Attribute encryption-based intelligent unmanned vehicle equipment multi-party collaborative session key distribution method and system

Abstract

The invention relates to the technical field of unmanned driving data security, in particular to a smart unmanned vehicle equipment multi-party cooperation session key distribution method and system based on attribute encryption, and the method comprises the steps: extracting user attributes in a smart unmanned vehicle equipment multi-party cooperation scene and a smart unmanned vehicle equipment access control strategy; dividing user attributes into a plurality of attribute groups satisfying an access control strategy according to the intelligent unmanned vehicle equipment service type; aiming at the target user session request, obtaining a target user security key and an attribute group; establishing a mapping relationship between the smart unmanned vehicle device key and the attribute group and a mapping relationship between the smart unmanned vehicle device and the edge server; and creating a group key for the users in the region by using the edge server, generating key fragments according to the group key, and distributing the key fragments to each user according to the user attribute tree relationship, so as to realize fine-grained management control of each user on the intelligent unmanned vehicle equipment. Session keys can be safely and efficiently distributed in a multi-user request data environment, and the data safety of intelligent unmanned vehicle equipment is ensured.

Description

Technical Field

[0001] The present invention relates to the field of unmanned driving data security technology, and in particular to a method and system for distributing multi-party collaborative session keys for intelligent unmanned vehicle equipment based on attribute encryption. Background Art

[0002] With the continuous development of information technology, intelligent unmanned vehicles are widely used in public transportation, environmental monitoring, emergency rescue, security patrols, and other fields. Due to the diverse functions, clear positioning, and rich data types of unmanned intelligent devices such as sensors, data processing centers often need to combine multiple types of devices and multiple types of data for collaborative analysis to draw reliable conclusions. This process often requires the participation of multiple institutions, departments, and personnel. Different unmanned intelligent devices have their own independent data management methods, making data sharing across devices and systems difficult. For intelligent unmanned vehicle operators, they often need to operate or manage multiple intelligent unmanned vehicles, which makes it difficult to use devices across devices and systems.

[0003] On the other hand, with the continuous development of the Internet of Things (IoT) and the interconnectedness of everything, the number of intelligent unmanned vehicles requiring security protection is rapidly increasing, significantly increasing the volume of keys required to be distributed by intelligent unmanned vehicle management and control platforms. Traditional methods based on asymmetric cryptography or multi-party key distribution inevitably suffer from high computational complexity and low key distribution efficiency when distributing keys to large numbers of users. Large-scale distributed applications urgently need to support one-to-many communication models to reduce the significant overhead associated with per-user key encryption. Summary of the Invention

[0004] To this end, the present invention provides a method and system for distributing multi-party collaborative session keys for intelligent unmanned vehicle equipment based on attribute encryption, which solves the problems of low efficiency of large-scale user key distribution and difficulty in distributed multi-party collaborative scenario distribution in existing intelligent unmanned vehicle equipment management and control platforms.

[0005] According to the design scheme provided by the present invention, on the one hand, a method for distributing multi-party collaborative session keys for intelligent unmanned vehicle devices based on attribute encryption is provided, comprising:

[0006] Extract user attributes and access control policies for smart unmanned vehicle devices in multi-party collaboration scenarios, and divide user attributes into several attribute groups that meet access control policies based on the business types of smart unmanned vehicle devices;

[0007] In response to the target user's session request, obtain the target user's security key and attribute group;

[0008] Establish mapping relationships between smart unmanned vehicle device keys and attribute groups, and between smart unmanned vehicle devices and edge servers;

[0009] The edge server is used to create a group key for users in the area and generate key fragments based on the group key. The key fragments are then distributed to each user according to the tree relationship of user attributes to achieve fine-grained management and control of smart unmanned vehicle equipment by each user.

[0010] As a multi-party collaborative session key distribution method for intelligent unmanned vehicle equipment based on attribute encryption of the present invention, further, the user attributes include but are not limited to: user's organization, user position, user department, security level, business type, user age, required intelligent unmanned vehicle equipment model and business geographical location.

[0011] As a multi-party collaborative session key distribution method for smart unmanned vehicle equipment based on attribute encryption of the present invention, further, the attribute group includes but is not limited to: smart unmanned vehicle equipment control attribute group, smart unmanned vehicle equipment usage attribute group and smart unmanned vehicle equipment other authority attribute group.

[0012] As the multi-party collaborative session key distribution method for intelligent unmanned vehicle devices based on attribute encryption of the present invention, further obtaining the target user security key and attribute group includes:

[0013] Generate public-private key pairs and master keys;

[0014] Generate the target user security key based on the target user attributes and public-private key pair, and obtain the target user attribute group according to the access control policy.

[0015] As the multi-party collaborative session key distribution method for intelligent unmanned vehicle devices based on attribute encryption of the present invention, further, a mapping relationship between the intelligent unmanned vehicle device key and the attribute group is established, including:

[0016] The corresponding smart unmanned vehicle device key is determined based on the user security key to establish a mapping relationship between the smart unmanned vehicle key and the user attribute group. The corresponding smart unmanned vehicle device is a smart unmanned vehicle device that has been activated in the multi-party collaborative session.

[0017] As the multi-party collaborative session key distribution method for intelligent unmanned vehicle devices based on attribute encryption of the present invention, further, a mapping relationship between the intelligent unmanned vehicle devices and the edge server is established, including:

[0018] Obtain the edge server closest to the smart unmanned vehicle device to establish a mapping relationship between the smart unmanned vehicle device and the edge server.

[0019] As the multi-party collaborative session key distribution method for intelligent unmanned vehicle devices based on attribute encryption of the present invention, further, each user's fine-grained management and control of the intelligent unmanned vehicle devices includes:

[0020] According to the Shamir threshold scheme, when the target user who meets the access control policy meets the specified number of users, the target user obtains the key of the smart unmanned vehicle device.

[0021] On the other hand, the present invention also provides a multi-party collaborative session key distribution system for intelligent unmanned vehicle equipment based on attribute encryption, comprising: a user data setting module, a session request sending module, a mapping relationship establishment module and a session key distribution module, wherein:

[0022] The user data setting module is used to extract user attributes and access control policies for smart unmanned vehicle devices in multi-party collaboration scenarios, and divide user attributes into several attribute groups that meet the access control policies based on the business types of smart unmanned vehicle devices;

[0023] The session request sending module is used to obtain the target user's security key and attribute group in response to the target user's session request;

[0024] A mapping relationship establishment module is used to establish a mapping relationship between the smart unmanned vehicle device key and the attribute group, and between the smart unmanned vehicle device and the edge server;

[0025] The session key distribution module is used to use the edge server to create a group key for users in the area and generate key fragments based on the group key, and distribute the key fragments to each user according to the user attribute tree relationship to achieve fine-grained management and control of the smart unmanned vehicle equipment by each user.

[0026] Beneficial effects of the present invention:

[0027] This invention utilizes attribute encryption algorithms and the national secret SM4 algorithm to achieve secure and efficient distribution of session keys in the multi-user data request environment of an intelligent unmanned vehicle device management and control platform. This ensures data security for intelligent unmanned vehicle devices and enables fine-grained control over user key distribution. This approach is compared with existing key distribution methods based on asymmetric cryptographic algorithms, and experimental data demonstrates that this solution offers advantages in large-scale user key distribution efficiency, demonstrating promising application prospects in areas such as autonomous driving and smart transportation. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a schematic diagram of the multi-party collaborative session key distribution process for smart unmanned vehicle devices based on attribute encryption in an embodiment;

[0029] Figure 2 This is a schematic diagram of the key encryption and decryption process in the embodiment;

[0030] Figure 3 This is a schematic diagram of the key distribution algorithm framework in the embodiment;

[0031] Figure 4Figure 2 is a comparison of the key distribution time overhead in the embodiments. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below with reference to the accompanying drawings and technical solutions.

[0033] Unmanned intelligent devices such as sensors are rich in variety and diverse in functions. With the development of information technologies such as artificial intelligence, cloud computing, and the Internet of Things, they occupy an important position in people's lives. As a hardware carrier that carries equipment and transmits sensitive information, unmanned intelligent devices may cause serious consequences such as equipment loss of control and sensitive information leakage if attacked by a network attack. There are urgent security needs in terms of confidential transmission of equipment data, dynamic command control, real-time screen sharing, and collaborative data analysis. The frequent security accidents involving unmanned intelligent devices in recent years have made people realize the importance of unmanned intelligent data security. In view of the problems of low key distribution efficiency and difficulty in distribution in distributed multi-party collaborative scenarios in the key distribution adopted by existing smart unmanned vehicle equipment in cloud-edge collaborative scenarios, an embodiment of the present invention provides a multi-party collaborative session key distribution method for smart unmanned vehicle equipment based on attribute encryption, comprising:

[0034] Extract user attributes and access control policies for smart unmanned vehicle devices in multi-party collaboration scenarios, and divide user attributes into several attribute groups that meet access control policies based on the business types of smart unmanned vehicle devices;

[0035] In response to the target user's session request, obtain the target user's security key and attribute group;

[0036] Establish mapping relationships between smart unmanned vehicle device keys and attribute groups, and between smart unmanned vehicle devices and edge servers;

[0037] The edge server is used to create a group key for users in the area and generate key fragments based on the group key. The key fragments are then distributed to each user according to the tree relationship of user attributes to achieve fine-grained management and control of smart unmanned vehicle equipment by each user.

[0038] See also Figure 1As shown, w1, w2, and wn represent the node's own attributes, such as w1 for the department, w2 for the security level, and wn for the business type. wg represents the same key protected by the attribute policy. For example, the policy "w1 = Department 1 ∧ w2 = Level 1 ∧ w3 = Read" means that only users with Department 1, Security Level 1, and Business Type Read can decrypt and obtain the security key. Specifically, a security key for the SM4 algorithm can be generated using random numbers and key seeds. At the same time, the attribute group that meets the control and other permissions of the smart unmanned vehicle can be found by combining the various attributes defined in the access control policy. Subsequently, the generated key is used according to the corresponding smart unmanned vehicle that has been normally started in the identity authentication, and a mapping relationship between the key and its attribute group is established. At the same time, the edge server closest to each smart unmanned vehicle is located, and a mapping relationship between the smart unmanned vehicle and the edge server is established to facilitate the subsequent key distribution to the edge server. Finally, based on the association between attributes and permissions established by the multi-party collaborative key sharing strategy, the CP-ABE algorithm is used, and according to the Shamir threshold scheme, the generated key is distributed to various different attributes according to the attribute policy relationship. Each user with the corresponding attribute has part of the secret to unlock the correct key. Only users who meet the attributes and attribute groups have a sufficient number of secrets to unlock the correct key and obtain the key. Users who do not meet the attribute group will not be able to unlock the correct key due to insufficient secrets. Edge servers that have no mapping relationship with the smart unmanned vehicle will also not be able to obtain the correct key, thereby ensuring the data security of the smart unmanned vehicle and achieving fine-grained control of user management.

[0039] User attributes include, but are not limited to, the user's organization, position, department, security level, business type, age, required smart autonomous vehicle model, and business location. Attribute groups include, but are not limited to, the smart autonomous vehicle device control attribute group, the smart autonomous vehicle device usage attribute group, and the smart autonomous vehicle device other permission attribute group.

[0040] like Figure 2 As shown in the figure, after a random number is generated for key generation, the CP-ABE algorithm is used according to the multi-party collaborative key sharing strategy. Based on the Shamir threshold scheme, the generated random number is dispersed into various attributes according to a tree relationship. Each user with the corresponding attribute has part of the secret to unlock the correct key. Only users who meet the attributes and attribute groups have a sufficient number of secrets to unlock the correct key and obtain the random number used to generate the key. Users who do not meet the attribute group will not be able to unlock the correct random number and obtain the correct key due to insufficient number of secrets, thereby ensuring the data security of unmanned intelligent devices and realizing fine-grained control of data.

[0041] After the random number is encrypted, it can be securely sent to the user who has the key attribute to decrypt it. The user can decrypt it using his or her own private key and attribute. The key distribution algorithm framework between the user and the server can be as follows: Figure 3 As shown, the specific design can include the following steps:

[0042] Step 1: Initialize the CP-ABE algorithm and determine the type of group and encryption algorithm to be used.

[0043] Step 2: Generate the server's public key and master key, the random number to be encrypted, and the attribute strategy of the decryption key.

[0044] Step 3: Encrypt the random number using the server public key and decryption attribute policy.

[0045] Step 4: The user decrypts the ciphertext based on the user key obtained in advance and his own attributes.

[0046] Step 5: Hash the decrypted random number and take the first 16 bytes as the SM4 algorithm key.

[0047] The meanings of the symbols in the algorithm are shown in Table 1:

[0048] Table 1 Symbol meaning

[0049]

[0050] Specifically, the four algorithms included in the basic ABE mechanism are introduced as follows: Setup, Extract, Encrypt, and Decrypt. During system initialization, the BDH parameter generator runs according to the security parameters to produce two groups G1 and G2 of order prime number q, and a bilinear pairing e: G1×G1→G2. d is the threshold parameter.

[0051] (1) System initialization phase: Setup(d): Executed by the authorized agency, selects y, t1,…, t n ∈Z q , the system public key PK is The master key MK is (y,t1,...,t n ).

[0052] (2) User private key generation phase: KeyGen: Executed by the authorized agency, generates the private key of user u based on the user's attributes and the system public-private key pair. Randomly select a (d-1)-order polynomial p, let p(0) = y, and the user private key SK is

[0053]

[0054] (3) Encryption phase: Encrypt: The sender executes and generates a random number M1∈G2, using the attribute set A C And the system public and private key pair encrypts the random number. Randomly select s∈Z q , the ciphertext is

[0055]

[0056] Generate a random number M2 and combine it with the encrypted ciphertext to form the ciphertext

[0057]

[0058] (4) Key acquisition phase: Decrypt: The receiver executes. If |A u ∩A C |>d, then select d attributes i∈A u ∩A C , calculate e(E i ,D i )=e(g,g) p(i)s , and then use Lagrange interpolation to find Y s =e(g,g) p(0)s =e(g,g) ys , get the random number M1=E / Y sent by the encryption party s In order to obtain the key length suitable for the SM4 algorithm, the SM3 algorithm is used to calculate the hash value X=H(M1||M2) of the random numbers M1 and M2, and the first 128 bits of the hash value X are taken as the key of the SM4 algorithm.

[0059] Furthermore, based on the above method, an embodiment of the present invention also provides a multi-party collaborative session key distribution system for intelligent unmanned vehicle devices based on attribute encryption, comprising: a user data setting module, a session request sending module, a mapping relationship establishment module and a session key distribution module, wherein:

[0060] The user data setting module is used to extract user attributes and access control policies for smart unmanned vehicle devices in multi-party collaboration scenarios, and divide user attributes into several attribute groups that meet the access control policies based on the business types of smart unmanned vehicle devices;

[0061] The session request sending module is used to obtain the target user's security key and attribute group in response to the target user's session request;

[0062] A mapping relationship establishment module is used to establish a mapping relationship between the smart unmanned vehicle device key and the attribute group, and between the smart unmanned vehicle device and the edge server;

[0063] The session key distribution module is used to use the edge server to create a group key for users in the area and generate key fragments based on the group key, and distribute the key fragments to each user according to the user attribute tree relationship to achieve fine-grained management and control of the smart unmanned vehicle equipment by each user.

[0064] To verify the effectiveness of this solution, the following is a further explanation based on experimental data:

[0065] The experimental environment includes four devices: a user terminal, an edge server, a cloud server, and a smart unmanned vehicle. The user terminal uses Ubuntu 20.04, a quad-core CPU, and 4GB of RAM. The edge server uses Ubuntu 20.04, an octa-core CPU, and 8GB of RAM. The cloud server uses Ubuntu 20.04, an octa-core CPU, and 8GB of RAM. The smart unmanned vehicle relies on a Raspberry Pi 4B platform and uses Ubuntu 20.04 and 4GB of RAM.

[0066] Experimental process: The method of the present invention and the key distribution method using the SM2 algorithm were used to test the time overhead of key distribution under different user scale conditions of 2500, 5000, 7500, 10000, 12500, 15000, 17500 and 20000 users respectively.

[0067] Based on the above experimental environment and experimental process, the key distribution time overhead of this scheme is compared with that of the traditional key distribution method based on the asymmetric encryption algorithm SM2 under different user scales. Figure 4 As shown in the figure, the time overhead of key distribution using traditional asymmetric cryptographic algorithms is approximately proportional to the user base. This overhead is significant in large-scale key distribution scenarios, resulting in low key distribution efficiency and potentially causing time-sensitive devices to malfunction. However, the time overhead of key distribution in this solution is independent of user base, and the key only needs to be encrypted once for devices with the same attribute group to complete distribution, offering certain advantages in large-scale key distribution scenarios.

[0068] Furthermore, in this solution, devices in the same attribute group do not share the same key during key distribution. Therefore, if a device in the same attribute group experiences an unexpected key failure and requires key destruction, other devices in the group do not need to replace their keys. The key distribution endpoint stores the random number used by each device when calculating the key, enabling the calculation of the keys used by different devices in the attribute group. This enables secure and efficient information exchange and sharing across multiple organizations, departments, personnel, systems, and devices. This improves key distribution efficiency while addressing security issues arising from key sharing across multiple devices.

[0069] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0070] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0071] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0072] Those skilled in the art will appreciate that all or part of the steps in the above method can be performed by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps in the above embodiment can be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or software functional modules. The present invention is not limited to any specific combination of hardware and software.

[0073] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A method for distributing multi-party collaborative session keys for intelligent unmanned vehicle devices based on attribute encryption, characterized in that: Include: Extract user attributes and access control policies of smart unmanned vehicle equipment in multi-party collaboration scenarios, and divide user attributes into several attribute groups that meet the access control policies according to the business types of smart unmanned vehicle equipment; In response to the target user's session request, obtain the target user's security key and attribute group; Establish mapping relationships between smart unmanned vehicle device keys and attribute groups, and between smart unmanned vehicle devices and edge servers; The edge server is used to create a group key for users in the area and generate key fragments based on the group key. The key fragments are distributed to each user according to the tree relationship of user attributes to achieve fine-grained management and control of smart unmanned vehicle equipment by each user.

2. The method for distributing multi-party collaborative session keys for intelligent unmanned vehicle devices based on attribute encryption according to claim 1 is characterized in that: The user attributes include but are not limited to: the user's organization, user position, user department, security level, business type, user age, required smart unmanned vehicle equipment model and business geographical location.

3. The method for distributing multi-party collaborative session keys for intelligent unmanned vehicle devices based on attribute encryption according to claim 1 or 2 is characterized in that: The attribute groups include but are not limited to: smart unmanned vehicle equipment control attribute group, smart unmanned vehicle equipment usage attribute group and smart unmanned vehicle equipment other authority attribute group.

4. The method for distributing multi-party collaborative session keys for intelligent unmanned vehicle devices based on attribute encryption according to claim 1 is characterized in that: Get the target user's security key and attribute group, including: Generate public-private key pairs and master keys; Generate the target user security key based on the target user attributes and the public-private key pair, and obtain the target user attribute group according to the access control policy.

5. The method for distributing multi-party collaborative session keys for intelligent unmanned vehicle devices based on attribute encryption according to claim 1 is characterized in that: Establish a mapping relationship between the smart unmanned vehicle device key and the attribute group, including: The corresponding smart unmanned vehicle device key is determined based on the user security key to establish a mapping relationship between the smart unmanned vehicle key and the user attribute group. The corresponding smart unmanned vehicle device is a smart unmanned vehicle device that has been activated in the multi-party collaborative session.

6. The method for distributing multi-party collaborative session keys for intelligent unmanned vehicle devices based on attribute encryption according to claim 1 is characterized in that: Establish a mapping relationship between the smart unmanned vehicle device and the edge server, including: Obtain the edge server that is closest to the smart unmanned vehicle device to establish a mapping relationship between the smart unmanned vehicle device and the edge server.

7. The method for distributing multi-party collaborative session keys for intelligent unmanned vehicle devices based on attribute encryption according to claim 1 is characterized in that: Each user has fine-grained management and control over smart unmanned vehicle equipment, including: According to the Shamir threshold scheme, when the target users who meet the access control policy meet the specified number of users, the target user obtains the smart unmanned vehicle device key.

8. A multi-party collaborative session key distribution system for intelligent unmanned vehicle equipment based on attribute encryption, characterized in that: It includes: user data setting module, session request sending module, mapping relationship establishment module and session key distribution module, among which, The user data setting module is used to extract user attributes and access control policies of smart unmanned vehicle equipment in the multi-party collaboration scenario of smart unmanned vehicle equipment, and divide user attributes into several attribute groups that meet the access control policies according to the business type of smart unmanned vehicle equipment; A session request sending module, used to obtain a target user security key and attribute group in response to a target user session request; A mapping relationship establishment module is used to establish a mapping relationship between a smart unmanned vehicle device key and an attribute group, and between a smart unmanned vehicle device and an edge server; The session key distribution module is used to use the edge server to create group keys for users in the area and generate key fragments based on the group keys, and distribute the key fragments to each user according to the user attribute tree relationship to achieve fine-grained management and control of the smart unmanned vehicle equipment by each user.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images