CN114302390A - Intra-group authentication key negotiation method in vehicle-mounted ad hoc network - Google Patents

Abstract

The invention belongs to the field of authentication key agreement, and particularly relates to an intra-group authentication key agreement method in a vehicle-mounted ad hoc network; the method comprises the following steps: establishing a dynamic vehicle group according to the Chinese remainder theorem; information sender V in vehicle group_iSigning information using private key information, information receiver V_jInformation sender V through public key information in signature information_iThe identity of (2) is authenticated; information sender V_iAnd an information receiver V_jAfter the identities are authenticated mutually, the two communication parties carry out key agreement according to the semigroup of Chebyshev chaotic mapping; respectively updating the corresponding pseudonyms and private keys of the vehicles by adopting a pseudonym updating mechanism and a private key updating mechanism; the identity of the malicious vehicle is traced through the signature message, and the legal identity of the malicious vehicle is cancelled by modifying the public key information corresponding to the malicious vehicle.

Description

Intra-group authentication key negotiation method in vehicle-mounted ad hoc network

Technical Field

The invention belongs to the field of authentication key agreement, and particularly relates to an intra-group authentication key agreement method in a vehicle-mounted ad hoc network.

Background

The rapid development of wireless communication and automotive technologies has promoted the development of Intelligent Transportation Systems (ITS). As an important component of ITS, a Vehicular Ad Hoc Network (VANET) can provide auxiliary information such as a current driving road condition, a traffic congestion condition, a weather condition and the like for a vehicle node, so that a vehicle driver can drive a vehicle more safely and conveniently. The communication modes in the VANET are mainly divided into two types: Vehicle-to-Vehicle, Vehicle-to-infrastructure (V2V), and Vehicle-to-infrastructure (V2I). Since V2V and V2I both communicate over public wireless channels, they are vulnerable to attacks by malicious parties, such as eavesdropping, spoofing, replay attacks, etc., when transmitting information in VANET. The communication privacy security in VANET is threatened by the attack of the malicious person. Meanwhile, compared with other static network structures, the VANET system has the characteristics of high-speed vehicle mobility and rapid network topology change, so that the privacy security of the VANET system is more easily damaged by malicious persons.

The Authentication and Key Agreement (AKA) protocol enables participants to complete mutual authentication and establish a secure session Key on a public network, so as to protect privacy and security of both communication parties.

A number of scholars have done a great deal of research on AKA technology and have proposed a number of valuable solutions. In a conventional Public Key Infrastructure (PKI) based scheme, a digital certificate is used as a medium, and a symmetric and asymmetric encryption technology is combined to bind information such as a user identity and a public key together, so that integrity, identity authentication and non-repudiation of a message are ensured. However, the scheme needs to manage a large amount of anonymous certificates and revocation lists, and the storage cost is very large; and the certificate verification process of the scheme involves a large number of nodes and is relatively complicated, so that the scheme has relatively low authentication efficiency. The block chain based authenticated key agreement scheme provides mutual authentication and key agreement between users while protecting user privacy by taking advantage of block chains, such as auditable logs, decentralized architecture, and Denial of Service (DoS) prevention. However, the authentication key negotiation scheme based on the block chain rarely considers the factor of member dynamic change, and cannot cope with the characteristic of rapid change of the VANET network topology. A certificateless asymmetric group key agreement scheme provides a public encryption key, each group member can calculate a corresponding decryption key, and only the group members can correctly decrypt information encrypted by a public key. The scheme can realize mutual authentication and key agreement among members. But the scheme does not consider the identity traceability and revocable of the members and cannot process the malicious behaviors of the group members.

Disclosure of Invention

Aiming at the defects in the prior art, the invention provides a method for negotiating an intra-group authentication key in a vehicle-mounted ad hoc network, which comprises the following steps: .

Establishing a dynamic vehicle group according to the Chinese remainder theorem;

information sender V in vehicle group_iSigning information using private key information, information receiver V_jInformation sender V through public key information in signature information_iThe identity of (2) is authenticated; information sender V_iAnd an information receiver V_jAfter the identities are authenticated mutually, the two communication parties carry out key agreement according to the semigroup of Chebyshev chaotic mapping;

respectively updating the corresponding pseudonyms and private keys of the vehicles by adopting a pseudonym updating mechanism and a private key updating mechanism;

the identity of the malicious vehicle is traced through the signature message, and the legal identity of the malicious vehicle is revoked by modifying the public key information corresponding to the malicious vehicle.

Preferably, the establishing of the dynamic vehicle group according to the Chinese remainder theorem includes: initializing a trusted center TA; registering a vehicle-mounted unit OBU and a roadside unit RSU on the TA; and the TA constructs a dynamic vehicle group by adopting the Chinese remainder theorem according to the registered OBU and the registered RSU.

Further, the process of constructing the dynamic vehicle group comprises: the credible center constructs a congruence equation set according to the public key of the vehicle node i and the public key of the roadside unit, wherein the congruence equation set is expressed as follows:

where c denotes the system public key, y_i(i ═ 1,2, …, k) denotes the public key of vehicle node i, y_k+1Public key representing roadside unit, p_i(i-1, 2, …, k) represents the prime number issued by the trust center to vehicle i, p_k+1Representing the prime number sent by the trusted center to the roadside unit.

Preferably, the process of performing key agreement by both communication parties according to the semigroup of the chebyshev chaotic mapping includes:

S1:V_iselecting a timestamp T_viCalculating B from the selected time stamp_viAnd AIDV; will request message B_vi,T_vi,AIDV_i,SIDV_jSending to roadside units RSU_i(ii) a Wherein, SIDV_jRepresents V_jPseudonym of (B)_viRepresenting a first pseudonym-verification-assistance parameter, AIDV_iRepresenting a second pseudonym-verification-assistance parameter;

S2：RSU_iverifying the received request message, and if the verification fails, rejecting the request message; if the verification is successful, the RSU_iWill { p_j,T_RiIs sent to V_i(ii) a Wherein p is_jRepresents V_jPrime number of, T_RiRepresenting the RSU_iTo V_iA timestamp of (d);

S3：V_iauthentication from RSU_iIf the verification is passed, sending a key negotiation request message to V_j(ii) a If the authentication fails, the authentication process is executed,refusing to receive the RSU_iThe message of (2); wherein, the key negotiation request message includes: v_iFirst signature of

V_iSecond signature of

Time slice t_vi，V_iTo V_jTime stamp T of_ijKey agreement information xi₁；

S4：V_jVerifying the time stamp in the key negotiation request message, and if the verification is successful, sending the time stamp to the RSU_iSending prime number request message, if verification fails, refusing to receive key negotiation request message;

S5：RSU_iverifying the received key negotiation request message, and if the verification fails, rejecting the request message; if the verification is successful, the RSU_iWill { p_i,T_RjIs sent to V_j(ii) a Wherein p is_iRepresents V_iPrime number of, T_RjIndicating a current timestamp of the system;

S6：V_jauthentication from RSU_iAfter passing the verification, V_jTo V_iAfter the authentication is successful, the key negotiation message is sent to the V_i(ii) a Otherwise refusing to send the key negotiation message;

S7：V_iinspection V_jIf the verification fails, the establishment of the session key fails, and if the verification succeeds, the establishment of the session key succeeds.

Further, RSU_iAuthenticating the received request message comprises: judging whether the freshness condition is satisfied, if not, rejecting the request message, if so, rejecting the request message according to V_iPrime number p of_iTime stamp T_viAnd AIDV_i' calculation B_vi'; judgment B_vi' and B_viAnd whether the two are equal or not is judged, if so, the verification is successful, and if not, the verification fails.

Go toOf step (V)_jTo V_iThe authenticating the identity information comprises: according to V_iPrime number p of_iComputing public key y of vehicle node i_iAccording to the public key y of the vehicle node i_iCalculation equation

If it is not true, V_jRefuse V_iThe key agreement request is received, the identity authentication fails, and if the key agreement request is received, the identity authentication is successful.

Preferably, the pseudonym update mechanism is as follows: the trust center TA assigns a pseudonym update seed delta ID to each registered vehicle_j(ii) a When the vehicle node V_iAccess V_jCurrent pseudonym

After the corresponding prime number, the road side unit RSU sends a pseudonym updating request to the TA; TA calculation of V_jCorresponding next pseudonym

And publishing; record the corresponding prime number p_jAnd l, corresponding pseudonym prime numbers to lists

Sent to the RSU.

Preferably, the private key update mechanism is as follows: v_iAt the t th_viA private key of a time slice of

Then at t_viV in +1 time slices_iThe private key of

When t is_viAfter the private key corresponding to +1 time slice is generated, the OBU_iImmediately will t_viDeleting the private key of each time slice; if t_viVehicle node V ═ L_iT th of output_viThe key of +1 time slice is an empty string; when V is_iTime ofWhen the fragment is used up, V_iReselecting private key x'_i,0And recalculates the corresponding public key y_iTA from the recalculated public key y_iThe system public key c is updated.

Preferably, the process of revoking the legal identity of the malicious vehicle by modifying the public key information corresponding to the malicious vehicle comprises: v_iIn the RSU_iWhen a malicious message is issued in a coverage area, the RSU_iObtaining V_iP used in sending malicious messages_i(ii) a In the list of pseudonyms and prime numbers λ_SIDV,pFinding a trusted center TA of V_iThe generated current pseudonym is obtained as V_iCurrent pseudonym SIDV_i(ii) a Sending pseudonyms SIDV_iAnd p_iTo TA, TA is given by equation H₀(IDV_i||δ_sk)＝SIDV_i、p_iCorresponding l and pseudonym update seed delta ID_iJudging the real identity of the vehicle corresponding to the pseudonym; TA will pair V according to the real identity of the vehicle to which the pseudonym corresponds_iThe revocation is performed with a legitimate identity within the group.

Further, the modifying the public key information corresponding to the malicious vehicle includes: will V_iCorresponding public key information y_iModified to another random number y'_iAnd the other vehicle node information is kept unchanged, and the system public key c is updated.

The invention has the beneficial effects that: the invention considers the problems of rapid movement of vehicles and rapid change of vehicle topology in the VANET system, establishes a dynamic vehicle group by utilizing the Chinese remainder theorem and adapts to the rapid change of the VANET network topology; aiming at the problem that communication on a network which is disclosed again by vehicles in VANET is easy to be attacked by eavesdropping, tampering, counterfeiting and the like, the key agreement is carried out by utilizing the semigroup of Chebyshev chaotic mapping, and the communication message is encrypted by using the agreed key to complete the safe communication on the public network; a pseudonym updater and a private key updating scheme are adopted to update the pseudonym and the private key corresponding to the vehicle, so that the identity privacy safety of the vehicle is effectively protected; for the problem of the malicious vehicles in the vehicle group, the identity of the malicious vehicles is traced by using signature messages of the malicious vehicles, and the legal identity of the malicious vehicles is revoked by modifying public key information corresponding to the malicious vehicles; the BAN logic model is used for formalized proving of the semantic security of the authentication key agreement scheme, so that the secure communication can be ensured under the condition of malicious attack, and the method has good economic benefit.

Drawings

Fig. 1 is a schematic diagram illustrating an intra-group authentication key agreement method in a vehicle ad hoc network according to the present invention;

FIG. 2 is a model diagram of a vehicle-mounted ad hoc network system according to the present invention;

FIG. 3 is a flow chart of vehicle registration in the present invention;

FIG. 4 is a flow chart of roadside unit registration in the present invention;

FIG. 5 is a block diagram of an authenticated key agreement algorithm based on Chebyshev chaos operation and the Chinese remainder theorem in the present invention;

FIG. 6 is a flowchart of an identity tracing and revocation algorithm for a malicious vehicle according to the present invention;

fig. 7 is a block diagram of the BAN logic algorithm in the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

The invention provides a method for negotiating an intra-group authentication key in a vehicle-mounted ad hoc network, which comprises the following steps of: establishing a dynamic vehicle group according to the Chinese remainder theorem; information sender V in vehicle group_iSigning information using private key information, information receiver V_jInformation sender V through public key information in signature information_iThe identity of (2) is authenticated; information sender V_iAnd an information receiver V_jAfter the identities are authenticated mutually, the two communication parties carry out key agreement according to the semigroup of Chebyshev chaotic mapping; using a pseudonym update mechanismThe private key updating mechanism updates the corresponding pseudonyms and private keys of the vehicles respectively; the identity of the malicious vehicle is traced through the signature message, and the legal identity of the malicious vehicle is revoked by modifying the public key information corresponding to the malicious vehicle.

As shown in fig. 2, the vehicle ad hoc network system includes: the system comprises a roadside unit RSU, a mobile automobile TV and a trusted authority TA, wherein wired communication is adopted between the TA and the RSU, and wireless communication is adopted between the TV and the RSU.

The TA (trusted center) will establish a dynamic group of vehicle sessions with registered vehicles and RSUs (road side units) using the chinese remainder theorem. The specific process is as follows:

and (3) TA initialization phase:

TA is responsible for system initialization, defining two one-way hash functions

l_iThe bit width output for the hash function. For Chebyshev chaotic mapping, TA selects a public parameter x, a large prime number n and a system private key delta_sk。

RSU and OBU (on board unit) registration phase:

1)OBU_iis registered with

As shown in FIG. 3, assume that there is a group of vehicles, where there are now k members of the vehicle { V }₁,V₂,…,V_k}. Vehicle node V_iIn identity registration, V_iOn OBU_iWill vehicle V_iTrue identity IDV of_iSent to the TA over the secure channel. After TA receives the message, calculate V_iIs the pseudonym SIDV of_i＝H₀(IDV_i||δ_sk) And published in the whole system. TA selects a large prime number p_i(i-1, 2, …, k) satisfying the condition that when i-j, p_i≠p_jAnd is in (0-p)_iTwo large prime numbers in-1). TA selection System common parameter g, g is the primitive root of the exponential operation, and is also all multiplications

The generator of (1). TA will { SIDV_i,p_iIs sent to V through a safety channel_i。

V_iReceiving SIDV from TA_i,p_iAfter the code is multiplied, the initial code of the user is randomly selected

Calculating V_iOf (2) a public key

V_iWill { y_iIt is sent to the TA over the secure channel. The TA divides the effective time of the public key of the vehicles in the vehicle group into L time segments, and the public key y of the vehicle node in the L time segments_iRemain unchanged. When L time slices are exhausted, V_iWill reselect private key x'_i,0And recalculates the public key y_iThe TA will also update the system public key c.

2)RSU_iIs registered with

As shown in fig. 4, RSU_iRegistration procedure and OBU_iSimilar to the registration process of the prior art, the true identity IDR is obtained_iSent to TA via secure channel, TA calculates RSU_iIs a pseudonym SIDR_i＝H₀(IDR_i||δ_sk) And is allocated to RSU_iA large prime number p_k+1。RSU_iSelecting a private key

And calculates the corresponding public key y_k+1And returns to TA.

TA building groups

TA based on receiving y from k vehicle nodes_i(i ═ 1,2, …, k) and (ii) from RSU_iY of (A) to (B)_k+1Constructing a congruence equation set:

wherein c is a system public key, and the congruence equation set can be calculated by utilizing the Chinese remainder theorem to be

Wherein P ═ P₁p₂…p_k+1，

To represent

To p_iTaking the inverse of the modulus; TA calculation SP_i＝H₁(SIDV_i||p_i) And will { SIDV_i,p_iIs sent to the registered RSU_i。RSU_iAccording to received { SIDV_i,p_i} generation of a V_iList lambda with corresponding pseudonyms and prime numbers_SIDV,p。

The two communication parties utilize the signature information to quickly authenticate the identity of the message sender and carry out key agreement through the semigroup of Chebyshev chaotic mapping. The algorithm flow is shown in fig. 5, and the specific process of the algorithm is as follows:

S1:V_iselecting a timestamp T_viCalculating B from the selected time stamp_viAnd AIDV; will request message B_vi,T_vi,AIDV_i,SIDV_jSending to roadside units RSU_i(ii) a Wherein, SIDV_jRepresents V_jPseudonym of (B)_viAnd AIDV_iThe calculation formulas of (A) and (B) are respectively as follows:

B_vi＝H₁(SIDV_i||p_i||T_vi)

wherein, B_viRepresenting a first pseudonym-verification-assistance parameter, AIDV_iDenotes a second pseudonym verification auxiliary parameter, H₁() Representing a hash function, | | | represents a connector;

S2：RSU_iverifying the received request message, wherein the verification process comprises the following steps: RSU_iAfter receiving the message, first pass (T)_iR-T_vi) < Δ T check T_viWhere Δ T represents the effective time difference between the two timestamps specified by the system, T_iRRepresents V_iA timestamp issued to the RSU; if the verification fails, rejecting the request message; if the verification is successful, calculating

By judging equation B'_vi＝H₁(SIDV’_i||p_i||T_vi)＝B_viWhether the identity of the message requester is valid or not is judged, and only members in the group can pass the verification. If the equality is not true, rejecting the request message; if the equation is true, the RSU_iWill { p_j,T_RiIs sent to V_i。

S3：V_iAuthentication from RSU_iAnd sends a key agreement request message to V_j(ii) a The verification process comprises the following steps: v_iReceive { p_j,T_RiAfter that, first by (T)_vRi-T_Ri) < Δ T check timestamp T_RiFreshness of (T)_vRiIs the system current timestamp; by the equation SP_j＝H₁(SIDV_j||p_j) Whether it is true or not to determine whether it is true from the RSU_iCorrectness of the message. If not, rejecting the message, if true, V_iSelecting a current timestamp T_ijSelecting random number alpha and calculating xi₁≡T_α(x)modn；V_iSigning the key agreement request, randomly selecting

Represents less than V_iPrime number p of_iDetermining the time segment t_viCalculating V_iFirst signature of

And V_iSecond signature of

V_iKey agreement request message

Is sent to V_j。

S4：V_jFor time stamp T in key agreement request message_ijCarrying out verification; the verification process comprises the following steps: v_jAfter receiving the message, pass (T)_rj-T_ij) < Δ T test T_ijFreshness of (T)_rjIs the system current timestamp. If the verification fails, refusing to receive the key negotiation request message, if the verification succeeds, generating a time stamp T_vj；V_jSending prime number request message B_vj,T_vj,AIDV_j,SIDV_iTo RSU_i；B_vjAnd AIDV_jThe calculation formulas of (A) and (B) are respectively as follows:

B_vj＝H₁(SIDV_j||p_j||T_vj)

S5：RSU_iverifying the received key negotiation request message; the verification process comprises the following steps: RSU_iAfter receiving the message, first pass (T)_jR-T_vj) < Δ T check timestamp T_vjFreshness of (T)_jRIs the system current timestamp. If the verification fails, rejecting the request message; if the verification is successful, calculating

By calculating equation B'_vj＝H₁(SIDV’_j||p_j||T_vj)＝B_vjAnd whether the identity of the sender of the message is valid or not is judged. If the equality is not true, rejecting the request message; if the equation is true, the RSU_iWill { p_i,T_RjIs sent to V_j。

S6：V_jAuthentication from RSU_iAfter passing the verification, V_jTo V_iAfter the authentication is successful, the key negotiation message is sent to the V_i(ii) a Otherwise refusing to send the key negotiation message; the verification process comprises the following steps: v_jBy (T)_vRj-T_Rj) < Δ T decision timestamp T_RjFreshness of (T)_RjIs the system current timestamp. By calculating the equation SP_i＝H₁(SIDV_i||p_i) Judging whether the signal is from RSU_iCorrectness of prime numbers. After the verification is passed, the pair V_iThe identity information of the user is authenticated, and the authentication process comprises the following steps: calculating y_i≡c(modp_i) Judgment equation

(modp_i) Whether or not this is true. If the equality is not true, reject from V_iThe authentication fails; if the equation holds, authentication succeeds, V_jRandomly selecting beta and timestamp T_jiCalculating xi₂≡T_β(x)modn，sk≡T_β(ξ₁)modn，M_ij＝H₁(sk||ξ₁||ξ₂)，

V_jSigning the key agreement message, randomly selecting

Represents less than V_jPrime number p of_jDetermining the time segment t_vjCalculating

And

V_jsending a key agreement message

For V_i。

S7：V_iInspection V_jIf the verification fails, the establishment of the session key fails, and if the verification succeeds, the establishment of the session key succeeds; the inspection process comprises the following steps: v_iFirst pass through (T)_ri-T_ji)<Δ T vs. timestamp T_jiCarrying out an inspection of T_riIs the system current timestamp. After the time stamp passes the verification, V is authenticated again_jIs determined by the identity of

Whether or not this is true. If the result is false, the authentication fails, and if the result is true, the sk' ≡ T is calculated_α(ξ₂) modn and M'_ij＝H₁(sk’||ξ₁||ξ₂) Judgment equation

Whether the result is true or not; if not, the session key negotiation fails; if true, V_i,V_jThe session key negotiation between the two is successful, and the session key is the sk ≡ T_α(T_β(x))modn＝T_β(T_α(x))modn。

By adopting a pseudonym updating mechanism and a private key updating mechanism, the identity privacy safety of the vehicle can be effectively protected, and if the same pseudonym and the same private key are used all the time, an attacker can threaten the privacy safety of the vehicle by collecting signature information corresponding to the pseudonym; the process of respectively updating the corresponding pseudonym and the private key of the vehicle by adopting the pseudonym updating mechanism and the private key updating mechanism is as follows:

private key update mechanism: v_iAt the t th_viA private key of a time slice of

Then at t_viV in +1 time slices_iThe private key of

When t is_viAfter the private key corresponding to +1 time slice is generated, the OBU_iWill immediately send t_viThe private key of each time slice is deleted. If t_viVehicle node V ═ L_iT th of output_viThe key for the +1 time segment is an empty string. When V is_iWhen the time segment of (V) is exhausted_iReselecting private key x'_i,0And recalculates the corresponding public key y_iThe TA will also update the system public key c.

Pseudonym update mechanism: TA assigns a pseudonym update seed delta ID to each registered vehicle_iOr delta ID_jWhen the vehicle node V_iAccess V_jCurrent pseudonym

After the corresponding prime number, the RSU sends a pseudonym update request to the TA, and the TA calculates V_jCorresponding next pseudonym

And publishes and records the corresponding prime number p_jAnd l. Then the pseudonym prime numbers are correspondingly listed

Sent to the RSU.

When the system finds that the malicious vehicle carries out malicious behaviors in the vehicle group, the TA carries out identity tracing on the identity of the malicious vehicle according to the signature message in the message issued by the malicious vehicle, and the malicious vehicle does not have the legal identity in the vehicle group by modifying the large prime number distributed to the malicious vehicle. The algorithm flow is shown in fig. 6, and the specific process is as follows:

when passing the registered vehicle node V_iWhen a malicious message is issued in a vehicle group, the TA traces and revokes the legal identity of the TA. V_iIn the RSU_iWhen a malicious message is issued in a coverage area, the RSU_iFirst obtain V_iP used in sending malicious messages_iThen tabulated λ in pseudonym and prime numbers_SIDV,pIs found inTA is V_iThe current pseudonym generated. To obtain V_iCurrent pseudonym SIDV_iAfter that, the pseudonym SIDV is transmitted_iAnd p_iTo TA. TA by equation H₀(IDV_i||δ_sk)＝SIDV_i、p_iCorresponding l and pseudonym update seed delta ID_iAnd judging the real identity of the vehicle corresponding to the pseudonym. Obtaining V_iAfter the true identity of TA, TA will be paired with V_iThe revocation is performed with a legitimate identity within the group. In addition, when registered legal vehicle node V_jWhen leaving the vehicle node group established by the TA, the TA can also withdraw V_jThe identity of (c). TA revocation group Member V_iLegal identity within a group, only V needs to be assigned_iCorresponding public key information y_iModified to another random number y'_iThe other vehicle node information remains unchanged and then the system public key c is updated. At this time V_iIt is revoked and its key will not be able to generate valid key agreement information.

The invention uses BAN logic model to prove the semantic security of the scheme, the flow chart of the model is shown in figure 7, and the concrete model is described as follows:

1) BAN logical notation

In the process of secure attestation of the protocol herein, the following BAN logical notation is used:

p | ≡ X: p believes that message X is authentic.

②

P finds a message containing X.

P | -X: p has sent a message containing X for a certain period of time.

④

P owns the jurisdiction of message X.

Fifth # (X): message X is fresh.

Sixthly, (X, Y): x and Y are part of a message (X, Y).

⑦〈X〉_Y: message X is encrypted using key Y.

⑧

K is a key shared by P and Q.

2) BAN logic rules

The protocol security is formalized proof herein using 4 BAN logic rules R1-R4:

information-meaning (Message-meaning) rule:

R1：

r1 represents that if P believes the key K shared between entities P and Q and finds that K encrypts the message X, P will believe that Q sent X once.

Nonce-verification (Nonce-verification) rule:

R2：

r2 indicates that if P believes that X is fresh, and P believes that Q has ever sent X, then P believes that Q is believing X.

(iii) jurisdictional (jurisdictional) rules:

R3：

r3 indicates that if P believes Q has jurisdiction over X, and P believes Q is believing X, then P will believe X.

Freshness (Freshness) rule:

R4：

r4 indicates that if P believes that a portion (X) of the message (X, Y) is fresh, then P believes that (X, Y) is also fresh.

3) Establishing two schema proof targets

To indicate that the vehicle node mutual authentication key scheme within the cluster is secure, two security goals, Goal1 and Goal2, need to be implemented.

Goal1：V_j|≡ξ₁。V_jIt is believed that V_iThe sent key agreement information.

Goal2：V_i|≡ξ₂。V_iIt is believed that V_jThe sent key agreement information.

4) Idealized protocol form

The general form of the 3.3 authenticated key agreement protocol flow is converted into an idealized form:

①

②

③

④

⑤

⑥

5) hypothesis of the premises

Prior to the security attestation of the protocol, the following assumptions need to be made for the BAN logic:

P1：

P2：

P3：

P4：

P5：

P6：

P7：

P8：

P9：

P10：

P11：

P12：

6) proof of scheme security

By analyzing the safety of the idealized scheme form, two safety certification targets, Goal1 and Goal2, were obtained.

①

According to P1:

and Message-serving rule R1:

RSU can be obtained_i|≡V_i|～{B_vi,AIDV_i}. When the time stamp T_viAfter passing the test, there is RSU_i|≡#(T_vi). And according to the Freshness rule R4:

and Nonce-verification rule R3:

to obtain the RSU_i|≡V_i|≡{B_vi,AIDV_i}. And finally, according to the Jurisdiction rule R2:

and P7:

RSU can be obtained_i|≡{B_vi,AIDV_i}。B_viAnd AIDV_iAfter passing the test, RSU_iWill SIDV_jCorresponding prime number p_jIs sent to V_i。

②

The same applies to P2:

and R1, V can be obtained_i|≡RSU_i|～p_j. When the time stamp T_RiAfter passing the test, there is V_i|≡#(T_Ri). From R4 and R3, V can be derived_i|≡RSU_i|≡p_j. Finally according to R2 and P8:

can obtain V_i|≡p_j. When V is_iTo obtain V_jAfter the corresponding prime number, sending a signature authentication key agreement message to V_j。

③

According to P5:

and R1, RSU can be obtained_i|≡V_j|～{B_vj,AIDV_j}. When the time stamp T_vjAfter customs clearance inspection, RSU is available_i|≡#(T_vj). RSU can be obtained from R4 and R3_i|≡V_j|≡{B_vj,AIDV_j}. Finally according to R2 and P10:

RSU can be obtained_i|≡{B_vj,AIDV_j}。B_vjAnd AIDV_jAfter passing the test, RSU_iWill SIDV_iCorresponding prime number p_iIs sent to V_j。

④

According to P6:

and R1, V can be obtained_j|≡RSU_i|～p_i. When the time stamp T_RjAfter passing the test, there is V_j|≡#(T_Rj). From R4 and R3, V can be derived_j|≡RSU_i|≡p_i. Finally according to R2 and P11:

can obtain V_i|≡p_j. When V is_jTo obtain V_iAfter the corresponding prime number, it is paired with the prime number from V_iThe signature information is verified, and after the verification is passed, a signature key negotiation message is sent to the V_i。

⑤

According to P4:

and R1, can give

When the time stamp T_ijAfter passing the test, there is V_j|≡#(T_ij). From R4 and R3, one can obtain

Then according to R2 and P9:

to obtain

When coming from V_iSigned message of

And

after passing the check, the protocol completes V_jTo V_iAuthentication of (V)_jIt is believed that V_iKey agreement message xi of₁I.e. V_j|≡ξ₁. This completes the target Goal 1. V_jSelecting random number beta, calculating xi₂＝T_β(x) modn and session key sk ≡ T_β(ξ₁)modn≡T_β·α(x) mod n. Finally, sending a signature authentication key negotiation message to V_i。

⑥

According to P3:

and R1, can give

When the time stamp T_jiVerified as fresh, i.e. V_i|#(T_ji). From R4 and R3, one can obtain

Then according to R2 and P12:

to obtain

When coming from V_jSignature information of

And

by inspection, δ also passes verification, V_iIs believed to come from V_jOf session key message xi₂I.e. V_i|≡ξ₂. The target Goal2 is completed here. Last V_iComputing the session key sk ≡ T_α(ξ₂)modn≡T_α·β(x)modn。

As can be seen from the certification process of Goal1 and Goal2, the scheme provided by the invention can effectively realize the security certification of mutual authentication key agreement of members in a group. All messages involved in the scheme are simulated by utilizing a BAN logic model, two targets of completing scheme safety certification are established, and verification of message sources, verification of message freshness and verification of message source reliability are completed on the premise of reasonable assumption. And finally, proving two preset targets according to the model rule, and finishing formalized proving of the scheme.

The invention considers the problems of rapid movement of vehicles and rapid change of vehicle topology in the VANET system, establishes a dynamic vehicle group by utilizing the Chinese remainder theorem and adapts to the rapid change of the VANET network topology; aiming at the problem that communication on a network which is disclosed again by vehicles in VANET is easy to be attacked by eavesdropping, tampering, counterfeiting and the like, the key agreement is carried out by utilizing the semigroup of Chebyshev chaotic mapping, and the communication message is encrypted by using the agreed key to complete the safe communication on the public network; a pseudonym updater and a private key updating scheme are adopted to update the pseudonym and the private key corresponding to the vehicle, so that the identity privacy safety of the vehicle is effectively protected; for the problem of the malicious vehicles in the vehicle group, the identity of the malicious vehicles is traced by using signature messages of the malicious vehicles, and the legal identity of the malicious vehicles is revoked by modifying public key information corresponding to the malicious vehicles; the BAN logic model is used for formalized proving of the semantic security of the authentication key agreement scheme, so that the secure communication can be ensured under the condition of malicious attack, and the method has good economic benefit.

The above-mentioned embodiments, which further illustrate the objects, technical solutions and advantages of the present invention, should be understood that the above-mentioned embodiments are only preferred embodiments of the present invention, and should not be construed as limiting the present invention, and any modifications, equivalents, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims (10)

1. A method for negotiating a group authentication key in a vehicle-mounted ad hoc network is characterized by comprising the following steps:

establishing a dynamic vehicle group according to the Chinese remainder theorem;

information sender V in vehicle group_iSigning information using private key information, information receiver V_jInformation sender V through public key information in signature information_iThe identity of (2) is authenticated; information sender V_iAnd an information receiver V_jAfter the identities are authenticated mutually, the two communication parties carry out key agreement according to the semigroup of Chebyshev chaotic mapping;

respectively updating the corresponding pseudonyms and private keys of the vehicles by adopting a pseudonym updating mechanism and a private key updating mechanism;

the identity of the malicious vehicle is traced through the signature message, and the legal identity of the malicious vehicle is revoked by modifying the public key information corresponding to the malicious vehicle.

2. The method of claim 1, wherein establishing a dynamic vehicle group according to the Chinese remainder theorem comprises: initializing a trusted center TA; registering a vehicle-mounted unit OBU and a roadside unit RSU on the TA; and the TA constructs a dynamic vehicle group by adopting the Chinese remainder theorem according to the registered OBU and the registered RSU.

3. The method of claim 2, wherein the process of constructing the dynamic vehicle group comprises: the credible center constructs a congruence equation set according to the public key of the vehicle node i and the public key of the roadside unit, wherein the congruence equation set is expressed as follows:

where c denotes the system public key, y_i(i ═ 1,2, …, k) denotes the public key of vehicle node i, y_k+1Public key representing roadside unit, p_i(i-1, 2, …, k) represents the prime number issued by the trust center to vehicle i, p_k+1Representing the prime number sent by the trusted center to the roadside unit.

4. The method for intra-group authenticated key agreement in the vehicle-mounted ad hoc network according to claim 1, wherein the process of key agreement between two communication parties according to the half-group of chebyshev chaotic mapping comprises:

S1:V_iselecting a timestamp T_viCalculating B from the selected time stamp_viAnd AIDV; will request message B_vi,T_vi,AIDV_i,SIDV_jSending to roadside units RSU_i(ii) a Wherein, SIDV_jRepresents V_jPseudonym of (B)_viIndicates first falseFirst name verification auxiliary parameter, AIDV_iRepresenting a second pseudonym-verification-assistance parameter;

S2：RSU_iverifying the received request message, and if the verification fails, rejecting the request message; if the verification is successful, the RSU_iWill { p_j,T_RiIs sent to V_i(ii) a Wherein p is_jRepresents V_jPrime number of, T_RiRepresenting the RSU_iTo V_iA timestamp of (d);

S3：V_iauthentication from RSU_iIf the verification is passed, sending a key negotiation request message to V_j(ii) a If the verification fails, the RSU is refused to be received_iThe message of (2); wherein, the key negotiation request message includes: v_iFirst signature of

V_iSecond signature of

Time slice t_vi，V_iTo V_jTime stamp T of_ijKey agreement information xi₁；

S4：V_jVerifying the time stamp in the key negotiation request message, and if the verification is successful, sending the time stamp to the RSU_iSending prime number request message, if verification fails, refusing to receive key negotiation request message;

S5：RSU_iverifying the received key negotiation request message, and if the verification fails, rejecting the request message; if the verification is successful, the RSU_iWill { p_i,T_RjIs sent to V_j(ii) a Wherein p is_iRepresents V_iPrime number of, T_RjIndicating a current timestamp of the system;

S6：V_jauthentication from RSU_iAfter passing the verification, V_jTo V_iAfter the authentication is successful, the key negotiation message is sent to the V_i(ii) a Otherwise refusing to send the key negotiation message;

S7：V_iinspection V_jIf the verification fails, the establishment of the session key fails, and if the verification succeeds, the establishment of the session key succeeds.

5. The method of claim 4, wherein the RSU performs the negotiation of the authentication key in the group in the Ad hoc network_iAuthenticating the received request message comprises: judging whether the freshness condition is satisfied, if not, rejecting the request message, if so, rejecting the request message according to V_iPrime number p of_iTime stamp T_viAnd AIDV_i' calculation B_vi'; judgment B_vi' and B_viAnd whether the two are equal or not is judged, if so, the verification is successful, and if not, the verification fails.

6. The method of claim 4, wherein V is a group authentication key agreement method in a vehicle ad hoc network_jTo V_iThe authenticating the identity information comprises: according to V_iPrime number p of_iComputing public key y of vehicle node i_iAccording to the public key y of the vehicle node i_iCalculation equation

If it is not true, V_jRefuse V_iThe key agreement request is received, the identity authentication fails, and if the key agreement request is received, the identity authentication is successful.

7. The method of claim 1, wherein the pseudonym update mechanism is: the trust center TA assigns a pseudonym update seed delta ID to each registered vehicle_j(ii) a When the vehicle node V_iAccess V_jCurrent pseudonym

After the corresponding prime number, the road side unit RSU sends a pseudonym updating request to the TA; TA calculation of V_jCorresponding next pseudonym

And publishing; record the corresponding prime number p_jAnd l, corresponding pseudonym prime numbers to lists

Sent to the RSU.

8. The method for negotiating the authentication key in the group in the vehicle ad hoc network according to claim 1, wherein the private key updating mechanism is: v_iAt the t th_viA private key of a time slice of

Then at t_viV in +1 time slices_iThe private key of

When t is_viAfter the private key corresponding to +1 time slice is generated, the OBU_iImmediately will t_viDeleting the private key of each time slice; if t_viVehicle node V ═ L_iT th of output_viThe key of +1 time slice is an empty string; when V is_iWhen the time segment of (V) is exhausted_iReselecting private key x_i'_,0And recalculates the corresponding public key y_iTA from the recalculated public key y_iThe system public key c is updated.

9. The method for negotiating the authentication key in the cluster in the vehicular ad hoc network as claimed in claim 1, wherein the process of revoking the legal identity by modifying the public key information corresponding to the malicious vehicle comprises: v_iIn the RSU_iWhen a malicious message is issued in a coverage area, the RSU_iObtaining V_iP used in sending malicious messages_i(ii) a In the list of pseudonyms and prime numbers λ_SIDV,pFinding a trusted center TA of V_iThe generated current pseudonym is obtained as V_iCurrent pseudonym SIDV_i(ii) a Hair-like deviceSIDV sending kana_iAnd p_iTo TA, TA is given by equation H₀(IDV_i||δ_sk)＝SIDV_i、p_iCorresponding l and pseudonym update seed delta ID_iJudging the real identity of the vehicle corresponding to the pseudonym; TA will pair V according to the real identity of the vehicle to which the pseudonym corresponds_iThe revocation is performed with a legitimate identity within the group.

10. The method of claim 9, wherein the negotiating the authentication key in the group in the vehicle ad hoc network by modifying the public key information corresponding to the malicious vehicle comprises: will V_iCorresponding public key information y_iModified to another random number y_i' the other vehicle node information remains unchanged and the system public key c is updated.

Images