WO2011006341A1 - 一种传感器网络鉴别与密钥管理机制的融合方法 - Google Patents

一种传感器网络鉴别与密钥管理机制的融合方法 Download PDF

Info

Publication number
WO2011006341A1
WO2011006341A1 PCT/CN2009/076173 CN2009076173W WO2011006341A1 WO 2011006341 A1 WO2011006341 A1 WO 2011006341A1 CN 2009076173 W CN2009076173 W CN 2009076173W WO 2011006341 A1 WO2011006341 A1 WO 2011006341A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
key
authentication
broadcast message
broadcast
Prior art date
Application number
PCT/CN2009/076173
Other languages
English (en)
French (fr)
Inventor
杜志强
曹军
铁满霞
葛莉
黄振海
Original Assignee
西安西电捷通无线网络通信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 西安西电捷通无线网络通信股份有限公司 filed Critical 西安西电捷通无线网络通信股份有限公司
Priority to KR1020127001604A priority Critical patent/KR101486030B1/ko
Priority to JP2012519869A priority patent/JP5367168B2/ja
Priority to EP09847266.5A priority patent/EP2456243B1/en
Priority to US13/382,651 priority patent/US8571223B2/en
Publication of WO2011006341A1 publication Critical patent/WO2011006341A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/065—Network architectures or network communication protocols for network security for supporting key management in a packet data network for group communications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/60—Digital content management, e.g. content distribution
    • H04L2209/601—Broadcast encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/18—Self-organising networks, e.g. ad-hoc networks or sensor networks

Definitions

  • the invention relates to a fusion method of sensor network authentication and key management mechanism.
  • the sensor network consists of a large number of small, inexpensive, battery-powered sensor nodes with wireless communication and monitoring capabilities. These nodes are densely deployed in the monitoring area for the purpose of monitoring the physical world.
  • Wireless sensor networks are a new research direction in information technology. They have broad application prospects in environmental monitoring, military, homeland security, traffic control, community security, forest fire prevention, and target location.
  • the sensor network is a data-centric data collection platform. Establishing a secure sensor network authentication and key management infrastructure is the basis for secure data integration, storage and access control. At present, the research on sensor network security technology has made great breakthroughs, and many sensor network security technologies have been designed. Key management is the basis of sensor network security. It is a supporting technology for node secure communication and inter-node identity authentication. It is generally composed of key pre-distribution before network deployment and key establishment and session key negotiation after network deployment. Stage composition. Identification is divided into message authentication and identity authentication. The sensor network implements important functions such as routing table creation, network query, software update, time synchronization, and network management based on broadcast.
  • broadcast information may be modified by an attacker or inserted into malicious information. It is necessary to introduce an authentication mechanism to ensure broadcast.
  • the legitimacy and integrity of information, broadcast message authentication technology is also the basis of sensor network security.
  • Identity authentication is the basis of computer network security. It is also the basis of sensor network security. It is used to verify the legitimacy and validity of the identity of both parties.
  • key management and authentication are indispensable and mutually supportive in sensor network security solutions.
  • the authentication mechanism requires key pre-distribution technology in the key management mechanism to provide pre-shared or initial keys.
  • the session key negotiation technology in the key management mechanism is based on the results of the identity authentication technology. Only when the two work in coordination can form a basic sensor network security solution. However, at present, the sensor network key management and authentication mechanism is not fully considered in the design, and cannot be transmitted.
  • the sensor network provides complete secure communication and authentication services, and the sensor network still has security risks. Summary of the invention
  • the present invention integrates a security mechanism such as sensor network key management, identity authentication, and broadcast message authentication from a protocol processing flow to form a comprehensive sensor network authentication and key management method.
  • a security mechanism such as sensor network key management, identity authentication, and broadcast message authentication from a protocol processing flow to form a comprehensive sensor network authentication and key management method.
  • the technical solution of the present invention is:
  • the present invention provides a fusion method of sensor network authentication and key management mechanism, which is special in that: the method comprises the following steps:
  • the communication key used to establish a secure connection between the nodes is pre-distributed to the node;
  • the communication node After the network is deployed, the communication node authenticates the legitimacy of the identity of the other party before communicating;
  • the broadcast message receiving node After the network is deployed, when the broadcast exists in the network, the broadcast message receiving node authenticates the validity of the broadcast message;
  • the session key is negotiated to generate a session key based on the result of the node identity authentication process.
  • step 1.1 The specific implementation of step 1.1 above is:
  • the basic random key pre-distribution method is adopted.
  • the specific implementation of the above step 1.1) is as follows: Before the sensor network is deployed, the deployment server first generates a key pool with a total number of keys P and all keys in the key pool. Key identifier; then based on the number of nodes in the network and the expected network connectivity and the section Click the desired number of neighbor nodes, and randomly select k different keys from the key pool for each node to form a key chain, and load it into the node, where k «P.
  • step 1.2 The specific implementation of step 1.2) above is:
  • the deployment server Before the network is deployed, the deployment server generates a broadcast message authentication key chain according to the network size and the characteristics of the broadcast node;
  • the deployment server pre-distributes the initial key in the broadcast message authentication keychain to all broadcast message receiving nodes.
  • the TESLA broadcast message authentication method is adopted.
  • the specific implementation manner of the foregoing step 1.2) is: Before the network deployment, the deployment server generates a one-way ha used for authenticating the broadcast message according to parameters such as the lifetime of the broadcast node, the broadcast message authentication key disclosure delay, and the like.
  • the hash chain that is, the broadcast message authentication key chain; then, the deployment server distributes the broadcast message authentication key chain to the broadcast node, and distributes the chain key in the key chain to all broadcast message receiving nodes.
  • step 2.1 After the network is deployed, before the node communicates, the nodes establish a shared key, perform pre-shared key-based authentication based on the shared key, or perform nodes according to other preset authentication methods. Identification of identity.
  • the above pre-shared key based authentication process includes the following steps:
  • node A generates a random number N A and sends it to node B;
  • the PSK represents a pre-shared key
  • F represents a key generation algorithm
  • H represents a one-way hash function
  • the specific implementation of the above step 2.2) is: When there is a broadcast in the network, the node authenticates the validity of the broadcast message according to the pre-distributed initial broadcast message authentication key.
  • the TESLA broadcast message authentication method is adopted.
  • the specific implementation manner of the foregoing step 2.2) is: the broadcast node uses a broadcast message to authenticate a certain key in the key chain to perform MAC calculation on the message to be broadcast, and combines the broadcast message with the MAC value.
  • the broadcast node will send the broadcast message to the receiving node, and the receiving node first authenticates the validity of the key according to the pre-distributed initial broadcast message, and then according to Verify the validity of the broadcast message MAC value to verify the legitimacy of the broadcast message.
  • step 3 is:
  • the negotiation method in step 3 above is:
  • the multicast node generates a multicast session key MSK
  • the MSK is encrypted and sent to the multicast message receiving node by using the unicast session key generated between the receiving node and the multicast message receiving node, and the multicast message receiving node saves the MSK and responds to the multicast node.
  • the broadcast message receiving node authenticates the legitimacy of the broadcast message.
  • the above nodes are base stations, cluster head nodes, and common nodes in the sensor network.
  • a fusion system of sensor network authentication and key management mechanism is characterized in that: the system includes a deployment server and a node, and the node includes a broadcast node, a broadcast message receiving node, a multicast message receiving node, and a multicast node.
  • the deployment server pre-distributes the communication key and the initial broadcast message authentication key to the node; the node performs authentication and session key negotiation; wherein the broadcast node sends a broadcast message to the broadcast message receiving node;
  • the broadcast message receiving node receives and processes the broadcast message of the broadcast node; the multicast node sends the multicast message to the multicast message receiving node; and the multicast message receiving node receives and processes the multicast message of the multicast node.
  • the invention has the advantages that the invention provides a fusion method of sensor network identification and key management mechanism, and constructs a sensor network by integrating sensor network basic security technologies such as key management, identity authentication and broadcast message authentication from a process.
  • Security infrastructure The invention firstly identifies the key pre-distribution in the sensor network key management technology and the initial broadcast message in the broadcast message authentication technology.
  • the key pre-distribution process is integrated to provide pre-distribution of the communication key and the initial broadcast message authentication key to the network node before network deployment, and provides support for identity authentication, secure communication, and broadcast message authentication after network deployment.
  • it is a combination of broadcast message authentication and identity authentication, session key negotiation process, and can provide authentication of broadcast messages while performing identity authentication and session key negotiation.
  • the present invention constructs a sensor network security architecture to form a basic sensor network security solution.
  • FIG. 1 is a schematic flow chart of a fusion method provided by the present invention.
  • the present invention provides a method for merging a sensor network authentication and key management mechanism, the method comprising the following steps:
  • the communication key used to establish a secure connection between the nodes is pre-distributed to the node.
  • the specific implementation manner is as follows:
  • the basic random key pre-distribution method is adopted. Before the sensor network is deployed, the deployment server first generates a key pool with a total number of keys P and key identifiers of all keys in the key pool. Then, according to the nodes in the network The number and expected network connectivity and the number of neighbor nodes expected by the node, for each node randomly picking k different keys from the key pool to form a key chain, and loading into the node, where k «P.
  • This random pre-allocation method enables neighboring nodes to share keys with a certain probability, so that a secure connection can be established to ensure that the desired network connectivity can be achieved after network deployment.
  • the initial key for authenticating the broadcast message is pre-distributed to the broadcast message receiving node, and the specific implementation manner is as follows:
  • the deployment server Before the network is deployed, the deployment server generates a broadcast message authentication key chain according to the network size and the characteristics of the broadcast node;
  • the deployment server pre-distributes the initial key in the broadcast message authentication keychain to all broadcast message receiving nodes.
  • the TESLA broadcast message authentication method is used.
  • the deployment server Before the network is deployed, the deployment server generates a one-way hash chain for authenticating the broadcast message according to parameters such as the lifetime of the broadcast node and the broadcast message authentication key disclosure delay, that is, the broadcast message authentication key. Chain; then, the deployment server distributes the broadcast message authentication key chain to the broadcast node, and distributes the chain key in the key chain to all broadcast message receiving nodes, wherein the deployment server sends a broadcast message authentication secret to the broadcast node
  • the keychain can also be taken online.
  • Node identity authentication after network deployment, the communication node authenticates the legitimacy of the identity of the other party before communication.
  • the specific implementation manner is as follows: After the network is deployed, before the node communicates, the nodes establish a shared key and then use the shared key. The authentication process based on the pre-shared key, or the identification of the identity between the nodes according to other preset authentication methods.
  • the pre-shared key-based authentication method is used to perform authentication based on the shared key PSK.
  • the node A first checks whether the random number N B in the message is consistent with the random number that it sends to the node B in step a).
  • broadcast message authentication After the network is deployed, when the broadcast exists in the network, the broadcast message receiving node authenticates the validity of the broadcast message.
  • the specific implementation manner is as follows: When there is broadcast in the network, the node authenticates the secret according to the pre-distributed initial broadcast message. The key authenticates the legitimacy of the broadcast message.
  • the authentication of broadcast messages may occur at any time after the network is deployed, such as during session key negotiation, depending on the broadcast conditions in the network.
  • the broadcast node first performs MAC calculation on the message to be broadcast by using a certain key in the broadcast message authentication key chain, and sends the broadcast message together with the MAC value to the broadcast message receiving node; After the preset broadcast message authentication key disclosure delay, the broadcast node will send to the broadcast message receiving node, and the receiving node authenticates the validity of the key first verification according to the pre-distributed initial broadcast message, and then according to the validity of verifying the broadcast message MAC value. Sex, from And verify the legitimacy of the broadcast message.
  • Session key negotiation after the node identity authentication succeeds, based on the result of the node identity authentication process, the session key is negotiated between the nodes.
  • the broadcast message receiving node authenticates the broadcast message.
  • Sex which is mainly done by the following substeps:
  • the specific negotiation method may adopt the following steps: a) the multicast node generates a multicast session key MSK; b) encrypts the MSK and sends it to the multicast message receiving node by using a unicast session key generated between the receiving node and the multicast message receiving node The multicast message receiving node responds to the multicast node after saving the MSK.
  • the nodes in the present invention generally refer to various network entities in a sensor network, including but not limited to a base station, a cluster head node, a common node, and the like.
  • a fusion system of sensor network authentication and key management mechanism comprising a deployment server and a node, the node comprising a broadcast node, a broadcast message receiving node, a multicast message receiving node and a multicast node; the deployment server will communicate the key and The initial broadcast message authentication key is pre-distributed to the node; the node performs authentication and session key negotiation; wherein the broadcast node sends the broadcast message to the broadcast message receiving node; the broadcast message receiving node receives and processes the broadcast message of the broadcast node; The multicast message is sent to the multicast message receiving node; the multicast message receiving node receives and processes the multicast message of the multicast node.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种传感器网络鉴别与密钥管理机制的融合方法，该方法包括以下步骤：1）密钥预分发，其包括：1.1）通信密钥的预分发；1.2）初始广播消息鉴别密钥的预分发；2）鉴别，其包括：2.1）节点身份鉴别；2.2）广播消息鉴别；3）由节点进行会话密钥协商。

Description

一种传感器网络鉴别与密钥管理机制的融合方法
本申请要求于 2009 年 7 月 15 日提交中国专利局、 申请号为 200910023382.9、 发明名称为"一种传感器网络鉴别与密钥管理机制的融合方 法"的中国专利申请的优先权， 其全部内容通过引用结合在本申请中。
技术领域
本发明涉及一种传感器网络鉴别与密钥管理机制的融合方法。
背景技术
传感器网络是由大量体积小、 价格便宜、 电池供电、 具有无线通信和监测 能力的传感器节点组成。 这些节点被稠密部署在监测区域， 以达到监测物理世 界的目的。 无线传感器网络是信息技术中的一个新的研究方向， 在环境监测、 军事、 国土安全、 交通管制、 社区安防、 森林防火、 目标定位等方面具有广泛 的应用前景。
由于传感器节点大多被部署在无人照看或者敌方区域，传感器网络安全问 题尤为突出。传感器网络是以数据为中心的数据收集平台， 建立安全传感器网 络鉴别与密钥管理基础设施是实现数据的安全融合、 存储与访问控制的基础。 目前，传感器网络安全技术的研究已取得了较大突破，许多传感器网络安全技 术已经被设计。 密钥管理是传感器网络安全的基础，是实现节点保密通信及节 点间身份鉴别的支撑性技术，一般由网络部署前的密钥预分发和网络部署后的 密钥建立和会话密钥协商两个阶段构成。鉴别分为消息鉴别和身份鉴别。传感 器网络基于广播实现路由表创建、 网络查询、 软件更新、 时间同步以及网络管 理等重要功能， 由于其无线及广播特性， 广播信息可能被攻击者墓改或插入恶 意信息， 需要引入鉴别机制确保广播信息的合法性和完整性， 广播消息鉴别技 术也是传感器网络安全的基础。 身份鉴别是计算机网络安全的基础， 同样也是 传感器网络安全的基础， 用于验证通信双方身份的合法性和有效性。作为核心 安全机制，密钥管理和鉴别在传感器网络安全解决方案中缺一不可、互为支撑， 鉴别机制需要密钥管理机制中的密钥预分发技术为其提供预共享或初始密钥， 而密钥管理机制中的会话密钥协商技术又以身份鉴别技术的结果为基础，二者 只有协调工作才能构成基本的传感器网络安全解决方案。但是， 目前传感器网 络密钥管理和鉴别机制在设计时并没有充分考虑二者之间的融合，均无法为传 感器网络提供完整的保密通信和鉴别服务， 传感器网络仍旧存在安全隐患。 发明内容
为了解决背景技术中存在的问题，本发明通过将传感器网络密钥管理、身 份鉴别、广播消息鉴别等安全机制从协议处理流程上进行整合， 形成一种综合 的传感器网络鉴别与密钥管理方法， 为传感器网络安全提供基础解决框架。
本发明技术解决方案是：本发明提供了一种传感器网络鉴别与密钥管理机 制的融合方法， 其特殊之处在于： 该方法包括以下步骤：
1 ) 密钥预分发， 其包括：
1.1 )通信密钥的预分发；
网络部署前， 将用于建立节点间安全连接的通信密钥预分发给节点；
1.2 )初始广播消息鉴别密钥的预分发；
网络部署前， 将用于鉴别广播消息的初始密钥预分发给广播消息接收节 点；
2 )鉴别， 其包括：
2.1 )节点身份鉴别；
网络部署后， 通信节点在通信之前鉴别对方身份的合法性；
2.2 )广播消息鉴别；
网络部署后， 网络中存在广播时， 广播消息接收节点鉴别广播消息的合法 性；
3 ) 由节点进行会话密钥协商；
节点身份鉴别成功后，基于节点身份鉴别过程的结果， 节点间协商产生会 话密钥。
上述步骤 1.1 ) 的具体实现方式是：
1.1.1 ) 网络部署前， 根据网络的规模生成密钥池；
1.1.2 )根据网络中的节点数量以及期望的网络连通度为所有节点预分发密 钥。
采用基本的随机密钥预分发方法， 上述步骤 1.1 ) 的具体实现方式是： 在 传感器网络部署前， 部署服务器首先生成一个密钥总数为 P的密钥池和密钥池 中所有密钥的密钥标识；然后根据网络中的节点数和期望的网络连通度以及节 点期望的邻居节点数， 为每一节点从密钥池里随机选取 k个不同密钥构成密钥 链， 并加载到该节点中， 其中 k«P。
上述步骤 1.2) 的具体实现方式是：
1.2.1)网络部署前， 部署服务器根据网络规模和广播节点特征生成广播消 息鉴别密钥链；
1.2.2 )部署服务器将广播消息鉴别密钥链中的初始密钥预分发给所有的广 播消息接收节点。
采用 TESLA广播消息鉴别方法， 上述步骤 1.2)的具体实现方式是： 网络 部署前，部署服务器根据广播节点的生存期、广播消息鉴别密钥透露延迟等参 数， 生成用于鉴别广播消息的单向哈希链， 即广播消息鉴别密钥链； 然后， 部 署服务器将广播消息鉴别密钥链分发给广播节点，并将该密钥链中的链头密钥 分发给所有广播消息接收节点。
上述步骤 2.1) 的具体实现方式是： 网络部署后， 节点通信之前， 节点间 在建立共享密钥后，基于共享密钥进行基于预共享密钥的鉴别， 或根据预设的 其他鉴别方式进行节点间身份的鉴别。
上述基于预共享密钥的鉴别过程包括以下步骤：
a)节点 A产生随机数 NA并发送给节点 B;
b)节点 B产生随机数 NB,并计算与节点 A的会话密钥 SK=F(PSK, NBIINA), 然后利用会话密钥 SK产生消息鉴别码 MAd=H (SK, NBIINA), 并构造消息 NBHNAIIMA 发送给节点 A;
c)节点 A首先检查消息中的随机数 NB是否与步骤 a) 中发送给节点 B的随 机数一致， 若不一致， 终止鉴别； 若一致， 则计算与节点 B的会话密钥 SK=F
(PSK, NBIINA), 并利用 SK产生鉴别码 MAC2=H ( SK , ΝΒΙΙΝΑ), 如果 MAC2=MAd, 节点 A计算 MAC3=H (SK, NB ), 并构造消息 NBIIMAC3发送给 节点 B;
其中所述 PSK表示预共享密钥， F表示密钥生成算法， H表示单向哈希函 数。
上述步骤 2.2) 的具体实现方式是： 当网络中存在广播时， 节点根据预分 发的初始广播消息鉴别密钥鉴别广播消息的合法性。 采用 TESLA广播消息鉴别方法， 上述步骤 2.2 )的具体实现方式是： 广播 节点利用广播消息鉴别密钥链中的某个密钥 对将要广播的消息进行 MAC计 算， 并将广播消息与 MAC值一并发送给广播消息接收节点； 经过预设的广播 消息鉴别密钥透露延迟后， 广播节点将 发送给广播消息接收节点， 接收节点 根据预分发的初始广播消息鉴别密钥首先验证的 有效性， 然后根据 验证广 播消息 MAC值的合法性， 从而验证广播消息的合法性。
上述步骤 3 ) 的具体实现方式是：
3.1 ) 当节点间需要点对点通信时， 基于鉴别过程的结果， 节点间进行单 播会话密钥的协商；
3.2 ) 当节点间需要一对多通信时， 基于鉴别过程以及单播会话密钥协商 的结果， 节点间进行组播会话密钥的协商。
上述步骤 3 ) 中的协商方法是：
a )组播节点生成组播会话密钥 MSK;
b )利用与组播消息接收节点间生成的单播会话密钥， 将 MSK加密后发送 给组播消息接收节点， 组播消息接收节点将 MSK保存后对组播节点进行响应。
上述步骤 3 ) 中当网络中存在广播时， 广播消息接收节点鉴别广播消息的 合法性。
上述节点是传感器网络中的基站、 簇头节点、 普通节点。
一种传感器网络鉴别与密钥管理机制的融合系统， 其特殊之处在于： 所述 系统包括部署服务器和节点， 所述节点包括广播节点、 广播消息接收节点、 组 播消息接收节点和组播节点；所述部署服务器将通信密钥和初始广播消息鉴别 密钥预分发给节点； 所述节点进行鉴别和会话密钥的协商； 其中所述广播节点 将广播消息发送给广播消息接收节点；所述广播消息接收节点接收并处理广播 节点的广播消息； 所述组播节点将组播消息发送给组播消息接收节点； 所述组 播消息接收节点接收并处理组播节点的组播消息。
本发明的优点是：本发明提供一种传感器网络鉴别与密钥管理机制的融合 方法， 通过将密钥管理、 身份鉴别、 广播消息鉴别等传感器网络基础安全技术 从流程上进行整合，构造传感器网络安全基础设施。本发明首先将传感器网络 密钥管理技术中的密钥预分发与广播消息鉴别技术中的初始广播消息鉴别密 钥预分发过程进行整合，通过在网络部署前将通信密钥和初始广播消息鉴别密 钥预分发给网络节点， 为网络部署后的身份鉴别、 保密通信、 广播消息鉴别提 供支持。 其次， 是广播消息鉴别与身份鉴别、 会话密钥协商过程的结合， 在进 行身份鉴别和会话密钥协商的同时能够提供对广播消息的鉴别。通过上述传感 器网络基础安全技术的整合， 本发明构造出一种传感器网络安全体系结构， 形 成基本的传感器网络安全解决方案。
附图说明
图 1为本发明所提供的融合方法的流程示意图。
具体实施方式
参见图 1 ,本发明提供了一种传感器网络鉴别与密钥管理机制的融合方法， 该方法包括以下步骤：
1 ) 密钥预分发， 主要包括以下两个子步骤完成：
1.1 )通信密钥的预分发， 网络部署前， 将用于节点间建立安全连接的通 信密钥预分发给节点， 其具体实现方式是：
1.1.1 ) 网络部署前， 根据网络的规模生成密钥池；
1.1.2 )根据网络中的节点数量以及期望的网络连通度为所有节点预分发密 钥。
采用基本的随机密钥预分发方法，在传感器网络部署前， 部署服务器首先 生成一个密钥总数为 P的密钥池和密钥池中所有密钥的密钥标识； 然后， 根据 网络中的节点数和期望的网络连通度以及节点期望的邻居节点数，为每一节点 从密钥池里随机选取 k个不同密钥构成密钥链，并加载到该节点中，其中 k«P。 这种随机预分配方式使得相邻节点能够以一定的概率共享密钥，从而能够建立 安全连接， 以保证网络部署后能够达到期望的网络连通度。
1.2 )初始广播消息鉴别密钥的预分发， 网络部署前， 将用于鉴别广播消 息的初始密钥预分发给广播消息接收节点， 其具体实现方式是：
1.2.1 )网络部署前， 部署服务器根据网络规模和广播节点特征生成广播消 息鉴别密钥链；
1.2.2 )部署服务器将广播消息鉴别密钥链中的初始密钥预分发给所有的广 播消息接收节点。 采用 TESLA广播消息鉴别方法， 在网络部署前， 部署服务器根据广播节 点的生存期、广播消息鉴别密钥透露延迟等参数， 生成用于鉴别广播消息的单 向哈希链， 即广播消息鉴别密钥链； 然后， 部署服务器将广播消息鉴别密钥链 分发给广播节点， 并将该密钥链中的链头密钥分发给所有广播消息接收节点， 其中部署服务器在向广播节点发送广播消息鉴别密钥链时也可采取在线方式。
2 )鉴别， 其主要包括以下两个子步骤：
2.1 ) 节点身份鉴别， 网络部署后， 通信节点在通信之前鉴别对方身份的 合法性， 其具体实现方式是： 网络部署后， 节点通信之前， 节点间在建立共享 密钥后，基于共享密钥进行基于预共享密钥的鉴别过程， 或根据预设的其他鉴 别方式进行节点间身份的鉴别。
采用基于预共享密钥的鉴别方式， 基于共享密钥 PSK进行鉴别， 鉴别方式 采用如下步骤： a )节点 A产生随机数 NA并发送给节点 B; b ) B产生随机数 NB, 并计算与节点 A的会话密钥 SK=F ( PSK, NBIINA ), 然后利用 SK产生消息鉴别 码 MAd=H ( SK, NBIINA ), 并构造消息 ΝΒΠΝΑΙΙ MA(^^ l给节点 A; c )节点 A首先检查消息中的随机数 NB是否与自己在第 a )步中发送给节点 B的随机数一 致， 若不一致， 终止鉴别； 若一致， 则计算与节点 B的会话密钥 SK=F ( PSK, NBIINA ), 并利用 SK产生鉴别码 MAC2=H ( SK, NBIINA )。 如果 MAC2=MAd, A计算 MAC3=H ( SK, NB ), 并构造消息 NBIIMAC3发送给节点 B; 上述 PSK表 示预共享密钥， F表示密钥生成算法， H表示单向哈希函数。
2.2 ) 广播消息鉴别， 网络部署后， 网络中存在广播时， 广播消息接收节 点鉴别广播消息的合法性， 其具体实现方式是： 当网络中存在广播时， 节点根 据预分发的初始广播消息鉴别密钥鉴别广播消息的合法性。广播消息的鉴别根 据网络中的广播情况， 可能发生在网络部署后的任意时刻，如会话密钥协商过 程中。
采用 TESLA广播消息鉴别方法， 广播节点首先利用广播消息鉴别密钥链 中的某个密钥 对将要广播的消息进行 MAC计算， 并将广播消息与 MAC值一 并发送给广播消息接收节点；然后，经过预设的广播消息鉴别密钥透露延迟后， 广播节点将 发送给广播消息接收节点，接收节点根据预分发的初始广播消息 鉴别密钥首先验证的 有效性， 然后根据 验证广播消息 MAC值的合法性，从 而验证广播消息的合法性。
3 )会话密钥协商， 节点身份鉴别成功后， 基于节点身份鉴别过程的结果， 节点间协商产生会话密钥， 在此过程中， 当网络中存在广播时， 广播消息接收 节点鉴别广播消息的合法性， 其主要通过以下子步骤完成：
3.1 ) 当节点间需要点对点通信时， 基于鉴别过程的结果， 节点间进行单 播会话密钥的协商；
3.2 ) 当节点间需要一对多通信时， 基于鉴别过程以及单播会话密钥协商 的结果， 节点间进行组播会话密钥的协商。
具体协商方式可采用如下步骤： a )组播节点生成组播会话密钥 MSK; b ) 利用与组播消息接收节点间生成的单播会话密钥， 将 MSK加密后发送给组播 消息接收节点， 组播消息接收节点将 MSK保存后对组播节点进行响应。
本发明中所述节点泛指传感器网络中的各种网络实体， 包括但不限于基 站、 簇头节点、 普通节点等。
一种传感器网络鉴别与密钥管理机制的融合系统，所述系统包括部署服务 器和节点， 节点包括广播节点、 广播消息接收节点、 组播消息接收节点和组播 节点； 部署服务器将通信密钥和初始广播消息鉴别密钥预分发给节点； 节点进 行鉴别和会话密钥的协商； 其中广播节点将广播消息发送给广播消息接收节 点； 广播消息接收节点接收并处理广播节点的广播消息； 组播节点将组播消息 发送给组播消息接收节点； 组播消息接收节点接收并处理组播节点的组播消 息。

Claims

权 利 要 求
1、 一种传感器网络鉴别与密钥管理机制的融合方法， 其特征在于： 该方 法包括以下步骤：
1 ) 密钥预分发， 其包括：
1.1 )通信密钥的预分发；
网络部署前， 将用于建立节点间安全连接的通信密钥预分发给节点； 1.2 )初始广播消息鉴别密钥的预分发；
网络部署前， 将用于鉴别广播消息的初始密钥预分发给广播消息接收节 点；
2 )鉴别， 其包括：
2.1 )节点身份鉴别；
网络部署后， 通信节点在通信之前鉴别对方身份的合法性；
2.2 )广播消息鉴别；
网络部署后， 网络中存在广播时， 广播消息接收节点鉴别广播消息的合法 性；
3 ) 由节点进行会话密钥协商；
节点身份鉴别成功后，基于节点身份鉴别过程的结果， 节点间协商产生会 话密钥。
2、根据权利要求 1所述的传感器网络鉴别与密钥管理机制的融合方法， 其 特征在于： 所述步骤 1.1 ) 包括：
1.1.1 ) 网络部署前， 根据网络的规模生成密钥池；
1.1.2 )根据网络中的节点数量以及期望的网络连通度为所有节点预分发密 钥。
3、根据权利要求 2所述的传感器网络鉴别与密钥管理机制的融合方法， 其 特征在于： 采用基本的随机密钥预分发方法， 所述步骤 1.1.1 )包括： 在传感器 网络部署前， 部署服务器首先生成一个密钥总数为 P的密钥池和密钥池中所有 密钥的密钥标识；
所述步骤 1.1.2 )包括： 根据网络中的节点数和期望的网络连通度以及节点 期望的邻居节点数，为每一节点从密钥池里随机选取 k个不同密钥构成密钥链， 并加载到该节点中， 其中 k«P。
4、 根据权利要求 1至 3中任意一项所述的传感器网络鉴别与密钥管理机制 的融合方法， 其特征在于： 所述步骤 1.2 ) 包括：
1.2.1 )网络部署前， 部署服务器根据网络规模和广播节点特征生成广播消 息鉴别密钥链；
1.2.2 )部署服务器将广播消息鉴别密钥链中的初始密钥预分发给所有的广 播消息接收节点。
5、根据权利要求 4所述的传感器网络鉴别与密钥管理机制的融合方法， 其 特征在于： 采用 TESLA广播消息鉴别方法， 所述步骤 1.2.1 ) 包括： 网络部署 前， 部署服务器根据广播节点的生存期、 广播消息鉴别密钥透露延迟等参数， 生成用于鉴别广播消息的单向哈希链， 即广播消息鉴别密钥链；
所述步骤 1.2.2 )包括：部署服务器将广播消息鉴别密钥链分发给广播节点， 并将该密钥链中的链头密钥分发给所有广播消息接收节点。
6、 根据权利要求 1至 5中任意一项所述的传感器网络鉴别与密钥管理机制 的融合方法， 其特征在于： 所述步骤 2.1 ) 包括： 网络部署后， 节点通信之前， 节点间在建立共享密钥后， 基于共享密钥进行基于预共享密钥的鉴别。
7、根据权利要求 6所述的传感器网络鉴别与密钥管理机制的融合方法， 其 特征在于： 所述基于预共享密钥的鉴别过程包括以下步骤：
a )节点 A产生随机数 NA并发送给节点 B;
b )节点 B产生随机数 NB,并计算与节点 A的会话密钥 SK=F( PSK, NBIINA ), 然后利用会话密钥 SK产生消息鉴别码 MAd=H ( SK, NBIINA ), 并构造消息 NBIINAII MA 发送给节点 A;
c )节点 A首先检查消息中的随机数 NB是否与步骤 a ) 中发送给节点 B的随 机数一致， 若不一致， 终止鉴别； 若一致， 则计算与节点 B的会话密钥 SK=F ( PSK , NBIINA ) , 并利用 SK产生鉴别码 MAC2=H ( SK , ΝΒΙΙΝΑ ) , 如果 MAC2=MAd, 节点 Α计算 MAC3=H ( SK, NB ), 并构造消息 NBIIMAC3发送给 节点 B;
其中所述 PSK表示预共享密钥， F表示密钥生成算法， H表示单向哈希函 数。
8、 根据权利要求 1至 7中任意一项所述的传感器网络鉴别与密钥管理机制 的融合方法， 其特征在于： 所述步骤 2.2 ) 包括： 当网络中存在广播时， 节点 根据预分发的初始广播消息鉴别密钥鉴别广播消息的合法性。
9、根据权利要求 8所述的传感器网络鉴别与密钥管理机制的融合方法， 其 特征在于： 采用 TESLA广播消息鉴别方法， 所述节点根据预分发的初始广播 消息鉴别密钥鉴别广播消息的合法性包括：广播节点利用广播消息鉴别密钥链 中的某个密钥 对将要广播的消息进行 MAC计算， 并将广播消息与 MAC值一 并发送给广播消息接收节点； 经过预设的广播消息鉴别密钥透露延迟后， 广播 节点将 发送给广播消息接收节点，接收节点根据预分发的初始广播消息鉴别 密钥首先验证的 有效性， 然后根据 验证广播消息 MAC值的合法性，从而验 证广播消息的合法性。
10、根据权利要求 1至 9任一权利要求所述的传感器网络鉴别与密钥管理机 制的融合方法， 其特征在于： 所述步骤 3 ) 包括：
3.1 ) 当节点间需要点对点通信时， 基于鉴别过程的结果， 节点间进行单 播会话密钥的协商；
3.2 ) 当节点间需要一对多通信时， 基于鉴别过程以及单播会话密钥协商 的结果， 节点间进行组播会话密钥的协商。
11、 根据权利要求 10所述的传感器网络鉴别与密钥管理机制的融合方法， 其特征在于： 所述步骤 3.2 ) 的组播会话密钥协商的步骤包括：
a )组播节点生成组播会话密钥 MSK;
b )利用与组播消息接收节点间生成的单播会话密钥， 将 MSK加密后发送 给组播消息接收节点， 组播消息接收节点将 MSK保存后对组播节点进行响应。
12、 根据权利要求 1至 11所述的传感器网络鉴别与密钥管理机制的融合方 法， 其特征在于： 所述节点是传感器网络中的基站、 簇头节点、 普通节点。
13、 一种传感器网络鉴别与密钥管理机制的融合系统， 其特征在于： 所述 系统包括部署服务器和节点， 所述节点包括广播节点、 广播消息接收节点、 组 播消息接收节点和组播节点；所述部署服务器将通信密钥和初始广播消息鉴别 密钥预分发给节点； 所述节点进行鉴别和会话密钥的协商； 其中所述广播节点 将广播消息发送给广播消息接收节点；所述广播消息接收节点接收并处理广播 节点的广播消息； 所述组播节点将组播消息发送给组播消息接收节点； 所述组 播消息接收节点接收并处理组播节点的组播消息。
PCT/CN2009/076173 2009-07-15 2009-12-29 一种传感器网络鉴别与密钥管理机制的融合方法 WO2011006341A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
KR1020127001604A KR101486030B1 (ko) 2009-07-15 2009-12-29 센서 네트워크에서 인증 및 비밀 키 관리 메커니즘을 결합하는 방법
JP2012519869A JP5367168B2 (ja) 2009-07-15 2009-12-29 センサーネットワーク認証と鍵管理メカニズムの統合方法
EP09847266.5A EP2456243B1 (en) 2009-07-15 2009-12-29 Method for combining authentication and secret keys management mechanism in a sensor network
US13/382,651 US8571223B2 (en) 2009-07-15 2009-12-29 Method for combining authentication and secret keys management mechanism in a sensor network

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2009100233829A CN101610452B (zh) 2009-07-15 2009-07-15 一种传感器网络鉴别与密钥管理机制的融合方法
CN200910023382.9 2009-07-15

Publications (1)

Publication Number Publication Date
WO2011006341A1 true WO2011006341A1 (zh) 2011-01-20

Family

ID=41483987

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2009/076173 WO2011006341A1 (zh) 2009-07-15 2009-12-29 一种传感器网络鉴别与密钥管理机制的融合方法

Country Status (6)

Country Link
US (1) US8571223B2 (zh)
EP (1) EP2456243B1 (zh)
JP (1) JP5367168B2 (zh)
KR (1) KR101486030B1 (zh)
CN (1) CN101610452B (zh)
WO (1) WO2011006341A1 (zh)

Families Citing this family (37)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2012533761A (ja) * 2009-07-15 2012-12-27 コーニンクレッカ フィリップス エレクトロニクス エヌ ヴィ 無線ネットワークにおいて機密データを安全にブロードキャストするための方法
CN101699891B (zh) * 2009-10-21 2012-07-25 西安西电捷通无线网络通信股份有限公司 一种传感器网络密钥管理和节点鉴别方法
CN101895888A (zh) * 2010-07-30 2010-11-24 中国移动通信集团重庆有限公司 传感器鉴权的方法、装置及传感器鉴权系统
US10797864B2 (en) 2011-11-21 2020-10-06 Combined Conditional Access Development And Support, Llc System and method for authenticating data while minimizing bandwidth
CN102547693B (zh) * 2012-02-17 2014-09-10 南京邮电大学 一种无线传感网分簇安全路由方法
US9210578B2 (en) * 2012-07-12 2015-12-08 Nokia Technologies Oy Methods and apparatus for authentication
CN102917313B (zh) * 2012-10-17 2015-05-27 重庆邮电大学 一种适用于无线传感器网络广播认证的方法
EP2912799B1 (en) * 2012-10-26 2021-08-18 Nokia Technologies Oy Methods and apparatus for data security in mobile ad hoc networks
KR101363291B1 (ko) * 2012-10-31 2014-02-19 고려대학교 산학협력단 노드간 인증을 통한 네트워크 접근 제어 방법
US9559851B2 (en) 2013-06-13 2017-01-31 Intel Corporation Secure pairing for secure communication across devices
US9444580B2 (en) 2013-08-06 2016-09-13 OptCTS, Inc. Optimized data transfer utilizing optimized code table signaling
US10523490B2 (en) * 2013-08-06 2019-12-31 Agilepq, Inc. Authentication of a subscribed code table user utilizing optimized code table signaling
US9455799B2 (en) 2013-08-06 2016-09-27 OptCTS, Inc. Dynamic control of quality of service (QOS) using derived QOS measures
CN103763096B (zh) * 2014-01-17 2018-02-09 北京邮电大学 随机密钥分配方法和装置
CN103856939B (zh) * 2014-03-27 2017-01-25 北京工业大学 一种基于随机数的两级身份认证方法
KR101507046B1 (ko) * 2014-04-02 2015-04-01 인하대학교 산학협력단 UWSN 환경에서 브로드캐스트 메시지 인증을 위한 가변 키 슬롯을 사용하는 μTESLA 방법 및 이용한 UWSN 시스템
EP3164942A1 (en) 2014-07-02 2017-05-10 Agilepq, Inc. Data recovery utilizing optimized code table signaling
KR101759133B1 (ko) * 2015-03-17 2017-07-18 현대자동차주식회사 비밀 정보 기반의 상호 인증 방법 및 장치
US9697359B2 (en) 2015-04-15 2017-07-04 Qualcomm Incorporated Secure software authentication and verification
US20170063853A1 (en) * 2015-07-10 2017-03-02 Infineon Technologies Ag Data cipher and decipher based on device and data authentication
CN106850508B (zh) * 2015-12-07 2020-04-17 中国电信股份有限公司 安全组通信方法和系统以及相关设备
US10237305B2 (en) * 2016-02-17 2019-03-19 Nagravision S.A. Methods and systems for enabling legal-intercept mode for a targeted secure element
US10587399B2 (en) 2016-06-06 2020-03-10 Agilepq, Inc. Data conversion systems and methods
US10819701B2 (en) 2018-03-14 2020-10-27 Microsoft Technology Licensing, Llc Autonomous secrets management for a managed service identity
US10691790B2 (en) 2018-03-14 2020-06-23 Microsoft Technology Licensing, Llc Autonomous secrets management for a temporary shared access signature service
US10965457B2 (en) 2018-03-14 2021-03-30 Microsoft Technology Licensing, Llc Autonomous cross-scope secrets management
US11762980B2 (en) 2018-03-14 2023-09-19 Microsoft Technology Licensing, Llc Autonomous secrets renewal and distribution
CN109040132B (zh) * 2018-09-26 2021-05-28 南京南瑞继保电气有限公司 一种基于共享密钥随机选择的加密通信方法
CN109728905B (zh) * 2019-01-11 2021-04-06 如般量子科技有限公司 基于非对称密钥池的抗量子计算mqv密钥协商方法和系统
CN109687962B (zh) * 2019-01-15 2021-04-06 如般量子科技有限公司 基于私钥池的抗量子计算mqv密钥协商方法和系统
CN110048849B (zh) * 2019-03-11 2022-10-21 广东安创信息科技开发有限公司 一种多层保护的会话密钥协商方法
CN111447615B (zh) * 2020-03-18 2022-07-15 重庆邮电大学 一种适用于分簇无线传感器网络模型的对密钥管理方法
CN111491270B (zh) * 2020-04-08 2022-02-01 四川轻化工大学 一种层簇型无线传感器网络全局密钥管理方法
CN112911599B (zh) * 2021-01-20 2023-03-28 沈阳化工大学 支持完整性验证无线传感器网络低能耗数据融合隐性方法
CN114124388B (zh) * 2022-01-27 2022-05-10 济南量子技术研究院 一种基于量子密钥的Gossip协议同步方法
CN114726515B (zh) * 2022-03-25 2024-08-06 杭州舜时科技有限公司 一种量子加密通信方法及相应通信系统
CN117792674A (zh) * 2023-11-15 2024-03-29 北京计算机技术及应用研究所 一种基于身份标识的天地一体化网络双向认证方法

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1996833A (zh) * 2006-12-04 2007-07-11 中国科学院计算技术研究所 一种传感器网络中对密钥进行分配和管理的方法
CN101243673A (zh) * 2005-08-19 2008-08-13 英特尔公司 用于保护无线网络中广播的管理控制消息的无线通信设备和方法

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7486795B2 (en) * 2002-09-20 2009-02-03 University Of Maryland Method and apparatus for key management in distributed sensor networks
CN103647641B (zh) 2005-06-08 2017-07-11 皇家飞利浦电子股份有限公司 识别传感器和最大化无线系统的可扩展性、弹性和性能的方法
JP4213176B2 (ja) * 2006-11-16 2009-01-21 シャープ株式会社 センサデバイス、サーバノード、センサネットワークシステム、通信経路の構築方法、制御プログラム、および記録媒体
CN101005459B (zh) * 2007-01-18 2011-01-05 西安电子科技大学 基于密钥链的无线传感器访问控制方法
US8027474B2 (en) * 2007-04-05 2011-09-27 Industrial Technology Research Institute Method and system for secure data aggregation in wireless sensor networks
CN101232378B (zh) * 2007-12-29 2010-12-08 西安西电捷通无线网络通信股份有限公司 一种无线多跳网络的认证接入方法

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101243673A (zh) * 2005-08-19 2008-08-13 英特尔公司 用于保护无线网络中广播的管理控制消息的无线通信设备和方法
CN1996833A (zh) * 2006-12-04 2007-07-11 中国科学院计算技术研究所 一种传感器网络中对密钥进行分配和管理的方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
LI YAO ET AL.: "Efficient authentication and key agreement scheme for wireless sensor network.", COMPUTER ENGINEERING AND APPLICATIONS., no. 19, 10 July 2009 (2009-07-10), pages 107 - 109, XP008150218 *

Also Published As

Publication number Publication date
CN101610452B (zh) 2011-06-01
EP2456243B1 (en) 2018-08-22
JP5367168B2 (ja) 2013-12-11
KR101486030B1 (ko) 2015-01-22
US20120114124A1 (en) 2012-05-10
EP2456243A1 (en) 2012-05-23
CN101610452A (zh) 2009-12-23
KR20120047911A (ko) 2012-05-14
US8571223B2 (en) 2013-10-29
JP2012533237A (ja) 2012-12-20
EP2456243A4 (en) 2017-06-28

Similar Documents

Publication Publication Date Title
WO2011006341A1 (zh) 一种传感器网络鉴别与密钥管理机制的融合方法
CA2662846C (en) Method and apparatus for establishing security associations between nodes of an ad hoc wireless network
KR101198570B1 (ko) Ｉｄ 기반 무선 멀티-홉 네트워크 인증 액세스의 방법，장치 및 시스템
US20140007207A1 (en) Method and device for generating local interface key
WO2009089738A1 (fr) Système et procédé d'accès pour authentification destinés à un réseau sans fil à sauts multiples
CN101371491A (zh) 提供无线网状网络的方法和装置
KR20120085826A (ko) 센서 네트워크의 암호키 관리 및 노드 인증 방법
WO2008083628A1 (fr) Serveur d'authentification, procédé, système et dispositif d'authentification mutuelle dans un réseau sans fil maillé
WO2010020186A1 (zh) 基于单播会话密钥的组播密钥分发方法、更新方法及基站
CN104145465A (zh) 机器类型通信中基于群组的自举
CN108964897B (zh) 基于群组通信的身份认证系统和方法
CN108880799B (zh) 基于群组密钥池的多次身份认证系统和方法
CN111865593B (zh) 一种基于混合密钥的节点群密钥的预分配方法和装置
CN102006595B (zh) 一种无线传感器网络密钥管理方法
CN114466318B (zh) 组播服务有效认证和密钥分配协议实现方法、系统及设备
You et al. A novel group key agreement protocol for wireless mesh network
Roychoudhury et al. A secure Device-to-Device communication scheme for massive Machine Type Communication
Nam et al. Security enhancement to a password-authenticated group key exchange protocol for mobile ad-hoc networks
Lu et al. Distributed ledger technology based architecture for decentralized device-to-device communication network
CN109067705B (zh) 基于群组通信的改进型Kerberos身份认证系统和方法
Leshem et al. Probability based keys sharing for IoT security
JP5472977B2 (ja) 無線通信装置
CN116830533A (zh) 用于分发多播加密密钥的方法和设备
CN117459935A (zh) 一种基于国密sm9支持批认证的高效切换认证方法
CN117729056A (zh) 一种设备身份认证方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09847266

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 13382651

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2012519869

Country of ref document: JP

ENP Entry into the national phase

Ref document number: 20127001604

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2009847266

Country of ref document: EP