Lightweight vehicle intranet identity authentication and key agreement method based on PUF (Physical Unclonable Function)

Abstract

The invention discloses a lightweight vehicle intranet identity authentication and key negotiation method based on a PUF (Physical Unclonable Function). The method comprises a system initialization stage, a PUF registration stage, an identity authentication and key negotiation stage and a block chain synchronization stage. The method is oriented to an automobile domain architecture, direct low-cost identity authentication is carried out on the electronic control unit by utilizing the PUF (namely a physical unclonable function), the necessity of installing safety hardware on the electronic control unit can be eliminated, and secret key leakage is prevented; meanwhile, symmetric cryptography is adopted, a hash function, a pseudo-random function and a Lagrange interpolation formula are combined to balance the speed and safety of the key negotiation process of the electronic control unit, and compared with an existing vehicle intranet identity authentication and key negotiation method, the method has remarkable performance advantages.

Description

Technical Field

[0001] The present invention relates to vehicle network security and vehicle-mounted communication technology, and in particular to a PUF-based lightweight in-vehicle network identity authentication and key negotiation method. Background Art

[0002] The next generation of service-oriented automotive domain architecture modularizes a large number of distributed electronic control units and integrates them into a few high-performance domain controllers. The in-vehicle system is generally divided into the power domain, chassis domain, body domain, infotainment domain, and ADAS domain. The in-vehicle network system using domain architecture can well cope with the growing complexity and computing needs, which is the expectation of the new generation of car consumers and the development trend of the automotive industry.

[0003] However, due to the lack of a strong security mechanism in the in-vehicle network, it is difficult to guarantee the reliability, confidentiality, integrity of the system, as well as key requirements such as ECU authentication and key distribution. It is crucial to design an authentication and key agreement (AKA) method suitable for in-vehicle networks. Through the AKA method, different communication entities in the car can securely negotiate and generate keys, which can be used as inputs to the key derivation function to generate a series of short-term session keys. These short-term session keys, combined with existing message authentication codes and symmetric encryption functions, can comprehensively improve the security of in-vehicle communications.

[0004] PUF, or Physical Unclonable Function, is a chip-level security technology that uses the unique physical properties of integrated circuit chips to produce a unique device response that cannot be cloned for a given input. This technology provides a digital fingerprint for the physical chip and is an important solution for hardware authentication on resource-constrained electronic devices, with the advantages of being lightweight and unique.

[0005] However, there are some shortcomings in the existing research. In the document "A lightweight privacy-preserving batch authentication method for vehicle networks based on PUF", the authentication of vehicles and roadside units is completely dependent on a single trusted center. When the trusted center is attacked by DoS, the entire system will not work properly. The document "A lightweight identity authentication and key negotiation method for vehicle networks based on PUF" uses the elliptic curve Diffie-Hellman key exchange method for key negotiation, but the elliptic curve algorithm has a high dependence on hardware, especially during implementation, and is vulnerable to side channel attacks.

[0006] Blockchain is a decentralized distributed ledger that is tamper-proof, secure and reliable. It combines distributed storage, peer-to-peer transmission, consensus mechanism, cryptography and other technologies to record transactions and information through an ever-growing data block chain to ensure data security and transparency. The application of blockchain technology will greatly improve the integrity and efficiency of key establishment, and has the robustness to resist various attacks such as denial of service and side channel attacks. Summary of the invention

[0007] Purpose of the invention: The purpose of the present invention is to solve the deficiencies in the prior art and provide a lightweight in-vehicle network identity authentication and key negotiation method based on PUF. By using PUF to authenticate the electronic control unit, the present invention does not need to embed any secure storage hardware in the electronic control unit to save long-term keys, effectively reducing the risk of key leakage. In order to ensure the lightness of the key negotiation process between electronic control units, the present invention innovatively constructs a lightweight authentication key negotiation mechanism based on the Lagrange interpolation formula to eliminate the reliance on resource-intensive public key encryption technology. At the same time, a private blockchain is used to reliably and in real time maintain the consistency of challenge-response data between domain controllers, enhance network resilience, and simplify maintenance.

[0008] Technical solution: A lightweight PUF-based in-vehicle network identity authentication and key negotiation method of the present invention comprises the following steps:

[0009] Step (1), system initialization stage;

[0010] The OEM and the car brand jointly formulate appropriate initial parameters Params = {h1, h2, h3, h4} and write them into the electronic control unit ECU (Electronic Control Unit) and domain controller DC (Domain Controller) they produce; h1, h2, h3, h4 are four different hash functions;

[0011] Step (2), PUF registration phase;

[0012] The car brand registers the challenge-response pair CRP (Challenge-Response Pair) for all electronic control units in the car to the trusted platform module TPM (Trusted Platform Module); specifically, the i-th electronic control unit ECU i First, pass your unique ID i To the kth domain controller DC k Initiate a registration request, domain controller DC k After receiving the registration request, the electronic control unit ECU i Send Challenge Electronic Control Unit ECU i After receiving the challenge, the physical unclonable function PUF(·) generates the corresponding response {R1, R2, …, R N} and returns to the domain controller DC k , domain controller DC k Finally, {idi ,(C1,R1),(C2,R2),…,(C N ,R N )} is stored in its own trusted platform module; N is the number of challenges and responses;

[0013] Step (3), identity authentication and key negotiation phase, that is, whenever the vehicle is started, the domain controller DC k Initiate an authentication negotiation request to wake up two different electronic control units ECU i and ECU j , identity authentication and key negotiation are performed based on the challenge-response mechanism. The specific method is as follows:

[0014] Step (3.1), whenever the vehicle is started, the domain controller DC k Broadcast authentication negotiation request req={id i ,C i ,id j ,C j ,t p}, where id i and id j They are the ECUs of the two negotiating parties. i and ECU j The other electronic control units that receive the request will discard the data frame. i and C j ECU i and ECU j Challenges

[0015] Step (3.2), Electronic Control Unit ECU i Once the request req is received, it is judged by |t p -t cur |<ΔT is true to check the freshness of the request req, where t p ,t cur and ΔT are the timestamp when the request is sent, the timestamp when the request is received, and the maximum valid time interval preset by the car brand;

[0016] If not, ignore the request and terminate the process. If the equation is true, perform the following operations: First, the electronic control unit ECU i Calculate the response R using a physical unclonable function i =PUF(C i );Then, ECU i Pick a random number Calculate the temporary key s i =h1(R i ,n), delete R from memory i; Next, ECU i Get the current timestamp t i , and calculate α i =h2(s i ,id i ,n,t i ); Finally, ECU i Set the message tuple M1 = {id i ,n,t i ,α i}Send to bus;

[0017] At the same time, another electronic control unit ECU j Also check the freshness of the request req. If it is confirmed to be fresh, perform the above operations. Finally, the ECU j Send message tuple M2} to the bus;

[0018] Step (3.3), upon receiving the messages M1 and M2 from the two electronic control units, the domain controller DC k By judging |t i -t cur |<ΔT&|t j -t cur |<ΔT is true at the same time to check the freshness of messages M1 and M2, where t cur and ΔT are the current timestamp and the maximum valid time interval preset by the car brand. If not, terminate the process. If yes, continue with the following operations:

[0019] First, DC k Input(id i ,C i ) and (id j ,C i ) to its trusted platform module TPM, TPM retrieves the CRP list and outputs the corresponding response R i and R j , D.C. k Using R i and R j Calculate s′ i =h1(R i ,n) and s′ j =h1(R j ,m), then,DC k Calculate α′ i =h2(s′ i ,id i ,n,t i ) and β′ j =h2(s′ j ,id j ,m,t j), check the equation α′ i =α i &β′ j =β j Whether it is true at the same time to check the integrity of messages M1 and M2; if not, DC k Reject the message and terminate the process. If both are true, continue with the following operations; DC k Set x1=n and x2=m, and get the current timestamp t k , and calculate y1 = PRF(h1(s′ i ,t k ),x1),y2=PRF(h1(s′ j ,t k ),x2) and f(x),

[0020] DC k Pick a random number And meet Calculate f using a linear polynomial f(x) r =f(r), get the current timestamp t k , calculate γ k =h3(s′ i ,id i ,m,r,f r ,t k ) and δ k =j3(d′ j ,id j ,n,r,f r ,t k ); DC k Remove the used C from its TPM i -R i and C j -R j To prevent theft; DC k Send M3 = {m, r, f(r), t k ,γ k} and M4={n,r,f(r),t k ,δ k} to bus;

[0021] Step (3.4), ECU i After receiving the message M3, first determine |t k -t cur |<ΔT to check its freshness. If not, terminate the process. Otherwise, continue with the following operation:

[0022] ECU i Calculate γ′ k =h3(s i ,idi ,m,r,f r ,t k ), and check the equation γ′ k =γ k Is it true? If the equation is not true, ECU i Terminate the process. If successful, continue to perform the following operations:

[0023] ECU i Calculate PRF(h1(s i ,t k ),x1), where PRF(·) represents a pseudo-random function, and then using the coordinates (x1,y1) = (n,PRF(h1(s i ,t k ),x1)) and (x2,y2)=(r,f r ) calculates a linear polynomial f′(x);

[0024] Then ECU i Calculate k i , and finally calculate the session key sk ij =h4(k i ,id i ,n,id j ,m,r,f r ,t k );

[0025] At the same time, another electronic control unit ECU j After receiving the message M4, the above operation is also performed; finally the session key sk is obtained ji =h4(k j ,id i ,n,id j ,m,r,f r ,t k );

[0026] Step (4), the blockchain synchronization phase, is to synchronize the challenge-response data stored in different domain controllers online.

[0027] The present invention integrates a physical unclonable function on the electronic control unit for low-cost identity authentication, and installs a trusted platform module (TPM) on the domain controller to securely store challenge-response pair data. At the same time, the present invention fully adopts symmetric cryptography and Lagrange interpolation formula for lightweight key negotiation, and uses a hash message authentication code mechanism to ensure the authenticity of key negotiation messages. The present invention enables the in-vehicle electronic control unit to achieve safe and efficient identity authentication and key negotiation without using public key cryptography. The blockchain broadcast technology is used to synchronize the challenge-response pair data stored in the domain controller online to prevent denial of service attacks and side channel attacks.

[0028] Furthermore, the four hash functions in step 1 are defined as follows:

[0029]

[0030] The inputs of h1,h2,h3,h4 are 2, 4, 6, and 8 bit strings respectively, and the outputs of h1,h2,h3,h4 are all one bit string. An element of (a group modulo q).

[0031] Furthermore, in step 2, the electronic control unit ECU i Get unique identity and integrate physically unclonable functions into its chips;

[0032] Domain Controller DC k Select N different random numbers as challenges, denoted as

[0033] Electronic Control Unit ECU i After receiving the challenge, As the input of PUF, it outputs N corresponding responses {R1, R2, …, R N} and returns to DC k , that is, R j =PUF(C j ),j=1,2,…,N, where PUF(·) represents a physically unclonable function.

[0034] Furthermore, in step (3) during identity authentication and key negotiation;

[0035] Another electronic control unit ECU j Once the request req is received, the freshness of the request req is first checked. If it is not true, the request is ignored and the process is terminated. If it is true, the following operations are performed: First, the ECU j Calculate the response R using a physical unclonable function j =PUF(C i ), then pick a random number Calculate the temporary key s i =h1(R j ,m), delete R from memory j ; Next, ECU j Get the current timestamp t j , and calculate β j =h2(s j ,id j ,m,t j ); Finally, ECU j Set the message tuple M2 = {idj ,m,t j ,β j}Send to bus;

[0036] Domain Controller DC k According to the Lagrange interpolation formula, the coordinates (x1, y1) and (x2, y2) are used to calculate the first-order polynomial f(x):

[0037] f(x)=y1(x-x2)(x1-x2) -1 +y2(x-x1)(x2-x1) -1 =PRF(h1(s′ i ,t k ),n)×(xm)×(nm) -1 +PRF(h1(s′ j ,t k ),m)×(xn)×(mn) -1 mod q;

[0038] Electronic Control Unit ECU i The expression of f′(x) is calculated as follows:

[0039] f′(x)=y1(x-x2)(x1-x2) -1 +y2(x-x1)(x2-x1) -1 =PRF(h1(s i ,t k ),n)×(xr)×(nr) -1 +f r ×(xn)×(rn) -1 mod q;

[0040] k i The expression is:

[0041] k i =f′(0)=-r×PRF(h1(s i ,t k ),n)×(nr) -1 -n×f r ×(rn) -1 ;

[0042] For another electronic control unit ECU j The calculated expression of the first-order polynomial f″(x) is:

[0043] f″(x)=y1(x-x2)(x1-x2) -1 +y2(x-x1)(x2-x1) -1 =PRF(h1(sj ,t k ),m)×(xr)×(mr) -1 +f r ×(xm)×(rm) -1 mod q, and calculate k j =f″(0).

[0044] Furthermore, the detailed method of step (4) is:

[0045] Step (4.1), different domain controller nodes establish connections using a point-to-point communication protocol;

[0046] Step (4.2), once each domain controller node is connected to the network, it requests and verifies the latest block header information, including the hash value of the latest block and the previous block;

[0047] Step (4.3), after verifying the block header information, the domain controller node requests the latest block data or transaction data from other domain controller nodes;

[0048] Step (4.4), other domain controller nodes verify the integrity and validity of the acquired data. This step usually involves checking digital signatures, executing smart contracts (if applicable), and ensuring that the data complies with the consensus rules of the blockchain;

[0049] Step (4.5), after successful verification, the domain controller node adds the newly acquired data to the local copy of the blockchain.

[0050] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0051] (1) The present invention proposes a lightweight identity authentication and key agreement method tailored for the automotive domain architecture. It fully adopts symmetric cryptography and combines hash functions, pseudo-random functions and Lagrange interpolation formulas, which has lower computational and communication overheads than the existing technology.

[0052] (2) The present invention utilizes PUF to perform direct and low-cost authentication of the electronic control unit, effectively preventing key leakage, and eliminating the necessity of installing secure storage hardware on the electronic control unit and the reliance on pre-shared keys, thereby ensuring perfect forward secrecy.

[0053] (3) The security of the cryptographic protocol proposed in this invention is evaluated through formal security analysis and is able to resist various types of attacks, and has stronger security than other related methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a system framework diagram of the present invention;

[0055] Figure 2 This is a flow chart of the identity authentication and key agreement phase in one embodiment of the present invention;

[0056] Figure 3 This is a diagram comparing computational overheads in one embodiment of the present invention.

[0057] Figure 4 This is a comparison diagram of communication overhead in one embodiment of the present invention. DETAILED DESCRIPTION

[0058] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0059] like Figure 1 As shown, the PUF-based lightweight in-vehicle network identity authentication and key negotiation method of the present invention solves the security and efficiency problems of in-vehicle network communication in the prior art, involving two participating entities: an electronic control unit (ECU) and a domain controller (DC). An electronic control unit is a microcontroller that controls various systems of a vehicle and performs specific functions; it is the smallest unit of in-vehicle communication, has relatively low processing power, and is responsible for transmitting data collected by sensors along the bus to a domain controller or other electronic control units; it is assumed that the electronic control unit is an untrusted entity. The domain controller is responsible for coordinating and managing the communication and operation of various electronic control units in a specific field, and has strong computing and storage performance; the number of domain controllers in the vehicle is far less than the number of electronic control units. At the same time, the domain controller also acts as a blockchain node, and can synchronize its own stored challenge-response pair data with other domain controller nodes in an online manner.

[0060] In order to facilitate the understanding of the technical solution of this embodiment, the meanings of the relevant variables are explained, and the specific contents are shown in Table 1.

[0061] Table 1

[0062]

[0063] The PUF-based lightweight in-vehicle network identity authentication and key negotiation method of this embodiment specifically includes the following steps:

[0064] Step (1), system initialization stage;

[0065] OEMs and car brands jointly formulate appropriate initial parameters Params = {h1, h2, h3, h4} and write them into the electronic control units, ECUs and domain controllers DCs they produce; h1, h2, h3, h4 are four different hash functions;

[0066] Step (2), PUF registration phase;

[0067] The car brand registers challenge-response pairs CRP for all electronic control units in the car to the trusted platform module TPM; specifically, the i-th electronic control unit ECU i First, pass your unique ID i To the kth domain controller DC k Initiate a registration request, domain controller DC k After receiving the registration request, the electronic control unit ECU i Send Challenge Electronic Control Unit ECU i After receiving the challenge, the physical unclonable function PUF(·) generates the corresponding response {R1, R2, …, R N} and returns to the domain controller DC k , domain controller DC k Finally, {id i ,(C1,R1),(C2,R2),…,(C N ,R N )} is stored in its own trusted platform module; N is the number of challenges and responses;

[0068] Step (3), identity authentication and key negotiation phase, that is, whenever the vehicle is started, the domain controller DC k Initiate an authentication negotiation request to wake up two different electronic control units ECU i and ECU j , identity authentication and key negotiation are performed based on the challenge-response mechanism. The specific method is as follows:

[0069] Step (3.1), whenever the vehicle is started, the domain controller DC k Broadcast authentication negotiation request req={id i ,C i ,id j ,C j ,t p}, where id i and id j They are the ECUs of the two negotiating parties. i and ECU j The other electronic control units that receive the request will discard the data frame. i and C j ECU i and ECU j Challenges

[0070] Step (3.2), Electronic Control Unit ECU i Once the request req is received, it is judged by |t p -t cur|<ΔT is true to check the freshness of the request req, where t p ,t cur and ΔT are the timestamp when the request is sent, the timestamp when the request is received, and the maximum valid time interval preset by the car brand;

[0071] If not, ignore the request and terminate the process. If the equation is true, perform the following operations: First, the electronic control unit ECU i Calculate the response R using a physical unclonable function i =PUF(C i );Then, ECU i Pick a random number Calculate the temporary key s i =h1(R i ,n), delete R from memory i ; Next, ECU i Get the current timestamp t i , and calculate α i =h2(s i ,id i ,n,t i ); Finally, ECU i Set the message tuple M1 = {id i ,n,t i ,α i}Send to bus;

[0072] At the same time, another electronic control unit ECU j Also check the freshness of the request req. If it is confirmed to be fresh, perform the above operations. Finally, the ECU j Send message tuple M2} to the bus;

[0073] Step (3.3), upon receiving the messages M1 and M2 from the two electronic control units, the domain controller DC k By judging |t i -t cur |<ΔT&|t j -t cur |<ΔT is true at the same time to check the freshness of messages M1 and M2, where t cur and ΔT are the current timestamp and the maximum valid time interval preset by the car brand. If not, terminate the process. If yes, continue with the following operations:

[0074] First, DC k Input(id i ,C i ) and (id j ,C i) to its trusted platform module TPM, TPM retrieves the CRP list and outputs the corresponding response R i and R j , D.C. k Using R i and R j Calculate s′ i =h1(R i ,n) and s′ j =h1(R j ,m), then,DC k Calculate α′ i =h2(s′ i ,id i ,n,t i ) and β′ j =h2(s′ j ,id j ,m,t j ), check the equation α′ i =α i &β′ j =β j Whether it is true at the same time to check the integrity of messages M1 and M2; if not, DC k Reject the message and terminate the process. If both are true, continue with the following operations; DC k Set x1=n and x2=m, and get the current timestamp t k , and calculate y1 = PRF(h1(s′ i ,t k ),x1),y2=PRF(h1(s′ j ,t k ),x2) and f(x), domain controller DC k Pick a random number And meet Calculate f using a linear polynomial f(x) r =f(r), get the current timestamp t k , calculate γ k =h3(s′ i ,id i ,m,r,f r ,t k ) and δ k =h3(s′ j ,id j ,n,r,f r ,t k ); DC k Remove the used C from its TPM i -R i and C j -R j To prevent theft; DCk Send M3 = {m, r, f(r), t k ,γ k} and M4={n,r,f(r),t k ,δ k} to the bus; t k is the current timestamp, δ k is the message verification code;

[0075] Step (3.4), ECU i After receiving the message M3, first determine |t k -t cur |<ΔT to check its freshness. If not, terminate the process. Otherwise, continue with the following operation:

[0076] ECU i Calculate γ′ k =h3(s i ,id i ,m,r,f r ,t k ), and check the equation γ′ k =γ k Is it true? If the equation is not true, ECU i Terminate the process. If successful, continue to perform the following operations:

[0077] ECU i Calculate PRF(h1(s i ,t k ),x1), where PRF(·) represents a pseudo-random function, and then using the coordinates (x1,y1) = (n,PRF(h1(s i ,t k ),x1)) and (x2,y2)=(r,f r ) calculates a linear polynomial f′(x);

[0078] Then ECU i Calculate k i , and finally calculate the session key sk ij =h4(k i ,id i ,n,id j ,m,r,f r ,t k );

[0079] At the same time, another electronic control unit ECU j After receiving the message M4, the above operation is also performed; finally the session key sk is obtained ji =h4(k j ,id i ,n,idj ,m,r,f r ,t k );

[0080] Step (4), the blockchain synchronization phase, is to synchronize the challenge-response data stored in different domain controllers online.

[0081] The four hash functions in step 1 of this embodiment are defined as follows:

[0082]

[0083] The inputs of h1,h2,h3,h4 are 2, 4, 6, and 8 bit strings respectively, and the outputs of h1,h2,h3,h4 are all one bit string. The elements in .

[0084] The electronic control unit ECU of this embodiment i Get unique identity and integrate physically unclonable functions into its chips;

[0085] Domain Controller DC k Select N different random numbers as challenges, denoted as

[0086] Electronic Control Unit ECU i After receiving the challenge, As the input of PUF, it outputs N corresponding responses {R1, R2, …, R N} and returns to DC k , that is, R j =PUF(C j ),j=1,2,…,N, where PUF(·) represents a physically unclonable function.

[0087] Step (3) of this embodiment is during the identity authentication and key negotiation process;

[0088] Another electronic control unit ECU j Once the request req is received, the freshness of the request req is first checked. If it is not true, the request is ignored and the process is terminated. If it is true, the following operations are performed: First, the ECU j Calculate the response R using a physical unclonable function j =PUF(C j ), then pick a random number Calculate the temporary key s j =h1(R j ,m), delete R from memory j ; Next, ECU j Get the current timestamp t j, and calculate β j =h2(s j ,id j ,m,t j ); Finally, ECU j Set the message tuple M2 = {id j ,m,t j ,β j}Send to bus;

[0089] Domain Controller DC k According to the Lagrange interpolation formula, the coordinates (x1, y1) and (x2, y2) are used to calculate the first-order polynomial f(x):

[0090] f(x)=y1(x-x2)(x1-x2) -1 +y2(x-x1)(x2-x1) -1 =PRF(h1(s′ i ,t k ),n)×(xm)×(nm) -1 +PRF(h1(s′ j ,t k ),m)×(xn)×(mn) -1 mod q;

[0091] Electronic Control Unit ECU i The expression of f′(x) is calculated as follows:

[0092] f′(x)=y1(x-x2)(x1-x2) -1 +y2(x-x1)(x2-x1) -1 =PRF(h1(s i ,t k ),n)×(xr)×(nr) -1 +f r ×(xn)×(rn) -1 mod q;

[0093] k i The expression is:

[0094] k i =f′(0)=-r×PRF(h1(s i ,t k ),n)×(nr) -1 -n×f r ×(rn) -1 ;

[0095] For another electronic control unit ECU jThe calculated expression of the first-order polynomial f″(x) is:

[0096] f″(x)=y1(x-x2)(x1-x2) -1 +y2(x-x1)(x2-x1) -1 =PRF(h1(s j ,t k ),m)×(xr)×(mr) -1 +f r ×(xm)×(rm) -1 mod q, and calculate k j =f″(0).

[0097] The detailed method of step (4) of this embodiment is:

[0098] Step (4.1), different domain controller nodes establish connections using a point-to-point communication protocol;

[0099] Step (4.2), once each domain controller node is connected to the network, it requests and verifies the latest block header information, including the hash value of the latest block and the previous block;

[0100] Step (4.3), after verifying the block header information, the domain controller node requests the latest block data or transaction data from other domain controller nodes;

[0101] Step (4.4), other domain controller nodes verify the integrity and validity of the acquired data;

[0102] Step (4.5), after successful verification, the domain controller node adds the newly acquired data to the local copy of the blockchain.

[0103] This example runs on the Ubuntu 17.0.0 operating system, with an Intel Core i7-12700 CPU and 8GB of memory. The execution time of the basic cryptographic operations in this example is measured by a cryptographic library called MIRACL. The time measurement method is to repeat an operation 5000 times (with 1 input or variable) and get the average execution time. Specifically, this example selects SHA-256 as the one-way hash function and uses two pairs of random numbers in Implement Lagrange interpolation operations on the PUF, treat the PUF operation as HMAC, and select HMAC to implement the PRF operation. Select HMAC-based KDF to implement the KDF operation.

[0104] In addition, this embodiment uses AES128-CBC as the symmetric encryption method, ECDSA as the signature algorithm (using the parameters of curve SECP160R1), and RSA as the asymmetric encryption algorithm. The experimental results are shown in Table 2.

[0105] Table 2

[0106] Cryptographic Operations Execution time (unit: microseconds) SHA-256 execution time 1.02 Lagrange interpolation formula execution time 1.64 Physical unclonable function execution time 2.00 Pseudo-random function execution time 2.02 Key derivation function execution time 19.24 Symmetric encryption or decryption execution time 0.13 Signature algorithm ECDSA execution time 289.40 Signature verification execution time 363.20 Asymmetric encryption execution time 1705.38 Asymmetric decryption execution time 1734.87

[0107] The actual application calculation cost of the technical solution of the present invention is compared with the calculation cost of other solutions. The results are as follows: Figure 3 As shown, whether it is the electronic control unit computing overhead, domain controller or gateway computing overhead or the total computing overhead, the technical solution of the present invention has obvious advantages. The actual application communication overhead of the technical solution of the present invention is compared with the communication overhead of other solutions. The results are as follows Figure 4 As shown, the total communication overhead of the technical solution of the present invention is the lowest.

Claims

1. A lightweight in-vehicle network identity authentication and key negotiation method based on PUF, characterized in that: The following steps are involved: Step (1), system initialization stage; OEMs and car brands jointly formulate appropriate initial parameters Params = {h1, h2, h3, h4} and write them into the electronic control units, ECUs and domain controllers DCs they produce; h1, h2, h3, h4 are four different hash functions; Step (2), PUF registration phase; The car brand registers challenge-response pairs CRP for all electronic control units in the car to the trusted platform module TPM; specifically, the i-th electronic control unit ECU i First, pass your unique ID i To the kth domain controller DC k Initiate a registration request, domain controller DC k After receiving the registration request, the electronic control unit ECU i Send Challenge Electronic Control Unit ECU i After receiving the challenge, the physical unclonable function PUF(·) generates the corresponding response {R1, R2, …, R N } and returns to the domain controller DC k , domain controller DC k Finally, {id i ,(C1,R1),(C2,R2),…,(C N ,R N )} is stored in its own trusted platform module; N is the number of challenges and responses; Step (3), identity authentication and key negotiation phase, that is, whenever the vehicle is started, the domain controller DC k Initiate an authentication negotiation request to wake up two different electronic control units ECU i and ECU j , identity authentication and key negotiation are performed based on the challenge-response mechanism. The specific method is as follows: Step (3.1), whenever the vehicle is started, the domain controller DC k Broadcast authentication negotiation request req={id i ,C i ,id j ,C j ,t p }, where id i and id j They are the ECUs of the two negotiating parties. i and ECU j The other electronic control units that receive the request will discard the data frame. i and C j ECU i and ECU j Challenges Step (3.2), Electronic Control Unit ECU i Once the request req is received, it is judged by |t p -t cur |<ΔT is true to check the freshness of the request req, where t p ,t cur and ΔT are the timestamp when the request is sent, the timestamp when the request is received, and the maximum valid time interval preset by the car brand; If not, ignore the request and terminate the process. If the equation is true, perform the following operations: First, the electronic control unit ECU i Calculate the response R using a physical unclonable function i =PUF(C i );Then, ECU i Pick a random number Calculate the temporary key s i =h1(R i ,n), delete R from memory i ; Next, ECU i Get the current timestamp t i , and calculate α i =h2(s i ,id i ,n,t i ); Finally, ECU i Set the message tuple M1 = {id i ,n,t i ,α i }Send to bus; At the same time, another electronic control unit ECU j Also check the freshness of the request req. If it is confirmed to be fresh, perform the above operations. Finally, the ECU j Send message tuple M2} to the bus; Step (3.3), upon receiving the messages M1 and M2 from the two electronic control units, the domain controller DC k By judging |t i -t cur |<ΔT&|t j -t cur |<ΔT is true at the same time to check the freshness of messages M1 and M2, where t cur and ΔT are the current timestamp and the maximum valid time interval preset by the car brand. If not, terminate the process. If yes, continue with the following operations: First, DC k Input(id i ,C i ) and (id j ,C i ) to its trusted platform module TPM, which retrieves the CRP list and outputs the corresponding response R i and R j , D.C. k Using R i and R j Calculate i ′=h1(R i ,n) and s j ′=h1(R j ,m), then,DC k Calculate α i ′=h2(s i ′,id i ,n,t i ) and β j ′=h2(s j ′,id j ,m,t j ), check the equation α i ′=α i &β j ′=β j Whether it is true at the same time to check the integrity of messages M1 and M2; if not, DC k Reject the message and terminate the process. If both are true, continue with the following operations; DC k Set x1=n and x2=m, and get the current timestamp t k , and calculate y1 = PRF(h1(s i ′,t k ),x1),y2=PRF(h1(s j ′,t k ),x2) and f(x), domain controller DC k Pick a random number And meet Calculate f using a linear polynomial f(x) r =f(r), get the current timestamp t k , calculate γ k =h3(s i ′,id i ,m,r,f r ,t k ) and δ k =h3(s j ′,id j ,n,r,f r ,t k ); DC k Remove the used C from its TPM i -R i and C j -R j To prevent theft; DC k Send M3 = {m, r, f(r), t k ,γ k } and M4={n,r,f(r),t k ,δ k } to the bus; t k is the current timestamp, δ k is the message verification code; Step (3.4), ECU i After receiving the message M3, first determine |t k -t cur |<ΔT to check its freshness. If not, terminate the process. Otherwise, continue with the following operation: ECU i Calculate γ′ k =h3(s i ,id i ,m,r,f r ,t k ), and check the equation γ′ k =γ k Is it true? If the equation is not true, ECU i Terminate the process. If successful, continue to perform the following operations: ECU i Calculate PRF(h1(s i ,t k ),x1), where PRF(·) represents a pseudo-random function, and then using the coordinates (x1,y1) = (n,PRF(h1(s i ,t k ),x1)) and (x2,y2)=(r,f r ) calculates a linear polynomial f′(x); Then ECU i Calculate k i , and finally calculate the session key sk ij =h4(k i ,id i ,n,id j ,m,r,f r ,t k ); At the same time, another electronic control unit ECU j After receiving the message M4, the above operation is also performed; finally the session key sk is obtained ji =h4(k j ,id i ,n,id j ,m,r,f r ,t k ); Step (4), the blockchain synchronization phase, is to synchronize the challenge-response data stored in different domain controllers online.

2. The PUF-based lightweight in-vehicle network identity authentication and key negotiation method according to claim 1, characterized in that: The four hash functions in step 1 are defined as follows: The inputs of h1,h2,h3,h4 are 2, 4, 6, and 8 bit strings respectively, and the outputs of h1,h2,h3,h4 are all one bit string. The elements in .

3. The PUF-based lightweight in-vehicle network identity authentication and key negotiation method according to claim 1, characterized in that: In step 2, the electronic control unit ECU i Get unique identity and integrate physically unclonable functions into its chips; Domain Controller DC k Select N different random numbers as challenges, denoted as Electronic Control Unit ECU i After receiving the challenge, As the input of PUF, it outputs N corresponding responses {R1, R2, …, R N } and returns to DC k , that is, R j =PUF(C j ),j=1,2,…,N, where PUF(·) represents a physically unclonable function.

4. The PUF-based lightweight in-vehicle network identity authentication and key negotiation method according to claim 1, characterized in that: Step (3) during identity authentication and key negotiation; Another electronic control unit ECU j Once the request req is received, the freshness of the request req is first checked. If it is not true, the request is ignored and the process is terminated. If it is true, the following operations are performed: First, the ECU j Calculate the response R using a physical unclonable function j =PUF(C j ), then pick a random number Calculate the temporary key s j =h1(R j ,m), delete R from memory j ; Next, ECU j Get the current timestamp t j , and calculate β j =h2(s j ,id j ,m,t j ); Finally, ECU j Set the message tuple M2 = {id j ,m,t j ,β j }Send to bus; Domain Controller DC k According to the Lagrange interpolation formula, the coordinates (x1, y1) and (x2, y2) are used to calculate the first-order polynomial f(x): f(x)=y1(x-x2)(x1-x2) -1 +y2(x-x1)(x2-x1) -1 =PRF(h1(s i ′,t k ),n)×(x-m)×(n-m) -1 +PRF(h1(s j ′,t k ),m)×(x-n)×(m-n) -1 modq; Electronic Control Unit ECU i The expression of f′(x) is calculated as follows: f′(x)=y1(x-x2)(x1-x2) -1 +y2(x-x1)(x2-x1) -1 =PRF(h1(s i ,t k ), n) × (xr) × (nr) -1 +f r ×(xn) ×(rn) -1 modq: k i The expression is: k i =f′(0)=-r×PRF(h1(s i ,t k ),n)×(no.) -1 -n×f r ×(rn) -1 ; For another electronic control unit ECU j The calculated expression of the first-order polynomial f″(x) is: f″(x)=y1(x-x2)(x1-x2) -1 +y2(x-x1)(x2-x1) -1 =PRF(h1(s j ,t k ),m)×(xr)×(mr) -1 +f r ×(xm)×(rm) -1 modq, and calculate k j =f″(0).

5. The PUF-based lightweight in-vehicle network identity authentication and key negotiation method according to claim 1, characterized in that: The detailed method of step (4) is: Step (4.1), different domain controller nodes establish connections using a point-to-point communication protocol; Step (4.2), once each domain controller node is connected to the network, it requests and verifies the latest block header information, including the hash value of the latest block and the previous block; Step (4.3), after verifying the block header information, the domain controller node requests the latest block data or transaction data from other domain controller nodes; Step (4.4), other domain controller nodes verify the integrity and validity of the acquired data; Step (4.5), after successful verification, the domain controller node adds the newly acquired data to the local copy of the blockchain.

Images