Anti-collusion attack VANET privacy protection method based on certificateless aggregation signature

Abstract

The invention provides an anti-collusion attack VANET privacy protection method based on certificateless aggregation signature, and relates to the technical field of vehicle-mounted network security. The method specifically comprises the following steps: constructing an anti-collusion attack VANET privacy protection model based on certificateless aggregation signature, wherein the anti-collusion attack VANET privacy protection model comprises a vehicle provided with a vehicle-mounted unit, a roadside unit, an application server, a key generation center and a trusted mechanism; wherein the roadside unit is mainly used for aggregating signatures of vehicles and transmitting the signatures to the application server; the application server is mainly used for verifying the validity of the aggregation signature, detecting whether the VANET is subjected to a collusion attack, and sending the invalid aggregation signature which does not pass the verification to the trusted mechanism; the key generation center is mainly used for generating part of private keys for the vehicle; and the trusted mechanism is mainly used for providing registration service for the roadside unit and the vehicle and generating a pseudonym for the vehicle so as to reveal the true identity of the illegal signature from the application server by using the pseudonym of the vehicle.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle-mounted network security, and in particular to a VANET privacy protection method against collusion attacks based on certificateless aggregate signature. Background Art

[0002] With the advancement of communication technology, vehicular ad hoc networks (VANETs) have developed into a practical service platform between vehicles and other vehicles, vehicles and roads, and vehicles and pedestrians. However, with the intelligence and networking of VANETs, ​​the security issues of VANETs have become increasingly prominent and often lead to extremely serious consequences. For example, when a vehicle is attacked remotely and maliciously controlled, user privacy will be leaked. Attackers can also control the driving of vehicles through attacks, and even a large number of connected cars may be controlled in batches, eventually causing major social security incidents. In VANET, authentication technology is one of the main solutions to solve the security issues of vehicle networks. In view of the growing demand for intelligent transportation systems (ITS), VANET is considered to be a suitable solution for implementing ITS. The traditional VANET system consists of a trusted authority (TA), a key generation center (KGC), a roadside unit (RSU), an onboard unit (OBU) embedded in the vehicle, and an application server (AS). There are two representative communication types in VANET: Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I). However, both V2V and V2I transmit information in open channels, including vehicle location, speed, and surrounding traffic conditions, so attackers can easily access and tamper with this information for malicious purposes, such as stealing user privacy and disrupting traffic by forging traffic information. Therefore, before VANET is widely deployed, it is necessary to explore its required security properties, especially authentication and message integrity, which can be well met by message signatures.

[0003] Aiming at the security attributes such as security authentication and privacy protection in VANET, researchers have proposed many signature authentication schemes, including those based on Public Key Infrastructure (PKI), Identity-based (ID) encryption, and Certificateless Public Key Cryptography (CL-PKC). In addition, based on the existing Dedicated Short Range Communications (DSRC) protocol, vehicles must send messages periodically (300ms), which requires VANET to transmit and verify a large number of messages within a given time frame. Considering the limited network bandwidth and vehicle computing power of VANET, aggregate signature is an effective technology to meet the performance requirements. By aggregating n signatures from different vehicles into a short signature, the computational and communication overhead can be greatly reduced, which is particularly suitable for bandwidth-constrained VANET environments.

[0004] Although many privacy-preserving certificateless aggregate signature schemes have been constructed in VANET applications, most of them are based on bilinear pairing, which greatly increases computational and communication overheads. In existing certificateless aggregate signature schemes, most only consider two types of adversary attacks, including malicious KGC attacks and public key substitution attacks, while collusion attacks are usually ignored. In a collusion attack, two malicious vehicles can pass the aggregate signature authentication by forging signatures, even if the aggregated single signature is invalid, which will pose a major threat to VANET security. In addition, most of the existing invalid signature recognition algorithms are inefficient and cannot accurately identify invalid signatures because they ignore collusion attacks. Summary of the invention

[0005] In view of the above-mentioned deficiencies in the prior art, the present invention proposes a VANET privacy protection method against collusion attacks based on certificateless aggregate signature based on certificateless aggregate signature technology, aiming to avoid the certificate management overhead and key escrow problems in traditional authentication methods, and provides a new certificateless aggregate signature method.

[0006] The present invention proposes a VANET privacy protection method against collusion attacks based on certificateless aggregate signature, comprising:

[0007] Step 1: Construct a VANET privacy protection model based on certificateless aggregate signature to resist collusion attacks, including vehicles equipped with on-board units OBU, roadside units RSU, application servers AS, key generation centers KGC and trusted institutions TA;

[0008] Step 2: Use elliptic curve cryptography to generate model parameters of the VANET privacy protection model against collusion attacks based on certificateless aggregate signature;

[0009] Step 3: The RSU in the VANET privacy protection model against collusion attacks based on certificateless aggregate signature submits a registration application to the TA, and after the registration is completed, the TA sends the model parameters to the RSU;

[0010] Step 4: For the i-th vehicle v in the VANET privacy protection model against collusion attacks based on certificateless aggregate signature i , vehicle v i Submit a registration application to TA, and TA sends the model parameters to the vehicle v i And save to OBU, TA generates vehicle v i Pseudonymous PID i And send them to the vehicle v respectively i and KGC;

[0011] Step 5: When KGC receives the pseudonym PID transmitted by TA i When KGC checks PID i Is it within the valid time period? If not, KGC discards the pseudonym. If yes, it generates a vehicle v i The public and private key pair;

[0012] Step 6: When the vehicle v i Generates message m when an event is detected i , using pseudonymous PID i 、Vehicle i The public and private key pair and the current timestamp t i For message m i Sign and generate message m i The signed message package is sent to RSU;

[0013] Step 7: RSU receives vehicle v i Check the timestamp and pseudonym PID of the signed message packet i The valid time period of the RSU is determined, and the signed message packet is verified. If the verification fails, the RSU discards the signed message packet; if the verification passes, the RSU accepts the signed message packet; where PK i For vehicle v i 's public key;

[0014] Step 8: After the RSU receives the signature message packets of n vehicles, it aggregates the signature message packets of n vehicles and sends the signature message packets of n vehicles and the generated aggregate signature σ to the AS;

[0015] Step 9: After receiving the aggregate signature σ and the signature message packets of n vehicles, AS checks the timestamp and pseudonym PID of each signature message packet i The AS receives the valid time period of the aggregate signature σ and verifies the aggregate signature σ. If the verification is successful, the AS receives the aggregate signature σ. If the verification is unsuccessful, the AS sends the aggregate signature to the RSU as an invalid aggregate signature.

[0016] Step 10: AS and RSU use the binary method to collaboratively identify the invalid aggregate signature, and obtain all invalid signatures in the invalid aggregate signature. AS sends the pseudonym of the vehicle corresponding to each invalid signature to TA, and obtains the real identity of the vehicle corresponding to each invalid signature;

[0017] The vehicle equipped with the OBU in step 1 is used to communicate with vehicles equipped with the OBU, roadside units RSU and pedestrians within the coverage of the dedicated short-range communication DSRC technology;

[0018] The roadside unit RSU is used to receive traffic information of all vehicles within the communication range of the RSU, verify the integrity and validity of the traffic information of any vehicle within the communication range of the RSU, and then send the verified traffic information to the trusted agency TA; aggregate the signatures of all vehicles within the communication range of the RSU and transmit the obtained aggregated signature to the application server AS;

[0019] The application server AS is used to obtain the aggregate signature of the vehicle from the roadside unit RSU through a wired connection and verify the validity of the aggregate signature. For the aggregate signature that passes the verification, the aggregate signature and the public and private keys of the AS are used to detect whether the VANET is attacked by collusion; for the invalid aggregate signature that fails the verification, the invalid aggregate signature is sent to the trusted institution TA as an illegal signature;

[0020] The key generation center KGC is used to generate a partial private key for each vehicle equipped with an OBU;

[0021] The trusted authority TA is used to initialize the VANET privacy protection model based on certificateless aggregate signature to resist collusion attack; to provide registration services for roadside units RSU and vehicles equipped with OBU; to communicate with roadside units RSU through a secure transmission protocol; to generate a pseudonym for the vehicle, and to use the pseudonym of the vehicle to reveal the true identity of the illegal signature from the application server AS;

[0022] The step 2 further comprises:

[0023] Step 2.1: Based on the selected security parameter λ, the key generation center KGC and the trusted authority TA select an elliptic curve E, determine a cyclic group G of order q on the elliptic curve E, and determine the generator P; where q is a large prime number;

[0024] The elliptic curve E is expressed as:

[0025] E:y 2 =x 3 +ax+b(modp)

[0026] Where y and x are unknowns in the elliptic curve equation; a and b are constants that define the elliptic curve, and a,b∈F p , 4a 3 +27b 2 (modp)≠0; F p is a finite field; mod represents the modulo operation; p is a large prime number;

[0027] Step 2.2: KGC selects a random number k as the private key of KGC and calculates the public key of KGC; TA selects a random number t as the private key of TA and calculates the public key of TA; AS selects a random number s as the private key of AS and calculates the public key of AS; where represents the multiplication group modulo p;

[0028] Step 2.3: Generate model parameters {G, q, T pub ,K pub ,A pub ,H0,H1,H2,H3,H4,P,G,E}; where T pub is the public key of TA; K pub A is the public key of KGC; pub is the public key of AS; H0, H1, H2, H3 and H4 are all hash functions;

[0029] The step 4 further comprises:

[0030] Step 4.1: For the i-th vehicle v in the VANET privacy protection model against collusion attacks based on certificateless aggregate signature i , vehicle v i Submit a registration application to TA, and TA will send the model parameters to the vehicle v after receiving the registration application i ;

[0031] Step 4.2: Use TA's public key and vehicle v i Real ID RID i Calculate the pseudonymous first identifier PID i,1 , thereby generating a vehicle authentication message {N i ,PID i,1}, and by vehicle v i Sent to TA; n i For vehicle v i A random number is chosen, and Represents the exclusive OR operation;

[0032] The pseudonymous first identifier PID i,1 for:

[0033] PID i,1 =n i P

[0034] Step 4.3: TA saves the received vehicle authentication message {N i ,PID i,1}, use TA's private key t to calculate vehicle v i Real ID RID i , and the calculated real identity RID i Match the real identities of all vehicles stored in TA. If the match fails, it means that RID i Invalid and discarded; if the match is successful, calculate the pseudonym second identifier PID i,2 ;

[0035] The pseudonymous second identifier PID i,2 It is expressed as:

[0036]

[0037] Where T i Indicates PID i The effective time period;

[0038] Step 4.4: Based on the pseudonymous first identifier PID i,1 and the pseudonymous second identifier PID i,2 Generate vehicle v i Pseudonymous PID i , and the pseudonym PID i Sent to KGC and vehicle v i ;

[0039] The vehicle v i Pseudonymous PID i It is expressed as:

[0040] PID i ={PID i,1 ,PID i,2 ,T i};

[0041] The step 5 further comprises:

[0042] Step 5.1: Vehicle v i Pick a random number x i as a secret value, and Calculate vehicle v i Part of the public key X i ;

[0043] Step 5.2: KGC selects a random number r i ,and And based on the random number r i And hash function H1 calculates the hash value h 1i ;

[0044] Step 5.3: KGC calculates the hash value h 1i Calculate vehicle v i Part of the private key d i , and generate a partial secret key PPK i Send to vehicle v i ;

[0045] The partial key PPK i It is expressed as:

[0046] PPK i =(d i ,R i )

[0047] Where R i =r i P, r i is a random number selected by KGC, and

[0048] Step 5.4: Vehicle v i Receive PPK i Post-verification partial secret key PPK i Is it legal? If the expression for verifying legality is established, it means that the partial secret key PPK i Legal, vehicle v i Accept partial key PPK i ; If the expression for verifying legitimacy is not true, it means that the partial secret key PPK i Illegal, vehicle v i Discard some PPK keys i ;

[0049] The expression for verifying the legality is:

[0050] d i P=R i +h 1i K pub

[0051] Step 5.5: Vehicle v iBased on the partial key PPK i Generate vehicle v i The public key PK i and private key SK i , and form vehicle v i The public and private key pair;

[0052] The vehicle v i The public key PK i It is expressed as:

[0053] PK i =(X i ,R i )

[0054] The vehicle v i The private key SK i It is expressed as:

[0055] SK i =(x i ,d i );

[0056] The step 6 further comprises:

[0057] Step 6.1: When the vehicle v i Generates message m when an event is detected i , and get the current timestamp t i ; where m i ∈{0,1} * ;

[0058] Step 6.2: Vehicle v i Pick a random number z i ,and And use the pseudonym PID i 、Vehicle i The public and private key pair and the current timestamp t i For message m i Sign and generate message m i The certificateless signature σ i ;

[0059] The message m i The certificateless signature σ i It is expressed as:

[0060] σ i =(Z i ,V i )

[0061] Where Z i and V i All are signed without certificatesσ i The signature result in , and there are:

[0062] Z i =z i P

[0063] V i =z i +h 2i x i +h 3i d i

[0064] where h 2i and h 3i are the hash values ​​calculated by hash functions H2 and H3 respectively, and there are:

[0065] h 2i =H2(PID i ,X i ,K pub ,R i ,t i )

[0066] h 3i =H3(PID i ,m i ,PK i ,Z i ,t i )

[0067] Step 6.3: Vehicle v i Using vehicle v i The public key and current timestamp t i 、Message i The certificateless signature σ i 、Message i and vehicle v i Pseudonymous PID i Generate vehicle v i The signature message package {PK i ,t i ,σ i ,m i ,PID i};

[0068] The step 7 further comprises:

[0069] Step 7.1: RSU receives vehicle v i The signature message package {PK i ,t i ,σ i ,m i ,PID i}, verify t i Is it correct? If not, discard the signature message packet. If correct, execute step 7.2.

[0070] Step 7.2: RSU receives the vehicle v i The signature message package {PK i ,t i ,σ i ,m i ,PID i} Calculate the hash values ​​h of hash functions H1, H2 and H3 respectively 1i 、h 2i and h 3i ;

[0071] Step 7.3: RSU uses the hash value h 1i 、h 2i and h 3i Calculate the verification information α of the signature message packet i , if α i ≠0, the RSU discards the signed message packet. If α i =0, then accept the signed message packet;

[0072] Verification information α of the signature message packet i It is expressed as:

[0073] α i =V i PZ i -h 2i X i -h 3i (R i +h 1i K pub );

[0074] The aggregate signature σ in step 8 is expressed as:

[0075]

[0076] where Z1, Z2, ..., Z n They represent the signature results of the certificateless signatures of the first, second and nth vehicles respectively; V represents the aggregated signature value, and there are:

[0077]

[0078] The basis for detecting whether VANET is under collusion attack is:

[0079]

[0080] Where V1, V2 and V n Respectively represent the signature results of the certificateless signature of the 1st, 2nd and nth vehicles;

[0081] The step 9 further comprises:

[0082] Step 9.1: After receiving the aggregate signature σ and the signature message packets of n vehicles, AS checks the timestamp and pseudonym PID of each signature message packet respectively. i Whether the valid time period is correct, if it is correct, execute step 9.2; if it is not correct, discard the aggregate signature;

[0083] Step 9.2: AS uses the received aggregate signature σ and the signature message packets of n vehicles to calculate the hash values ​​h of the hash functions H1, H2 and H3 1i 、h 2i and h 3i ;

[0084] Step 9.3: AS calculates the verification information α of the validity of the aggregate signature based on the aggregate signature σ and the signature message packets of n vehicles. If α=0, it means that the aggregate signature σ is valid, and step 9.4 is executed; if α≠0, it means that the aggregate signature σ is invalid, and AS sends the aggregate signature as an invalid aggregate signature to RSU;

[0085] The verification information α of the validity of the aggregate signature is expressed as:

[0086]

[0087] in

[0088] Step 9.4: Set the verification equation of a single vehicle signature, and calculate the verification information β of the VANET being attacked by collusion based on the verification equation of the n vehicle signatures and the aggregate signature σ. If β = 0, the AS receives the aggregate signature σ and the signature message packet {PK i t i ,σ i ,m i ,PID i}, where i = 1, 2, ..., n; if β ≠ 0, it means that VANET is attacked by collusion, and AS sends the aggregate signature as an invalid aggregate signature to RSU;

[0089] The verification equation of the single vehicle signature is expressed as:

[0090] M i =V i P=Z i +h 2i X i +h 3i (R i +h 1i K pub )

[0091] The verification information β of the VANET subjected to collusion attack is expressed as:

[0092]

[0093] Among them, M1, M2, M3 and M n Represent the verification equations of the vehicle signatures of the 1st, 2nd, 3rd and nth vehicles respectively;

[0094] The step 10 further comprises:

[0095] Step 10.1: When the RSU receives an invalid aggregate signature σ from the AS * When , the invalid aggregate signature σ * The signature message packets of all the n vehicles participating in the aggregation are randomly sorted, the middle position of the sorting result is found, and the sorting result is divided into two parts of signatures starting from the middle position. The two parts of signatures are aggregated separately to obtain the re-aggregated signature and And send it to AS;

[0096] Step 10.2: AS receives from RSU and Afterwards, respectively and Verify. If the verification is successful, the AS accepts the aggregate signature. If the verification is not successful, the AS sends the aggregate signature to the RSU as a new invalid aggregate signature and returns to step 10.1.

[0097] The respective and The verification process is as follows: for the re-aggregated signature AS Check The timestamp and pseudonymous PID of each signed message packet i Is the valid time period correct? If not, discard it. If correct, calculate Verification information of the validity of the aggregate signature like Then explain Invalid, AS will As a new invalid aggregate signature, it is sent to RSU and returns to step 10.1; if Then explain Effective, calculate the verification information of VANET under collusion attack like Then AS receives the aggregate signature And the signature message package corresponding to the aggregate signature; if Then explain If the AS is attacked by collusion, As the new invalid aggregate signature Send to RSU and return to step 10.1; for the re-aggregated signature The verification method is the same as above The verification method is the same;

[0098] Step 10.3: AS and RSU repeat steps 10.1-10.2 multiple times until an invalid aggregate signature σ is found. * All invalid signatures in AS will send the pseudonym PID of the vehicle corresponding to each invalid signature i Send it to TA, TA receives the pseudonym PID i The real identity of the vehicle corresponding to each invalid signature is retrieved from the TA's database; where i = 1, 2, 3, ..., l, l represents the number of invalid signatures.

[0099] The beneficial effects of adopting the above technical solution are:

[0100] The method of the present invention uses a certificate-free method, avoiding the certificate management overhead of the public key infrastructure method, and also solves the key escrow problem based on identity encryption; and through the aggregate signature technology, multiple signatures are aggregated into one signature, greatly improving the efficiency of signature verification. The method of the present invention does not use the traditional bilinear pairing, reducing the calculation and communication overhead.

[0101] Aiming at the problem that the traditional certificateless aggregate signature scheme cannot resist collusion attack, compared with the existing certificateless aggregate signature method, the method of the present invention provides a specific method for detecting collusion attack, that is, the public and private keys of the application server AS are given at the time of initialization, and the collusion attack can be effectively detected in the aggregate verification stage through the public and private keys of AS. Multiple malicious vehicles cannot pass the aggregate verification by forging a single signature, which greatly enhances the security of VANET.

[0102] Aiming at the problem that the existing invalid signature recognition algorithm is inefficient and cannot accurately recognize invalid signatures, the method of the present invention provides an efficient invalid signature recognition algorithm. Compared with the traditional algorithm, the method of the present invention improves the invalid signature recognition algorithm, uses binary search and avoids repeated verification in the recursion of the traditional algorithm. It is not only more efficient, but also can effectively detect malicious vehicles that initiate collusion attacks, greatly improving the accuracy of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0103] Figure 1 Flow chart of the VANET privacy protection method against collusion attacks based on certificateless aggregate signature in this implementation mode;

[0104] Figure 2 Schematic diagram of the VANET privacy protection model against collusion attacks based on certificateless aggregate signature in this implementation mode;

[0105] Figure 3 A flow chart for generating model parameters in this embodiment;

[0106] Figure 4 This is a flow chart of the TA generating a pseudonym for a vehicle in this embodiment;

[0107] Figure 5 A flowchart for generating a public and private key pair for a vehicle in this embodiment;

[0108] Figure 6 A flow chart for generating a certificateless signature for a vehicle in this embodiment;

[0109] Figure 7 This is a flow chart of the RSU performing single signature verification on the received certificateless signature in this implementation mode;

[0110] Figure 8 This is a flow chart of AS performing aggregate verification and detecting collusion attacks in this implementation mode. DETAILED DESCRIPTION

[0111] In order to facilitate the understanding of the present application, the specific embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings and embodiments. The following embodiments are used to illustrate the present invention, but are not intended to limit the scope of the present invention. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thoroughly understood.

[0112] The present embodiment provides a VANET privacy protection method against collusion attacks based on certificateless aggregate signature. Figure 1 As shown, the method comprises the following steps:

[0113] Step 1: Construct a VANET privacy protection model against collusion attacks based on certificateless aggregate signature, including: vehicles equipped with on-board units (OBU), roadside units (RSU), application servers (AS), key generation centers (KGC) and trusted authorities (TA).

[0114] In this embodiment, if Figure 2 As shown in the figure, the VANET privacy protection model includes the following entities: vehicles with OBU installed, roadside units RSU, application servers AS, key generation centers KGC and trusted authorities TA.

[0115] The vehicle equipped with the OBU is used to communicate with other vehicles also equipped with the OBU, roadside units RSU and pedestrians within the coverage of the dedicated short range communications (DSRC) technology.

[0116] In this implementation, the vehicle equipped with OBU is the core component of VANET, and intelligent interconnection can be achieved through OBU. Dedicated short-range communication DSRC technology is a wireless communication technology that allows vehicles to communicate directly with surrounding infrastructure and other vehicles at high speed and safety. DSRC technology can communicate with devices carried by pedestrians, such as smartphones or other DSRC-enabled devices, through RSU to achieve information exchange between vehicles and pedestrians.

[0117] The roadside unit RSU is used to receive traffic information of all vehicles within the communication range of the RSU, verify the integrity and validity of the traffic information of any vehicle within the communication range of the RSU, and then send the verified traffic information to the trusted agency TA; aggregate the signatures of all vehicles within the communication range of the RSU and transmit the obtained aggregated signature to the application server AS.

[0118] The traffic information includes: vehicle location, vehicle speed, driving direction and traffic events occurring in the vehicle.

[0119] In this embodiment, the roadside unit RSU is a communication device deployed on the roadside, which can receive traffic information of vehicles within its coverage area and verify the integrity and validity of the traffic information, wherein the verification method of integrity and validity is selected according to the usual practical scheme, such as RSU adopts Aggregate MAC technology to verify the authenticity and integrity of the message. RSU can also send valid traffic information to the traffic control center, and the traffic control center can formulate reasonable traffic strategies based on the received information to improve traffic efficiency. There is no fixed standard for the coverage of RSU, and most RSUs have a coverage range of 100 to 300 meters in common urban environments.

[0120] The application server AS is used to obtain the vehicle's aggregate signature from the roadside unit RSU through a wired connection and verify the validity of the aggregate signature. For the verified aggregate signature, the aggregate signature and the public and private keys of the AS are used to detect whether the VANET is subjected to a conspiracy attack; for the invalid aggregate signature that fails to pass the verification, the invalid aggregate signature is sent to the trusted agency TA as an illegal signature.

[0121] In this embodiment, the application server AS collects information from the roadside unit through a secure wired connection, provides navigation, entertainment, information, safety, intelligent traffic control, remote vehicle diagnosis, traffic rescue and other services, and is responsible for verifying the aggregate signature from the RSU. In this embodiment, the AS also uses its public and private keys to detect whether the VANET is under collusion attack. Collusion attack refers to collusion between attackers to undermine the security of the network by forging or tampering with information. A valid aggregate signature indicates that the source and integrity of the information are guaranteed. The AS will use this information to analyze the communication behavior in the network, identify abnormal patterns or behaviors, and thus detect potential collusion attacks. If a collusion attack is detected, the AS needs to perform an emergency response to deal with the threat, take defensive countermeasures, and compare security performance. If no collusion attack is detected, it means that the VANET can continue to operate normally because the network is considered to be secure and not affected by the collusion attack. When the AS detects invalid illegal signatures, it will send these illegal signatures to the trusted agency TA. TA is responsible for further investigation and processing, including tracking the source of the illegal signatures and taking corresponding security measures to respond to and prevent such attacks.

[0122] The key generation center KGC is used to generate a partial private key for each vehicle equipped with an OBU.

[0123] In this embodiment, in the Certificateless Aggregate Signature (CLAS) technology, the role of KGC is to provide part of the private key of the vehicle, and the other part of the private key is generated by the vehicle itself. This design eliminates the certificate hosting problem and is more suitable for VANET environment.

[0124] The trusted authority TA is used to initialize the VANET privacy protection model based on certificateless aggregate signature to resist collusion attack; to provide registration services for roadside units RSU and vehicles equipped with OBU; to communicate with the roadside units RSU through a secure transmission protocol; and to generate a pseudonym for the vehicle and use the pseudonym of the vehicle to reveal the true identity of the illegal signature from the application server AS.

[0125] In this embodiment, the trusted agency TA is a trusted third-party agency responsible for initializing VANET. TA is the registration center of RSU and OBU, providing registration services for RSU and OBU, ensuring that each device is verified and authorized before joining the network and will never be compromised. TA and RSU communicate through a secure transmission protocol to ensure the security and integrity of information transmission. TA is also responsible for generating pseudonyms for vehicles to protect the privacy of vehicles. The main purpose of the pseudonym is to protect the privacy of the vehicle and prevent the vehicle from being tracked and identified in the communication between vehicles or between vehicles and roadside units RSU. The pseudonym is used to achieve vehicle identity authentication and privacy protection. Once the vehicle has malicious behavior, after the AS sends the illegal signature to TA, TA can reveal the true identity of the vehicle through the pseudonym.

[0126] Step 2: Use elliptic curve cryptography to generate model parameters of the VANET privacy protection model based on certificateless aggregate signature against collusion attacks.

[0127] In this embodiment, if Figure 3 As shown, KGC, TA and AS complete the generation of model parameters and master keys, that is, public and private keys.

[0128] Step 2.1: Based on the selected security parameter λ, the key generation center KGC and the trusted authority TA select an elliptic curve E, determine a cyclic group G of order q on the elliptic curve E, and determine the generator P; where q is a large prime number.

[0129] The elliptic curve E is expressed as:

[0130] E:y 2 =x 3 +ax+b(modp) (1)

[0131] Where y and x are unknowns in the elliptic curve equation; a and b are constants that define the elliptic curve, and a,b∈F p , 4a 3 +27b 2 (modp)≠0; F p is a finite field; mod represents the modulo operation; p is a large prime number.

[0132] In this embodiment, the security parameter directly affects the selection of the elliptic curve and the order of the cyclic group. The security parameters usually include the required security level, key length, etc. These parameters determine the complexity and anti-attack capability of the elliptic curve. Based on the security parameter λ, TA and KGC select an elliptic curve E:y 2 =x 3+ax+b(modp), determine a q-order cyclic group G on E, q is a large prime number. After determining the q-order cyclic group, TA and KGC need to find a point P on the elliptic curve. This point is the generator of the cyclic group, that is, the q-times point of P is the infinite point O, which is the identity element of the group. The selection of point P is very critical because it will be used as the basis for subsequent key generation. All operations are performed under the condition of modulo p, that is, in the finite field F p In the p The elements in are integers modulo p. In the above process, the security parameter affects the finite field F p The choice of prime number p directly affects the security of the elliptic curve; the security parameter determines the elliptic curve equation E:y 2 =x 3 The choice of parameters a and b in +ax+b(modp) needs to satisfy certain conditions to ensure that the curve is non-singular, that is, 4a 3 +27b 2 (modp)≠0; the security parameter also affects the selection of the order q of the cyclic group. q is a prime factor of the set of points on the elliptic curve, and a prime number that matches the security parameter is usually selected to ensure the security and efficiency of the system.

[0133] Step 2.2: KGC selects a random number k as the private key of KGC and calculates the public key of KGC; TA selects a random number t as the private key of TA and calculates the public key of TA; AS selects a random number s as the private key of AS and calculates the public key of AS; where represents the multiplicative group modulo p.

[0134] The public key of the KGC is:

[0135] K pub =kP (2)

[0136] Where K pub It is the public key of KGC.

[0137] The public key of the TA is:

[0138] T pub =tP (3)

[0139] Where T pub is the public key of TA.

[0140] The public key of the AS is:

[0141] A pub =sP (4)

[0142] Among them A pub The public key of AS.

[0143] Step 2.3: Generate model parameters {G,q,T pub ,K pub ,A pub ,H0,H1,H2,H3,H4,P,G,E}.

[0144] In this embodiment, TA and KGC select five one-way hash functions from the SHA-256 hash function library, denoted as: H0, H1, H2, H3, H4; publish system parameters {G, q, T pub ,K pub ,A pub ,H0,H1,H2,H3,H4,P,G,E}.

[0145] Step 3: In the VANET privacy protection model against collusion attacks based on certificateless aggregate signature, the RSU submits a registration application to the TA. After the registration is completed, the TA sends the model parameters to the RSU.

[0146] Step 4: For the i-th vehicle v in the VANET privacy protection model against collusion attacks based on certificateless aggregate signature i , vehicle v i Submit a registration application to TA, and TA sends the model parameters to the vehicle v i And save to OBU, TA generates vehicle v i Pseudonymous PID i And send them to the vehicle v respectively i and KGC.

[0147] In this embodiment, if Figure 4 As shown, TA generates a pseudonym PID for the vehicle after submitting the registration application i .

[0148] Step 4.1: For the i-th vehicle v in the VANET privacy protection model against collusion attacks based on certificateless aggregate signature i , vehicle v i Submit a registration application to TA, and TA will send the model parameters to the vehicle v after receiving the registration application i .

[0149] Step 4.2: Use TA's public key and vehicle v i Real ID RID i Calculate the pseudonymous first identifier PID i,1 , thereby generating a vehicle authentication message {N i ,PID i,1}, and by vehicle v i Sent to TA; n i For vehicle v i A random number is chosen, and Represents the exclusive OR operation.

[0150] The pseudonymous first identifier PID i,1 for:

[0151] PID i,1 =n i P (5)

[0152] In this embodiment, the vehicle v i Random Selection PID used to calculate the pseudonym i,1 .RID i Is the vehicle v i The real identity of the vehicle is stored in the TA's database. In most cases, the TA will maintain its own database to store and manage the vehicle's identity information. i Indicates vehicle v i The intermediate calculation result is obtained by passing the random number n i Multiply by TA's public key T pub Generate a value that has nothing to do with your identity and then compare it to your real identity RID i Perform an XOR operation to protect the real identity from being directly disclosed. XOR is a common binary operator that compares two digits bit by bit. If the values ​​of the two bits are the same, the result is 0, and if they are different, the result is 1.

[0153] Step 4.3: TA saves the received vehicle authentication message {N i ,PID i,1}, use TA's private key t to calculate vehicle v i Real ID RID i , and the calculated real identity RID i Match the real identities of all vehicles stored in TA. If the match fails, it means that RID i Invalid and discarded; if the match is successful, calculate the pseudonym second identifier PID i,2 .

[0154] The pseudonymous second identifier PID i,2 It is expressed as:

[0155]

[0156] Where T i Indicates PID i The effective time period.

[0157] Step 4.4: Based on the pseudonymous first identifier PID i,1 and the pseudonymous second identifier PID i,2 Generate vehicle v iPseudonymous PID i , and the pseudonym PID i Sent to KGC and vehicle v i .

[0158] The vehicle v i Pseudonymous PID i It is expressed as:

[0159] PID i ={PID i,1 ,PID i,2 ,T i} (7)

[0160] Step 5: When KGC receives the pseudonym PID transmitted by TA i When KGC checks PID i Is it within the valid time period? If not, KGC discards the pseudonym. If yes, it generates a vehicle v i The public and private key pair.

[0161] In this embodiment, if Figure 5 As shown, when the vehicle v i Transmit pseudonymous PID to KGC i When KGC first checks the PID i Is it within the valid time period? If not, KGC will discard it. Otherwise, output v i Part of the private key.

[0162] Step 5.1: Vehicle v i Pick a random number x i as a secret value, and Calculate vehicle v i Part of the public key X i .

[0163] The vehicle v i Part of the public key X i for:

[0164] X i =x i P (8)

[0165] Step 5.2: KGC selects a random number r i ,and And based on the random number r i And hash function H1 calculates the hash value h 1i .

[0166] The hash value h 1i It is expressed as:

[0167] h 1i =H1(PID i,R i ,K pub ,X i ) (9)

[0168] Where R i =r i P.

[0169] Step 5.3: KGC calculates the hash value h 1i Calculate vehicle v i Part of the private key d i , and generate a partial secret key PPK i Send to vehicle v i .

[0170] The vehicle v i Part of the private key d i It is expressed as:

[0171] d i =r i +kh 1i (10)

[0172] The partial key PPK i It is expressed as:

[0173] PPK i =(d i ,R i ) (11)

[0174] Step 5.4: Vehicle v i Receive PPK i Post-verification partial secret key PPK i Is it legal? If the expression for verifying legality is established, it means that the partial secret key PPK i Legal, vehicle v i Accept partial key PPK i ; If the expression for verifying legitimacy is not true, it means that the partial secret key PPK i Illegal, vehicle v i Discard some PPK keys i .

[0175] The expression for verifying the legality is:

[0176] d i P=R i +h 1i K pub (12)

[0177] In this embodiment, by calculating the formula d i P=R i +h 1i K pubIs it established to verify PPK i If established, the vehicle accepts PPK i , otherwise discarded.

[0178] Step 5.5: Vehicle v i Based on the partial key PPK i Generate vehicle v i The public key PK i and private key SK i , and form vehicle v i The public and private key pair.

[0179] The vehicle v i The public key PK i It is expressed as:

[0180] PK i =(X i ,R i ) (13)

[0181] The vehicle v i The private key SK i It is expressed as:

[0182] SK i =(x i ,d i ) (14)

[0183] Step 6: When the vehicle v i Generates message m when an event is detected i , using pseudonymous PID i 、Vehicle i The public and private key pair and the current timestamp t i For message m i Sign and generate message m i The signed message package is sent to the RSU.

[0184] Step 6.1: When the vehicle v i Generates message m when an event is detected i , and get the current timestamp t i ; where m i ∈{0,1} * .

[0185] Step 6.2: Vehicle v i Pick a random number z i ,and And use the pseudonym PID i 、Vehicle i The public and private key pair and the current timestamp t i For message m i Sign and generate message m iThe certificateless signature σ i .

[0186] The message m i The certificateless signature σ i It is expressed as:

[0187] σ i =(Z i ,V i ) (15)

[0188] Where Z i and V i All are signed without certificatesσ i The signature result in , and there are:

[0189] Z i =z i P (16)

[0190] V i =z i +h 2i x i +h 3i d i (17)

[0191] where h 2i and h 3i are the hash values ​​calculated by hash functions H2 and H3 respectively, and there are:

[0192] h 2i =H2(PID i ,X i ,K pub ,R i ,t i ) (18)

[0193] h 3i =H3(PID i ,m i ,PK i ,Z i ,t i ) (19)

[0194] In this embodiment, if Figure 6 As shown in Figure 1, when a vehicle detects a specific event, such as a traffic accident or road condition, it generates and signs an event message to report to surrounding vehicles or roadside units (RSUs). 2i and h 3i Calculated by hash functions H2 and H3 respectively, used to protect the integrity of the signature and bind information such as message and timestamp; V i One of the signature results, used for the verification process of signature without certificate.

[0195] Step 6.3: Vehicle v i Using vehicle v i The public key and current timestamp t i 、Message i The certificateless signature σ i 、Message i and vehicle v i Pseudonymous PID i Generate vehicle v i The signature message package {PK i ,t i ,σ i ,m i ,PID i}.

[0196] In this embodiment, the vehicle v i The generated signature message package {PK i ,t i ,σ i ,m i ,PID i}Sent to nearby RSUs for verification and aggregation.

[0197] Step 7: RSU receives vehicle v i Check the timestamp and pseudonym PID of the signed message packet i The RSU verifies the signed message packet. If the verification fails, the RSU discards the signed message packet. If the verification passes, the RSU accepts the signed message packet.

[0198] In this embodiment, if Figure 7 As shown, RSU receives the vehicle v i The signature message package {PK i ,t i ,σ i ,m i ,PID i}, check t i and PID i The effective time period T i Is it the correct time period? If not, RSU will discard the signed message packet; if correct, RSU will verify the single signature.

[0199] Step 7.1: RSU receives vehicle v i The signature message package {PK i ,t i ,σ i ,m i ,PID i}, verify t iIs it correct? If not, discard the signed message packet. If correct, execute step 7.2.

[0200] Step 7.2: RSU receives the vehicle v i The signature message package {PK i ,t i ,σ i ,m i ,PID i} Calculate the hash values ​​h of hash functions H1, H2 and H3 respectively 1i 、h 2i and h 3i .

[0201] h 1i =H1(PID i ,R i ,K pub ,X i ) (20)

[0202] h 2i =H2(PID i ,X i ,K pub ,R i ,t i ) (twenty one)

[0203] h 3i =H3(PID i ,m i ,PK i ,Z i ,t i ) (twenty two)

[0204] In this embodiment, h 1i 、h 2i 、h 3i Represents the calculation results of different hash functions, which are used to ensure the binding and integrity of messages, identities, and signatures.

[0205] Step 7.3: RSU uses the hash value h 1i 、h 2i and h 3i Calculate the verification information α of the signature message packet i , if α i ≠0, the RSU discards the signed message packet. If α i =0, the signed message packet is accepted.

[0206] Verification information α of the signature message packet i It is expressed as:

[0207] α i =V i PZi -h 2i X i -h 3i (R i +h 1i K pub ) (twenty three)

[0208] In this embodiment, the RSU calculates the signature verification information α i , if α i =0, the signature verification is successful and the RSU accepts the signed message packet.

[0209] Step 8: After the RSU receives the signature message packets of n vehicles, it aggregates the signature message packets of the n vehicles and sends the signature message packets of the n vehicles and the generated aggregate signature σ to the AS.

[0210] The aggregate signature σ is expressed as:

[0211]

[0212] where Z1, Z2, ..., Z n They represent the signature results of the certificateless signatures of the first, second, and nth vehicles respectively; V represents the aggregated signature value, which is the sum of the signatures of n vehicles, and has:

[0213]

[0214] The basis for detecting whether VANET is under collusion attack is:

[0215]

[0216] Where V1, V2 and V n Represent the signature results of the certificateless signature of the 1st, 2nd and nth vehicles respectively.

[0217] In this embodiment, RSU will pass a large number of signature message packets {PK i ,t i ,σ i ,m i ,PID i}, where i = 1, 2, ..., n is aggregated, and the aggregate signature and the signature message package corresponding to the individual signatures in the aggregate signature are sent {PK i ,t i ,σ i ,m i ,PID i} to AS for verification.

[0218] Step 9: After receiving the aggregate signature σ and the signature message packets of n vehicles, AS checks the timestamp and pseudonym PID of each signature message packet i The AS receives the valid time period of the aggregate signature σ and verifies the aggregate signature σ. If the verification is successful, the AS receives the aggregate signature σ. If the verification is unsuccessful, the AS sends the aggregate signature to the RSU as an invalid aggregate signature.

[0219] In this embodiment, if Figure 8 As shown, when AS receives the aggregate signature and information {PK i ,t i ,σ i ,m i ,PID i}(i=1,2,...,n), verify each message t i Whether it is fresh, and the corresponding pseudonym PID i T i If they are not fresh or correct, AS discards them. Otherwise, AS performs aggregate verification and detects whether it is subject to collusion attacks.

[0220] Step 9.1: After receiving the aggregate signature σ and the signature message packets of n vehicles, AS checks the timestamp and pseudonym PID of each signature message packet respectively. i The validity period of the aggregate signature is correct. If correct, execute step 9.2; if incorrect, discard the aggregate signature.

[0221] Step 9.2: AS uses the received aggregate signature σ and the signature message packets of n vehicles to calculate the hash values ​​h of the hash functions H1, H2 and H3 1i 、h 2i and h 3i .

[0222] In this embodiment, the hash value h 1i 、h 2i and h 3i The calculation method of is the same as formula (20)-(22).

[0223] Step 9.3: AS calculates the verification information α of the validity of the aggregate signature based on the aggregate signature σ and the signature message packets of n vehicles. If α=0, it means that the aggregate signature σ is valid, and execute step 9.4; if α≠0, it means that the aggregate signature σ is invalid, and AS sends the aggregate signature as an invalid aggregate signature to RSU.

[0224] The verification information α of the validity of the aggregate signature is expressed as:

[0225]

[0226] in

[0227] Step 9.4: Set the verification equation of a single vehicle signature, and calculate the verification information β of the VANET being attacked by collusion based on the verification equation of the n vehicle signatures and the aggregate signature σ. If β = 0, the AS receives the aggregate signature σ and the signature message packet {PK i t i ,σ i ,m i ,PID i}, where i = 1, 2, ..., n; if β≠0, it means that VANET is attacked by collusion, and AS sends the aggregate signature to RSU as an invalid aggregate signature.

[0228] The verification equation of the single vehicle signature is expressed as:

[0229] M i =V i P=Z i +h 2i X i +h 3i (R i +h 1i K pub ) (27)

[0230] The verification information β of the VANET subjected to collusion attack is expressed as:

[0231]

[0232] Among them, M1, M2, M3 and M n Represent the verification equations of the vehicle signatures of the 1st, 2nd, 3rd and nth vehicles respectively.

[0233] In this embodiment, the verification equation M of a single vehicle signature is set i , used to verify whether each signature meets the standards of the aggregate signature; calculate the verification information β of the VANET being attacked by collusion, which is used to detect whether the VANET is attacked by collusion. If β=0, the AS accepts the aggregate signature σ and the {PK i t i ,σ i ,m i ,PID i}, if it is not 0, it means that VANET is attacked by collusion, and AS discards the aggregate signature.

[0234] Step 10: AS and RSU use the binary search method to collaboratively identify the invalid aggregate signature and obtain all invalid signatures in the invalid aggregate signature. AS sends the pseudonym of the vehicle corresponding to each invalid signature to TA and obtains the real identity of the vehicle corresponding to each invalid signature.

[0235] In this embodiment, when the AS finds that the aggregate signature verification fails, the AS calculates the verification information α of the validity of the aggregate signature corresponding to the aggregate signature. * ≠0 or the verification information β of the VANET corresponding to the aggregate signature being attacked by collusion * ≠0, the invalid aggregate signature σ * Sent to RSU via secure channel. AS and RSU collaborate to identify invalid aggregate signatures that cause aggregate verification failure, find out the single invalid signature in the invalid aggregate signature, and send the pseudonyms that signed these signatures to TA. TA will reveal the true identity of these pseudonyms.

[0236] Step 10.1: When the RSU receives an invalid aggregate signature σ from the AS * When , the invalid aggregate signature σ * The signature message packets of all the n vehicles participating in the aggregation are randomly sorted, the middle position of the sorting result is found, and the sorting result is divided into two parts of signatures starting from the middle position. The two parts of signatures are aggregated separately to obtain the re-aggregated signature and And send it to AS.

[0237] In this embodiment, the invalid aggregate signature σ * Randomly sort all the signatures participating in the aggregation, divide all the signatures into two parts starting from the middle position, and re-aggregate them according to the method in step 8, and re-aggregate the signatures and Sent to AS. The method for determining the intermediate position is:

[0238]

[0239] Step 10.2: AS receives from RSU and Afterwards, respectively and Verification is performed. If the verification passes, the AS accepts the aggregate signature. If the verification fails, the AS sends the aggregate signature to the RSU as a new invalid aggregate signature and returns to step 10.1.

[0240] The respective and The verification process is as follows: for the re-aggregated signature AS Check The timestamp and pseudonymous PID of each signed message packet i Is the valid time period correct? If not, discard it. If correct, calculate Verification information of the validity of the aggregate signature like Then explain Invalid, AS will As a new invalid aggregate signature, it is sent to RSU and returns to step 10.1; if Then explain Effective, calculate the verification information of VANET under collusion attack like Then AS receives the aggregate signature And the signature message package corresponding to the aggregate signature; if Then explain If the AS is attacked by collusion, As the new invalid aggregate signature Send to RSU and return to step 10.1; for the re-aggregated signature The verification method is the same as above The verification method is similar.

[0241] In this embodiment, the aggregation verification method in step 9 is used to respectively and Verify the re-aggregated signature AS Check The timestamp and pseudonymous PID of each signed message packet i Is the valid time period correct? If not, discard it. If correct, calculate Verification information of the validity of the aggregate signature like Then explain Invalid, AS will As a new invalid aggregate signature, it is sent to RSU and returns to step 10.1; if Then explain Effective, calculate the verification information of VANET under collusion attack like Then AS receives the aggregate signature And the signature message package corresponding to the aggregate signature σ; if Then explain If the AS is attacked by collusion, As the new invalid aggregate signature Send to RSU and return to step 10.1. For the re-aggregated signature The verification method is the same as above The verification method is similar to that of AS. The timestamp and pseudonymous PID of each signed message packet i Is the valid time period correct? If not, discard it. If correct, calculate Verification information of the validity of the aggregate signature like Then explain Invalid, AS will As a new invalid aggregate signature, it is sent to RSU and returns to step 10.1; if Then explain Effective, calculate the verification information of VANET under collusion attack like Then AS receives the aggregate signature And the signature message package corresponding to the aggregate signature; if Then explain If the AS is attacked by collusion, It is sent to RSU as a new invalid aggregate signature and returns to step 10.1.

[0242] Step 10.3: AS and RSU repeat steps 10.1-10.2 multiple times until an invalid aggregate signature σ is found. * All invalid signatures in AS will send the pseudonym PID of the vehicle corresponding to each invalid signature i Send it to TA, TA receives the pseudonym PID i The real identity of the vehicle corresponding to each invalid signature is retrieved from the TA's database; where i = 1, 2, 3, ..., l, l represents the number of invalid signatures.

[0243] In this embodiment, the AS and the RSU repeat steps 10.1 and 10.2 until all invalid signatures are found. l is the number of invalid signatures, and AS sends the corresponding illegal pseudonym Give it to TA, and TA will reveal the true identity of the illegal pseudonym.

[0244] In this embodiment, TA uses a binary search algorithm for invalid signatures to reveal the true identity of the invalid pseudonym. The specific steps are shown in Table 1 below.

[0245] Table 1 Binary search algorithm for invalid signatures

[0246]

[0247]

[0248] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.

Claims

1. A VANET privacy protection method against collusion attacks based on certificateless aggregate signature, characterized in that: The method comprises the following steps: Step 1: Construct a VANET privacy protection model based on certificateless aggregate signature to resist collusion attacks, including vehicles equipped with on-board units OBU, roadside units RSU, application servers AS, key generation centers KGC and trusted institutions TA; Step 2: Use elliptic curve cryptography to generate model parameters of the VANET privacy protection model against collusion attacks based on certificateless aggregate signature; Step 3: The RSU in the VANET privacy protection model against collusion attacks based on certificateless aggregate signature submits a registration application to the TA, and after the registration is completed, the TA sends the model parameters to the RSU; Step 4: For the i-th vehicle v in the VANET privacy protection model against collusion attacks based on certificateless aggregate signature i , vehicle v i Submit a registration application to TA, and TA sends the model parameters to the vehicle v i And save to OBU, TA generates vehicle v i Pseudonymous PID i And send them to the vehicle v respectively i and KGC; Step 5: When KGC receives the pseudonym PID transmitted by TA i When KGC checks PID i Is it within the valid time period? If not, KGC discards the pseudonym. If yes, it generates a vehicle v i The public and private key pair; Step 6: When the vehicle v i Generates message m when an event is detected i , using pseudonymous PID i 、Vehicle i The public and private key pair and the current timestamp t i For message m i Sign and generate message m i The signed message package is sent to RSU; Step 7: RSU receives vehicle v i Check the timestamp and pseudonym PID of the signed message packet i The RSU verifies the signature message packet. If the verification fails, the RSU discards the signature message packet. If the verification is successful, the RSU accepts the signed message packet; Step 8: After the RSU receives the signature message packets of n vehicles, it aggregates the signature message packets of n vehicles and sends the signature message packets of n vehicles and the generated aggregate signature σ to the AS; Step 9: After receiving the aggregate signature σ and the signature message packets of n vehicles, AS checks the timestamp and pseudonym PID of each signature message packet i The AS receives the valid time period of the aggregate signature σ and verifies the aggregate signature σ. If the verification is successful, the AS receives the aggregate signature σ. If the verification is unsuccessful, the AS sends the aggregate signature to the RSU as an invalid aggregate signature. Step 10: AS and RSU use the binary search method to collaboratively identify the invalid aggregate signature and obtain all invalid signatures in the invalid aggregate signature. AS sends the pseudonym of the vehicle corresponding to each invalid signature to TA and obtains the real identity of the vehicle corresponding to each invalid signature.

2. According to claim 1, the VANET privacy protection method against collusion attacks based on certificateless aggregate signature is characterized in that: The vehicle equipped with the OBU in step 1 is used to communicate with vehicles equipped with the OBU, roadside units RSU and pedestrians within the coverage of the dedicated short-range communication DSRC technology; The roadside unit RSU is used to receive traffic information of all vehicles within the communication range of the RSU, verify the integrity and validity of the traffic information of any vehicle within the communication range of the RSU, and then send the verified traffic information to the trusted agency TA; aggregate the signatures of all vehicles within the communication range of the RSU and transmit the obtained aggregated signature to the application server AS; The application server AS is used to obtain the aggregate signature of the vehicle from the roadside unit RSU through a wired connection and verify the validity of the aggregate signature. For the verified aggregate signature, the aggregate signature and the public and private keys of the AS are used to detect whether the VANET is subjected to a conspiracy attack; For invalid aggregate signatures that fail verification, the invalid aggregate signature is sent to the trusted authority TA as an illegal signature; The key generation center KGC is used to generate a partial private key for each vehicle equipped with an OBU; The trusted authority TA is used to initialize the VANET privacy protection model against collusion attacks based on certificateless aggregate signature; Used to provide registration services for roadside units (RSU) and vehicles equipped with OBU; Used to communicate with the roadside unit RSU through a secure transmission protocol; Used to generate a pseudonym for the vehicle and use the pseudonym of the vehicle to reveal the true identity of the illegal signature from the application server AS.

3. According to claim 2, the VANET privacy protection method against collusion attacks based on certificateless aggregate signature is characterized in that: The step 2 further comprises: Step 2.1: Based on the selected security parameter λ, the key generation center KGC and the trusted authority TA select an elliptic curve E, determine a cyclic group G of order q on the elliptic curve E, and determine the generator P; where q is a large prime number; The elliptic curve E is expressed as: E:y 2 =x 3 +ax+b(modp) Where y and x are unknowns in the elliptic curve equation; a and b are constants that define the elliptic curve, and a,b∈F p , 4a 3 +27b 2 (modp)≠0; F p is a finite field; mod represents the modulo operation; p is a large prime number; Step 2.2: KGC selects a random number k as the private key of KGC and calculates the public key of KGC; TA selects a random number t as the private key of TA and calculates the public key of TA; AS selects a random number s as the private key of AS and calculates the public key of AS; where represents the multiplication group modulo p; Step 2.3: Generate model parameters {G, q, T pub ,K pub ,A pub ,H0,H1,H2,H3,H4,P,G,E}; where T pub is the public key of TA; K pub A is the public key of KGC; pub is the public key of AS; H0, H1, H2, H3 and H4 are all hash functions.

4. According to claim 3, the VANET privacy protection method against collusion attacks based on certificateless aggregate signature is characterized in that: The step 4 further comprises: Step 4.1: For the i-th vehicle v in the VANET privacy protection model against collusion attacks based on certificateless aggregate signature i , vehicle v i Submit a registration application to TA, and TA will send the model parameters to the vehicle v after receiving the registration application i ; Step 4.2: Use TA's public key and vehicle v i Real ID RID i Calculate the pseudonymous first identifier PID i,1 , thereby generating a vehicle authentication message {N i ,PID i,1 }, and by vehicle v i Sent to TA; n i For vehicle v i A random number is chosen, and Represents the exclusive OR operation; The pseudonymous first identifier PID i,1 for: PID i,1 =n i P Step 4.3: TA saves the received vehicle authentication message {N i ,PID i,1 }, use TA's private key t to calculate the real identity RID of vehicle vi i , and the calculated real identity RID i Match the real identities of all vehicles stored in TA. If the match fails, it means that RID i Invalid and discarded; if the match is successful, calculate the pseudonym second identifier PID i,2 ; The pseudonymous second identifier PID i,2 It is expressed as: Where T i Indicates PID i The effective time period; Step 4.4: Based on the pseudonymous first identifier PID i,1 and the pseudonymous second identifier PID i,2 Generate vehicle v i Pseudonymous PID i , and the pseudonym PID i Sent to KGC and vehicle v i ; The vehicle v i Pseudonymous PID i It is expressed as: PID i ={PID i,1 ,PID i,2 ,T i }。 5. According to claim 4, the method for protecting VANET privacy against collusion attacks based on certificateless aggregate signature is characterized in that: The step 5 further comprises: Step 5.1: Vehicle v i Pick a random number x i as a secret value, and Calculate vehicle v i Part of the public key X i ; Step 5.2: KGC selects a random number r i ,and And based on the random number r i And hash function H1 calculates the hash value h 1i ; Step 5.3: KGC calculates the hash value h 1i Calculate vehicle v i Part of the private key d i , and generate a partial secret key PPK i Send to vehicle v i ; The partial key PPK i It is expressed as: PPK i =(d i ,R i ) Where R i =r i P, r i is a random number selected by KGC, and Step 5.4: Vehicle v i Receive PPK i Post-verification partial secret key PPK i Is it legal? If the expression for verifying legality is established, it means that the partial secret key PPK i Legal, vehicle v i Accept partial key PPK i ; If the expression for verifying legitimacy is not true, it means that the partial secret key PPK i Illegal, vehicle v i Discard some PPK keys i ; The expression for verifying the legality is: d i P=R i +h 1i K pub Step 5.5: Vehicle v i Based on the partial key PPK i Generate vehicle v i The public key PK i and private key SK i , and form vehicle v i The public and private key pair; The vehicle v i The public key PK i It is expressed as: PK i =(X i ,R i ) The vehicle v i The private key SK i It is expressed as: SK i =(x i ,d i )。 6. The method for protecting VANET privacy against collusion attacks based on certificateless aggregate signature according to claim 5 is characterized in that: The step 6 further comprises: Step 6.1: When the vehicle v i Generates message m when an event is detected i , and get the current timestamp t i ; where m i ∈{0,1} * ; Step 6.2: Vehicle v i Pick a random number z i ,and And use the pseudonym PID i 、Vehicle i The public and private key pair and the current timestamp t i For message m i Sign and generate message m i The certificateless signature σ i ; The message m i The certificateless signature σ i It is expressed as: σ i =(Z i ,V i ) Where Z i and V i All are signed without certificatesσ i The signature result in , and there are: WITH i =from i P V i =z i +h 2i x i +h 3i d i where h 2i and h 3i are the hash values ​​calculated by hash functions H2 and H3 respectively, and there are: h 2i =H2(PID i ,X i ,K pub ,R i ,t i ) h 3i =H3(PID i ,m i ,PK i ,Z i ,t i ) Step 6.3: Vehicle v i Using vehicle v i The public key and current timestamp t i 、Message i The certificateless signature σ i 、Message i and vehicle v i Pseudonymous PID i Generate vehicle v i The signature message package {PK i ,t i ,σ i ,m i ,PID i }.

7. The method for protecting VANET privacy against collusion attacks based on certificateless aggregate signature according to claim 6 is characterized in that: The step 7 further comprises: Step 7.1: RSU receives vehicle v i The signature message package {PK i ,t i ,σ i ,m i ,PID i }, verify t i Is it correct? If not, discard the signature message packet. If correct, execute step 7.

2. Step 7.2: RSU receives the vehicle v i The signature message package {PK i ,t i ,σ i ,m i ,PID i } Calculate the hash values ​​h of hash functions H1, H2 and H3 respectively 1i 、h 2i and h 3i ; Step 7.3: RSU uses the hash value h 1i 、h 2i and h 3i Calculate the verification information α of the signature message packet i , if α i ≠0, the RSU discards the signed message packet. If α i =0, then accept the signed message packet; Verification information α of the signature message packet i It is expressed as: α i =V i P-Z i -h 2i X i -h 3i (R i +h 1i K pub )。 8. The VANET privacy protection method against collusion attacks based on certificateless aggregate signature according to claim 7 is characterized in that: The aggregate signature σ in step 8 is expressed as: where Z1, Z2, ..., Z n They represent the signature results of the certificateless signatures of the first, second and nth vehicles respectively; V represents the aggregated signature value, and there are: The basis for detecting whether VANET is under collusion attack is: Where V1, V2 and V n Represent the signature results of the certificateless signature of the 1st, 2nd and nth vehicles respectively.

9. The VANET privacy protection method against collusion attacks based on certificateless aggregate signature according to claim 8 is characterized in that: The step 9 further comprises: Step 9.1: After receiving the aggregate signature σ and the signature message packets of n vehicles, AS checks the timestamp and pseudonym PID of each signature message packet respectively. i Whether the valid time period is correct, if it is correct, execute step 9.2; if it is not correct, discard the aggregate signature; Step 9.2: AS uses the received aggregate signature σ and the signature message packets of n vehicles to calculate the hash values ​​h of the hash functions H1, H2 and H3 1i 、h 2i and h 3i ; Step 9.3: AS calculates the verification information α of the validity of the aggregate signature based on the aggregate signature σ and the signature message packets of n vehicles. If α=0, it means that the aggregate signature σ is valid, and step 9.4 is executed; if α≠0, it means that the aggregate signature σ is invalid, and AS sends the aggregate signature as an invalid aggregate signature to RSU; The verification information α of the validity of the aggregate signature is expressed as: in Step 9.4: Set the verification equation of a single vehicle signature, and calculate the verification information β of the VANET being attacked by collusion based on the verification equation of the n vehicle signatures and the aggregate signature σ. If β = 0, the AS receives the aggregate signature σ and the signature message packet {PK i t i ,σ i ,m i ,PID i }, where i = 1, 2, ..., n; if β ≠ 0, it means that VANET is attacked by collusion, and AS sends the aggregate signature as an invalid aggregate signature to RSU; The verification equation of the single vehicle signature is expressed as: M i =V i P=Z i +h 2i X i +h 3i (R i +h 1i K pub ) The verification information β of the VANET subjected to collusion attack is expressed as: Among them, M1, M2, M3 and M n Represent the verification equations of the vehicle signatures of the 1st, 2nd, 3rd and nth vehicles respectively.

10. The VANET privacy protection method against collusion attacks based on certificateless aggregate signature according to claim 9 is characterized in that: The step 10 further comprises: Step 10.1: When the RSU receives an invalid aggregate signature σ from the AS * When , the invalid aggregate signature σ * The signature message packets of all the n vehicles participating in the aggregation are randomly sorted, the middle position of the sorting result is found, and the sorting result is divided into two parts of signatures starting from the middle position. The two parts of signatures are aggregated separately to obtain the re-aggregated signature and And send it to AS; Step 10.2: AS receives from RSU and Afterwards, respectively and Verify. If the verification is successful, the AS accepts the aggregate signature. If the verification is not successful, the AS sends the aggregate signature to the RSU as a new invalid aggregate signature and returns to step 10.

1. The respective and The verification process is as follows: for the re-aggregated signature AS Check The timestamp and pseudonymous PID of each signed message packet i Is the valid time period correct? If not, discard it. If correct, calculate Verification information of the validity of the aggregate signature like Then explain Invalid, AS will As a new invalid aggregate signature, it is sent to RSU and returns to step 10.1; if Then explain Effective, calculate the verification information of VANET under collusion attack like Then AS receives the aggregate signature And the signature message package corresponding to the aggregate signature; if Then explain If the AS is attacked by collusion, As the new invalid aggregate signature Send to RSU and return to step 10.1; for the re-aggregated signature The verification method is the same as above The verification method is the same; Step 10.3: AS and RSU repeat steps 10.1-10.2 multiple times until an invalid aggregate signature σ is found. * All invalid signatures in AS will send the pseudonym PID of the vehicle corresponding to each invalid signature i Send it to TA, TA receives the pseudonym PID i The real identity of the vehicle corresponding to each invalid signature is retrieved from the TA's database; where i = 1, 2, 3, ..., l, l represents the number of invalid signatures.

Images