WO2020087805A1 - 基于双密值和混沌加密的可信测控网络认证方法 - Google Patents

基于双密值和混沌加密的可信测控网络认证方法 Download PDF

Info

Publication number
WO2020087805A1
WO2020087805A1 PCT/CN2019/075661 CN2019075661W WO2020087805A1 WO 2020087805 A1 WO2020087805 A1 WO 2020087805A1 CN 2019075661 W CN2019075661 W CN 2019075661W WO 2020087805 A1 WO2020087805 A1 WO 2020087805A1
Authority
WO
WIPO (PCT)
Prior art keywords
measurement
user
application server
identity
control application
Prior art date
Application number
PCT/CN2019/075661
Other languages
English (en)
French (fr)
Inventor
尚文利
曾鹏
尹隆
陈春雨
赵剑明
刘贤达
Original Assignee
中国科学院沈阳自动化研究所
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国科学院沈阳自动化研究所 filed Critical 中国科学院沈阳自动化研究所
Priority to US16/636,727 priority Critical patent/US20210367753A1/en
Publication of WO2020087805A1 publication Critical patent/WO2020087805A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/001—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using chaotic signals
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G06F21/645—Protecting data integrity, e.g. using checksums, certificates or signatures using a third party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0847—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving identity based encryption [IBE] schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0877—Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/12—Details relating to cryptographic hardware or logic circuitry
    • H04L2209/127—Trusted platform modules [TPM]

Definitions

  • the invention relates to a technical method for performing identity authentication by adopting a double-density value and a chaotic encryption key negotiation algorithm in an industrial measurement and control network, and belongs to the field of industrial control network security.
  • USBKey-based PKI identity authentication method has the characteristics of long key, dynamic change of identity authentication credentials, high security, and ease of use.
  • there are often complex digital certificate issuance, long certificate verification structure and other factors that lead to actual The efficiency of verification is limited.
  • various embedded terminal devices in the application scenario of the industrial measurement and control system have limited computing power and computing resources, and it is difficult to quickly and efficiently perform cryptographic operations involving multiple rounds of iterations.
  • the purpose of the present invention is to adopt a technical scheme for generating and verifying user identity information vouchers based on the idea of double secret values, and to design a key agreement protocol based on Chebyshev mapping chaotic public key ciphers suitable for industrial measurement and control networks.
  • Identity authentication method between terminal devices and the use of trusted computing technology to establish a chain of trust, to ensure that the terminal device identity is also trusted to provide integrity enhancement and verification of its upper layer software, to prevent the control software module from being abnormally modified and lead to untrustworthy measurement and control commands and results, and Affect the overall credibility and safety level of the measurement and control system.
  • the object of the present invention is to provide an identity authentication method based on the combination of double-secret value and chaotic encryption algorithm.
  • the invention takes the industrial measurement and control system network as an application scenario, negotiates key keys by adopting a chaotic encryption public key cryptographic algorithm, ensures that intermediate data is difficult to be tampered by replay or forgery to affect the authentication result, and builds a measurement and control network based on trusted computing technology Information security protection system.
  • the technical solution adopted by the present invention to solve its technical problems is: a trusted measurement and control network authentication method based on double-density values and chaotic encryption, including the following steps:
  • the control terminal and the measurement and control application server respectively generate user identification information based on the user secret value and the measurement and control application server secret value, and transmit them through asymmetric encryption;
  • the measurement and control application server infers the authenticity of the user's identification information by analyzing the user's identity credentials.
  • the consistency analysis between the control terminal and the measurement and control application server to verify the software integrity of the control terminal includes the following steps:
  • the terminal device makes the control terminal software module execute in a predetermined order by verifying and then jumping, so as to enhance the integrity of the control terminal software;
  • the software module code M is passed to the TPM in the control terminal.
  • the measurement and control application server verifies the digital signature with the control terminal public key AIK_PK, compares the obtained PCR integrity characterization value, that is, the digital fingerprint PCR, with the PCR integrity characterization value obtained from the integrity characterization log SML, and verifies that the control terminal software is complete Sex: If they are consistent, the integrity verification is successful, otherwise the verification fails.
  • the control terminal and the measurement and control application server respectively generate user identification information based on the user secret value and the measurement and control application server secret value, and transmit the information through asymmetric encryption.
  • the steps are as follows:
  • the operation terminal generates user identity credentials, including the following steps:
  • the terminal device calculates the extraction parameter h (PW
  • K represents the server secret value
  • a user identity authentication request ⁇ ID, Q 1 , Q 2 , Q 3 , T 1 ⁇ is generated and sent to the measurement and control application server through the network.
  • the measurement and control application server infers the authenticity of the user identification information held by the user by analyzing the user identity credentials, including the following steps:
  • the credible measurement and control network authentication method based on double-density value and chaos encryption also includes authentication result confirmation, including the following steps:
  • the measurement and control application server creates the identity verification result parameter AUTH ⁇ ⁇ True, False ⁇ , generates a random number R 2 , authentication time T 2 , and calculates the response message parameters:
  • the USBKey device After receiving the confirmation message, the USBKey device checks the freshness of the time stamp T 2 : recalculates the parameters And compare it with P 3 in the confirmation message; if It indicates that the measurement and control application server holds the secret value x and the cryptographic function ⁇ (.) That characterize its identity, can calculate the user's identity authentication key K, and decouples the identity evidence V 2 from the identity authentication request message to decouple the identity Certification results Reliable; and calculate the session key according to 6b).
  • the communication key negotiation between the two measurement and control terminal devices using the chaotic public key cryptographic algorithm includes the following steps:
  • the terminal device A first selects a large integer r, a large prime number N and x on the finite field and calculates T r (x); assigns its own user ID ID A and the recipient device ID ID B , x, N , And connect with T r (x), and encrypt it with the shared session key created between yourself and the measurement and control application server, after generating the cipher text E TA (ID A , ID B , x, N, T r (x)) Send to the measurement and control application server; r, N is greater than the set value;
  • the measurement and control application server After receiving the information sent by the terminal device A, the measurement and control application server decrypts the data E TA (ID A , ID B , x, N, T r (x)) with the shared key of the terminal device A, and verifies the device Whether A is a legal identity; if the verification fails, it is terminated, otherwise the obtained information is encrypted with the key shared with the terminal device B, and E TB (ID B , ID A , x, N, T r (x )), And send E TB (ID B , ID A , x, N, T r (x)) to terminal device B;
  • the measurement and control application server After receiving the information from terminal device B, the measurement and control application server decrypts E TB (ID B , T s (x)) with the key shared with device B, and verifies the identity of device B; if the verification is unsuccessful, it terminates Otherwise, the measurement and control application server encrypts ID B and T s (x) with the key shared with device A, that is, E TA (ID B , T s (x)); then E TA (ID B , T s (x) ) And MAC B are sent to terminal device A;
  • the present invention adopts a double-density scheme to calculate the parameters K, K and the one-way function h to derive the user identification code V 1 and apply the random number R 1 to V 1 and K to form a dynamically changing user identity certificate V 2. Introduce a time stamp T 1 to form a fresh identity certificate Q 1 , Q 2 , Q 3 and transmit it on the Internet. To forge the user's identity, K, V 1 and V 2 need to be obtained by analyzing Q 1 , Q 2 and Q 3 . Since Q 1 and Q 2 are obtained by performing XOR operations on two position parameters, they can only be cracked using random guessing methods.
  • the probability of successful cracking is calculated as T represents the time it takes to perform a crack by a random guess method, and n represents the number of failures before the last guess attack succeeds.
  • T represents the time it takes to perform a crack by a random guess method
  • n represents the number of failures before the last guess attack succeeds.
  • the traditional user authentication process based on the PKI scheme involves user digital certificate verification and private key certificate verification.
  • the user certificate with a certificate chain length of n levels requires the verifier to perform n certificate verifications to verify the certificate issuer ’s Whether the digital signature is valid, each operation involves at least one large modulus exponentiation operation and one hash operation, the total cost is ne + nh, where e is the time overhead of the large modulus exponentiation operation, and h is the time of the hash operation Overhead; and the verification of the user's private key certificate needs to send challenge and response information to the USBKey once, at least 2 encryption operations, 2 signatures and 1 verification operation, the calculation cost is 5e + 3h, the total calculation cost The total is (n + 5) e + (n + 3) h.
  • the authenticator calculates K, R 1 , V 1 , V 2 , Two hash operations and two modular power operations are required, and calculating the response message parameters P 1 , P 2 , P 3 , and P 4 requires three hash operations and one modular power operation, which requires a total calculation cost of 5e + 3h, Therefore, the longer the certificate chain can reflect the advantages of the present invention.
  • the present invention adopts the Chebyshev mapping chaotic public key cryptographic algorithm, and applies its characteristics such as chaotic characteristics, semigroup characteristics and unidirectionality to the process of identity authentication and key negotiation between devices.
  • the present invention adopts encrypted transmission for sensitive parameters T s (x) and device user IDs ID A and ID B that may be required for short-cycle attacks, and it is difficult for attackers to break through short-cycle attacks; and a trusted third party is introduced
  • the measurement and control application server is responsible for data encryption and transmission, and uses the Hash function to generate a confirmation code to ensure that any change in information can be detected, which can prevent man-in-the-middle listening attacks; It is generated randomly, and only devices A and B can determine the generation method of the session key k and the random element in the Hash authentication code to ensure the timeliness of the verification information and thus can effectively resist replay attacks.
  • FIG. 1 is a schematic diagram of a method for enhancing and verifying the integrity of a terminal software integrity of a trusted measurement and control network authentication technology in the present invention
  • FIG. 2 is a schematic diagram of a method for safely generating user identity identification information in a trusted measurement and control network identity authentication stage of the present invention
  • FIG. 3 is a schematic diagram of the process of generating user identity evidence at the stage of credible measurement and control network identity authentication in the present invention
  • FIG. 4 is a schematic diagram of a user identity verification process in a trusted measurement and control network identity authentication stage of the present invention
  • FIG. 5 is a schematic diagram of a key negotiation process between devices in an identity authentication phase of a trusted measurement and control network in the present invention.
  • FIG. 6 is a schematic diagram of the trusted measurement and control network authentication method of the present invention.
  • the present invention relates to a trusted measurement and control network authentication technology method based on double-density value and chaotic encryption algorithm.
  • the specific method is based on building a trust chain through trusted computing to achieve a safe and reliable operating environment.
  • the identity authentication method in the present invention includes multiple links such as the safe generation of user identity marks, read protection packaging, secure transmission, and key negotiation, and each link adopts a unique and confidential cryptographic function for data security generation , So as to ensure the safety of access to certified equipment in the industrial measurement and control network.
  • TPM refers to the abbreviation of Trusted Platform Module (Trust Platform Module). It exists as a trusted root for the platform at the beginning of the establishment of the trusted computing trust chain, usually referring to the TPM chip.
  • the SHA-1 engine is an algorithm engine that executes the SHA-1 one-way hash function, and exists as a cryptographic operation module in the TPM chip.
  • the operation terminal transmits the module digital fingerprints and integrity characterization logs collected during the transfer of the trust chain to the measurement and control application server.
  • the application server verifies the integrity of the measurement and control terminal software by performing consistency analysis on the unforgeable digital fingerprints and integrity marks.
  • the integrity enhancement and verification process includes the following related steps:
  • the terminal device adopts the TPM-based trust chain transfer method, and the method of verifying and then jumping, so that the control terminal software module is executed according to a predetermined order, and the integrity of the control terminal software is enhanced.
  • the measurement and control application server verifies the digital signature with the control terminal public key AIK_PK, compares the PCR integrity characterization value and the integrity characterization log SML, and verifies the control terminal software integrity.
  • the user identification information of the measurement and control terminal equipment must have unique, anti-guessing and other security features, and adopt reading and packaging technology, transmission through a secure channel, and import into tamper-resistant secure storage media such as USBKey (U-Shield), only Specified users can hold this information.
  • USBKey U-Shield
  • the method for safely generating user identity information in the identity authentication process based on the double-density value includes three aspects of user identity code generation, read protection encapsulation, and safe transmission of user identity information, each phase of implementation The process is as follows:
  • the measurement and control application server will be composed of encrypted and encapsulated user identification code E (F), user ID, encrypted and encapsulated identity authentication key EK, h (PW
  • UPK), E (F), EK, p, UN, AN, UC,... ⁇ composed of such information is encrypted with the public key UPK and transmitted to the USBKey device, USBKey uses the private key SPK opposite to UPK for decryption and storage, and creates a secure channel for user identification information transmission and import to USBKey through asymmetric encryption technology.
  • the user identity certificate of the measurement and control terminal device contains the user identification feature code, which should have security features such as dynamic, freshness, anti-eavesdropping, recording and playback.
  • the user identity credentials are generated in the USBKey, and this process is activated when the user enters the correct PIN password or user secret value PW.
  • Generating user identity credentials includes the following steps:
  • a user identity authentication request ⁇ ID, Q 1 , Q 2 , Q 3 , T 1 ⁇ is generated and sent to the measurement and control application server through the network.
  • the measurement and control application server decouples the user identity credentials to obtain an exportable user identity identification code, and then compares it with the expected user identity identification code to finally obtain identity authentication result.
  • the user identity verification process includes the following steps:
  • the measurement and control application server constructs an identity verification confirmation message according to the identity verification result and sends it to the terminal device.
  • the terminal device uses USBKey to decouple the data to obtain the identity verification result, and creates a measurement and control server.
  • the verification result confirmation process includes the following steps:
  • the USBKey device After receiving the confirmation message, the USBKey device checks the freshness of the time stamp T 2 and recalculates the parameters And compare it with P 3 in the confirmation message, if It indicates that the measurement and control application server holds a secret value x and a password function ⁇ (.) That characterize its identity, can calculate the user's identity authentication encryption parameter K, and decouples the identity evidence V 2 from the identity authentication request message to decouple the identity Certification results reliable. And calculate the session key according to b).
  • the terminal device A first selects a large integer r, a large prime number N and x on the finite field and calculates T r (x). Own user identity ID A, the recipient device identity ID B, x, N, and share a session key T r (x) are connected, and a monitoring and control applications server between themselves and create encrypted, generates a ciphertext E TA (ID A , ID B , x, N, T r (x)) is sent to the measurement and control application server.
  • monitoring and control applications server receives data with information on the shared key of the terminal device A E TA (ID A, ID B , x, N, T r (x)) to decrypt and verify that the device A is a legitimate Identity, if the verification fails, terminate, otherwise the obtained information will be encrypted with the key shared with the terminal device B to get E TB (ID B , ID A , x, N, T r (x)), and E TB (ID B, ID A, x, N, T r (x)) to the terminal device B.
  • E TA ID A, ID B , x, N, T r (x)
  • the measurement and control application server After receiving the information, the measurement and control application server decrypts E TB (ID B , T s (x)) with the key shared with device B, and verifies the identity of device B. If the verification is not successful, it is terminated. Otherwise, the measurement and control application server encrypts ID B and T s (x) with the key shared with device A, that is, E TA (ID B , T s (x)). Then send E TA (B, T s (x)) and MAC B to device A.
  • MAC ′ B and MAC B represent the message confirmation code obtained by encrypting the shared key k between the terminal device B and the server using the Hash function.

Abstract

本发明涉及基于双密值和混沌加密的可信测控网络认证方法，具体方法为在通过可信计算构建信任链实现安全可信的运行环境的基础上，使用双密值和混沌公钥密码实现身份认证和密钥协商流程，实现用户身份凭证安全传输和验证，从而构建安全可信的数据传输通道。本发明中的身份认证方法包含用户身份标识安全产生、读取保护封装、安全传输、密钥协商等多个环节，每个环节中均采用了具有唯一性和保密性的密码函数进行数据安全生成，从而保证了工业测控网络中认证设备接入的安全。

Description

基于双密值和混沌加密的可信测控网络认证方法 技术领域
本发明涉及一种在工业测控网络中采用双密值与混沌加密密钥协商算法进行身份认证的技术方法，属于工业控制网络安全领域。
背景技术
伴随我国工业信息化程度逐渐加快，越来越多的通讯技术和嵌入式应用被应用到了工业生产网络中。在享受高新科技为生产过程带来便利的同时，也体现了不同程度上的信息安全问题。一旦存在一些不受控的设备接入到工业测控网络中，通过如拒绝式服务攻击或者对通信协议进行渗透挖掘，能够利用协议中存在的漏洞对生产系统核心装置进行攻击，修改装置的应用配置或固件信息，获取系统最高控制权限，就可以使整个系统的作业状态出现不可控的风险。因此，为了解决传统工控网络中缺少认证技术体系的问题，需要将身份认证技术集成到现有工业测控网络中以实现可信认证节点的安全接入。
目前大部分工业测控系统中采用基于PKI认证体系来实现身份认证和访问权限控制。传统基于USBKey的PKI身份认证方法具有密钥长、身份认证凭证动态变化、安全性高、使用方便等特点，而工业测控系统应用场景中往往存在复杂数字证书签发、证书验证结构冗长等因素导致实际验证效率受到限制。并且工业测控系统应用场景中的各种嵌入式终端设备存在计算能力和计算资源受限的情况，难以快速高效地执行涉及多轮迭代的密码运算操作。因此需要提供一套计算开销少同时能保证可抗多种类型的密码攻击的身份认证和密钥协商技术理论，以保证工业测控系统网络实现可信工作，提高身份认证效率，支持可伸缩系统构架等需求。
综上所述，本发明目的通过采用一种基于双密值思想的用户身份信息凭证生成及验证技术方案，并通过基于Chebyshev映射混沌公钥密码的密钥协商协议设计适用于工业测控网络中的终端设备之间的身份认证方法。并采用可信计算技术建立信任链，使保证终端设备身份可信的同时也提供对其上层软件进行完整性增强和验证，防止因操控软件模块被非正常修改导致测控命令和结果不可信，进而影响测控系统的整体可信性和安全水平。
发明内容
针对上述技术不足，本发明的目的提供一种基于双密值与混沌加密算法结合的身份认证方法。本发明以工业测控系统网络作为应用场景，通过采用混沌加密公钥密码算法协商关键密钥，保证中间数据难以通过重放或伪造方式被篡改而影响认证结果，并基于可信计算技术构建测控网络信息安全防护体系。
本发明解决其技术问题所采用的技术方案是：基于双密值和混沌加密的可信测控网络认证方法，包括以下步骤：
操控终端与测控应用服务器进行一致性分析来验证操控终端软件完整性；
操控终端与测控应用服务器分别以用户密值、测控应用服务器密值共同产生用户标识信息，通过非对称加密方式进行传输；
操控终端产生用户身份凭证；
测控应用服务器通过对用户身份凭证分析来推断用户持有用户标识信息的真实性。
所述操控终端与测控应用服务器进行一致性分析来验证操控终端软件完整性，包括以下步骤：
2a)终端设备以先验证后跳转的方式，使操控终端软件模块按照预订顺序执行，实现操控终端软件完整性增强；
2b)软件模块代码M传递给操控终端内的TPM，TPM中SHA-1引擎计算软件模块代码数字指纹PCR，以散列扩展方式保存到平台配置寄存器中，即：PCR i＝SHA-1(PCR i||P i)，产生完整性表征日志SML；i表示数字指纹序号；SHA-1表示单向散列函数；
2c)测控应用服务器发送挑战串Challenge＝Nonce启动完整性验证，操控终端对内部平台配置寄存器用操控终端的私钥AIK_SK对PCR、Nonce签名，加上SML形成响应消息Response＝Sign AIK_SK{P CR,Nonce}||SML；Sign AIK_SK表示用私钥AIK_SK做数字签名运算；
2d)测控应用服务器用操控终端公钥AIK_PK验证数字签名，将已得到的PCR完整性表征值即数字指纹PCR和由完整性表征日志SML获取的PCR完整性表征值进行对比，验证操控终端软件完整性：若一致，则完整性验证成功，否则验证失败。
所述操控终端与测控应用服务器分别以用户密值、测控应用服务器密值共同产生用户标识信息，通过非对称加密方式进行传输，步骤如下：
3a)测控应用服务器利用服务器密值K、秘密函数β(.)、用户提供的ID号、用户公钥UPK和用户密值PW的散列值，产生用户身份标识码F＝[h(ID||x)﹒h(PW||UPK) β(κ)]mod p；h(.)表示单向散列函数，x表示测控应用服务器持有表征其身份的秘密值，mod表示模除运算；
3b)用h(PW||UPK)对用户身份标识码F进行读取保护封装，得到E(F)：
Figure PCTCN2019075661-appb-000001
3c)将由加密封装的用户身份标识码E(F)、用户ID、加密封装的身份认证密钥EK、h(PW||UPK)、参数p、用户名UN、单位名称AN、用户类别UC构成的用户标识信息{ID，C，h(PW||UPK)，E(F)，EK，p，UN，AN，UC，…}，使用公钥UPK加密，传送给USBKey设备，USBKey采用和UPK相对的私钥SPK进行解密保存，通过非对称加密为用户标识信息传输和导入USBKey创建一个安全通道。
所述操控终端产生用户身份凭证，包括以下步骤：
4a)终端设备计算用户密值的提取参数h(PW||UPK)，通过计算
Figure PCTCN2019075661-appb-000002
来解封E(F)还原F，利用USBKey和测控应用服务器之间的身份认证密钥 K＝β(h(x) h(ID)mod p)进行变换后得到用户身份标识码V 1＝F h(K)mod p；h(.)表示单向散列函数，mod表示模除运算，β(.)表示秘密函数，p表示参数；
4b)用户随机数R 1作用于V 1，得到动态变化用户身份凭证V 2：
Figure PCTCN2019075661-appb-000003
4c)使用时间标记T 1转换生成具有时鲜性的用户身份凭证：
Figure PCTCN2019075661-appb-000004
K表示服务器密值；
d)最后产生用户身份认证请求{ID，Q 1，Q 2，Q 3，T 1}，并将其通过网络发送到测控应用服务器。
所述测控应用服务器通过对用户身份凭证分析来推断用户持有用户标识信息的真实性，包括以下步骤：
5a)测控应用服务器收到终端设备发来的身份认证请求{ID，Q 1，Q 2，Q 3，T 1}后，先进行时鲜性检查：若满足条件T-T 1≤阈值△T,则利用密值K、秘密函数β(.)、用户提供的ID号计算与USBKey共享的身份认证密钥K＝β(h(x) h(ID)mod p)；
5b)接着利用K、T 1从Q 2中解耦随机数
Figure PCTCN2019075661-appb-000005
从Q 1中还原用户身份标识码
Figure PCTCN2019075661-appb-000006
并利用R 1、V 1、K计算随机化用户身份凭证
Figure PCTCN2019075661-appb-000007
和融入时间标记的用户身份凭证
Figure PCTCN2019075661-appb-000008
5c)然后比较测控应用服务器还原得到的身份凭证
Figure PCTCN2019075661-appb-000009
与接收到的身份凭证Q 3，还原用户标识码V 1与期望用户身份标识码PF＝F h(K)mod p，若V 1与PF一致，则表明用户掌握其密值PW，终端用户提供的USBKey拥有表征用户的秘密值E(F)和EK，终端设备的用户身份得到确认。
基于双密值和混沌加密的可信测控网络认证方法，还包括认证结果确认，包括以下步骤：
6a)测控应用服务器创建身份验证结果参数AUTH∈{True,False}，生成随机数R 2、认证时间T 2，计算响应消息参数：
Figure PCTCN2019075661-appb-000010
6b)测控应用服务器创建身份认证确认消息{P 1,P 3,T 2,AUTH}，将其反馈给USBKey，同时创建同终端设备的会话密钥Skey＝h(K,V 2,P 2,R 1,R 2,T 1,T 2)；
6c)USBKey设备收到确认信息后，检查时间标记T 2时鲜性：重新计算参数
Figure PCTCN2019075661-appb-000011
Figure PCTCN2019075661-appb-000012
并与确认消息中的P 3对比；若
Figure PCTCN2019075661-appb-000013
则表明测控应用服务器持有表征其身份的秘密值x和密码函数β(.)，能计算用户的身份认证密钥K，并从身份认证请求消息中解耦出身份证据V 2，解耦身份认证结果
Figure PCTCN2019075661-appb-000014
可靠；并按照6b)计算会话密钥。
经过身份认证后已确认用户身份凭证(Q 1,Q 2,Q 3)有效的两台测控终端设备之间采用混沌公钥密码算法进行通信密钥协商，包括如下步骤：
a)终端设备A首先选择一个大整数r,一个大素数N和有限域上的x并计算T r(x)；将自己的用户身份标识ID A，接受方设备身份标识ID B，x，N，和T r(x)连接起来，并用自己与测控应用服务器之间创建的共享会话密钥进行加密，生成密文E TA(ID A，ID B，x，N，T r(x))后发送给测控应用服务器；r、N大于设定值；
b)测控应用服务器收到终端设备A发来的信息后用与终端设备A的共享密钥对数据E TA(ID A，ID B，x，N，T r(x))进行解密，验证设备A是否是一个合法的身份；如果验证失败则终止，否则将得到的信息用其与终端设备B共享的密钥进行加密，得到E TB(ID B，ID A，x，N，T r(x)),并将E TB(ID B，ID A，x，N，T r(x))发送给终端设备B；
c)终端设备B收到信息后用其与测控应用服务器共享的密钥对E TB(ID B，ID A，x，N，T r(x))进行解密，然后随机选择一个大整数s用来计算T s(x)，将终端设备B身份标识ID B和T s(x)连接起来用与测控应用服务器共享密钥加密，即E TB(ID B,T s(x))；然后计算k＝T s(T r(x))，并用k作为密钥采用Hash函数计算消息确认码MAC B＝h k(ID B,ID A,T r(x))；终端设备B将E TB(B,T s(x))和MAC B发送给测控应用服务器；s大于设定值，h k表示Hash函数，T s(x)、T r(x)表示混沌公钥密码算法计算表达式；
d)测控应用服务器收到终端设备B发来的信息后用与设备B共享的密钥解密E TB(ID B,T s(x))，并验证设备B的身份；若验证不成功则终止；否则测控应用服务器用与设备A共享的密钥加密ID B和T s(x)，即E TA(ID B,T s(x))；然后将E TA(ID B,T s(x))和MAC B发送给终端设备A；
e)终端设备A收到测控应用服务器发来的信息后，计算消息确认码MAC′ B＝h k(ID B,ID A,T r(x))，对比MAC′ B和MAC B是否相等；若不等，则设备A终止与B的协商通信；否则其确认B为真实的通信对象，且双方共享的会话密钥为k＝T s(T r(x))；终端设备A发送认证结果消息MAC A＝h k(ID A,ID B,T s(x))给终端设备B进行确认；
f)终端设备B用密钥k计算Hash函数值MAC′ A＝h k(ID A,ID B,T s(x))，对比MAC′ A和收到的MAC A是否相等；若不等，则终端设备B终止协商；否则，确认终端设备A是其真实通信对象，会话密钥为k。
本发明具有以下有益效果及优点：
1.本发明采用双密值方案将参数K、K和单向函数h计算可导出用户身份标识码V 1，并将随机数R 1作用于V 1和K，形成动态变化的用户身份凭证V 2，再引入时间标记T 1形成具有时鲜性的身份凭证Q 1,Q 2,Q 3在网上传输。若要伪造用户身份，需通过对Q 1,Q 2,Q 3的分析获取K、V 1、V 2。由于Q 1,Q 2为通过两个位置参数执行异或操作得到的，只能采用随机猜测方法破解，破解成功概率经计算为
Figure PCTCN2019075661-appb-000015
T代表通过随机猜测方法进行一次破解所花的时间，n代表在最后一次猜测攻击成功之前失败的次数。与传统PKI方案相比，双密值身份认证方案的抗身份伪造能力更强。
2.本发明与传统基于PKI方案的身份认证方案相比，在涉及到的密码运算复杂度上的性能开销更小。传统基于PKI方案的用户认证过程涉及用户数字证书验证与私钥凭证验证过程中，从根CA开始对证书链长度为n级的用户数字证书需要认证方执行n次证书验证，验证证书签发者的数字签名是否有效，每次操作至少涉及1次大数模幂运算和1次散列运算，合计开销为ne+nh，其中e为大数模幂运算的时间开销，h为散列运算的时间开销；而对用户私钥凭证的验证需要向USBKey发送挑战信息和响应信息各一次，至少需要2次加密运算、2次签名和1次验签操作，计算开销为5e+3h，总的计算开销合计为(n+5)e+(n+3)h。本发明中，认证方计算K、R 1、V 1、V 2、
Figure PCTCN2019075661-appb-000016
需要2次散列操作和2次模幂操作，而计算响应消息参数P 1、P 2、P 3、P 4需要3次散列操作、1次模幂操作，共需要计算开销5e+3h，因此证书链越长越能映衬本发明的优势。
3.本发明采用基于Chebyshev映射混沌公钥密码算法，将其具有的如混沌特性、半群特性和单向性等特点很好的应用到设备间间身份认证及密钥协商过程中。本发明对可能产生短周期攻击所需要的敏感参数T s(x)和设备用户身份标识ID A及ID B采用加密传输，难以被攻击者采用短周期攻击方式攻破；并且引入了可信第三方测控应用服务器来负责数据加密传递，使用Hash函数产生确认码方式保证信息的任何改变都可被检测出，能够阻止中间人监听攻击；在本发明密钥协商过程中，大整数r和s每次都是随机生成，也只有设备A和B能决定会话密钥k的生成方式和Hash认证码中的随机性元素，保证验证信息的时效性从而能有效地抵抗重播攻击。
附图说明
图1为本发明中可信测控网络认证技术操控终端软件完整性增强与验证方法示意图；
图2为本发明中可信测控网络身份认证阶段用户身份标识信息安全产生方法原理图；
图3为本发明中可信测控网络身份认证阶段用户身份证据生成过程示意图；
图4为本发明中可信测控网络身份认证阶段用户身份验证过程示意图；
图5为本发明中可信测控网络身份认证阶段设备间密钥协商过程示意图。
图6为本发明的可信测控网络认证方法示意图。
具体实施方式
下面结合附图及实施例对本发明做进一步的详细说明。
如图6所示，本发明涉及一种基于双密值和混沌加密算法的可信测控网络认证技术方法，具体方法为在通过可信计算构建信任链实现安全可信的运行环境的基础上，使用双密值和混沌公钥密码实现身份认证和密钥协商流程，实现用户身份凭证安全传输和验证，从而构建安全可信的数据传输通道。本发明中的身份认证方法包含用户身份标识安全产生、读取保护封装、安全传输、密钥协商等多个环节，每个环节中均采用了具有唯一性和保密性的密码函数进行数据安全生成，从而保证了工业测控网络中认证设备接入的安全。
TPM是指可信计算平台模块(Trust Platform Module)的简称，是作为可信计算信任链建立之初为平台提供可信根而存在，通常指TPM芯片。
SHA-1引擎，是执行SHA-1单向散列函数的算法引擎，是作为TPM芯片里面的一个密码运算模块而存在。
1.操作终端软件完整性增强与验证
如图1所示，操作终端基于可信计算数字签名方法，将信任链传递过程中采集的模块数字指纹、完整性表征日志，传送到测控应用服务器。应用服务器通过将不可仿造数字指纹、完整性标志进行一致性分析来验证测控终端软件完整性。完整性增强与验证过程包含如下相关步骤：
a)终端设备采用基于TPM的信任链传递方法，以先验证后跳转的方式，使操控终端软件模块按照预订顺序执行，实现操控终端软件完整性增强。
b)软件模块代码M同时传递给TPM，SHA-1引擎对其计算模块代码数字指纹，以散列扩展方式保存到平台配置寄存器中，即：PCR i＝SHA-1(PCR i||P i)，产生完整性表征日志SML。
c)测控应用服务器操控终端监控模块发送挑战串Challenge＝Nonce启动完整性验证，操控终端对PCR寄存器用其私钥AIK_SK对PCR、Nonce签名，加上SML形成响应消息Response＝Sign AIK_SK{PCR,Nonce}||SML。
d)测控应用服务器用操控终端公钥AIK_PK验证数字签名，将PCR完整性表征值、完整性表征日志SML进行对比，验证操控终端软件完整性。
2.用户身份标识信息安全产生
测控终端设备的用户身份标识信息必须具备唯一性、抗猜测等安全特性，并采取读取封装技术，通过安全通道进行传输、导入到防篡改的如USBKey(U盾)等安全存储介质中，仅指定用户可持有该信息。
如图2所示，基于双密值思想的身份认证过程中的用户身份标识信息安全产生方法包含用户身份标识码产生、读保护封装、用户身份标识信息安全传输三个方面，每个阶段的实现过程如下：
a)具有唯一性、防猜测性的用户标识码产生方法
测控系统应用服务器利用服务器密值κ、秘密函数β(.)、用户提供的ID号、用户公钥UPK和用户密值PW的散列值，产生不可导出用户身份标识码F＝[h(ID||x)﹒h(PW||UPK) β(κ)]mod p，从而完成用户标识码的生成。
b)用户身份标识码读保护封装算法
用h(PW||UPK)对用户身份标识码F进行读取保护封装，得到E(F)：
Figure PCTCN2019075661-appb-000017
仅在用户输入正确密值PW时才能从USBKey中还原出F，继续进行身份认证请求过程。
c)用户身份标识信息安全传输与导入
测控应用服务器将由加密封装的用户身份标识码E(F)、用户ID、加密封装的身份认证密钥EK、h(PW||UPK)、参数p、用户名UN、单位名称AN、用户类别UC等信息共同构成的用户标识信息{ID，C，h(PW||UPK)，E(F)，EK，p，UN，AN，UC，…}，使用公钥UPK加密，传送给USBKey设备，USBKey采用和UPK相对的私钥SPK进行解密保存，通过非对称加密技术为用户标识信息传输和导入到USBKey创建一个安全通道。
3.生成用户身份凭证
测控终端设备的用户身份凭证中包含用户标识特征码，应具备动态性、时鲜性，防窃听、录制重放等安全特性。
如图3所示，用户身份凭证在USBKey内生成，当用户输入正确PIN口令或用户密值PW时激活该过程。生成用户身份凭证包括如下步骤：
a)计算用户密值的提取参数h(PW||UPK)，通过计算
Figure PCTCN2019075661-appb-000018
来解封E(F)还原F，利用USBKey和测控应用服务器之间的身份认证密钥K＝β(h(x) h(ID)mod p)进行变换后计算得到用户身份标识码V 1＝F h(K)mod p。
b)将用户随机数R 1作用于V 1，得到动态变化用户身份凭证V 2：
Figure PCTCN2019075661-appb-000019
c)使用时间标记T 1转换生成具有时鲜性的用户身份凭证：
Figure PCTCN2019075661-appb-000020
d)最后产生用户身份认证请求{ID，Q 1，Q 2，Q 3，T 1}，并将其通过网络发送到测控应用服务器。
4.用户身份凭证验证
如图4所示，测控应用服务器收到终端设备发来的身份认证请求后，通过用户身份凭证解耦，获得可导出用户身份标识码，然后与期望用户身份标识码进行比较，最终得到身份认证结果。用户身份凭证验证过程包含如下步骤：
a)对用户身份凭证验证时，可信测控应用服务器收到终端设备发来的身份认证请求{ID，Q 1，Q 2，Q 3，T 1}后，先进行时鲜性检查，若满足条件T-T 1≤△T,则利用密值κ、秘密函数β(.)、用户提供的ID号计算与USBKey共享的身份认证密钥K＝β(h(x) h(ID)mod p)。
b)接着利用K、T 1从Q 2中解耦随机数
Figure PCTCN2019075661-appb-000021
从Q 1中还原可导出用户身份标识码
Figure PCTCN2019075661-appb-000022
并利用R 1、V 1、K计算随机化用户身份凭证
Figure PCTCN2019075661-appb-000023
和融入时间标记的用户身份凭证
Figure PCTCN2019075661-appb-000024
可导出就是可以通过计算
Figure PCTCN2019075661-appb-000025
来得到Q 1，即Q 1可由计算
Figure PCTCN2019075661-appb-000026
来导出。
c)然后比较测控应用服务器还原得到的身份凭证
Figure PCTCN2019075661-appb-000027
与接收到的身份凭证Q 3，还原可导出用户标识码V 1与期望可导出用户身份标识码PF＝F h(K)mod p，若一致则表明用户掌握其密值PW，其提供的USBKey拥有表征用户的秘密值E(F)和EK，终端设备的用户身份得到确认。
5.认证结果确认
如图4所示，测控应用服务器根据身份认证结果构造身份认证确认消息发送给终端设备，终端设备收到身份确认信息后使用USBKey对其进行数据解耦，获得身份认证结果，并创建与测控服务器之间的会话密钥。认证结果确认过程包含如下步骤：
a)创建身份验证结果参数AUTH∈{True,False}，生成随机数R 2、认证时间T 2，计算响应消息参数：
Figure PCTCN2019075661-appb-000028
b)创建身份认证确认消息{P 1,P 3,T 2,AUTH}，将其反馈给USBKey，同时创建同终端设备的会话密钥Skey＝h(K,V 2,P 2,R 1,R 2,T 1,T 2)。
c)USBKey设备收到确认信息后，检查时间标记T 2时鲜性，重新计算参数
Figure PCTCN2019075661-appb-000029
Figure PCTCN2019075661-appb-000030
并与确认消息中的P 3对比，若
Figure PCTCN2019075661-appb-000031
则表明测控应用服务器持有表征其身份的秘密值x和密码函数β(.)，能计算用户的身份认证加密参数K，并从身份认证请求消息中解耦出身份证据V 2，解耦身份认证结果
Figure PCTCN2019075661-appb-000032
可靠。并按照b)计算会话密钥。
6.基于Chebyshev映射混沌公钥密码的密钥协商
如图5所示，经过身份认证后已确认用户身份凭证有效的两台测控终端设备之间通过采用基于Chebyshev映射混沌公钥密码算法进行通信密钥协商的过程步骤如下：
a)终端设备A首先选择一个大整数r,一个大素数N和有限域上的x并计算T r(x)。将自己的用户身份标识ID A，接受方设备身份标识ID B，x，N，和T r(x)连接起来，并用自己与测控应用服务器之间创建的共享会话密钥进行加密，生成密文E TA(ID A，ID B，x，N，T r(x))后发送给测控应用服务器。
b)测控应用服务器收到信息后用与终端设备A的共享密钥对数据E TA(ID A，ID B，x，N，T r(x))进行解密，验证设备A是否是一个合法的身份，如果验证失败则终止，否则将得到的信息用其与终端设备B共享的密钥进行加密，得到E TB(ID B，ID A，x，N，T r(x)),并将E TB(ID B，ID A，x，N，T r(x))发送给终端设备B。
c)终端设备B收到信息后用其与测控应用服务器共享的密钥对E TB(ID B，ID A，x，N，T r(x))进行解密，然后随机选择一个大整数s用来计算T s(x)，将设备B身份标识ID B和T s(x)连接起来用与测控应用服务器共享密钥加密，即E TB(ID B,T s(x))。然后计算k＝T s(T r(x))，并用k作为密钥采用Hash函数计算MAC B＝h k(ID B,ID A,T r(x))。设备B将E TB(ID B,T s(x))和MAC B发送给测控应用服务器。
d)测控应用服务器收到信息后用与设备B共享的密钥解密E TB(ID B,T s(x))，并验证设备B的身份。若验证不成功则终止。否则测控应用服务器用与设备A共享的密钥加密ID B和T s(x)，即E TA(ID B,T s(x))。然后将E TA(B,T s(x))和MAC B发送给设备A。
e)设备A收到信息后，计算MAC′ B＝h k(ID B,ID A,T r(x))，对比MAC′ B和MAC B是否相等，若不等，则设备A终止与B的协商通信。否则其确认B为真实的通信对象，且双方共享 的会话密钥为k＝T s(T r(x))。设备A可选择发送认证结果消息MAC A＝h k(ID A,ID B,T s(x))给设备B进行确认。
f)设备B用密钥k计算Hash函数值MAC′ A＝h k(ID A,ID B,T s(x))，对比MAC′ A和收到的MAC A是否相等，若不等，则设备B终止协商。否则可以确认设备A是其真实通信对象，会话密钥为k。MAC′ B和MAC B代表终端设备B用和服务器之间的共享密钥k用Hash函数加密得到的消息确认码。

Claims (7)

  1. 基于双密值和混沌加密的可信测控网络认证方法，其特征在于，包括以下步骤：
    操控终端与测控应用服务器进行一致性分析来验证操控终端软件完整性；
    操控终端与测控应用服务器分别以用户密值、测控应用服务器密值共同产生用户标识信息，通过非对称加密方式进行传输；
    操控终端产生用户身份凭证；
    测控应用服务器通过对用户身份凭证分析来推断用户持有用户标识信息的真实性。
  2. 根据权利要求1所述的基于双密值和混沌加密的可信测控网络认证方法，其特征在于所述操控终端与测控应用服务器进行一致性分析来验证操控终端软件完整性，包括以下步骤：
    2a)终端设备以先验证后跳转的方式，使操控终端软件模块按照预订顺序执行，实现操控终端软件完整性增强；
    2b)软件模块代码M传递给操控终端内的TPM，TPM中SHA-1引擎计算软件模块代码数字指纹PCR，以散列扩展方式保存到平台配置寄存器中，即：PCR i＝SHA-1(PCR i||P i)，产生完整性表征日志SML；i表示数字指纹序号；SHA-1表示单向散列函数；
    2c)测控应用服务器发送挑战串Challenge＝Nonce启动完整性验证，操控终端对内部平台配置寄存器用操控终端的私钥AIK_SK对PCR、Nonce签名，加上SML形成响应消息Response＝Sign AIK_SK{PCR,Nonce}||SML；Sign AIK_SK表示用私钥AIK_SK做数字签名运算；
    2d)测控应用服务器用操控终端公钥AIK_PK验证数字签名，将已得到的PCR完整性表征值即数字指纹PCR和由完整性表征日志SML获取的PCR完整性表征值进行对比，验证操控终端软件完整性：若一致，则完整性验证成功，否则验证失败。
  3. 根据权利要求1所述的基于双密值和混沌加密的可信测控网络认证方法，其特征在于所述操控终端与测控应用服务器分别以用户密值、测控应用服务器密值共同产生用户标识信息，通过非对称加密方式进行传输，步骤如下：
    3a)测控应用服务器利用服务器密值K、秘密函数β(.)、用户提供的ID号、用户公钥UPK和用户密值PW的散列值，产生用户身份标识码F＝[h(ID||x)﹒h(PW||UPK) β(κ)]mod p；h(.)表示单向散列函数，x表示测控应用服务器持有表征其身份的秘密值，mod表示模除运算；
    3b)用h(PW||UPK)对用户身份标识码F进行读取保护封装，得到E(F)：
    Figure PCTCN2019075661-appb-100001
    3c)将由加密封装的用户身份标识码E(F)、用户ID、加密封装的身份认证密钥EK、h(PW||UPK)、参数p、用户名UN、单位名称AN、用户类别UC构成的用户标识信息{ID，C，h(PW||UPK)，E(F)，EK，p，UN，AN，UC，…}，使用公钥UPK加密，传送给USBKey设备，USBKey采用和UPK相对的私钥SPK进行解密保存，通过非对称加密为用户标识信息传输和导入USBKey创建一个安全通道。
  4. 根据权利要求3所述的基于双密值和混沌加密的可信测控网络认证方法，其特征在于所述操控终端产生用户身份凭证，包括以下步骤：
    4a)终端设备计算用户密值的提取参数h(PW||UPK)，通过计算
    Figure PCTCN2019075661-appb-100002
    来解封E(F)还原F，利用USBKey和测控应用服务器之间的身份认证密钥K＝β(h(x) h(ID)mod p)进行变换后得到用户身份标识码V 1＝F h(K)mod p；h(.)表示单向散列函数，mod表示模除运算，β(.)表示秘密函数，p表示参数；
    4b)用户随机数R 1作用于V 1，得到动态变化用户身份凭证V 2：
    Figure PCTCN2019075661-appb-100003
    4c)使用时间标记T 1转换生成具有时鲜性的用户身份凭证：
    Figure PCTCN2019075661-appb-100004
    K表示服务器密值；
    d)最后产生用户身份认证请求{ID，Q 1，Q 2，Q 3，T 1}，并将其通过网络发送到测控应用服务器。
  5. 根据权利要求3所述的基于双密值和混沌加密的可信测控网络认证方法，其特征在于，所述测控应用服务器通过对用户身份凭证分析来推断用户持有用户标识信息的真实性，包括以下步骤：
    5a)测控应用服务器收到终端设备发来的身份认证请求{ID，Q 1，Q 2，Q 3，T 1}后，先进行时鲜性检查：若满足条件T-T 1≤阈值△T,则利用密值K、秘密函数β(.)、用户提供的ID号计算与USBKey共享的身份认证密钥K＝β(h(x) h(ID)mod p)；
    5b)接着利用K、T 1从Q 2中解耦随机数
    Figure PCTCN2019075661-appb-100005
    从Q 1中还原用户身份标识码
    Figure PCTCN2019075661-appb-100006
    Figure PCTCN2019075661-appb-100007
    并利用R 1、V 1、K计算随机化用户身份凭证
    Figure PCTCN2019075661-appb-100008
    和融入时间标记的用户身份凭证
    Figure PCTCN2019075661-appb-100009
    5c)然后比较测控应用服务器还原得到的身份凭证
    Figure PCTCN2019075661-appb-100010
    与接收到的身份凭证Q 3，还原用户标识码V 1与期望用户身份标识码PF＝F h(K)mod p，若V 1与PF一致，则表明用户掌握其密值PW，终端用户提供的USBKey拥有表征用户的秘密值E(F)和EK，终端设备的用户身份得到确认。
  6. 根据权利要求5所述的基于双密值和混沌加密的可信测控网络认证方法，其特征在于还包括认证结果确认，包括以下步骤：
    6a)测控应用服务器创建身份验证结果参数AUTH∈{True,False}，生成随机数R 2、认证时间T 2，计算响应消息参数：
    Figure PCTCN2019075661-appb-100011
    6b)测控应用服务器创建身份认证确认消息{P 1,P 3,T 2,AUTH}，将其反馈给USBKey，同时创建同终端设备的会话密钥Skey＝h(K,V 2,P 2,R 1,R 2,T 1,T 2)；
    6c)USBKey设备收到确认信息后，检查时间标记T 2时鲜性：重新计算参数
    Figure PCTCN2019075661-appb-100012
    Figure PCTCN2019075661-appb-100013
    并与确认消息中的P 3对比；若
    Figure PCTCN2019075661-appb-100014
    则表明测控应用服务器持有表征其身份的秘密值x和密码函数β(.)，能计算用户的身份认证密钥K， 并从身份认证请求消息中解耦出身份证据V 2，解耦身份认证结果
    Figure PCTCN2019075661-appb-100015
    可靠；并按照6b)计算会话密钥。
  7. 根据权利要求1所述的基于双密值和混沌加密的可信测控网络认证方法，其特征在于，经过身份认证后已确认用户身份凭证(Q 1,Q 2,Q 3)有效的两台测控终端设备之间采用混沌公钥密码算法进行通信密钥协商，包括如下步骤：
    a)终端设备A首先选择一个大整数r,一个大素数N和有限域上的x并计算T r(x)；将自己的用户身份标识ID A，接受方设备身份标识ID B，x，N，和T r(x)连接起来，并用自己与测控应用服务器之间创建的共享会话密钥进行加密，生成密文E TA(ID A，ID B，x，N，T r(x))后发送给测控应用服务器；r、N大于设定值；
    b)测控应用服务器收到终端设备A发来的信息后用与终端设备A的共享密钥对数据E TA(ID A，ID B，x，N，T r(x))进行解密，验证设备A是否是一个合法的身份；如果验证失败则终止，否则将得到的信息用其与终端设备B共享的密钥进行加密，得到E TB(ID B，ID A，x，N，T r(x)),并将E TB(ID B，ID A，x，N，T r(x))发送给终端设备B；
    c)终端设备B收到信息后用其与测控应用服务器共享的密钥对E TB(ID B，ID A，x，N，T r(x))进行解密，然后随机选择一个大整数s用来计算T s(x)，将终端设备B身份标识ID B和T s(x)连接起来用与测控应用服务器共享密钥加密，即E TB(ID B,T s(x))；然后计算k＝T s(T r(x))，并用k作为密钥采用Hash函数计算消息确认码MAC B＝h k(ID B,ID A,T r(x))；终端设备B将E TB(B,T s(x))和MAC B发送给测控应用服务器；s大于设定值，h k表示Hash函数，T s(x)、T r(x)表示混沌公钥密码算法计算表达式；
    d)测控应用服务器收到终端设备B发来的信息后用与设备B共享的密钥解密E TB(ID B,T s(x))，并验证设备B的身份；若验证不成功则终止；否则测控应用服务器用与设备A共享的密钥加密ID B和T s(x)，即E TA(ID B,T s(x))；然后将E TA(ID B,T s(x))和MAC B发送给终端设备A；
    e)终端设备A收到测控应用服务器发来的信息后，计算消息确认码MAC′ B＝h k(ID B,ID A,T r(x))，对比MAC′ B和MAC B是否相等；若不等，则设备A终止与B的协商通信；否则其确认B为真实的通信对象，且双方共享的会话密钥为k＝T s(T r(x))；终端设备A发送认证结果消息MAC A＝h k(ID A,ID B,T s(x))给终端设备B进行确认；
    f)终端设备B用密钥k计算Hash函数值MAC′ A＝h k(ID A,ID B,T s(x))，对比MAC′ A和收到的MAC A是否相等；若不等，则终端设备B终止协商；否则，确认终端设备A是其真实通信对象，会话密钥为k。
PCT/CN2019/075661 2018-11-02 2019-02-21 基于双密值和混沌加密的可信测控网络认证方法 WO2020087805A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/636,727 US20210367753A1 (en) 2018-11-02 2019-02-21 Trusted measurement and control network authentication method based on double cryptographic values and chaotic encryption

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811299442.5 2018-11-02
CN201811299442.5A CN111147225A (zh) 2018-11-02 2018-11-02 基于双密值和混沌加密的可信测控网络认证方法

Publications (1)

Publication Number Publication Date
WO2020087805A1 true WO2020087805A1 (zh) 2020-05-07

Family

ID=70461783

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/075661 WO2020087805A1 (zh) 2018-11-02 2019-02-21 基于双密值和混沌加密的可信测控网络认证方法

Country Status (3)

Country Link
US (1) US20210367753A1 (zh)
CN (1) CN111147225A (zh)
WO (1) WO2020087805A1 (zh)

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111711686A (zh) * 2020-06-15 2020-09-25 江苏方天电力技术有限公司 一种基于配电终端的安全防护方法
CN112215626A (zh) * 2020-10-22 2021-01-12 合肥工业大学 支持环形订单可验证的网约车系统与方法
CN113055363A (zh) * 2021-03-02 2021-06-29 南通大学 一种基于区块链信任机制的标识解析系统实现方法
CN113132083A (zh) * 2021-04-02 2021-07-16 四川省计算机研究院 应用于北斗导航系统的安全认证系统、方法和装置
CN113992411A (zh) * 2021-11-01 2022-01-28 令牌云(上海)科技有限公司 一种基于可信设备的用户身份认证方法和装置
CN114065193A (zh) * 2021-11-23 2022-02-18 北京邮电大学 一种应用于边缘云环境下图像任务的深度学习安全方法
CN114389811A (zh) * 2022-02-28 2022-04-22 南京邮电大学 一种基于医疗联盟链的跨域认证方法
US20220417029A1 (en) * 2021-06-23 2022-12-29 Blackberry Limited Method and system for digital signatures utilizing multiplicative semigroups
CN115694945A (zh) * 2022-10-25 2023-02-03 北京珞安科技有限责任公司 一种工业终端主机维护方法、系统及设备
CN116305330A (zh) * 2023-05-22 2023-06-23 西安晟昕科技股份有限公司 一种cpu硬件的安全管理方法
CN116614239A (zh) * 2023-07-14 2023-08-18 北京中超伟业信息安全技术股份有限公司 一种物联网中数据传输方法及系统
CN117177239A (zh) * 2023-11-03 2023-12-05 合肥工业大学 一种基于量子密钥的tsp平台数据加密通信系统及方法

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA3179622A1 (en) * 2010-10-08 2012-04-12 Brian Lee Moffat Private data sharing system
CN111917759B (zh) * 2020-07-27 2021-02-19 八维通科技有限公司 一种加油站用的数据安全交互方法
CN113014396B (zh) * 2021-03-01 2022-07-22 重庆邮电大学 一种适用于wban数据实时加密传输的超轻量级加密方法
CN114301597B (zh) * 2021-12-13 2024-02-09 零信技术(深圳)有限公司 密钥验证方法、设备及可读存储介质
CN114338213B (zh) * 2021-12-31 2022-09-13 电子科技大学 一种温度辅助认证的认证方法
CN114531666A (zh) * 2022-01-28 2022-05-24 重庆邮电大学 基于ZigBee的无线网络室内远程监测系统及方法
CN114422106B (zh) * 2022-03-28 2022-06-24 科大天工智能装备技术（天津）有限公司 一种多服务器环境下的物联网系统安全认证方法及系统
CN114978537B (zh) * 2022-05-16 2024-02-13 中国人民解放军国防科技大学 一种身份识别方法、装置、设备和计算机可读存储介质
CN114785615B (zh) * 2022-05-23 2023-07-25 北京科技大学 一种云计算环境下用于物联网系统的轻量级认证方法
CN115225350A (zh) * 2022-07-01 2022-10-21 浪潮云信息技术股份公司 基于国密证书的政务云加密登录验证方法及存储介质
CN115296934B (zh) * 2022-10-08 2023-01-24 北京安帝科技有限公司 基于工控网络入侵的信息传输方法、装置、电子设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101577917A (zh) * 2009-06-16 2009-11-11 深圳市星龙基电子技术有限公司 一种安全的基于手机的动态密码验证方法
WO2010051377A1 (en) * 2008-10-29 2010-05-06 Verisign, Inc. A method and apparatus for mobile time-based ui for vip
CN107113315A (zh) * 2016-04-15 2017-08-29 深圳前海达闼云端智能科技有限公司 一种身份认证方法、终端及服务器

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010051377A1 (en) * 2008-10-29 2010-05-06 Verisign, Inc. A method and apparatus for mobile time-based ui for vip
CN101577917A (zh) * 2009-06-16 2009-11-11 深圳市星龙基电子技术有限公司 一种安全的基于手机的动态密码验证方法
CN107113315A (zh) * 2016-04-15 2017-08-29 深圳前海达闼云端智能科技有限公司 一种身份认证方法、终端及服务器

Cited By (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111711686A (zh) * 2020-06-15 2020-09-25 江苏方天电力技术有限公司 一种基于配电终端的安全防护方法
CN112215626A (zh) * 2020-10-22 2021-01-12 合肥工业大学 支持环形订单可验证的网约车系统与方法
CN113055363B (zh) * 2021-03-02 2023-07-04 南通大学 一种基于区块链信任机制的标识解析系统实现方法
CN113055363A (zh) * 2021-03-02 2021-06-29 南通大学 一种基于区块链信任机制的标识解析系统实现方法
CN113132083A (zh) * 2021-04-02 2021-07-16 四川省计算机研究院 应用于北斗导航系统的安全认证系统、方法和装置
US11956370B2 (en) * 2021-06-23 2024-04-09 Blackberry Limited Method and system for digital signatures utilizing multiplicative semigroups
US20220417029A1 (en) * 2021-06-23 2022-12-29 Blackberry Limited Method and system for digital signatures utilizing multiplicative semigroups
CN113992411A (zh) * 2021-11-01 2022-01-28 令牌云(上海)科技有限公司 一种基于可信设备的用户身份认证方法和装置
CN114065193A (zh) * 2021-11-23 2022-02-18 北京邮电大学 一种应用于边缘云环境下图像任务的深度学习安全方法
CN114389811B (zh) * 2022-02-28 2023-07-25 南京邮电大学 一种基于医疗联盟链的跨域认证方法
CN114389811A (zh) * 2022-02-28 2022-04-22 南京邮电大学 一种基于医疗联盟链的跨域认证方法
CN115694945B (zh) * 2022-10-25 2023-05-23 北京珞安科技有限责任公司 一种工业终端主机维护方法及设备
CN115694945A (zh) * 2022-10-25 2023-02-03 北京珞安科技有限责任公司 一种工业终端主机维护方法、系统及设备
CN116305330A (zh) * 2023-05-22 2023-06-23 西安晟昕科技股份有限公司 一种cpu硬件的安全管理方法
CN116305330B (zh) * 2023-05-22 2023-08-04 西安晟昕科技股份有限公司 一种cpu硬件的安全管理方法
CN116614239A (zh) * 2023-07-14 2023-08-18 北京中超伟业信息安全技术股份有限公司 一种物联网中数据传输方法及系统
CN116614239B (zh) * 2023-07-14 2023-09-29 北京中超伟业信息安全技术股份有限公司 一种物联网中数据传输方法及系统
CN117177239A (zh) * 2023-11-03 2023-12-05 合肥工业大学 一种基于量子密钥的tsp平台数据加密通信系统及方法
CN117177239B (zh) * 2023-11-03 2024-01-02 合肥工业大学 一种基于量子密钥的tsp平台数据加密通信系统及方法

Also Published As

Publication number Publication date
US20210367753A1 (en) 2021-11-25
CN111147225A (zh) 2020-05-12

Similar Documents

Publication Publication Date Title
WO2020087805A1 (zh) 基于双密值和混沌加密的可信测控网络认证方法
US11757662B2 (en) Confidential authentication and provisioning
US8130961B2 (en) Method and system for client-server mutual authentication using event-based OTP
JP5845393B2 (ja) 暗号通信装置および暗号通信システム
TWI512524B (zh) 身份驗證系統及方法
CN104796265A (zh) 一种基于蓝牙通信接入的物联网身份认证方法
CN103763356A (zh) 一种安全套接层连接的建立方法、装置及系统
CN110020524B (zh) 一种基于智能卡的双向认证方法
JP2009503934A (ja) 展性攻撃に対して改良された安全性を有する技術（これに限定されない）を含む非ワンタイムパッド暗号で暗号化した署名鍵を用いた、暗号認証、及び／又は共有暗号鍵の設定
CN109951276B (zh) 基于tpm的嵌入式设备远程身份认证方法
CN114915396B (zh) 一种基于国密算法的跳变密钥数字通信加密系统和方法
CN111294212A (zh) 一种基于电力配电的安全网关密钥协商方法
CN108551391B (zh) 一种基于USB-key的认证方法
CN111245611B (zh) 基于秘密共享和可穿戴设备的抗量子计算身份认证方法及系统
CN112487380A (zh) 一种数据交互方法、装置、设备及介质
KR20080005344A (ko) 인증서버가 사용자단말기를 인증하는 시스템
CN116388995A (zh) 一种基于puf的轻量级智能电网认证方法
KR20070035342A (ko) 패스워드 기반의 경량화된 상호 인증 방법
CN115632797A (zh) 一种基于零知识证明的安全身份验证方法
CN116633530A (zh) 量子密钥传输方法、装置及系统
EP3185504A1 (en) Security management system for securing a communication between a remote server and an electronic device
JP2004274134A (ja) 通信方法並びにこの通信方法を用いた通信システム、サーバおよびクライアント
RU2771928C2 (ru) Безопасный обмен данными, обеспечивающий прямую секретность
WO2023151427A1 (zh) 量子密钥传输方法、装置及系统
CN109088728B (zh) 一种基于共享密钥的电力系统调试工具加密通信方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19878403

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19878403

Country of ref document: EP

Kind code of ref document: A1