Batch authentication and dynamic group key agreement method for internet of vehicles

Abstract

This application provides a batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks. The method includes: in the third-party authentication phase, a roadside unit (Roadside Unit) aggregates multiple vehicle authentication requests for batch verification by a trusted center, and encodes the authentication response and group key calculation parameters into a single composite value using the Chinese Remainder Theorem for broadcasting. Vehicles extract verification information and their unique parameters through modulo operation to complete bidirectional authentication. In the dynamic group key negotiation phase, the Roadside Unit maps authenticated vehicles and itself as binary tree leaf nodes, recursively generating a public group key based on the node's public key and unique parameters. When member changes, only the affected path node information is locally updated. This application integrates authentication response and key negotiation information, reducing downlink channel bandwidth usage and decreasing the group key update complexity from linear to logarithmic levels. It ensures forward and backward security while meeting the real-time communication requirements of high-concurrency access and highly dynamic topology scenarios in V2X networks.

Description

Technical Field

[0001] This application belongs to the field of vehicle-to-everything (V2X) secure communication technology, specifically relating to a batch authentication and dynamic group key negotiation method for V2X. Background Technology

[0002] With the rapid development of smart cities and intelligent transportation systems, the Internet of Vehicles (IoV) has become a core infrastructure for improving road safety and traffic efficiency. Vehicles, roadside units, and trusted centers frequently exchange sensitive information, including vehicle status, traffic warnings, and control commands, placing extremely high demands on the real-time performance and security of communication. Especially during peak urban traffic hours or in densely populated areas, a large number of vehicles simultaneously access the network and request authentication. The high-speed movement of vehicles also causes them to frequently cross the coverage areas of different roadside units, resulting in a highly dynamic communication topology. Therefore, how to efficiently handle large-scale concurrent authentication requests and achieve secure key management in dynamic environments while ensuring the confidentiality and integrity of communication content is a critical challenge that urgently needs to be addressed in the field of IoV security.

[0003] In the prior art, patent application CN 118042464 A discloses a method for vehicle-to-everything (V2X) identity authentication and privacy protection based on federated learning and drones. This scheme uses drones as mobile nodes for local model aggregation and applies the Chinese Remainder Theorem to the construction of trust domains. Through a preset logical hierarchy, it achieves batch verification and dynamic management of member identities within a specific range. Its core logic focuses on using the mathematical isomorphism characteristics under a multi-level architecture to handle node admission and revocation. Patent application CN 119628817 A discloses an attribute-based dual access control data sharing method for V2X. This scheme focuses on fine-grained permission control in the data sharing process. It uses attribute-based encryption technology to construct a dual access control system. By embedding access policies into ciphertext and combining offline and online encryption mechanisms, it enables cloud servers to pre-filter false information and accurately distribute data to authorized users based on specific attribute combinations. Its core technology lies in using complex attribute mapping relationships to determine data accessibility. The patent application with publication number CN118945650 A discloses a federated learning method and system for privacy protection in the Internet of Vehicles. This solution aims to enhance the privacy and security of vehicles during the federated learning iteration process. It adopts a system in which a trusted center distributes dual private keys, and combines local model training with parameter aggregation of neighboring roadside units to form a collaborative learning protection mechanism based on model weight signature verification. In terms of dynamic management of members, it relies more on the periodic synchronization of global model updates and system public parameters.

[0004] The aforementioned existing technical solutions still have several shortcomings in practical applications. First, the CN 118042464 A and CN 118945650 A solutions mainly focus on local model aggregation through UAVs or roadside units under the federated learning framework. Their authentication logic is deeply coupled with the model training process. When vehicle nodes move at high speeds, causing drastic changes in network topology, the stability of the authentication link will be greatly challenged. Moreover, the authentication response phase lacks efficient information compression methods, and the authentication results of multiple vehicles need to occupy a large amount of downlink channel resources for distribution, which can easily lead to communication congestion. At the same time, the response of such solutions to the dynamic revocation of members often relies on the periodic update of the global model, making it difficult to achieve millisecond-level real-time key synchronization. In high-speed vehicle handover scenarios, there is a long security risk window period. Secondly, the CN 119628817 A scheme focuses on using attribute-based encryption to achieve fine-grained access control. Its significant drawback lies in its extremely high computational overhead. Bilinear mapping operations are too burdensome for terminals with limited computing resources, such as on-board units, and the encryption / decryption latency cannot meet the real-time requirements of vehicle-to-everything (V2X) security messages. When handling dynamic member management, this scheme typically requires redefining access policies and updating complex attribute private keys, lacking a lightweight recursive update mechanism. This leads to a sharp increase in system maintenance costs and key distribution pressure when a large number of vehicles frequently enter and exit the roadside unit's coverage area. In summary, existing technologies have room for improvement in terms of authentication real-time performance, communication load, and dynamic group management overhead. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, this application provides a batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks. The technical problem to be solved by this application is achieved through the following technical solution: A batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks includes: During the third-party authentication phase, the roadside unit aggregates multiple vehicle authentication requests received and forwards them to the Trusted Center. The Trusted Center then performs batch verification of the aggregated vehicle requests. After successful verification, the roadside unit aggregates the authentication response information from the Trusted Center for each vehicle and sends it as a single broadcast message. Each vehicle extracts its own verification information from this single broadcast message to complete two-way authentication. During the dynamic group key negotiation phase, the roadside unit maps the authenticated vehicles and itself to leaf nodes of a binary tree, and recursively generates a public group key based on the node information. When there is a change in members, the remaining members in the group update their group keys synchronously by locally updating the node information on the affected path of the binary tree and broadcasting the changed part.

[0006] Beneficial effects: First, by having the roadside unit aggregate multiple vehicle authentication requests during the third-party authentication phase and then forward them to the trusted center for batch verification, and by having the roadside unit aggregate the trusted center's authentication response into a single broadcast message for transmission, the system can effectively reduce the computational pressure on the trusted center when a large number of vehicles access the system concurrently, shorten the average waiting delay for a single authentication, and improve the system's high-concurrency processing capability during peak traffic periods.

[0007] Second, by using elliptic curve aggregation verification technology to aggregate multiple vehicle signatures into a single verification value for one-time verification, the problem of computational overhead increasing linearly with the number of vehicles in the traditional one-to-one sequential verification mode is avoided, and the computational load of the trusted center is significantly reduced while ensuring the security of identity authentication.

[0008] Third, by utilizing the Chinese Remainder Theorem to encode the authentication responses for different vehicles into a single composite value for broadcasting, and embedding the exclusive parameters of each vehicle participating in the key calculation into the broadcast message, the authentication information and key negotiation information are integrated. The vehicle can obtain authentication confirmation and key negotiation input simultaneously through a single modulo operation, which significantly reduces downlink channel bandwidth usage while achieving deep integration of the authentication process and the key generation process.

[0009] Fourth, by mapping authenticated vehicles and roadside units to leaf nodes of a binary tree during the dynamic group key negotiation phase, and recursively generating a public group key based on the node public key and exclusive parameters, the generation and updating of the group key no longer depend on linear traversal or complex attribute mapping calculations, effectively reducing the computational overhead of key management.

[0010] Fifth, when a new vehicle joins or an existing vehicle leaves, only the private keys of the nodes on the affected path of the binary tree need to be locally updated and the changed information needs to be broadcast. There is no need to rebuild the entire key tree or perform a complete key renegotiation process. The computational complexity of group key updates caused by member changes is reduced from linear to logarithmic O(log n) in the traditional scheme, which can meet the real-time requirements of key updates in the context of high-speed vehicle movement and frequent cross-regional switching in the Internet of Vehicles environment.

[0011] Sixth, by recursively updating the private keys of path nodes when a new vehicle joins, the newly joined vehicle cannot decrypt historical communication content before joining. Furthermore, by deleting the corresponding leaf node and updating the private keys of branch nodes when a vehicle leaves, the departed vehicle cannot deduce the updated group key after leaving. This approach strictly guarantees both forward and backward security of group communication with low computational overhead, making it suitable for secure communication needs in highly dynamic topology scenarios such as vehicle-to-everything (V2X) networks. The following will provide a more detailed description of this application in conjunction with the accompanying drawings and embodiments. Attached Figure Description

[0012] Figure 1This is a timing diagram of the initialization and third-party authentication provided in this application; Figure 2 A schematic diagram illustrating the key negotiation and update process in the case of vehicle joining provided in this application; Figure 3 This is a schematic diagram illustrating the key negotiation update process when the vehicle leaves the premises, as provided in this application. Detailed Implementation

[0013] The present application will be described in further detail below with reference to specific embodiments, but the implementation of the present application is not limited thereto.

[0014] This application proposes an authentication-driven batch authentication and group key collaborative generation method. Its core lies in deeply integrating the authentication process with the key negotiation process, achieving an integrated mechanism of "authentication equals key generation." Specifically, it includes the following mechanisms: A batch authentication mechanism based on aggregation verification and the Chinese Remainder Theorem (CRT) is proposed: a three-party mutual authentication protocol involving vehicles, RSUs, and TAs is designed. Batch authentication technology is introduced, utilizing elliptic curve aggregation verification to enable the TA to simultaneously verify multiple vehicle credentials, significantly reducing average computational overhead. Simultaneously, the Chinese Remainder Theorem is innovatively incorporated, with the RSU aggregating multiple authentication responses into a single numerical broadcast. The authentication parameters corresponding to each vehicle are embedded into the CRT congruence equation, ensuring the broadcast result carries both authentication and key generation information. The vehicle recovers not only the authentication result through modulo operations but also its unique parameters for participating in group key calculations. This approach significantly optimizes channel bandwidth utilization while ensuring the security of two-way authentication.

[0015] A dynamic group key negotiation algorithm based on a binary tree structure: This application does not use the traditional fixed-allocation binary tree structure, but instead dynamically constructs a key tree based on vehicle authentication parameters, mapping all authenticated vehicles and a portion of the RSU's public keys to leaf nodes of the tree. By recursively calculating the tree keys of branch nodes, efficient generation of the public group key is achieved. This algorithm reduces the complexity of key updates from linear to logarithmic, ensuring system response speed even under large-scale node fluctuations.

[0016] An efficient key protection mechanism for member changes: A dedicated tree structure update strategy is designed for vehicle joining and leaving. When a new vehicle joins, leaf nodes are added and the private keys of path nodes are recursively updated. When a vehicle leaves, subtree shifting and path recalculation ensure real-time updates of the group key without affecting other nodes in the tree. By combining ECDSA signature verification with hash chain calculation, forward and backward security of group communication is strictly guaranteed with low computational cost.

[0017] like Figure 1As shown, this application provides a batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) communication, including: During the vehicle registration phase, the vehicle submits its real identity information to the Trusted Center through a secure channel, and the Trusted Center assigns a long-term session key and encryption credentials to the vehicle. Before the vehicle first connects to the network, it submits its true identity information to the TA via a secure channel. After recording the identity, the TA assigns the vehicle a unique long-term session key and encrypted credentials. This information will serve as the vehicle's "identity card" to prove its legitimacy in subsequent insecure channels.

[0018] During the roadside unit registration phase, the roadside unit registers with the Trusted Center and obtains its identity identifier and long-term key.

[0019] Roadside units (RSUs) also need to register with the TA to obtain their unique identity and a long-term key for authentication, thereby acting as a trusted relay between vehicles and the center.

[0020] During the third-party authentication phase, the roadside unit aggregates multiple vehicle authentication requests received and forwards them to the Trusted Center. The Trusted Center then performs batch verification of the aggregated vehicle requests. After successful verification, the roadside unit aggregates the authentication response information from the Trusted Center for each vehicle and sends it as a single broadcast message. Each vehicle extracts its own verification information from this single broadcast message to complete two-way authentication. During the dynamic group key negotiation phase, the roadside unit maps the authenticated vehicles and itself to leaf nodes of a binary tree, and recursively generates a public group key based on the node information. When there is a change in members, the remaining members in the group update their group keys synchronously by locally updating the node information on the affected path of the binary tree and broadcasting the changed part.

[0021] In one specific embodiment of this application, during the third-party authentication stage, The vehicle generates an authentication request containing a timestamp and a temporary public key, signs the authentication request using the cryptographic credentials obtained during the vehicle registration phase, and then sends it to the roadside unit. When a vehicle travels to the RSU coverage area and needs to join group communication, it generates a request message locally containing a timestamp and a temporary public key, signs it using the private parameters obtained during the registration phase, and then sends it to the RSU.

[0022] The roadside unit collects authentication requests from multiple vehicles within a preset time window, aggregates and packages the collected authentication requests, and encapsulates the aggregated data packets using the identity identifier and long-term key obtained during the roadside unit registration phase before forwarding them to the trusted center. The RSU collects authentication requests from multiple vehicles within a preset time window. To save resources, the RSU does not forward these requests one by one, but instead aggregates them and packages them together before sending them to the TA.

[0023] After receiving the data, the Trusted Center uses aggregated verification technology to perform a one-time batch legality verification of the identity credentials of multiple vehicles in the aggregated package. After the verification is passed, it generates group authentication parameters for the entire group and feeds the group authentication parameters back to the roadside unit. The Trust Center described in this application utilizes elliptic curve aggregation verification technology to aggregate the signatures of multiple vehicles contained in the aggregation request into a single verification value, and verifies the legality of all vehicle signatures through a single elliptic curve dot product operation.

[0024] Upon receiving the message, the TA first verifies the legitimacy of the RSU, and then uses aggregated verification technology to verify the legitimacy of the identity credentials of all vehicles at once. After successful verification, the TA generates authentication parameters for the entire group and sends them back to the RSU.

[0025] This application introduces a third-party batch authentication mechanism based on elliptic curve aggregation verification. During the vehicle access phase, the Trusted Center (TA) performs a one-time batch verification of the massive number of vehicle signatures collected by the RSU, replacing the traditional one-by-one verification mode. This mechanism greatly reduces the computational burden on the central node while ensuring the authenticity of vehicle identities, effectively handling sudden access requests during peak periods of vehicle networking and reducing overall system latency.

[0026] After receiving the group authentication parameters, the roadside unit uses the Chinese Remainder Theorem to encode the authentication response for different vehicles into a single composite value and broadcasts it. After receiving the broadcast, each vehicle extracts its own verification information from the single composite value by performing a modulo operation with its own temporary public key parameters as the modulus, thereby completing the two-way authentication between the vehicle and the roadside unit.

[0027] After receiving feedback from the TA, the RSU uses the Chinese Remainder Theorem (CRT) to encode the authentication responses for different vehicles into a composite value and broadcasts it. Each vehicle, upon receiving the broadcast, extracts its own verification information through a specific modulo operation. If the verification matches, two-way authentication is completed between the vehicle and the RSU, and an initial secure connection is established.

[0028] This application designs an authentication response aggregation and distribution method based on the Chinese Remainder Theorem (CRT). After receiving the authentication feedback from the TA, the RSU no longer sends response packets to each vehicle individually. Instead, it uses the Chinese Remainder Theorem to aggregate multiple authentication parameters into a composite value for broadcast. Simultaneously, the authentication parameters corresponding to each vehicle are embedded into the CRT congruence equation, so that the broadcast result carries both authentication information and key generation information. The vehicle recovers not only the authentication result through modulo operations but also its own parameters for participating in the group key calculation. This design logically achieves "multi-information integration," significantly reducing downlink channel bandwidth usage and solving the problem of wireless communication congestion in large-scale vehicle concurrency environments.

[0029] In one specific embodiment of this application, the step of encoding the authentication response for different vehicles into a single composite value and broadcasting it using the Chinese Remainder Theorem includes: The roadside unit constructs a set of congruent equations based on the authentication parameters corresponding to each vehicle. The modulus of each congruent equation is the temporary public key or identity identifier related parameters of each vehicle, and the remainder is the authentication result information corresponding to the vehicle and the exclusive parameters for calculating the participating group key. The system of congruence equations is solved using the Chinese Remainder Theorem to obtain a unique composite value, which is then broadcast. This single composite value simultaneously carries the authentication result information of each vehicle and the exclusive parameters required for each vehicle to participate in subsequent dynamic group key negotiation. This allows vehicles to simultaneously obtain authentication confirmation and key negotiation input from a single broadcast message, achieving the integration of the authentication process and the key generation process.

[0030] In one specific embodiment of this application, During the dynamic group key negotiation phase, the roadside unit maps the vehicles that have passed third-party authentication and itself to leaf nodes of a binary tree. Based on the node public key corresponding to each leaf node and the exclusive parameters for participating in the group key calculation extracted from the single composite value by each vehicle, a public group key is generated through recursive calculation. like Figure 2 As shown, when a new vehicle joins through third-party authentication, the roadside unit adds a leaf node for the new vehicle in the binary tree and recursively updates the private keys of the affected nodes on the path from the new leaf node to the root node, and broadcasts the new node information on the affected path; the existing vehicle updates the tree structure stored locally according to the received broadcast information, and recursively calculates the new group key using the encrypted credentials obtained during the registration phase and the exclusive parameters. When a new vehicle joins via an authentication request, the RSU adds a new leaf node to the binary tree and updates the tree structure. The RSU only needs to broadcast the new node information on the affected paths, and existing vehicles update their local tree structure based on the broadcast information and recursively calculate the new group key. This ensures that newly joined vehicles cannot decrypt historical communication records prior to their joining.

[0031] like Figure 3 As shown, when a vehicle leaves, the roadside unit deletes the leaf node corresponding to the vehicle from the binary tree, adjusts the logical position of the remaining nodes to maintain the integrity of the tree structure, updates the private keys of the affected branch nodes, and broadcasts the change information; the remaining vehicles update their local tree structure according to the received broadcast information, and recursively calculate the new group key using the encryption credentials they obtained during the registration phase and the exclusive parameters.

[0032] When a vehicle leaves the RSU's range or voluntarily leaves, the RSU removes the node corresponding to that vehicle from the tree and adjusts the logical positions of the remaining nodes. Subsequently, the RSU updates the affected branch nodes and broadcasts the change information. The remaining vehicles synchronously update their keys to ensure that vehicles that have left cannot continue to eavesdrop on subsequent intra-group communications (backward security).

[0033] This application, while ensuring high-strength security, achieves batch processing of authentication and lightweight key updates, greatly improving the operational efficiency of vehicle-to-everything (V2X) networks in large-scale dynamic scenarios.

[0034] This application proposes an authentication-driven dynamic key tree construction mechanism. Instead of using a fixed-allocation binary tree structure, this application dynamically constructs the key tree based on vehicle authentication parameters. Group members are mapped to leaf nodes of the binary tree, and the group key is composed of the node public key, authentication parameters, and tree structure relationships, rather than simply generating the group session key through recursive hash calculation. During the dynamic group key negotiation phase, when a new vehicle joins or an existing vehicle leaves, the computational complexity of updating the group key is logarithmic O(logn), where n is the number of authenticated vehicles in the current group. Compared to traditional linear key distribution schemes, this application reduces the key update complexity during member changes from O(n) to O(logn).

[0035] In one specific embodiment of this application, the step of generating a public group key through recursive calculation based on the node public key corresponding to each leaf node and the exclusive parameters of the participating group key calculation obtained by each vehicle from the single composite value specifically includes: The vehicle public key, a partial public key of the roadside unit, and the specific parameters corresponding to each leaf node in the binary tree are taken as input. A one-way hash function is used to perform hash calculation on the combination information of the sibling nodes. The tree key of each branch node is recursively calculated from bottom to top until the root node, and the tree key of the root node is used as the current public group key.

[0036] In one specific embodiment of this application, when a new vehicle joins through third-party authentication, the private keys of the affected nodes on the path from the new leaf node to the root node are recursively updated and the new node information is broadcast. This prevents the newly joined vehicle from using the group key obtained after joining to decrypt its historical communication content before joining, thereby ensuring forward security of group communication. When a vehicle leaves, the corresponding leaf node is deleted and the private keys of the affected branch nodes are updated and the change information is broadcast. This prevents the departed vehicle from using the old group key parameters it holds to deduce the updated group key after leaving, thereby ensuring backward security of group communication.

[0037] In one specific embodiment of this application, the roadside unit deletes the leaf node corresponding to the vehicle from the binary tree and adjusts the logical positions of the remaining nodes to maintain the integrity of the tree structure, including: If the sibling node of the leaf node becomes an isolated node after deletion, the sibling node is moved up to the original parent node position to maintain the integrity and balance of the binary tree.

[0038] In one specific embodiment of this application, This application implements an efficient mechanism to ensure forward and backward security for group communication. During vehicle changes, recursive updates of the private keys of nodes along the binary tree path and broadcasting of the tree's public key ensure that newly joined vehicles cannot access historical communication information, while vehicles leaving the group cannot deduce subsequent group keys using old parameters. This mechanism maintains the continuous security of group communication in dynamic topologies with relatively low computational cost.

[0039] Combination Figures 1 to 3 In the initialization and registration phase, the Trusted Center (TA) generates public system parameters and assigns long-term session keys and identity credentials to vehicles and Roadside Units (RSUs). During the third-party authentication process, vehicles send signed authentication requests to the RSUs. The RSUs aggregate and forward multiple collected requests. Upon receiving these requests, the TA uses batch verification technology to simultaneously verify the identities of multiple vehicles and generates authentication responses. Subsequently, the RSUs innovatively utilize the Chinese Remainder Theorem (CRT) to aggregate the response information from each vehicle into a single numerical broadcast. The vehicles complete bidirectional authentication and establish a connection through modulo operations. In the dynamic group key negotiation phase, the system maintains a binary tree structure with vehicles and RSUs as leaf nodes, recursively generated based on the node public keys and authentication parameters using a one-way hash function combined with a key tree algorithm. Figure 2When a new vehicle requests to join, the RSU adds a new node to the tree structure and updates the path key of the corresponding branch. Existing vehicles recursively calculate the new group key using the received tree public key to ensure forward security. Figure 3 When a vehicle leaves, the RSU removes the corresponding node and adjusts the tree topology, recalculates the tree key for the affected path and broadcasts it. The remaining vehicles are updated synchronously to generate new keys, thereby strictly ensuring backward security and realizing lightweight dynamic key management throughout the entire lifecycle.

[0040] This application significantly improves the system's real-time processing capabilities in extremely high-concurrency scenarios by introducing decoupled batch authentication and rapid aggregation verification technologies. Compared to existing technologies one and three, which deeply couple the authentication process with the federated learning training cycle and the local aggregation of drones / RSUs, this application achieves independence and efficiency in the authentication logic. Existing solutions are often limited by the iteration frequency of model training or the movement trajectory of physical nodes, resulting in uncertain authentication latency. This application directly utilizes the mathematical isomorphism of elliptic curves, allowing the Trusted Center (TA) to process massive amounts of vehicle credentials simultaneously across regions without relying on auxiliary business processes. This mechanism effectively alleviates the computational bottleneck of the central node during peak periods, enabling the average authentication latency for a single vehicle to reach millisecond levels, perfectly adapting to the extremely high real-time requirements of safety warning scenarios in autonomous driving.

[0041] This application utilizes the Chinese Remainder Theorem (CRT) to implement a "multi-signal convergence" response aggregation mechanism, which significantly reduces downlink channel bandwidth loss and channel contention. Existing technologies, even with batch verification in the authentication feedback phase, often require individual distribution of response information to each terminal or multiple rounds of segmented broadcasting, easily leading to downlink congestion in densely populated areas. This application innovatively uses the Reliable State Unit (RSU) to aggregate massive authentication results into a single value for global broadcast. Vehicles can accurately obtain their own verification results simply through modulo operations. This aggregation broadcast mode improves spectrum utilization several times without sacrificing bidirectional authentication security, significantly reduces communication costs under extremely congested conditions, and enhances network stability.

[0042] The binary tree-structured dynamic group key negotiation method adopted in this application achieves strict security isolation for dynamic member management while ensuring extremely low computational overhead. Compared to the high encryption and decryption computation burden caused by attribute-based encryption in existing technology 2, or the key synchronization lag problem caused by federated learning parameter updates in existing technology 3, this application directly reduces the key update complexity from linear level (O(n)) or even more complex attribute mapping calculations to logarithmic level (O(logn)) by constructing a logical binary tree. In dynamic environments where vehicles enter or leave the RSU coverage area at high speeds, this application can reconstruct the group key in real time with minimal computational cost, ensuring both forward and backward security in stringent topology changes, and completely solving the security vulnerabilities caused by "key update lag" in large-scale dynamic vehicle networks. The third-party authentication and dynamic group key negotiation protocol proposed in this application has extremely broad application prospects in fields such as intelligent transportation, autonomous driving, and urban emergency management.

[0043] With the widespread adoption of 5G and 6G communication technologies, the demands on high-concurrency processing capabilities for the Internet of Vehicles (IoV) are becoming increasingly stringent, especially in scenarios with extremely high vehicle density, such as urban intersections, large parking lots, or highway toll stations. This application, through batch verification technology and an aggregation response mechanism based on the Chinese Remainder Theorem (CRT), effectively supports the instantaneous access needs of massive numbers of terminals, ensuring ultra-low latency and high reliability of system communication during peak traffic periods. This provides a solid foundation for data security access for the real-time scheduling of city-level traffic management systems.

[0044] In the field of autonomous driving cooperative perception and platooning, vehicles frequently need to form temporary dynamic communication groups to share sensor data and road condition warning information in real time. This application, with its logarithmic complexity binary tree key management mechanism, perfectly adapts to the dynamic characteristics of vehicles frequently crossing the coverage area of ​​roadside units (RSUs) during high-speed driving. While ensuring high-security information transmission and preventing malicious eavesdropping, it significantly reduces the resource consumption of onboard computing units during key updates, allowing vehicles to allocate more computing power to environmental perception and decision-making, thus significantly improving the overall operational efficiency of the autonomous driving system.

[0045] Furthermore, the architectural advantages of this technical solution give it strong cross-industry migration capabilities. Besides the Internet of Vehicles (IoV), this application can also be widely applied to complex topology scenarios such as drone swarm collaborative operations, industrial IoT cluster control, and mobile edge computing (MEC), where stringent security checks are required for the dynamic addition and removal of nodes. In these fields, this application can ensure strict forward and backward security protection even in environments with rapid node movement and drastic topology changes, preventing the leakage of sensitive information and providing crucial lightweight security technology support for building a fully connected, intelligent sensing network across all scenarios.

[0046] It is worth noting that the terms "first" and "second" in this application are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0047] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of this application and should not be construed as limiting the specific implementation of this application to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of this application, and all such modifications or substitutions should be considered within the scope of protection of this application.

Claims

1. A batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks, characterized in that, include: During the third-party authentication phase, the roadside unit aggregates multiple vehicle authentication requests received and forwards them to the Trust Center, which then performs batch verification of the aggregated vehicle requests. After successful verification, the roadside unit aggregates the authentication response information of each vehicle from the Trusted Center and sends it as a single broadcast message. Each vehicle extracts its own verification information from the single broadcast message to complete two-way authentication. During the dynamic group key negotiation phase, the roadside unit maps the authenticated vehicles and itself to leaf nodes of a binary tree, and recursively generates a public group key based on the node information. When there is a change in members, the remaining members in the group update their group keys synchronously by locally updating the node information on the affected path of the binary tree and broadcasting the changed part.

2. The batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks according to claim 1, characterized in that, Prior to the aforementioned third-party certification stage, there are also vehicle registration and roadside unit registration stages; During the vehicle registration phase, the vehicle submits its real identity information to the Trusted Center through a secure channel, and the Trusted Center assigns a long-term session key and encryption credentials to the vehicle. During the roadside unit registration phase, the roadside unit registers with the Trusted Center and obtains its identity identifier and long-term key.

3. The batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks according to claim 2, characterized in that, During the third-party certification phase The vehicle generates an authentication request containing a timestamp and a temporary public key, signs the authentication request using the cryptographic credentials obtained during the vehicle registration phase, and then sends it to the roadside unit. The roadside unit collects authentication requests from multiple vehicles within a preset time window, aggregates and packages the collected authentication requests, and encapsulates the aggregated data packets using the identity identifier and long-term key obtained during the roadside unit registration phase before forwarding them to the trusted center. After receiving the data, the Trusted Center uses aggregated verification technology to perform a one-time batch legality verification of the identity credentials of multiple vehicles in the aggregated package. After the verification is passed, it generates group authentication parameters for the entire group and feeds the group authentication parameters back to the roadside unit. After receiving the group authentication parameters, the roadside unit uses the Chinese Remainder Theorem to encode the authentication response for different vehicles into a single composite value and broadcasts it. After receiving the broadcast, each vehicle extracts its own verification information from the single composite value by performing a modulo operation with its own temporary public key parameters as the modulus, thereby completing the two-way authentication between the vehicle and the roadside unit.

4. The batch authentication and dynamic group key negotiation method for vehicle networking according to claim 3, characterized in that, The method of using aggregated verification technology to perform a one-time batch legality verification of the identity credentials of multiple vehicles in the aggregated package includes: The Trust Center uses elliptic curve aggregation verification technology to aggregate the signatures of multiple vehicles contained in the aggregation request into a single verification value, and verifies the legality of all vehicle signatures through a single elliptic curve dot product operation.

5. The batch authentication and dynamic group key negotiation method for vehicle networking according to claim 3, characterized in that, The method of encoding authentication responses for different vehicles into a single composite value and broadcasting it using the Chinese Remainder Theorem includes: The roadside unit constructs a set of congruent equations based on the authentication parameters corresponding to each vehicle. The modulus of each congruent equation is the temporary public key or identity identifier related parameters of each vehicle, and the remainder is the authentication result information and exclusive parameters for participating in the group key calculation of the vehicle. The system of congruence equations is solved using the Chinese Remainder Theorem to obtain a unique composite value, which is then broadcast. This single composite value simultaneously carries the authentication result information of each vehicle and the exclusive parameters required for each vehicle to participate in subsequent dynamic group key negotiation. This allows vehicles to simultaneously obtain authentication confirmation and key negotiation input from a single broadcast message, achieving the integration of the authentication process and the key generation process.

6. The batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks according to claim 5, characterized in that, During the dynamic group key negotiation phase, the roadside unit maps the vehicles that have passed third-party authentication and itself to leaf nodes of a binary tree. Based on the node public key corresponding to each leaf node and the exclusive parameters for participating in the group key calculation extracted from the single composite value by each vehicle, a public group key is generated through recursive calculation. When a new vehicle joins through third-party authentication, the roadside unit adds a leaf node for the new vehicle in the binary tree and recursively updates the private keys of the affected nodes on the path from the new leaf node to the root node, and broadcasts the new node information on the affected path; the existing vehicle updates the tree structure stored locally according to the received broadcast information, and recursively calculates the new group key using the encrypted credentials obtained during the registration phase and the exclusive parameters. When a vehicle leaves, the roadside unit removes the leaf node corresponding to the vehicle from the binary tree, adjusts the logical position of the remaining nodes to maintain the integrity of the tree structure, updates the private key of the affected branch nodes, and broadcasts the change information. The remaining vehicles update their local tree structure based on the received broadcast information and recursively calculate the new group key using the encrypted credentials they obtained during the registration phase and the exclusive parameters.

7. The batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks according to claim 6, characterized in that, The public group key is generated recursively based on the node public key corresponding to each leaf node and the exclusive parameters for calculating the participation group key obtained by each vehicle from the single composite value. Specifically, this includes: The vehicle public key, a partial public key of the roadside unit, and the specific parameters corresponding to each leaf node in the binary tree are taken as input. A one-way hash function is used to perform hash calculation on the combination information of the sibling nodes. The tree key of each branch node is recursively calculated from bottom to top until the root node, and the tree key of the root node is used as the current public group key.

8. The batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks according to claim 6, characterized in that, When a new vehicle joins through third-party authentication, the private keys of affected nodes along the path from the new leaf node to the root node are recursively updated, and the new node information is broadcast. This prevents the newly joined vehicle from using the group key obtained after joining to decrypt its historical communication content before joining, thus ensuring forward security of group communication. When a vehicle leaves, the corresponding leaf node is deleted, the private keys of affected branch nodes are updated, and the change information is broadcast. This prevents the departed vehicle from using its old group key parameters to deduce the updated group key after leaving, thus ensuring backward security of group communication.

9. The batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks according to claim 6, characterized in that, The roadside unit removes the leaf node corresponding to the vehicle from the binary tree and adjusts the logical positions of the remaining nodes to maintain the integrity of the tree structure, including: If the sibling node of the leaf node becomes an isolated node after deletion, the sibling node is moved up to the original parent node position to maintain the integrity and balance of the binary tree.

10. The batch authentication and dynamic group key negotiation method for vehicle-to-everything (V2X) networks according to claim 6, characterized in that, During the dynamic group key negotiation phase, when a new vehicle joins or an existing vehicle leaves, the computational complexity of updating the group key is logarithmic O(logn), where n is the number of certified vehicles in the current group.

Images