and verifyWhether it is a legal registered identity, if so, it will verify whether the time stamp is within the specified time, and if so, it will verify the signature information,Verification of,If it passes the verification, thenWill calculate,To calculate the intermediate process quantity, where (i+1) mod n represents the result of adding 1 to i and then taking the remainder of n, is a numerical result, at which time messages are broadcast to other users,,,};
Step S5.3: when the user equipmentUpon receipt of the broadcast request,First verifyIf it is equal, then proceed and verifyWhether it is a legal registered identity, if so, verifying whether the time stamp is within a specified time, if so, waiting for verification to passCollecting the remaining broadcast messages, when the number of last received messages is less than n-1, or the identity is not in the previously formed end-to-end group,Will exit the negotiation; at this time, the liquid crystal display device,All signatures in the end-to-end group are received and an aggregate signature is generatedWherein,Then verify the signature; If the signature is verified, it is accepted; otherwise, it may verify each received message once to collect the correct signature, or simply choose to discard the signature, at which point,Will calculate the session keyMembers of the group have generated the same session key; at this time, the liquid crystal display device,Using session keysCalculation ofAnd then generate a message,,And } wherein,To calculate the intermediate process quantity and send the message to the AMF;
step S5.4: when AMF receives the transmitted message, it verifies If it is within the specified range, the AMF will waitThe method comprises the steps of collecting the rest information and verifying whether the received hash values are equal, if so, the group equipment is provided with an equal session key, the AMF sends a confirmation information to all users, when the users receive the confirmation information, the users start to communicate, and finally, the users in the group perform secure communication.
5. The authentication method according to claim 1, characterized in that the new user joins the group, in particular as follows:
1) First, from In selecting two usersAndJoining a new group, the grouping beingAnd；
2）AndReselection response value,Calculation of，，，And a signature value; due to the original groupHas been negotiated, so authentication negotiation is not required; the key of the group is; New groupThe identity verification process is executed to finally obtainIs a key to a key (a);
3） And Using the original keyEncryption keyAnd send it to other members of the original group; And The key will be usedEncrypted keySending to other members of the new group;
4) Combining the two combinations into The new group key at this time is。
6. The authentication method according to claim 1, characterized in that the user leaves the group, in particular as follows:
let u= Is the current group, and V =Is a leaving member set in whichThe remaining set of members at this time can be expressed as a=；
1) Each memberInspection ofLeft member of (2)Or right memberWhether or not it has left; if it isOr (b)ThenRequiring re-selection of secret values, re-computationAnd signing and sending it to setting a;
2) If a member Does not change, thenSimply propagate their previous calculationsAnd signing to set a;
3) Upon receiving all values And after signing, each memberVerifying the aggregate signature; after verification is successful, the relevant parties can continue to calculate using the same procedure as before.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410459105.7A CN118075734B (en) | 2024-04-17 | 2024-04-17 | Security lightweight group authentication system and method based on smart grid end-to-end communication |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410459105.7A CN118075734B (en) | 2024-04-17 | 2024-04-17 | Security lightweight group authentication system and method based on smart grid end-to-end communication |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN118075734A CN118075734A (en) | 2024-05-24 |
| CN118075734B true CN118075734B (en) | 2024-08-09 |
Family
ID=91107933
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202410459105.7A Active CN118075734B (en) | 2024-04-17 | 2024-04-17 | Security lightweight group authentication system and method based on smart grid end-to-end communication |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN118075734B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110149214A (en) * | 2019-06-06 | 2019-08-20 | 西南交通大学 | LTE-R network group authentication key agreement method without certificate aggregate signature |
| CN115280718A (en) * | 2020-03-13 | 2022-11-01 | 国际商业机器公司 | Secure private key distribution between endpoint instances |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP4007983A4 (en) * | 2019-08-01 | 2023-08-30 | Coinbase, Inc. | Systems and methods for generating signatures |
-
2024
- 2024-04-17 CN CN202410459105.7A patent/CN118075734B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110149214A (en) * | 2019-06-06 | 2019-08-20 | 西南交通大学 | LTE-R network group authentication key agreement method without certificate aggregate signature |
| CN115280718A (en) * | 2020-03-13 | 2022-11-01 | 国际商业机器公司 | Secure private key distribution between endpoint instances |
Also Published As
| Publication number | Publication date |
|---|---|
| CN118075734A (en) | 2024-05-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110581854B (en) | Intelligent terminal safety communication method based on block chain | |
| Garg et al. | An efficient blockchain-based hierarchical authentication mechanism for energy trading in V2G environment | |
| Liu et al. | Time-bound anonymous authentication for roaming networks | |
| CN110489982B (en) | Smart power grid data aggregation and encryption method with forward security | |
| Rahman et al. | Privacy-friendly secure bidding for smart grid demand-response | |
| CN109687976A (en) | Fleet's establishment and management method and system based on block chain and PKI authentication mechanism | |
| CN111698225B (en) | Application service authentication encryption method suitable for power dispatching control system | |
| CN109005538B (en) | Message authentication method between unmanned vehicle and multi-mobile-edge computing server | |
| Au et al. | PERM: Practical reputation-based blacklisting without TTPs | |
| WO2023115850A1 (en) | Consortium blockchain consensus identity authentication method | |
| CN114710275B (en) | Cross-domain authentication and key negotiation method based on blockchain in Internet of things environment | |
| CN109284623B (en) | Management method of crowd sensing task based on user privacy protection | |
| CN111711607B (en) | Block chain-based flow type micro-service trusted loading and verifying method | |
| CN113612604B (en) | Asynchronous network-oriented safe distributed random number generation method and device | |
| CN111683090A (en) | Block chain digital signature method and device based on distributed storage | |
| CN114024698A (en) | Power distribution Internet of things service safety interaction method and system based on state cryptographic algorithm | |
| CN110336664A (en) | Information service entities cross-domain authentication method based on SM2 cryptographic algorithm | |
| CN101873328A (en) | Multipartite contract signing method based on aggregated signature | |
| CN113591103B (en) | Identity authentication method and system between intelligent terminals of electric power Internet of things | |
| CN114143021B (en) | News information credit score system based on block chain | |
| CN117544316A (en) | Implicit certificate issuing method and system supporting collaborative signature | |
| CN111245594B (en) | Homomorphic operation-based collaborative signature method and system | |
| CN117318935A (en) | Key generation method and system for vehicle team, and vehicle team formation method and system | |
| CN113438650A (en) | Block chain-based network equipment authentication method and system | |
| CN118075734B (en) | Security lightweight group authentication system and method based on smart grid end-to-end communication |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20241010 Address after: 102200 4th floor, block C, State Grid Smart Grid Research Institute, North District of future science and Technology City, Changping District, Beijing Patentee after: STATE GRID INFORMATION & TELECOMMUNICATION GROUP Co.,Ltd. Country or region after: China Patentee after: Beijing University of Posts and Telecommunications Patentee after: STATE GRID INFO-TELECOM GREAT POWER SCIENCE AND TECHNOLOGY Co.,Ltd. Patentee after: DALIAN POWER SUPPLY COMPANY, STATE GRID LIAONING ELECTRIC POWER Co.,Ltd. Address before: 102200 4th floor, block C, State Grid Smart Grid Research Institute, North District of future science and Technology City, Changping District, Beijing Patentee before: STATE GRID INFORMATION & TELECOMMUNICATION GROUP Co.,Ltd. Country or region before: China Patentee before: Beijing University of Posts and Telecommunications Patentee before: STATE GRID INFO-TELECOM GREAT POWER SCIENCE AND TECHNOLOGY Co.,Ltd. |