Internet of Vehicles Identity Management System and Management Method Based on Blockchain and Identification Password

Abstract

A vehicle network identity management system and management method based on blockchain and identification password, including: blockchain layer, management layer and perception layer, wherein: the blockchain layer interacts with the vehicle, the trusted authorization agency, the roadside unit, and the key generation center respectively to complete the identity management, data management, and behavior monitoring of the vehicle. The present invention uses the alliance chain to build a decentralized identity management platform between various car companies, unify the vehicle identity authentication process and the identity format stored on the chain, and facilitate cross-domain authentication; and through a lightweight two-way identity authentication mechanism based on identification password technology, simplifies the certificate-based authentication method in the traditional public key cryptography scheme; and uses MPT to build blockchain nodes, and designs the storage form of vehicle information in MPT in the form of key-value pairs to achieve rapid positioning and search of vehicle information, thereby improving the speed of on-chain queries.

Description

Technical Field

[0001] The present invention relates to a technology in the field of blockchain applications, specifically a vehicle networking identity management system based on blockchain and identification passwords. Background Art

[0002] Existing Internet of Vehicles systems generally use centralized certificate authorities (CA) to manage vehicle identities. On the one hand, centralized systems are vulnerable to DDos attacks, resulting in single point failures or vehicle identity leaks; on the other hand, since vehicles belong to different car companies and comply with different identity management standards, vehicles in different management domains cannot form a unified identity management standard and cannot achieve identity authentication for vehicles across management domains. Therefore, the present invention proposes to provide a decentralized management system for each car company based on blockchain. Each car company dynamically joins the alliance chain system as an organizational node and manages the vehicles in the domain. After being authenticated by the alliance chain node, the vehicles in each domain are stored on the blockchain in a unified format standard. The vehicle identity is visible to all parties on the blockchain, which facilitates cross-domain identity query and authentication. In addition, the blockchain system has the characteristics of tamper-proof and persistent storage, which can ensure the credibility of the vehicle identity stored on the chain.

[0003] The traditional identity management method based on public key cryptography requires issuing a certificate for the vehicle and completing the vehicle identity authentication based on the certificate. During the authentication process, it is necessary to frequently exchange and verify certificates, and it is necessary to access the CA server to query the validity status of the certificate, which greatly increases the complexity of the identity management process. In the Internet of Vehicles scenario, due to the rapid mobility of vehicles and frequent information interaction, the certificate-based identity management method is more complex for vehicles. The authentication method based on the identity identification password does not require a certificate, and the vehicle's identity is submitted to the Key Generation Center (KGC) to obtain a key pair. During the identity authentication process, no certificate exchange is required, which simplifies the authentication process and improves the authentication efficiency. It is suitable for application in the Internet of Vehicles scenario where the terminal equipment is relatively unified. Therefore, the present invention proposes to use the identification password technology to create a unique identity for the vehicle and apply for a public-private key pair, and designs a lightweight two-way authentication rule between the vehicle and the blockchain node to complete the identity mutual recognition of the vehicle and the blockchain node. The authentication process does not require certificate interaction, which simplifies the authentication process. After the blockchain node completes the identity authentication of the vehicle, it uses a unified format standard to store the vehicle identity information on the chain, which is convenient for cross-domain query and authentication of other blockchain members. Summary of the invention

[0004] In view of the shortcomings of the existing Internet of Vehicles identity management solutions based on centralized CA, such as being unable to form a unified vehicle identity management standard among multiple automobile companies, being difficult to achieve identity mutual recognition across management domains, and having a complex and inefficient authentication process, the present invention proposes an Internet of Vehicles identity management system based on blockchain and identification cryptography. A decentralized identity management platform is constructed among automobile companies using a consortium chain, which unifies the vehicle identity authentication process and the identity format stored on the chain, making it easier to achieve cross-domain authentication. A lightweight two-way identity authentication mechanism based on identification cryptography technology is used to simplify the certificate-based authentication method in the traditional public key cryptography scheme.

[0005] The present invention is achieved through the following technical solutions:

[0006] The present invention relates to a vehicle network identity management system based on blockchain and identification password, comprising: a blockchain layer, a management layer and a perception layer, wherein: the blockchain layer interacts with the vehicle, a trusted authorization authority (TA), a roadside unit (RSU), and a key generation center (KGC) respectively to complete the identity management, data management, and behavior monitoring of the vehicle.

[0007] The management layer includes: TA, RSU and KGC, among which: TA provides notarization services for vehicles and infrastructure within the domain, and as the provider of the real identity of the vehicle, provides endorsement evidence for the original identity of the vehicle; RSU, as the infrastructure within the domain, will frequently interact with the vehicle, and often acts as an agent of TA to perform relevant identity authentication and management on the vehicle; KGC, as a key generation center, generates a key pair for the vehicle according to the identity identification submitted by the vehicle, and discloses relevant system parameters to facilitate other institutions to authenticate the identity of the vehicle.

[0008] As a decentralized system, the blockchain disclosed on it is visible to all parties, which facilitates cross-domain query and authentication of vehicle identity, and has the characteristics of persistent storage and tamper-proof, thus ensuring the authenticity and reliability of vehicle identity. The blockchain layer includes: member identity provider (MSP), accounting node, and sorting node, among which: MSP provides identity management for members within the alliance chain organization, that is, the identity authorization party of the vehicle in the blockchain system. Only after the MSP completes the identity authentication of the vehicle, the vehicle can have a legal membership and initiate a smart contract call operation. The accounting node is used to execute the smart contract initiated by the client and endorse the execution result. The sorting node sorts the executed transactions and packages them into blocks, which are then sent to other nodes for consensus verification.

[0009] The perception layer is composed of vehicles within each management domain. The vehicle terminal generates a unique identity based on its own attributes, submits the identity to KGC to obtain a key pair, and then initiates an identity authentication request to the blockchain MSP. After completing the two-way authentication, the vehicle terminal can be added to the alliance chain system as a legitimate access client. The vehicle, as the object of identity authentication and management, is the core of the system's work.

[0010] The present invention relates to a vehicle networking identity management method based on the above system, which constructs a vehicle identity identifier and issues a key pair to the vehicle, thereby performing vehicle identity authentication, that is, identity mutual recognition between the MSP and the vehicle within the alliance chain organization. After the authentication is completed, it indicates that the vehicle has a legal identity within the organization; then, the vehicle information is registered on the chain by designing a blockchain smart contract and calling it, thereby realizing vehicle networking identity management.

[0011] The vehicle identification is as follows: a hardware unique key (HUK) is solidified inside the chip of the on-board unit (OBU) to form the vehicle identification together with the manufacturer, brand and serial number of the vehicle. Specifically, HUK / Manufacturer / Brands / VehicleID are used to form a URL. Combined with the principle of IBC certification, the URL is used as the vehicle identification. For example, vehicle A is recorded as ID A .

[0012] The key pair is generated according to the vehicle's identity, and the private key is returned to the vehicle through a secure channel. The specific implementation process is as follows:

[0013] ① On the elliptic curve E p Generate an additive cyclic group G with order n, P is an arbitrary generator of G, randomly selected As the system master private key, combined with P, kp=ks·P is calculated as the system master public key, then the system master key pair is (ks, kp).

[0014] ② Save the system master private key ks and disclose the system parameters (G, P, kp, h1, h2), where h1 and h2 are two one-way hash functions: h1 is to select two points on the elliptic curve, first perform point addition operation, then perform point multiplication operation, add the two coordinate values ​​of the operation results and then perform modulo p operation, h2 is obtained by performing modulo p operation.

[0015] h1 is suitable for devices with stronger computing power; h2 is suitable for devices with weaker computing power.

[0016] ③The vehicle sends its own IDA Then generate a timestamp T i ,calculate As the private key of vehicle A, calculate PK A =SK A P is used as the vehicle public key and is made public. {SK A , T i} to vehicle A, which receives the message and determines that When the vehicle private key is generated successfully, the vehicle private key SK A For encrypted storage, the vehicle's key pair is: {SK A , PK A},in For XOR operation, T i Is the current timestamp.

[0017] The identity authentication includes: two-way authentication between the vehicle and the blockchain MSP (member service provider), specifically including:

[0018] Step 1: As the initiator of the authentication process, the vehicle sends an identity authentication request message to the blockchain MSP to start two-way authentication. Vehicle A sends an authentication request message Req, and D A send to D MSP :Req;

[0019] Step 2: After receiving the authentication request from the vehicle, the MSP sends its identity ID A Add to the authentication list and propose an authentication challenge C1, specifically: select a random challenge number Generate timestamp T ji ; MSP sends challenge message C1, D MSP send to D A :{Challenge random number m j , timestamp T ji , Session ID, Identity ID MSP}, where: T ji Represents the timestamp generated by MSP and sent to vehicle A.

[0020] Step 3: After receiving the challenge message C1, vehicle A first verifies the timestamp T ji If it is invalid, it returns the authentication failure information and ends the authentication. Otherwise, it responds to the challenge and replies to the handshake information. Specifically, it uses the signature private key SK of vehicle A. i Complete the pair j Signature: Generate a random number for the response When |t i -T ji|<Δt is established when the hash value R is calculated Where Δt is the effective time value, vehicle A replies with a response message R1, D A send toD MSP :{ack1, R, T ij , ID, ID A}; In addition, vehicle A also presents an authentication challenge C2 to MSP, specifically: randomly select Generate timestamp T ij ; Vehicle A sends a challenge message C2, D A send to D MSP :{m i , T ij , ID, ID A}.

[0021] Step 4: After receiving the response message R1, MSP first checks the timestamp T ij Is it valid? If it is invalid, the authentication failure message is returned and the authentication is terminated. Otherwise, the challenge random number is used to verify the response ciphertext. If the verification fails, it means that the vehicle does not have a legal identity; if the verification succeeds, it proves that vehicle A is legal, and the MSP successfully authenticates the vehicle. Specifically, when |t j -T ij Calculate when |<Δt When m' is satisfied at the same time j =m j If R'=R, the authentication is successful; otherwise, the authentication fails, and an authentication result RE1 is generated and sent to vehicle A.

[0022] Step 5: Respond to the challenge message C2 sent by vehicle A with a handshake message R2, specifically: Use the signature private key SK of MSP j Complete the challenge of random number m i The signature of the response random number Calculating the hash value MSP replies with a response message R2, D MSP send to D A :{ack2, R, T ji , ID, ID MSP}; At this time, MSP sends the authentication result RE1 and response information R2 of vehicle A to the vehicle.

[0023] Step 6: Vehicle A receives the response message R2 and confirms the timestamp T jiThe validity of the challenge random number is used to verify the response ciphertext when it is valid. When the verification fails, the vehicle fails to authenticate the MSP identity and the vehicle is disconnected. When the verification succeeds, it proves that the MSP identity is correct and returns the authentication result RE2 to it. Specifically, when |t is satisfied i -T ji |<Δt, after D MSP After signing with the private key, ack2 is generated and returned to D A , D A Using D MSP The public key of ack2 is used to verify the signature, that is, to calculate If the verification is successful, it means D MSP Possessing the correct private key; the calculation of R' can ensure that D MSP The information sent has not been tampered with, ensuring the reliability of the transmitted information. That is, when m' i =m i When R'=R, the authentication is successful, and the authentication result RE2 is generated and fed back to the MSP.

[0024] Step 7: After receiving the authentication result RE2, MSP indicates that the two-way authentication is successful and creates a corresponding identity for the vehicle, indicating that the vehicle has a legal identity in the alliance chain organization and is ready to initiate a smart contract call.

[0025] After the vehicle identity authentication is passed, the relevant information of the vehicle needs to be stored on the blockchain to complete the on-chain registration of the vehicle identity. As an access client within the alliance chain organization, the vehicle writes the basic information of the vehicle into the blockchain system by initiating a smart contract call. The vehicle information stored on the chain is shown in Table 1. As the provider and manager of the vehicle identity, the blockchain needs to revoke the legal identity of the vehicle and publicize it on the blockchain when malicious behavior is found in the vehicle.

[0026] Data Entry describe Version Number Blockchain version information Vehicle ID Vehicle identification Issuer Basic Information of MSP Area Code Vehicle registration area information Certification time Vehicle identity registration time on blockchain Validity Validity period of vehicle ID Whether it has been revoked whether content Basic vehicle information

[0027] Table 1 Identity information of vehicle registered on the blockchain

[0028] The blockchain stores the relevant information of the vehicle in the form of a Merkle Patricia Tree (MPT) structure. The hash value of the root node, the version information of the blockchain and the generation time of the block are stored in the block header, and the vehicle's identity public key, issuer information, vehicle identity status and basic information of the identity validity period are stored in the block body.

[0029] All child nodes in the MPT structure have the same prefix, that is, the node data is stored in a key-value data structure. The key value of each node is composed of the key values ​​of all nodes on the path from the root node to the node, where the key value is composed of the area number, vehicle identity, and timestamp; the value includes: issuer information, authentication time, identity validity period, identity status and basic vehicle information.

[0030] The area number indicates the administrative code of the area to which the vehicle registration TA belongs. The format of the area number is similar to the national administrative division code, consisting of 6 digits, and each two digits represent the codes of the province, city, district / county, respectively. The area number is used as the beginning of the key value, and the branch path composed of provinces, cities and counties can be quickly matched when querying, which is convenient for querying the vehicle identity by region. The vehicle's identity is unique and cannot be forged or tampered with. The vehicle's identity is used to ensure the uniqueness of the key value. The timestamp represents the validity period of the vehicle's identity. When the timestamp expires, it will automatically trigger the execution of the smart contract and mark the vehicle's identity status as invalid. At the same time, the timestamp can also be used to determine the block time, and the block can be quickly located when querying. The design of the key value can realize the rapid location and search of vehicle information under the premise of ensuring uniqueness. The value value is mainly composed of the attribute information of the vehicle. When the specific block node corresponding to the key value is located, the detailed information of the vehicle can be obtained by querying the value value.

[0031] The vehicle network identity management includes: vehicle identity registration, vehicle query and vehicle revocation, where:

[0032] 1) Vehicle identity registration means: after the vehicle identity is created, a two-way authentication will be performed between the vehicle and the blockchain MSP. After the vehicle identity authentication is successful, the execution of the smart contract will be triggered to realize the vehicle identity chain registration. The main task of the smart contract is to create an MPT child node and build a key-value data pair based on the vehicle information, and add this node to the newly generated block.

[0033] 2) Vehicle query means: when a third party needs to query the identity information of a vehicle, it will trigger the execution of the smart contract. The main operation is to query the MPT tree structure and find specific vehicle information based on the key value.

[0034] 3) Vehicle revocation means: when the vehicle identity expires or it is judged that the vehicle has malicious behavior, the execution of the smart contract will be triggered. The main operation is to query the MPT tree structure according to the key value, change the vehicle identity status to invalid, and complete the revocation of the vehicle identity.

[0035] Further construct the blockchain consensus algorithm to meet the requirements of fast consensus in the Internet of Vehicles scenario, that is, adopt the alliance blockchain, use each car company as the organization node of the alliance chain to form an alliance chain network, and adopt the Practical Byzantine Fault Tolerance (PBFT) algorithm to implement the consensus mechanism. Specifically, it includes: assuming that there are 3n+1 accounting nodes, that is, the organization nodes formed by the car companies, the organization nodes will authenticate the vehicles in this management domain, and after the authentication is successful, the identity information of the vehicle will be broadcasted to the organization nodes of the entire network in the form of a transaction; other nodes will authenticate the transaction and return the authentication result to the organization node, and it is necessary to wait for n+1 different nodes to return the same result as the final result of the entire operation, thereby completing the consensus on a certain transaction.

[0036] Technical Effects

[0037] The present invention adopts a unified on-chain storage format to manage vehicle identities, which facilitates identity query and authentication across management domains. Compared with the traditional centralized CA management method, the decentralized identity management method can resist single-point attacks on the one hand, and unify the authentication standards of each management domain on the other hand. Secondly, for the creation of vehicle identity identification, the present invention proposes to extract a unique string based on the attribute information of the vehicle as the vehicle identity identification, which meets the requirements of uniqueness and easy distinguishability, and designs a lightweight two-way authentication rule between the vehicle and the blockchain MSP based on the IBC authentication principle. The authentication process omits the certificate interaction, simplifies the authentication process, and meets the requirements of fast authentication in the Internet of Vehicles scenario. Compared with the traditional PKI authentication scheme, the vehicle identity authentication method designed by the present invention has a simple interaction process, does not require access to the CA server, and the interactive information is more lightweight. Finally, a method for storing vehicle information on the blockchain is designed, a storage node is constructed with MPT, and vehicle information is stored in the form of key-value pairs, which is convenient for rapid positioning and query of vehicle information on the blockchain. Compared with traditional database storage, using MPT's tree structure to store vehicle information can improve query efficiency. Designing key values ​​according to actual query needs can achieve fast block positioning during query.

[0038] Based on the alliance blockchain, a decentralized identity management platform is built for each car company, using unified identity management standards to achieve mutual recognition of vehicle identities in cross-management domain scenarios.

[0039] Create an identity for the vehicle based on identification cryptography technology, and obtain the vehicle's key pair through KGC. Design lightweight two-way authentication rules to complete the mutual recognition of identity between the vehicle and the blockchain, and realize the on-chain registration of the vehicle identity; in addition, design the storage format of the vehicle identity on the blockchain, and use a unified standard to manage the vehicle identity on the chain, so that users across management domains can quickly query the vehicle identity.

[0040] 1. Based on the alliance blockchain, a decentralized identity management platform is built for each car company, and a unified identity management standard is adopted to facilitate the mutual recognition of vehicle identities in cross-domain management scenarios. Compared with the centralized identity management method, it is easier to unify the management standards, and the vehicle information is open on the blockchain, which is convenient for trusted parties to quickly query and authenticate; and the decentralized system has the characteristics of being tamper-proof and can resist various attacks well.

[0041] 2. Create an identity for the vehicle based on identification cryptography technology, and obtain the vehicle's key pair through KGC. Design lightweight two-way authentication rules to complete the mutual recognition of identity between the vehicle and the blockchain, and realize the on-chain registration of the vehicle identity; in addition, design the storage format of the vehicle identity on the blockchain, and use a unified standard to manage the vehicle identity on the chain, so that users across management domains can quickly query the vehicle identity. Different from the existing identity management method based on PKI certificates, the authentication process based on identity identification omits the exchange and query of certificates, simplifies the authentication process, has higher authentication and communication efficiency, and is more suitable for application in the Internet of Vehicles scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a schematic diagram of the Internet of Vehicles management system based on blockchain;

[0043] Figure 2 It is a schematic diagram of the embodiment flow chart;

[0044] Figure 3 It is a schematic diagram of an abstract model of vehicle identification;

[0045] Figure 4 This is a schematic diagram of KGC key distribution;

[0046] Figure 5 This is a schematic diagram of vehicle identity authentication and blockchain registration;

[0047] Figure 6 This is a schematic diagram of the time overhead performance test of two-way authentication. DETAILED DESCRIPTION

[0048] like Figure 2 As shown, this embodiment relates to an embodiment of vehicle network identity management based on blockchain and identification password, including:

[0049] Step 1: Build Figure 1 The basic management architecture of Internet of Vehicles based on blockchain is shown;

[0050] The architecture of the Internet of Vehicles identity management system based on blockchain includes: blockchain layer, management layer and perception layer. As the manager of the system, blockchain interacts with the identity management service provider to complete the identity management, data management and behavior monitoring of the vehicle. The management layer provides notarization services for vehicles and other infrastructure in the domain, and manages the original identity and keys of the vehicle. As the access client of the blockchain system, the perception layer is the object of identity authentication and management, and is also the provider of the original data of the system.

[0051] Step 2: Figure 3 As shown, a unique vehicle identity is created based on the vehicle attributes: the vehicle's hardware identification code, vehicle manufacturer, vehicle brand, and vehicle number are combined to form a URL, which is unique and has significant directional information.

[0052] like Figure 3 As shown, HUK / Manufacturer / Brands / VehicleID are used together to form the URL. Combined with the principle of IBC certification, this URL is the identity of the vehicle. For example, vehicle A is recorded as ID A .

[0053] Step 3: Figure 4 As shown, KGC generates a key pair for the vehicle according to the vehicle's identity: first, KGC is initialized. After the initialization is completed, KGC uses a key generation algorithm to generate a key pair for the vehicle according to the identity submitted by the vehicle.

[0054] Step 4: Figure 5 As shown, the vehicle initiates an identity registration request to the blockchain, and two-way identity authentication is performed between the blockchain MSP and the vehicle. That is, the vehicle initiates an authentication request, the MSP raises an authentication challenge in the form of a generated random number, the vehicle responds to the challenge data and challenges the MSP, and the identities of both parties are determined in the form of challenge and response. After the authentication is successful, the vehicle information is written into the blockchain by initiating a smart contract call.

[0055] Step 5: Use MPT as the blockchain data storage node and use the key-value data structure to store vehicle information, so as to facilitate the rapid positioning and query of vehicle information, including:

[0056] 5.1 The hash value of the root node, the version information of the blockchain, and the generation time of the block are stored in the block header. The vehicle's identity public key, issuer information, vehicle identity status, and basic information of the identity validity period are stored in the block body.

[0057] 5.2 A key-value pair data structure is used to store node data. The key value of each node is the concatenation of the key values ​​of all nodes on the path from the root node to the node. The key is a string consisting of the following information: area number - vehicle identity - timestamp; the value is a string consisting of the following information: issuer information - authentication time - identity validity period - identity status - basic vehicle information.

[0058] 5.3The design of the key value can realize the rapid location and search of vehicle information under the premise of ensuring uniqueness. The value value is mainly composed of the attribute information of the vehicle. When the specific block corresponding to the key value is located, the detailed information of the vehicle can be obtained by querying the value value.

[0059] Step 6: Design blockchain smart contracts to implement vehicle registration, query, and revocation operations, including:

[0060] 6.1 Vehicle registration: After completing the two-way authentication between the MSP and the vehicle, the execution of the smart contract will be triggered to realize the on-chain registration of the vehicle identity. The main task of the smart contract is to create an MPT child node and build a key-value data pair based on the vehicle information, and add this node to the newly generated block.

[0061] 6.2 Vehicle Query: When a third party needs to query the identity information of a vehicle, it will trigger the execution of the smart contract. The main operation is to query the MPT tree structure and find specific vehicle information based on the key value.

[0062] 6.3 Vehicle Revocation: When the vehicle identity expires or it is determined that the vehicle has malicious behavior, the execution of the smart contract will be automatically triggered. The main operation is to query the MPT tree structure according to the key value, change the vehicle identity status to invalid, and complete the revocation of the vehicle identity.

[0063] Step 7: Design a blockchain consensus algorithm and use the PBFT consensus mechanism to meet the requirements of fast consensus in the Internet of Vehicles scenario, including:

[0064] 7.1 There are 3n+1 accounting nodes, which are the organization nodes formed by various car companies. First, the organization node will authenticate the vehicle within the management domain. After the authentication is successful, the identity information of the vehicle will be broadcasted to the organization nodes of the entire network in the form of a transaction.

[0065] 7.2 After receiving the broadcast message, other organization nodes will authenticate the transaction and return the authentication result to the organization node. The organization node needs to wait for n+1 different nodes to return the same result as the final result of the entire operation, thereby completing the consensus on a certain message.

[0066] After specific practical experiments, a consortium chain system with 4 nodes was built in the local area network using the vehicle terminal device TBOX as the vehicle client. The node uses an eight-core Intel i7-1065G7 CPU with a 1.8GHz computing frequency and 16GB of running memory, 2Gbps network connection, and the go language is used to write smart contract code in the Ubuntu16.04 LTS system to implement vehicle identity registration, query, and revocation operations. The time overhead of two-way authentication between the vehicle and the blockchain is tested below. In order to compare the performance of this solution, a comparative test is conducted with the traditional PKI authentication method.

[0067] like Figure 6 As shown in the figure, it is the test result, the horizontal axis is the length of the vehicle private key, and the vertical axis is the time cost of completing the two-way authentication. It can be seen that as the length of the private key increases, the authentication time cost increases almost linearly. This is because the length of the private key is closely related to the complexity of cryptographic operations. If a longer key is used, the challenge and response time will increase during the authentication process. In addition, by comparing the performance of the PKI authentication scheme with that of this scheme, it can be seen that the authentication method designed by this scheme has a lower time cost than the traditional PKI authentication. Therefore, the authentication scheme designed in this embodiment has a more obvious improvement in performance.

[0068] Security analysis: Security is the basic requirement of the authentication system. It is crucial to ensure that the system has high security while having good performance. The following analysis is made on the security of this system from the aspects of key security, anti-man-in-the-middle attack, and anti-replay attack.

[0069] Key security analysis: The security of the vehicle's private key is the basic guarantee for the credibility of two-way authentication. In this embodiment, although the vehicle's public key is transmitted in plain text, the corresponding private key has never been disclosed in the interactive message. In the process of generating the vehicle's private key, KGC generates a public-private key pair for the vehicle based on the identity provided by the vehicle, and sends the private key to the vehicle through an encrypted channel. The key issuance process is often completed offline, and KGC can ensure the absolute security of the key issuance process. Therefore, the use and issuance process of the private key ensure that the private key will not be leaked. In addition, it is difficult to deduce the corresponding private key from the vehicle's public key because it faces mathematical problems on the discrete logarithm of the elliptic curve. Therefore, this solution can ensure the security of the vehicle's private key.

[0070] Anti-man-in-the-middle attack: During the two-way identity authentication between the vehicle and the blockchain MSP, a man-in-the-middle attack may occur. Assuming that the attacker intercepts D A With D MSP The communication message {ack1, R, T ij , ID, ID A}, tamper with the message and send it to DMSP In D MSP After receiving the message, ack1 will be verified. Since ack1 contains D A Therefore, if ack1 has been tampered with, the result of the ack1 signature verification will be different from the challenge random number m sent previously. j If they are inconsistent, it can be determined that ack1 has been tampered with, and the message will be rejected. If the timestamp and other attached messages are tampered with, since R is the hash value obtained after hash operation, it has one-way irreversibility, and the tampered message R is not equal to the recalculated R', and confirmation cannot be completed. Therefore, this solution can effectively resist man-in-the-middle attacks.

[0071] Anti-replay attack: An attacker may use the monitored historical messages to impersonate a legitimate vehicle for identity authentication, thus forming a replay attack. In our scheme, each interactive message is timestamped T i , so that the message has temporal uniqueness, and the message receiver will first verify the timestamp in the message after receiving the message. Only messages within the valid time range will be considered valid, otherwise the message will be directly discarded. Therefore, this solution can effectively resist replay attacks.

[0072] Compared with the traditional PKI authentication scheme, this embodiment has a significant reduction in authentication time overhead. As shown in the above experimental results, the performance of the test under different key lengths is better. From the perspective of system management, this scheme introduces blockchain technology and applies it to the Internet of Vehicles scenario. Compared with the traditional centralized CA management method, blockchain has the characteristics of decentralization and tamper-proof. It can build a joint management alliance between various car companies and adopt a unified vehicle identity management standard to facilitate vehicle identity query and authentication across management domains. The decentralized system can effectively resist single-point attacks and enhance the robustness of the system. In addition, this embodiment creates an identity for the vehicle based on the identification password, and designs a lightweight two-way authentication rule based on the identity. The authentication process omits certificate interaction, improves authentication efficiency, and is more in line with the characteristics of fast movement of the Internet of Vehicles. In terms of blockchain function design, this embodiment uses MPT to construct blockchain nodes, and stores vehicle information in MPT in the form of key-value pairs, and designs key values ​​according to the actual needs of Internet of Vehicles queries. It can quickly locate and search for vehicle information while ensuring uniqueness, and improve the speed of on-chain queries.

[0073] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principle and purpose of the present invention. The protection scope of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. Each implementation scheme within its scope shall be subject to the constraints of the present invention.

Claims

1. A vehicle networking identity management system based on blockchain and identification password, characterized in that: include: Blockchain layer, management layer and perception layer, where the blockchain layer interacts with vehicles, trusted authorization agencies, roadside units, and key generation centers to complete vehicle identity management, data management, and behavior monitoring; The management layer includes: TA, RSU and KGC, among which: TA provides notarization services for vehicles and infrastructure in the domain, and as the provider of the real identity of the vehicle, provides endorsement evidence for the original identity of the vehicle; RSU, as the infrastructure in the domain, will frequently interact with the vehicle, and often acts as an agent of TA to perform relevant identity authentication and management on the vehicle; KGC, as the key generation center, generates a key pair for the vehicle according to the identity submitted by the vehicle, and discloses relevant system parameters to facilitate other institutions to authenticate the identity of the vehicle; The blockchain layer includes: member identity provider (MSP), accounting node, and sorting node, among which: MSP provides identity management for members within the alliance chain organization, that is, the identity authorization party of the vehicle in the blockchain system; the accounting node executes the smart contract initiated by the client and endorses the execution result; the sorting node sorts the executed transactions and packages them into blocks, and then sends them to other nodes for consensus verification; The perception layer is composed of vehicles in each management domain. The vehicle terminal generates a unique identity based on its own attributes, submits the identity to KGC to obtain a key pair, and then initiates an identity authentication request to the blockchain MSP. After completing the two-way authentication, the vehicle terminal can be added to the alliance chain system as a legal access client, and the vehicle is the object of identity authentication and management; The key pair specifically includes: ① On the elliptic curve E p Generate an additive cyclic group G with order n, P is an arbitrary generator of G, randomly selected As the system master private key, combined with P, kp = ks·P is calculated as the system master public key, then the system master key pair is (ks, kp); ② Save the system master private key ks and disclose the system parameters (G, P, kp, h1, h2), where h1 and h2 are two one-way hash functions: h1 is to select two points on the elliptic curve, first perform point addition operation, then perform point multiplication operation, add the two coordinate values ​​of the operation results and perform modulo p operation, h2 is obtained by performing modulo p operation; ③The vehicle sends its own ID A Then generate a timestamp T i ,calculate As the private key of vehicle A, calculate PK A =SK A P is used as the vehicle public key and is published and sent via an encrypted channel {SK A , T i } to vehicle A, which receives the message and determines that When the vehicle private key is generated successfully, the vehicle private key SK A For encrypted storage, the vehicle's key pair is: {SK A , PK A },in For XOR operation, T i is the current timestamp; The identity authentication includes: two-way authentication between the vehicle and the blockchain MSP, specifically including: Step 1: As the initiator of the authentication process, the vehicle sends an identity authentication request message to the blockchain MSP to start two-way authentication. Vehicle A sends an authentication request message Req, and D A send to D MSP :Req; Step 2: After receiving the authentication request from the vehicle, the MSP sends its identity ID A Add to the authentication list and propose an authentication challenge C1, specifically: select a random challenge number Generate timestamp T ji ; MSP sends challenge message C1, D MSP send to D A : {Challenge random number m j , timestamp T ji , Session ID, Identity ID MSP }, where: T ji Represents the timestamp generated by MSP and sent to vehicle A; Step 3: After receiving the challenge message C1, vehicle A first verifies the timestamp T ji If it is invalid, it returns the authentication failure information and ends the authentication. Otherwise, it responds to the challenge and replies to the handshake information. Specifically, it uses the signature private key SK of vehicle A. i Complete the pair j Signature: Generate a random number for the response When |t i -T ji Calculate the hash value when |<Δt holds Where Δt is the effective time value, vehicle A replies with a response message R1, D A send toD MSP : {ack1, R, T ij , ID, ID A }; In addition, vehicle A also presents an authentication challenge C2 to MSP, specifically: randomly select Generate timestamp T ij ; Vehicle A sends a challenge message C2, D A send to D MSP :{m i , T ij , ID, ID A }; Step 4: After receiving the response message R1, MSP first checks the timestamp T ij Is it valid? If it is invalid, the authentication failure message is returned and the authentication is terminated. Otherwise, the challenge random number is used to verify the response ciphertext. If the verification fails, it means that the vehicle does not have a legal identity; if the verification succeeds, it proves that vehicle A is legal, and the MSP successfully authenticates the vehicle. Specifically, when |t j -T ij | Calculate when <Δt When m′ is satisfied at the same time j =m j If R′=R, the authentication is successful, otherwise the authentication fails, and the authentication result RE1 is generated and sent to vehicle A; Step 5: Respond to the challenge message C2 sent by vehicle A with a handshake message R2, specifically: Use the signature private key SK of MSP j Complete the challenge of random number m i The signature of the response random number Calculating the hash value MSP replies with a response message R2, D MSP send to D A : {ack2, R, T ji , ID, ID MSP }; At this time, MSP sends the authentication result RE1 and the response information R2 of vehicle A to the vehicle in turn; Step 6: Vehicle A receives the response message R2 and confirms the timestamp T ji The validity of the challenge random number is used to verify the response ciphertext when it is valid. When the verification fails, the vehicle fails to authenticate the MSP identity and the vehicle is disconnected. When the verification succeeds, it proves that the MSP identity is correct and returns the authentication result RE2 to it. Specifically, when |t is satisfied i -T ji |<Δt, after D MSP After signing with the private key, ack2 is generated and returned to D A , D A Using D MSP The public key of ack2 is used to verify the signature, that is, to calculate If the verification is successful, it means D MSP Possess the correct private key; the calculation of R′ can ensure D MSP The information sent has not been tampered with, ensuring the reliability of the transmitted information. That is, when m′ is satisfied i =m i When R′=R, the authentication is successful, and the authentication result RE2 is generated and fed back to the MSP; Step 7: After receiving the authentication result RE2, MSP indicates that the two-way authentication is successful and creates a corresponding identity for the vehicle, indicating that the vehicle has a legal identity in the alliance chain organization and is ready to initiate a smart contract call.

2. The vehicle networking identity management system according to claim 1 is characterized in that: The consensus verification described above uses the blockchain consensus algorithm to form a consortium chain network with each car company as the organization node of the consortium chain, and adopts a practical Byzantine fault-tolerant algorithm to achieve it, specifically including: assuming that there are 3n+1 accounting nodes in total, namely the organization nodes formed by the car companies, the organization nodes will perform identity authentication on the vehicles within the management domain, and after successful authentication, the identity information of the vehicle will be broadcasted to the organization nodes of the entire network in the form of a transaction; all nodes will perform authentication on the transaction and return the authentication result to the organization node, and it is necessary to wait for n+1 different nodes to return the same result as the final result of the entire operation, thereby completing the consensus on a certain transaction.

3. A method for managing vehicle network identity based on the system of claim 1 or 2, characterized in that: By building a vehicle identity and issuing a key pair to the vehicle, the vehicle identity is authenticated, that is, the identity is mutually recognized between the MSP and the vehicle within the alliance chain organization. After the authentication is completed, it means that the vehicle has a legal identity within the organization; Then, the vehicle information is registered on the blockchain by designing and calling the blockchain smart contract to realize the identity management of the Internet of Vehicles. The vehicle identification includes: the unique hardware key solidified inside the chip of the vehicle unit, the vehicle manufacturer, the vehicle brand and the vehicle number together constitute the vehicle identification, specifically: HUK / Manufacturer / Brands / VehicleID together constitute the URL, and combined with the principle of IBC certification, this URL is used as the vehicle's identity; The key pair is generated based on the vehicle's identity, and the private key is then returned to the vehicle via a secure channel.

4. The vehicle networking identity management method according to claim 3 is characterized in that: The blockchain stores vehicle-related information in the form of an MPT structure; The block header stores the hash value of the root node, the version information of the blockchain, and the generation time of the block. The block body stores the vehicle's identity public key, issuer information, vehicle identity status, and basic information about the identity validity period. All child nodes in the MPT structure have the same prefix, that is, the node data is stored in a key-value data structure. The key value of each node is composed of the key values ​​of all nodes on the path from the root node to the node, where the key value is composed of the area number, vehicle identity, and timestamp; the value includes: issuer information, authentication time, identity validity period, identity status and basic vehicle information.

5. The vehicle networking identity management method according to claim 3 is characterized in that: The vehicle network identity management includes: vehicle identity registration, vehicle query and vehicle revocation, where: 1) Vehicle identity registration means: after the vehicle identity is created, it will be authenticated with the blockchain MSP. After the vehicle identity authentication is successful, the execution of the smart contract will be triggered to realize the vehicle identity on-chain registration. The main work of the smart contract is to create an MPT child node and build a key-value data pair based on the vehicle information, and add this node to the newly generated block; 2) Vehicle query means: when a third party needs to query the identity information of a vehicle, it will trigger the execution of the smart contract. The main operation is to query the MPT tree structure and find specific vehicle information based on the key value; 3) Vehicle revocation means: when the vehicle identity expires or it is judged that the vehicle has malicious behavior, the execution of the smart contract will be triggered. The main operation is to query the MPT tree structure according to the key value, change the vehicle identity status to invalid, and complete the revocation of the vehicle identity.

6. The vehicle network identity management method according to any one of claims 3 to 5, characterized in that: include: Step 1: Build a basic management architecture for the Internet of Vehicles based on blockchain, including: blockchain layer, management layer and perception layer; blockchain, as the system manager, interacts with the identity management service provider to complete the identity management, data management and behavior monitoring of the vehicle; the management layer provides notarization services for vehicles and other infrastructure in the domain, and manages the original identity and keys of the vehicle; the perception layer, as the access client of the blockchain system, is the object of identity authentication and management, and is also the provider of the original data of the system; Step 2: Create a unique vehicle identity based on vehicle attributes: The vehicle hardware identification code, vehicle manufacturer, vehicle brand, and vehicle number are combined to form a URL. This URL is unique and has significant directional information. Step 3: KGC generates a key pair for the vehicle based on the vehicle's identity: First, KGC is initialized. After the initialization is completed, KGC uses a key generation algorithm to generate a key pair for the vehicle based on the identity submitted by the vehicle; Step 4: The vehicle initiates an identity registration request to the blockchain, and a two-way identity authentication is performed between the blockchain MSP and the vehicle. That is, the vehicle initiates an authentication request, the MSP issues an authentication challenge in the form of a generated random number, the vehicle responds to the challenge data and challenges the MSP, and the identities of both parties are determined in the form of challenge and response. After the authentication is successful, the vehicle information is written into the blockchain by initiating a smart contract call; Step 5: Use MPT as the blockchain data storage node and use the key-value data structure to store vehicle information, so as to facilitate the rapid positioning and query of vehicle information, including: 5.1 The hash value of the root node, the version information of the blockchain, and the generation time of the block are stored in the block header; the vehicle identity, issuer information, vehicle identity status, and identity validity period are stored in the block body; 5.2 The node data is stored in a key-value pair data structure. The key value of each node is the concatenation of the key values ​​of all nodes on the path from the root node to the node. The key is a string consisting of the following information: area number - vehicle identity - timestamp; the value is a string consisting of the following information: issuer information - authentication time - identity validity period - identity status - basic vehicle information; 5.3The design of the key value can realize the rapid location and search of vehicle information under the premise of ensuring uniqueness; the value value is mainly composed of the attribute information of the vehicle. When the specific block corresponding to the key value is located, the detailed information of the vehicle can be obtained by querying the value value; Step 6: Design blockchain smart contracts to implement vehicle registration, query, and revocation operations, including: 6.1 Vehicle registration: After the two-way authentication between MSP and the vehicle is completed, the execution of the smart contract will be triggered to realize the on-chain registration of the vehicle identity. The main work of the smart contract is to create an MPT child node and build a key-value data pair based on the vehicle information, and add this node to the newly generated block; 6.2 Vehicle Query: When a third party needs to query the identity information of a vehicle, it will trigger the execution of the smart contract. The main operation is to query the MPT tree structure and find specific vehicle information based on the key value; 6.3 Vehicle revocation: When the vehicle identity expires or it is judged that the vehicle has malicious behavior, the execution of the smart contract will be automatically triggered. The main operation is to query the MPT tree structure according to the key value, change the vehicle identity status to invalid, and complete the revocation of the vehicle identity; Step 7: Design a blockchain consensus algorithm and use the PBFT consensus mechanism to meet the requirements of fast consensus in the Internet of Vehicles scenario, including: 7.1 There are 3n+1 accounting nodes, which are the organization nodes jointly formed by various car companies. First, the organization node will authenticate the vehicles within the management domain. After successful authentication, the identity information of the vehicle will be broadcasted to the organization nodes of the entire network in the form of transactions. 7.2 After receiving the broadcast message, other organization nodes will authenticate the transaction and return the authentication result to the organization node. The organization node needs to wait for n+1 different nodes to return the same result as the final result of the entire operation, thereby completing the consensus on a certain message.

Images