WO2019104954A1 - 结合PMIPv6架构的车辆节点位置隐私保护系统及方法 - Google Patents

结合PMIPv6架构的车辆节点位置隐私保护系统及方法 Download PDF

Info

Publication number
WO2019104954A1
WO2019104954A1 PCT/CN2018/087565 CN2018087565W WO2019104954A1 WO 2019104954 A1 WO2019104954 A1 WO 2019104954A1 CN 2018087565 W CN2018087565 W CN 2018087565W WO 2019104954 A1 WO2019104954 A1 WO 2019104954A1
Authority
WO
WIPO (PCT)
Prior art keywords
location
obu
vehicle node
access gateway
mobility anchor
Prior art date
Application number
PCT/CN2018/087565
Other languages
English (en)
French (fr)
Inventor
高天寒
耿芳华
Original Assignee
东北大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 东北大学 filed Critical 东北大学
Publication of WO2019104954A1 publication Critical patent/WO2019104954A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Definitions

  • the invention belongs to the technical field of network security, and in particular relates to a vehicle node location privacy protection system and method combining the PMIPv6 architecture.
  • the VANET protocol includes two entities: a vehicle unit (OBU) and a roadside unit (RSU).
  • the PMIPv6 protocol is a mobile node's mobility management protocol, in which a fast handover policy can be adopted in the process of node handover to improve handover efficiency. Combining the network architecture of PMIPv6 with VANET can improve the efficiency of the movement of vehicle nodes, especially the switching efficiency of nodes.
  • the efficiency of the vehicle node has improved, there are still some safety and privacy leaks in the movement of the vehicle.
  • the vehicle node communicates with surrounding nodes or requests a service (inquiring information such as the nearest restaurant)
  • the vehicle's private information identity and location information of the vehicle node
  • the information may be tracked by malicious vehicle nodes or mobile devices, thus threatening the security of the vehicle nodes.
  • many experts and researchers have conducted long-term research on this, and also proposed many programs.
  • the present invention mainly adopts a group method, in which a group manager sends a location-based request instead of a vehicle node, and at the same time, the vehicle node in the group has to replace the pseudonym after each request. In this way, the malicious node cannot accurately find out which vehicle node sent the location-based service, which effectively ensures the location privacy of the vehicle node.
  • the present invention provides a vehicle node location privacy protection system and method in combination with a PMIPv6 architecture.
  • a vehicle node location privacy protection method combining PMIPv6 architecture comprising:
  • the location-based server LBS the vehicle node OBU registers with the third-party trust authority TA, the location-based server LBS obtains the certificate and private key issued by the third-party trust authority TA, and calculates its own public key; the vehicle node OBU obtains the third-party trust institution a series of pseudonyms issued by TA and corresponding public and private keys;
  • the vehicle node OBU requests a location service from the location-based server LBS: the vehicle node OBU generates a location service request using the pseudonym and location information, and sends it to the local mobility anchor LMA via the mobile access gateway MAG, and the local mobility anchor LMA places the location of each vehicle node OBU
  • the service request is aggregated and sent to the location-based server LBS;
  • the location-based server LBS provides location-based services for each vehicle node OBU: the location-based server LBS, in response to the pseudonym of the vehicle node OBU and the corresponding response message, will access all of the vehicle nodes OBU of the same local mobility anchor LMA
  • the response aggregation is sent to the local mobility anchor LMA, and the local mobility anchor LMA is sent to the corresponding mobile access gateway MAG for broadcast.
  • the vehicle node OBU under the same mobile access gateway MAG obtains the location service corresponding to the requested location service according to its own pseudonym. the response to.
  • the location-based server LBS provides location-based services for each vehicle node OBU, and further includes:
  • the pseudo-name and location information of the vehicle node OBU is encrypted by the location-based server LBS public key to obtain a location service request, and the location service request is encrypted to obtain the first ciphertext and sent to the mobile access gateway MAG;
  • the mobile access gateway MAG decrypts the first ciphertext by using the shared key between the vehicle node OBU and the mobile access gateway MAG, obtains a location service request from the vehicle node OBU, and accesses each vehicle of the same local mobility anchor LMA.
  • the location service request of the node OBU is aggregated, and the second ciphertext is sent to the local mobility anchor LMA by using the shared key between the mobile access gateway MAG and the local mobility anchor LMA.
  • the local mobility anchor LMA decrypts the second ciphertext using the shared key between the mobile access gateway MAG and the local mobility anchor LMA to obtain a location service request of the vehicle node OBU, and the local mobility anchor LMA utilizes the local mobility anchor LMA and location based
  • the shared key between the server LBSs encrypts the location service request to obtain a third ciphertext for forwarding to the location-based server LBS.
  • the location-based server LBS provides location-based services for each vehicle node OBU, and further includes:
  • the location-based server LBS decrypts the location service request message of each vehicle node OBU, provides a corresponding location service to the vehicle node OBU according to the location information of the vehicle node OBU, and obtains a response message by using the public key of the vehicle node OBU; the location-based server The LBS, in response to the pseudonym of the vehicle node OBU and the corresponding response message, aggregates the responses of all vehicle nodes OBU accessing the same local mobility anchor LMA, utilizing the shared key between the local mobility anchor LMA and the location-based server LBS. Performing encryption to obtain a fourth ciphertext and sending it to the local mobile anchor LMA;
  • the local mobility anchor LMA classifies the response of the location-based server LBS to the vehicle node OBU according to the mobile access gateway MAG where the vehicle node OBU is located, and responds to the shared secret between the mobile access gateway MAG and the local mobility anchor LMA.
  • the key encryption is sent to the corresponding mobile access gateway MAG by the fifth ciphertext;
  • the mobile access gateway MAG broadcasts the response, and the vehicle node OBU under the same mobile access gateway MAG obtains the response corresponding to the requested location service according to its own pseudonym.
  • the invention also provides a system for the method described, comprising:
  • the third-party trust authority TA receives the registration request of the location-based server LBS, the vehicle node OBU, and issues a certificate and a private key to the location-based server LBS; a series of pseudonyms issued to the vehicle node OBU and the corresponding public and private keys ;
  • Local mobility anchor LMA receiving a location service request sent by the mobile access gateway MAG, the local mobility anchor LMA aggregates the location service request of each vehicle node OBU and forwards it to the location-based server LBS, and the location-based server LBS The response is forwarded to the vehicle node OBU through the mobile access gateway MAG in the PMIPv6 architecture;
  • the mobile access gateway MAG receives the location service request of the vehicle node OBU and forwards it to the local mobility anchor LMA to which it is connected; receives the response sent by the local mobility anchor LMA and broadcasts it;
  • the vehicle node OBU requests the location service from the location-based server LBS, generates the location service request by using the pseudonym and the location information, and sends the location service request to the mobile access gateway MAG.
  • the vehicle node OBU under the same mobile access gateway MAG is connected from the mobile phone according to its own pseudonym. The response corresponding to the location service requested by the gateway MAG is obtained.
  • the vehicle node OBU encrypts the pseudonym and location information of the vehicle node OBU with the location-based server LBS public key to obtain a location service request, encrypts the location service request to obtain the first ciphertext, and sends the first ciphertext to the mobile access gateway MAG. ;
  • the mobile access gateway MAG decrypts the first ciphertext by using the shared key between the vehicle node OBU and the mobile access gateway MAG, obtains a location service request from the vehicle node OBU, and accesses the same local mobility anchor LMA.
  • the location service request of each vehicle node OBU is aggregated, and the second ciphertext is sent to the local mobility anchor LMA by using the shared key between the mobile access gateway MAG and the local mobility anchor LMA.
  • the local mobility anchor LMA decrypts the second ciphertext by using the shared key between the mobile access gateway MAG and the local mobility anchor LMA to obtain a location service request of the vehicle node OBU, and the local mobility anchor LMA utilizes the local mobility anchor LMA and is based on The shared key between the location server LBSs encrypts the location service request to obtain a third ciphertext forwarded to the location based server LBS.
  • the local mobility anchor LMA classifies the response of the location-based server LBS to the vehicle node OBU according to the mobile access gateway MAG where the vehicle node OBU is located, and uses the response between the mobile access gateway MAG and the local mobility anchor LMA.
  • the shared key encryption obtains the fifth ciphertext and sends it to the corresponding mobile access gateway MAG; the response includes the pseudonym of the vehicle node OBU and the corresponding response message, wherein the response message is encrypted with the public key of the vehicle node OBU.
  • the server LBS provides the corresponding location service for the vehicle node OBU.
  • the mobile access gateway MAG broadcasts the response, and the vehicle node OBU under the same mobile access gateway MAG obtains the response corresponding to the requested location service according to its own pseudonym.
  • the invention realizes the vehicle node location privacy protection in combination with the PMIPv6 architecture, and applies it to the vehicle node OBU in the vehicle network VANETs, using the group idea, the group consisting of the local mobile anchor LMA, the mobile access gateway MAG and the vehicle node OBU.
  • the medium local mobility anchor LMA is a group administrator, and the local mobile anchor LMA replaces the vehicle node OBU to issue a location-based request to the location-based server LBS and accepts a response message, thereby ensuring the location privacy of the vehicle node OBU.
  • This scheme can still maintain high-speed and accurate service when the vehicle node OBU performs handover. At the same time, the location privacy and untrackability of the vehicle node OBU are also well guaranteed.
  • FIG. 1 is a structural diagram of a vehicle node location privacy protection system in combination with a PMIPv6 architecture according to an embodiment of the present invention
  • FIG. 2 is a flowchart of registering a location-based server LBS to a third-party trust authority TA according to an embodiment of the present invention
  • FIG. 3 is a flow chart of providing a location-based service for each vehicle node OBU by a vehicle node OBU requesting a location service from a location-based server LBS and a location-based server LBS according to a specific embodiment of the present invention.
  • the vehicle node location privacy protection system combined with the PMIPv6 architecture is applied to the mobile vehicle node mobile communication process, and the local mobility anchor LMA sends a request to the location-based server LBS instead of the vehicle node OBU, thereby effectively protecting the vehicle node in the moving process.
  • the location is private, and the PMIPv6 architecture is combined in the vehicle network.
  • the mobile access gateway MAG is used instead of the roadside unit RSU to forward location-based requests and responses, and the PMIPv6 architecture is well integrated with the vehicle network VANETs, to the greatest extent. Realize the privacy protection of vehicle nodes.
  • the first layer is the Trusted Authority (TA), which is the trust root of all entities.
  • the third-party trust organization TA is trusted by default and is generally controlled by the government management department.
  • the third-party trust authority TA receives the registration request of the location-based server LBS and the vehicle node OBU, issues a certificate and a private key to the location-based server LBS, and issues a series of pseudonymous PSEs and corresponding public keys PK OBU and private keys to the vehicle node OBU.
  • PR OBU Only the third-party trust authority TA in the system can learn the true identity of the vehicle node OBU.
  • the second layer is the local mobility anchor LMA.
  • the group manager it is responsible for monitoring the movement of the group member, that is, the vehicle node OBU, and is responsible for receiving the location service request sent by the mobile access gateway MAG.
  • the local mobility anchor LMA will each vehicle node.
  • the OBU's location service request is aggregated and forwarded to the location-based server LBS, and the response of the location-based server LBS is forwarded to the vehicle node OBU through the mobile access gateway MAG in the PMIPv6 architecture.
  • the third layer is a mobile access gateway MAG in the PMIPv6 architecture, connected to the vehicle node OBU, the local mobility anchor LMA, and performs message interaction, and is responsible for receiving the location service request of the vehicle node OBU and forwarding it to the local mobility anchor LMA to which it is connected; Receive the response from the local mobile anchor LMA and broadcast it.
  • a mobile access gateway MAG in the PMIPv6 architecture, connected to the vehicle node OBU, the local mobility anchor LMA, and performs message interaction, and is responsible for receiving the location service request of the vehicle node OBU and forwarding it to the local mobility anchor LMA to which it is connected; Receive the response from the local mobile anchor LMA and broadcast it.
  • the fourth layer is the vehicle node OBU, and the location access service is requested by the mobile access gateway MAG and the local mobility anchor LMA, and the location service request is generated by using the pseudonym and the location information, and sent to the mobile access gateway MAG, the same mobile connection.
  • the vehicle node OBU entering the gateway MAG obtains the response corresponding to the requested location service from the broadcast of the mobile access gateway MAG according to its own pseudonym.
  • the above system performs a method for combining vehicle node location privacy protection in combination with a PMIPv6 architecture, including:
  • Step 1 The location-based server LBS and the vehicle node OBU register with the third-party trust authority TA.
  • the location-based server LBS obtains the certificate and private key issued by the third-party trust authority TA, and calculates its own public key;
  • the vehicle node OBU obtains A series of pseudonym PSEs issued by a third-party trust authority TA and corresponding public key PK OBU and private key PR OBU ;
  • Step 2 The vehicle node OBU requests a location service from the location-based server LBS: the vehicle node OBU generates a location service request by using the pseudonym PSE and the location information location, and sends it to the local mobility anchor LMA via the mobile access gateway MAG, and the local mobility anchor LMA will The location service request of the vehicle node OBU is aggregated and sent to the location-based server LBS;
  • the location-based server LBS provides location-based services for each vehicle node OBU: the location-based server LBS responds to the pseudonym of the vehicle node OBU and the corresponding response message, and accesses all vehicles of the same local mobility anchor LMA.
  • the response aggregation of the node OBU is sent to the local mobility anchor LMA, and the local mobility anchor LMA is sent to the corresponding mobile access gateway MAG for broadcast.
  • the vehicle node OBU under the same mobile access gateway MAG obtains its requested location according to its pseudonym. The response to the service.
  • the registration process of the location-based server LBS to the third-party trust organization TA is as shown in FIG. 2, including:
  • the location-based server LBS sends its own identity information IDLBS to the third-party trust authority TA; the third-party trust authority TA calculates the location-based server using the identity information IDLBS of the location-based server LBS and the private key PRTA of the third-party trust authority TA The certificate and private key of the LBS are sent to the location-based server LBS through a secure channel;
  • the location-based server LBS certificate CERT LBS Sign PRTA (ID LBS ,t), where t is the validity period of the certificate;
  • Location-based server LBS private key Where s is the private key of the third-party trust authority TA, P is the generator of the addition group G 1 in the BLMQ signature algorithm, and H is a hash function.
  • the vehicle node OBU registers with the third-party trust authority TA, including:
  • the vehicle node OBU sends its own identity information ID OBU to the third-party trust authority TA; the trusted third-party trust authority gives the vehicle node OBU the public-private key and the vehicle node OBU according to the generation of a series of pseudonymous PSEs and public-private key pairs PK OBU and PR OBU . pseudonym.
  • the vehicle node OBU requests a location service from the location-based server LBS, including:
  • the first ciphertext C 1 E SKOBU-MAG (request) is sent to the mobile access gateway MAG, where the SK OBU-MAG is a shared key between the vehicle node OBU and the mobile access gateway MAG.
  • Step 2-2 the MAG with the shared key SK OBU-MAG OBU nodes between the vehicle and the first Mobile Access Gateway MAG decrypt ciphertext C 1, is obtained from a vehicle location service request node OBU will
  • Step 2-3 The local mobility anchor LMA decrypts the second ciphertext C 2 by using the shared key SK MAG-LMA between the mobile access gateway MAG and the local mobility anchor LMA to obtain a location service request of the vehicle node OBU, and local mobility
  • the location-based server LBS provides location-based services for each vehicle node OBU, including:
  • Step 3-2 The local mobility anchor LMA classifies the response of the location-based server LBS to the vehicle node OBU according to the mobile access gateway MAG where the vehicle node OBU is located, and uses the mobile access gateway MAG and the local mobility anchor LMA in response.
  • Step 3-3 The mobile access gateway MAG broadcasts the response ⁇ PSEi, resulti>, and the vehicle node OBU under the same mobile access gateway MAG obtains the response corresponding to the requested location service according to its own pseudonym.
  • the vehicle node OBU requests a location service from the location based server LBS and a location based server LBS to provide a location based service flow for each vehicle node OBU as shown in FIG.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明提供一种结合PMIPv6架构的车辆节点位置隐私保护系统及方法。LBS、OBU向TA注册，LBS获得TA颁发的证书和私钥，并计算自身的公钥；OBU获得TA颁发的一系列假名以及对应的公钥和私钥；OBU利用假名和位置信息生成位置服务请求，经MAG发送给LMA，LMA将各个OBU的位置服务请求聚合后发送给LBS；LBS将OBU的假名和对应的回应消息作为响应，将接入同一个LMA的所有OBU的响应聚合发送给LMA，LMA再发送给相应的MAG广播出去，同一MAG下的OBU根据自己的假名获取其所请求的位置服务所对应的响应。本发明结合PMIPv6架构实现了车辆节点位置隐私保护，使用了群的思想，由LMA来代替OBU来向LBS发出基于位置的请求并接受回应消息，从而保证OBU的位置隐私。

Description

结合PMIPv6架构的车辆节点位置隐私保护系统及方法 技术领域
本发明属于网络安全技术领域，特别涉及一种结合PMIPv6架构的车辆节点位置隐私保护系统及方法。
背景技术
随着移动互联网络的发展，移动协议得到了广泛的应用，车辆节点的移动性服务和相关的安全和位置隐私问题，引起了广泛的关注。VANET协议中包括两个实体：车辆单元(OBU)和路边单元(RSU)。PMIPv6协议是移动节点的移动管理协议，其中在节点切换的过程中能够采用快速切换的策略，来提高切换的效率。把PMIPv6的网络架构和VANET相结合能够提高车辆节点移动过程中的效率，尤其是节点的切换效率。
虽然车辆节点的效率有所提高，但是车辆在移动过程中还存在一些安全和隐私泄露问题。车辆节点在和周围节点进行通信，或者请求服务(查询最近的餐厅等信息)时，可能会泄露车辆的隐私信息(车辆节点的身份和位置信息)。信息泄露后，就可能会被恶意的车辆节点或者移动设备跟踪，从而威胁车辆节点的安全。为了解决车辆节点的隐私保护问题，许多专家学者对此进行了长时间的研究，同时也提出了很多方案。
本发明主要采用群的方法，让群管理者代替车辆节点发送基于位置的请求，同时，每次请求后群内的车辆节点都要更换假名。这样恶意节点就不能准确发现到底是哪个车辆节点发送了基于位置的服务，有效保证了车辆节点的位置隐私。
发明内容
针对现有技术存在的不足，本发明提供一种结合PMIPv6架构的车辆节点位置隐私保护系统及方法。
一种结合PMIPv6架构的车辆节点位置隐私保护方法，包括：
基于位置的服务器LBS、车辆节点OBU向第三方信任机构TA注册，基于位置的服务器LBS获得第三方信任机构TA颁发的证书和私钥，并计算自身的公钥；车辆节点OBU获得第三方信任机构TA颁发的一系列假名以及对应的公钥和私钥；
车辆节点OBU向基于位置的服务器LBS请求位置服务：车辆节点OBU利用假名和位置信息生成位置服务请求，经移动接入网关MAG发送给本地移动锚LMA，本地移动锚LMA将各个车辆节点OBU的位置服务请求聚合后发送给基于位置的服务器LBS；
基于位置的服务器LBS为各车辆节点OBU提供基于位置的服务：基于位置的服务器LBS将车辆节点OBU的假名和对应的回应消息作为响应，将接入同一个本地移动锚LMA的所有 车辆节点OBU的响应聚合发送给本地移动锚LMA，本地移动锚LMA再发送给相应的移动接入网关MAG广播出去，同一移动接入网关MAG下的车辆节点OBU根据自己的假名获取其所请求的位置服务所对应的响应。
所述基于位置的服务器LBS为各车辆节点OBU提供基于位置的服务，进一步包括：
对车辆节点OBU的假名和位置信息用基于位置的服务器LBS公钥进行加密，得到位置服务请求，对该位置服务请求进行加密得到第一密文并发送给移动接入网关MAG；
移动接入网关MAG利用车辆节点OBU和移动接入网关MAG之间的共享密钥对第一密文解密，获得来自车辆节点OBU的位置服务请求，将接入同一个本地移动锚LMA的各个车辆节点OBU的位置服务请求进行聚合，并用移动接入网关MAG和本地移动锚LMA之间的共享密钥进行加密得到第二密文发送给本地移动锚LMA；
本地移动锚LMA利用移动接入网关MAG和本地移动锚LMA之间的共享密钥对第二密文解密，得到车辆节点OBU的位置服务请求，本地移动锚LMA利用本地移动锚LMA和基于位置的服务器LBS之间的共享密钥对该位置服务请求进行加密得到第三密文转发给基于位置的服务器LBS。
所述基于位置的服务器LBS为各车辆节点OBU提供基于位置的服务，进一步包括：
基于位置的服务器LBS对各个车辆节点OBU的位置服务请求消息解密，根据车辆节点OBU的位置信息给车辆节点OBU提供相应的位置服务，用车辆节点OBU的公钥加密得到回应消息；基于位置的服务器LBS将车辆节点OBU的假名和对应的回应消息作为响应，将接入同一个本地移动锚LMA的所有车辆节点OBU的响应聚合，利用本地移动锚LMA和基于位置的服务器LBS之间的共享密钥进行加密得到第四密文发送给本地移动锚LMA；
本地移动锚LMA按照车辆节点OBU所在的移动接入网关MAG将基于位置的服务器LBS提供给车辆节点OBU的响应进行分类，并且将响应利用移动接入网关MAG和本地移动锚LMA之间的共享密钥加密得到第五密文发送给相应的移动接入网关MAG；
移动接入网关MAG把响应广播出去，同一移动接入网关MAG下的车辆节点OBU根据自己的假名获取其所请求的位置服务所对应的响应。
本发明还提供了一种所述的方法所采用的系统，包括：
第三方信任机构TA：接收基于位置的服务器LBS、车辆节点OBU的注册请求，并向基于位置的服务器LBS颁发证书和私钥；向车辆节点OBU颁发的一系列假名以及对应的公钥和私钥；
本地移动锚LMA：接收经移动接入网关MAG发来的位置服务请求，本地移动锚LMA将各个车辆节点OBU的位置服务请求聚合后转发给基于位置的服务器LBS，以及将基于位 置的服务器LBS的响应通过PMIPv6架构中的移动接入网关MAG转发给车辆节点OBU；
移动接入网关MAG：接收车辆节点OBU的位置服务请求并转发给其所连接的本地移动锚LMA；接收本地移动锚LMA发来的响应并广播出去；
车辆节点OBU：向基于位置的服务器LBS请求位置服务，利用假名和位置信息生成位置服务请求，发送给移动接入网关MAG，同一移动接入网关MAG下的车辆节点OBU根据自己的假名从移动接入网关MAG的广播中获取其所请求的位置服务所对应的响应。
所述车辆节点OBU对车辆节点OBU的假名和位置信息用基于位置的服务器LBS公钥进行加密，得到位置服务请求，对该位置服务请求进行加密得到第一密文并发送给移动接入网关MAG；
所述移动接入网关MAG利用车辆节点OBU和移动接入网关MAG之间的共享密钥对第一密文解密，获得来自车辆节点OBU的位置服务请求，将接入同一个本地移动锚LMA的各个车辆节点OBU的位置服务请求进行聚合，并用移动接入网关MAG和本地移动锚LMA之间的共享密钥进行加密得到第二密文发送给本地移动锚LMA；
所述本地移动锚LMA利用移动接入网关MAG和本地移动锚LMA之间的共享密钥对第二密文解密，得到车辆节点OBU的位置服务请求，本地移动锚LMA利用本地移动锚LMA和基于位置的服务器LBS之间的共享密钥对该位置服务请求进行加密得到第三密文转发给基于位置的服务器LBS。
所述本地移动锚LMA按照车辆节点OBU所在的移动接入网关MAG将基于位置的服务器LBS提供给车辆节点OBU的响应进行分类，并且将响应利用移动接入网关MAG和本地移动锚LMA之间的共享密钥加密得到第五密文发送给相应的移动接入网关MAG；所述响应包括车辆节点OBU的假名和对应的回应消息，其中的回应消息是用车辆节点OBU的公钥加密基于位置的服务器LBS给车辆节点OBU提供相应的位置服务得到。
所述移动接入网关MAG把响应广播出去，同一移动接入网关MAG下的车辆节点OBU根据自己的假名获取其所请求的位置服务所对应的响应。
有益效果：
本发明结合PMIPv6架构实现了车辆节点位置隐私保护，将其应用在车辆网络VANETs中车辆节点OBU中，使用了群的思想，由本地移动锚LMA、移动接入网关MAG以及车辆节点OBU组成的群中本地移动锚LMA为群管理员，由本地移动锚LMA来代替车辆节点OBU来向基于位置的服务器LBS发出基于位置的请求并接受回应消息，从而保证车辆节点OBU的位置隐私。该方案在车辆节点OBU进行切换时，仍然能保持接收到高速准确的服务。同时也很好的保证车辆节点OBU的位置隐私和不可追踪性。
附图说明
图1为本发明具体实施方式的结合PMIPv6架构的车辆节点位置隐私保护系统架构图；
图2为本发明具体实施方式的基于位置的服务器LBS向第三方信任机构TA注册流程图；
图3为本发明具体实施方式的车辆节点OBU向基于位置的服务器LBS请求位置服务与基于位置的服务器LBS为各车辆节点OBU提供基于位置的服务流程图。
具体实施方式
下面结合附图对本发明的具体实施方式做详细说明。
本实施方式是将结合PMIPv6架构的车辆节点位置隐私保护系统应用于移动车辆节点移动通信过程中，本地移动锚LMA代替车辆节点OBU向基于位置的服务器LBS发送请求，有效保护了车辆节点在移动过程中的位置隐私，且在车辆网络中结合了PMIPv6架构，用移动接入网关MAG代替路边单元RSU来转发基于位置的请求及响应，将PMIPv6架构与车辆网络VANETs很好地融合，最大程度上实现车辆节点的隐私保护。
如图1所示的基于结合PMIPv6架构的车辆节点位置隐私保护系统，整个系统的架构分为三层：
第一层为第三方信任机构TA(Trusted Authority，TA)，是所有实体的信任根；第三方信任机构TA默认可信，一般由政府管理部门控制。第三方信任机构TA接收基于位置的服务器LBS、车辆节点OBU的注册请求，向基于位置的服务器LBS颁发证书和私钥，向车辆节点OBU颁发一系列假名PSE以及对应的公钥PK OBU和私钥PR OBU；系统中仅第三方信任机构TA能够获悉车辆节点OBU的真实身份。
第二层为本地移动锚LMA，作为群管理者，负责监视群成员即车辆节点OBU的运动情况，同时负责接收经移动接入网关MAG发来的位置服务请求，本地移动锚LMA将各个车辆节点OBU的位置服务请求聚合后转发给基于位置的服务器LBS，以及将基于位置的服务器LBS的响应通过PMIPv6架构中的移动接入网关MAG转发给车辆节点OBU。
第三层为PMIPv6架构中的移动接入网关MAG，与车辆节点OBU、本地移动锚LMA相连并且进行消息交互，负责接收车辆节点OBU的位置服务请求并转发给其所连接的本地移动锚LMA；接收本地移动锚LMA发来的响应并广播出去。
第四层为车辆节点OBU，通过移动接入网关MAG和本地移动锚LMA向基于位置的服务器LBS请求位置服务，利用假名和位置信息生成位置服务请求，发送给移动接入网关MAG，同一移动接入网关MAG下的车辆节点OBU根据自己的假名从移动接入网关MAG的广播中获取其所请求的位置服务所对应的响应。
上述系统进行结合PMIPv6架构的车辆节点位置隐私保护的方法，包括：
步骤1、基于位置的服务器LBS、车辆节点OBU向第三方信任机构TA注册，基于位置的服务器LBS获得第三方信任机构TA颁发的证书和私钥，并计算自身的公钥；车辆节点OBU获得可信第三方信任机构TA颁发的一系列假名PSE以及对应的公钥PK OBU和私钥PR OBU；
步骤2、车辆节点OBU向基于位置的服务器LBS请求位置服务：车辆节点OBU利用假名PSE和位置信息location生成位置服务请求，经移动接入网关MAG发送给本地移动锚LMA，本地移动锚LMA将各个车辆节点OBU的位置服务请求聚合后发送给基于位置的服务器LBS；
步骤3、基于位置的服务器LBS为各车辆节点OBU提供基于位置的服务：基于位置的服务器LBS将车辆节点OBU的假名和对应的回应消息作为响应，将接入同一个本地移动锚LMA的所有车辆节点OBU的响应聚合发送给本地移动锚LMA，本地移动锚LMA再发送给相应的移动接入网关MAG广播出去，同一移动接入网关MAG下的车辆节点OBU根据自己的假名获取其所请求的位置服务所对应的响应。
所述基于位置的服务器LBS向第三方信任机构TA注册流程如图2所示，包括：
基于位置的服务器LBS把自己的身份信息IDLBS发送给第三方信任机构TA；第三方信任机构TA利用基于位置的服务器LBS的身份信息IDLBS和第三方信任机构TA的私钥PRTA，计算基于位置的服务器LBS的证书和私钥并通过安全信道发送给基于位置的服务器LBS；
其中，
基于位置的服务器LBS的证书CERT LBS＝Sign PRTA(ID LBS，t)，其中t是该证书的有效期；
基于位置的服务器LBS的私钥
Figure PCTCN2018087565-appb-000001
其中s为第三方信任机构TA的私钥，P为BLMQ签名算法中加法群G 1的生成元，H为哈希函数。
基于位置的服务器LBS计算并保存自身的公钥PK LBS＝H(ID LBS)，H表示哈希函数，同时保存来自第三方信任机构TA的基于位置的服务器LBS的证书和私钥。
所述车辆节点OBU向第三方信任机构TA注册，包括：
车辆节点OBU发送自己的身份信息ID OBU给第三方信任机构TA；可信第三方信任机构给车辆节点OBU根据产生一系列假名PSE及公私钥对PK OBU和PR OBU，车辆节点OBU保存公私钥和假名。
所述车辆节点OBU向基于位置的服务器LBS请求位置服务，包括：
步骤2-1、对车辆节点OBU的假名PSE和位置信息location用基于位置的服务器LBS公钥PKLBS进行加密，得到位置服务请求request＝E PKLBS(PSE，location)，对该位置服务请求进行加密得到第一密文C 1＝E SKOBU-MAG(request)并发送给移动接入网关MAG，其中SK OBU-MAG为车辆节点OBU和移动接入网关MAG之间的共享密钥。
步骤2-2、移动接入网关MAG利用车辆节点OBU和移动接入网关MAG之间的共享密钥SK OBU-MAG对第一密文C 1解密，获得来自车辆节点OBU的位置服务请求，将接入同一个本地移动锚LMA的各个车辆节点OBU的位置服务请求进行聚合得到∑request i，并用移动接入网关MAG和本地移动锚LMA之间的共享密钥SK MAG-LMA进行加密得到第二密文C2＝E SKMAG-LMA(∑request i)并发送给本地移动锚LMA，其中request i为第i个车辆节点OBU的位置服务请求。
步骤2-3：本地移动锚LMA利用移动接入网关MAG和本地移动锚LMA之间的共享密钥SK MAG-LMA对第二密文C 2解密，得到车辆节点OBU的位置服务请求，本地移动锚LMA利用本地移动锚LMA和基于位置的服务器LBS之间的共享密钥SK LMA-LBS，对该位置服务请求进行加密得到第三密文C 3＝E SKLMA-LBS(∑request i)，并转发给基于位置的服务器LBS。
所述基于位置的服务器LBS为各车辆节点OBU提供基于位置的服务，包括：
步骤3-1：基于位置的服务器LBS对各个车辆节点OBU的位置服务请求消息解密，根据车辆节点OBU的位置信息给车辆节点OBU提供相应的位置服务response i；用车辆节点OBU的公钥PK OBU加密得到回应消息result i＝E PKOBU(response i)；基于位置的服务器LBS将所有的回应消息建立列表，列表的每行存储一个车辆节点OBU的假名和对应的回应消息<PSE i，result i>作为响应，将接入同一个本地移动锚LMA的所有车辆节点OBU的响应聚合得到∑(PSE i，result i)，利用本地移动锚LMA和基于位置的服务器LBS之间的共享密钥SK LBS-LMA进行加密得到第四密文C 4＝E SKLBS-LMA(∑(PSE i，result i))，发送给本地移动锚LMA。
步骤3-2：本地移动锚LMA按照车辆节点OBU所在的移动接入网关MAG将基于位置的服务器LBS提供给车辆节点OBU的响应进行分类，并且将响应利用移动接入网关MAG和本地移动锚LMA之间的共享密钥SK MAG-LMA加密得到第五密文C 5＝E SKMAG-LMA(∑(PSE i，result i))，发送给相应的移动接入网关MAG。
步骤3-3：移动接入网关MAG把响应<PSEi，resulti>广播出去，同一移动接入网关MAG下的车辆节点OBU根据自己的假名获取其所请求的位置服务所对应的响应。
车辆节点OBU向基于位置的服务器LBS请求位置服务与基于位置的服务器LBS为各车辆节点OBU提供基于位置的服务流程如图3所示。

Claims (6)

  1. 一种结合PMIPv6架构的车辆节点位置隐私保护方法，其特征在于，包括：
    基于位置的服务器LBS、车辆节点OBU向第三方信任机构TA注册，基于位置的服务器LBS获得第三方信任机构TA颁发的证书和私钥，并计算自身的公钥；车辆节点OBU获得第三方信任机构TA颁发的一系列假名以及对应的公钥和私钥；
    车辆节点OBU向基于位置的服务器LBS请求位置服务：车辆节点OBU利用假名和位置信息生成位置服务请求，经移动接入网关MAG发送给本地移动锚LMA，本地移动锚LMA将各个车辆节点OBU的位置服务请求聚合后发送给基于位置的服务器LBS；
    基于位置的服务器LBS为各车辆节点OBU提供基于位置的服务：基于位置的服务器LBS将车辆节点OBU的假名和对应的回应消息作为响应，将接入同一个本地移动锚LMA的所有车辆节点OBU的响应聚合发送给本地移动锚LMA，本地移动锚LMA再发送给相应的移动接入网关MAG广播出去，同一移动接入网关MAG下的车辆节点OBU根据自己的假名获取其所请求的位置服务所对应的响应。
  2. 根据权利要求1所述的方法，其特征在于，所述基于位置的服务器LBS为各车辆节点OBU提供基于位置的服务，包括：
    对车辆节点OBU的假名和位置信息用基于位置的服务器LBS公钥进行加密，得到位置服务请求，对该位置服务请求进行加密得到第一密文并发送给移动接入网关MAG；
    移动接入网关MAG利用车辆节点OBU和移动接入网关MAG之间的共享密钥对第一密文解密，获得来自车辆节点OBU的位置服务请求，将接入同一个本地移动锚LMA的各个车辆节点OBU的位置服务请求进行聚合，并用移动接入网关MAG和本地移动锚LMA之间的共享密钥进行加密得到第二密文发送给本地移动锚LMA；
    本地移动锚LMA利用移动接入网关MAG和本地移动锚LMA之间的共享密钥对第二密文解密，得到车辆节点OBU的位置服务请求，本地移动锚LMA利用本地移动锚LMA和基于位置的服务器LBS之间的共享密钥对该位置服务请求进行加密得到第三密文转发给基于位置的服务器LBS。
  3. 根据权利要求1所述的方法，其特征在于，所述基于位置的服务器LBS为各车辆节点OBU提供基于位置的服务，包括：
    基于位置的服务器LBS对各个车辆节点OBU的位置服务请求消息解密，根据车辆节点OBU的位置信息给车辆节点OBU提供相应的位置服务，用车辆节点OBU的公钥加密得到回应消息；基于位置的服务器LBS将车辆节点OBU的假名和对应的回应消息作为响应，将接 入同一个本地移动锚LMA的所有车辆节点OBU的响应聚合，利用本地移动锚LMA和基于位置的服务器LBS之间的共享密钥进行加密得到第四密文发送给本地移动锚LMA；
    本地移动锚LMA按照车辆节点OBU所在的移动接入网关MAG将基于位置的服务器LBS提供给车辆节点OBU的响应进行分类，并且将响应利用移动接入网关MAG和本地移动锚LMA之间的共享密钥加密得到第五密文发送给相应的移动接入网关MAG；
    移动接入网关MAG把响应广播出去，同一移动接入网关MAG下的车辆节点OBU根据自己的假名获取其所请求的位置服务所对应的响应。
  4. 权利要求1所述的方法所采用的系统，其特征在于，包括：
    第三方信任机构TA：接收基于位置的服务器LBS、车辆节点OBU的注册请求，并向基于位置的服务器LBS颁发证书和私钥；向车辆节点OBU颁发的一系列假名以及对应的公钥和私钥；
    本地移动锚LMA：接收经移动接入网关MAG发来的位置服务请求，本地移动锚LMA将各个车辆节点OBU的位置服务请求聚合后转发给基于位置的服务器LBS，以及将基于位置的服务器LBS的响应通过PMIPv6架构中的移动接入网关MAG转发给车辆节点OBU；
    移动接入网关MAG：接收车辆节点OBU的位置服务请求并转发给其所连接的本地移动锚LMA；接收本地移动锚LMA发来的响应并广播出去；
    车辆节点OBU：向基于位置的服务器LBS请求位置服务，利用假名和位置信息生成位置服务请求，发送给移动接入网关MAG，同一移动接入网关MAG下的车辆节点OBU根据自己的假名从移动接入网关MAG的广播中获取其所请求的位置服务所对应的响应。
  5. 根据权利要求4所述的系统，其特征在于，
    所述车辆节点OBU对车辆节点OBU的假名和位置信息用基于位置的服务器LBS公钥进行加密，得到位置服务请求，对该位置服务请求进行加密得到第一密文并发送给移动接入网关MAG；
    所述移动接入网关MAG利用车辆节点OBU和移动接入网关MAG之间的共享密钥对第一密文解密，获得来自车辆节点OBU的位置服务请求，将接入同一个本地移动锚LMA的各个车辆节点OBU的位置服务请求进行聚合，并用移动接入网关MAG和本地移动锚LMA之间的共享密钥进行加密得到第二密文发送给本地移动锚LMA；
    所述本地移动锚LMA利用移动接入网关MAG和本地移动锚LMA之间的共享密钥对第二密文解密，得到车辆节点OBU的位置服务请求，本地移动锚LMA利用本地移动锚LMA 和基于位置的服务器LBS之间的共享密钥对该位置服务请求进行加密得到第三密文转发给基于位置的服务器LBS。
  6. 根据权利要求4或5所述的系统，其特征在于，
    所述本地移动锚LMA按照车辆节点OBU所在的移动接入网关MAG将基于位置的服务器LBS提供给车辆节点OBU的响应进行分类，并且将响应利用移动接入网关MAG和本地移动锚LMA之间的共享密钥加密得到第五密文发送给相应的移动接入网关MAG；所述响应包括车辆节点OBU的假名和对应的回应消息，其中的回应消息是用车辆节点OBU的公钥加密基于位置的服务器LBS给车辆节点OBU提供相应的位置服务得到；
    所述移动接入网关MAG把响应广播出去，同一移动接入网关MAG下的车辆节点OBU根据自己的假名获取其所请求的位置服务所对应的响应。
PCT/CN2018/087565 2017-11-30 2018-05-18 结合PMIPv6架构的车辆节点位置隐私保护系统及方法 WO2019104954A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711235217.0 2017-11-30
CN201711235217.0A CN108024206B (zh) 2017-11-30 2017-11-30 结合PMIPv6架构的车辆节点位置隐私保护系统及方法

Publications (1)

Publication Number Publication Date
WO2019104954A1 true WO2019104954A1 (zh) 2019-06-06

Family

ID=62077567

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/087565 WO2019104954A1 (zh) 2017-11-30 2018-05-18 结合PMIPv6架构的车辆节点位置隐私保护系统及方法

Country Status (2)

Country Link
CN (1) CN108024206B (zh)
WO (1) WO2019104954A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108024206B (zh) * 2017-11-30 2020-07-14 东北大学 结合PMIPv6架构的车辆节点位置隐私保护系统及方法
CN109218974B (zh) * 2018-09-18 2020-04-10 北京邮电大学 一种协作隐私保护的节点确定方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102624917A (zh) * 2012-03-29 2012-08-01 杨涛 一种基于广播和属性加密技术的隐私保护系统
US20150088618A1 (en) * 2013-08-26 2015-03-26 Ims Solutions, Inc. Road tolling
CN107040516A (zh) * 2017-01-03 2017-08-11 东南大学 一种高效假名管理和数据完整性保护协议
CN107360551A (zh) * 2017-07-12 2017-11-17 安徽大学 车载自组织网络中基于差分隐私的位置隐私保护方法
CN108024206A (zh) * 2017-11-30 2018-05-11 东北大学 结合PMIPv6架构的车辆节点位置隐私保护系统及方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101932059B (zh) * 2010-08-02 2012-11-14 清华大学深圳研究生院 V2i通信中基于网络的导航辅助快速三层切换方法
US9521644B2 (en) * 2012-01-31 2016-12-13 Qualcomm Incorporated Methods and apparatus for providing network-assisted end-to-end paging between LTE devices
CN103618995B (zh) * 2013-12-04 2017-01-18 西安电子科技大学 基于动态假名的位置隐私保护方法
CN104853351A (zh) * 2015-03-20 2015-08-19 江苏大学 一种基于可控隐私的车联网分布式认证方法
CN107181597B (zh) * 2017-06-30 2020-02-07 东北大学 一种基于身份代理群签名的PMIPv6认证系统及方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102624917A (zh) * 2012-03-29 2012-08-01 杨涛 一种基于广播和属性加密技术的隐私保护系统
US20150088618A1 (en) * 2013-08-26 2015-03-26 Ims Solutions, Inc. Road tolling
CN107040516A (zh) * 2017-01-03 2017-08-11 东南大学 一种高效假名管理和数据完整性保护协议
CN107360551A (zh) * 2017-07-12 2017-11-17 安徽大学 车载自组织网络中基于差分隐私的位置隐私保护方法
CN108024206A (zh) * 2017-11-30 2018-05-11 东北大学 结合PMIPv6架构的车辆节点位置隐私保护系统及方法

Also Published As

Publication number Publication date
CN108024206B (zh) 2020-07-14
CN108024206A (zh) 2018-05-11

Similar Documents

Publication Publication Date Title
Wang et al. LIAP: A local identity-based anonymous message authentication protocol in VANETs
Eiza et al. Secure and privacy-aware cloud-assisted video reporting service in 5G-enabled vehicular networks
Yang et al. Multimedia cloud transmission and storage system based on internet of things
US20220158854A1 (en) Cryptographic methods and systems using blinded activation codes for digital certificate revocation
WO2019104955A1 (zh) 雾计算架构下的VANETs位置隐私保护查询方法
Zhang et al. Practical secure and privacy-preserving scheme for value-added applications in VANETs
KR101837338B1 (ko) Vanet을 위한 클라우드 지원 조건부 프라이버시를 보호하는 인증 방법 및 시스템
Liu et al. Bua: A blockchain-based unlinkable authentication in vanets
Wang et al. Hybrid conditional privacy-preserving authentication scheme for VANETs
Chen et al. An infrastructure framework for privacy protection of community medical internet of things: Transmission protection, storage protection and access control
JP2010519788A (ja) ロケーション情報およびロケーション情報を用いるアクセス制御を保証する方法および機器
US11582020B2 (en) Homomorphic encryption offload for lightweight devices
WO2020020007A1 (zh) 网络接入方法、装置、终端、基站和可读存储介质
WO2019015387A1 (zh) 一种基于身份群签的pmipv6匿名接入认证系统及方法
US20230029523A1 (en) Privacy-preserving delivery of activation codes for pseudonym certificates
WO2019001169A1 (zh) 一种基于身份代理群签名的PMIPv6认证系统及方法
Jiang et al. SAES: A self-checking authentication scheme with higher efficiency and security for VANET
US20220407701A1 (en) Processing of requests to control information stored at multiple servers
Hasan et al. WORAL: A witness oriented secure location provenance framework for mobile devices
Huang et al. EPPD: Efficient and privacy-preserving proximity testing with differential privacy techniques
CN105429962A (zh) 一种通用的面向加密数据的中间网络服务构建方法与体系
US20220376931A1 (en) Balancing privacy and efficiency for revocation in vehicular public key infrastructures
CN105262591A (zh) 一种基于数据的网络通信实现方法
Amadeo et al. Securing the mobile edge through named data networking
WO2019104954A1 (zh) 结合PMIPv6架构的车辆节点位置隐私保护系统及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18882793

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18882793

Country of ref document: EP

Kind code of ref document: A1