Identity authentication and data encryption transmission method based on wireless self-organizing network

Abstract

The present invention discloses an identity authentication and data encryption transmission method based on a wireless self-organizing network, comprising: initializing each node; generating a digital signature; performing distributed identity authentication; and performing data encryption and data decryption. In the present invention, a new node can be added to the network at any time, and other nodes do not need to be reinitialized. The information transmission process enhances the security of data transmission, prevents eavesdropping, and has stronger robustness. The transmitted information has anti-counterfeiting and traceability. The digital signature has a message authentication function, which can prevent the information from being illegally tampered with, and can timely discover abnormal nodes and count the abnormal conditions of the nodes. When the abnormal conditions reach a threshold, data interaction with the node should be stopped. The present invention adopts a distributed identity authentication method, and each node can perform identity authentication. The new node can perform identity authentication nearby, which improves the efficiency of identity authentication, reduces network overhead, and enhances the network's anti-damage capability.

Description

Technical Field

[0001] The present invention relates to the field of wireless self-organizing network security technology, and more specifically, to an identity authentication and data encryption transmission method based on a wireless self-organizing network. Background Art

[0002] Traditional wireless cellular communication networks require the support of fixed network equipment (such as switches, routers, base stations, etc.) to forward data and control user services. However, in some special occasions where these infrastructures are not available, such as battlefields, remote mountainous areas, rescue sites for disasters such as fires and floods, temporary venues, etc., people are in urgent need of a new type of network that can achieve rapid networking without relying on any communication infrastructure, and rely on the mutual cooperation between wireless terminals to complete the establishment, maintenance and information transmission of the network. In order to meet this demand, wireless self-organizing networks came into being.

[0003] A wireless self-organizing network (Mobile Ad Hoc Network, MANET) is a temporary network built by a group of mobile terminals with wireless network interfaces without the assistance of fixed network facilities and centralized management. Therefore, it does not require fixed infrastructure support, but is a network formed by multiple mobile terminals organizing themselves. The mobile terminals in a wireless self-organizing network are also called nodes. Each node can move at will and forward data directly or indirectly to achieve mutual communication. The nodes in a wireless self-organizing network have both the functions of a terminal and a router. Data can be forwarded from the sender to the destination node via multiple hops. When the wireless self-organizing network communicates, other user nodes forward the data. This network form breaks through the geographical limitations of traditional wireless cellular networks, and has the characteristics of self-organization, decentralization, dynamic topology, and multi-hop routing. It can be deployed more quickly, conveniently, and efficiently, and is suitable for the communication needs of some emergency situations, such as the single-soldier communication system on the battlefield.

[0004] However, the inventors found that the above characteristics make it impossible to directly apply the central authentication service in the wireless ad hoc network. At the same time, due to its characteristics of using wireless signals to transmit data, frequent topology changes, and no third-party authentication, the wireless ad hoc network is more vulnerable to external security attacks.

[0005] Therefore, it is necessary to provide an identity authentication and data encryption transmission method based on a wireless self-organizing network that is not susceptible to external security attacks. Summary of the invention

[0006] In order to overcome at least one of the above problems, the purpose of the present invention is to provide an identity authentication and data encryption transmission method based on a wireless self-organizing network, so that new nodes can join the network at any time, and other nodes do not need to be reinitialized, thereby enhancing the security of data transmission and preventing eavesdropping. It has stronger robustness in the case of poor wireless channel environment and information packet loss, making the transmitted information anti-counterfeiting and traceable, and each node can perform identity authentication, and new nodes can perform identity authentication nearby, thereby improving the efficiency of identity authentication, reducing network overhead, and enhancing the network's anti-damage capability.

[0007] In order to achieve the above object, the present invention adopts the following technical solutions:

[0008] The present invention provides an identity authentication and data encryption transmission method based on a wireless self-organizing network, which is applied to a wireless self-organizing network. The wireless self-organizing network includes a plurality of nodes. The method includes:

[0009] Initialize each node, where each node has a unique identifier and a built-in first global shared key K D and the second global shared key K A ;

[0010] Generate a digital signature, wherein: the node uses the corresponding unique identifier and the authentication request message as the initialization input M, and based on the first global shared single key K D and dual-key digital signature method to perform encryption calculation to generate a digital signature;

[0011] Performing distributed identity authentication, wherein the nodes include newly connected nodes and existing nodes, and performing distributed identity authentication on the newly connected nodes and the existing nodes respectively; and

[0012] Data encryption and data decryption are performed, wherein the second global shared single key K A Perform data encryption and data decryption.

[0013] In one embodiment, the first global shared key K D The new node cooperates with the dual-key digital signature method to generate a digital signature, and the second global shared key K A Used for transmission and encryption.

[0014] In one embodiment, generating a digital signature includes:

[0015] Randomly select prime factors q of prime numbers p and p-1;

[0016] Perform a hash operation based on the initialization input M, the prime number p, and the prime factor q of p-1 to obtain a hash operation result g, wherein the initialization input M is the original message, g=H(M, p, q);

[0017] Generate a user key K based on the hash operation result g X1 and the corresponding public key K Y1 ;

[0018] Select a secret random number k; and

[0019] Based on the user key K X1 and the first and global shared key K D Perform encryption operation on the initialization input M to obtain a digital signature (r, s) = Sig k (M,p,q,g,K X1 ).

[0020] In one embodiment, the performing distributed identity authentication on the new network node includes:

[0021] The newly joined node is based on the initialization input M, the digital signature (r, s), the prime number p, the prime factor q and the public key K Y1 Determine the identity authentication message M', wherein M'=M||(r, s)||q||p||K Y1 ;

[0022] The identity authentication message M' is based on the second global shared key K A Perform single key method encryption;

[0023] Broadcasting the encrypted identity authentication message M';

[0024] After receiving the broadcast information, any other node uses the second global shared key K stored locally to A Perform single key method decryption;

[0025] Based on the public key K Y1 and the first global shared key K D Perform digital signature verification to obtain the digital signature to be verified v=Ver(M, s, q, p); and

[0026] If the digital signature to be verified v=Ver(M, s, q, p) is consistent with r in the signature (r, s), the node is determined to be a legal node, and the node identity is included in the routing table.

[0027] In one embodiment, the performing distributed identity authentication on the new network node further includes:

[0028] Any other node determines the corresponding node's initialization input M, digital signature (r, s), prime number p, prime factor q and public key K Y1 ;

[0029] Based on the initialization input M, digital signature (r, s), prime number p, prime factor q and public key K of any other node Y1 Determine the identity authentication message M' of any other node, where M'=M||(r, s)||q||p||K Y1 ;

[0030] The identity authentication message M' of the other arbitrary node is based on the second global shared single key K A Perform single key encryption;

[0031] Broadcasting the encrypted identity authentication message M';

[0032] After receiving the broadcast information, the newly connected node uses the second globally shared key K stored locally to A Perform single key method decryption;

[0033] Based on the public key K Y1 and the first global shared key K D Perform digital signature verification to obtain the digital signature to be verified v=Ver(M, s, q, p); and

[0034] If the digital signature to be verified v=Ver(M, s, q, p) is consistent with r in the digital signature (r, s), then the other arbitrary node is determined to be a legal node, and the node identity of the other arbitrary node is included in the routing table.

[0035] In one embodiment, the performing distributed identity authentication on the networked node includes:

[0036] When the networked node receives the identity authentication message of the new networked node, the node authenticates the new networked node;

[0037] If the newly connected node is verified to be a legitimate identity, the identity authentication message of the connected node is re-sent on demand to the newly connected node;

[0038] The newly connected node performs identity authentication on the connected node; and

[0039] The node that has joined the network sends the public key K Y1 Send to the new node.

[0040] In one embodiment, before sending the initialization input M to the user in the routing table, the data encryption includes:

[0041] Based on the digital signature public key K generated by the other party Y1 and local digital signature private key K X Sign the data and obtain a digital signature (r, s);

[0042] Based on the initialization input M, the digital signature (r, s), the prime number p, the prime factor q and the public key K Y1 Determine the identity authentication message M', wherein M'=M||(r, s)||q||p||K Y1 ;

[0043] The identity authentication message M' is based on the second global shared key K A Perform single key encryption to obtain encrypted message C; and

[0044] The encrypted message C is sent to the peer end.

[0045] In one embodiment, the data decryption includes:

[0046] The opposite end receives the encrypted message C;

[0047] Based on the second globally shared key K stored locally A Perform single-key decryption to obtain the initialization input M;

[0048] Based on the public key K Y1 and local private key K X1 Perform digital signature verification to obtain the digital signature to be verified v=Ver(M, s, q, p);

[0049] If the digital signature to be verified v=Ver(M, s, q, p) is consistent with r in the signature (r, s), it is determined that the node is a legitimate node and the message has not been tampered with, completing the identity authentication and data encryption transmission process based on the wireless ad hoc network; and

[0050] If the digital signature to be verified v=Ver(M, s, q, p) is inconsistent with r in the signature (r, s), the untrustworthiness value in the local routing table of the corresponding node is increased by 1.

[0051] In one embodiment, the data decryption further comprises:

[0052] If the number of inconsistencies between the to-be-verified digital signature v=Ver(M, s, q, p) and r in the signature (r, s) is greater than or equal to 3, data interaction with the node is stopped.

[0053] In one embodiment, if it is determined that the node is a legitimate node and the message has not been tampered with, the untrustworthiness value in the local routing table of the corresponding node is set to zero.

[0054] The beneficial effects of the present invention are as follows:

[0055] In the present invention, when initializing the parameters, it is not necessary to bind the identity information of other nodes, so new nodes can be added to the network at any time, and other nodes do not need to be reinitialized. A single-key encryption method is used in the information transmission process to enhance the security of data transmission and prevent eavesdropping. Compared with the stream encryption algorithm, it has stronger robustness in the case of poor wireless channel environment and information packet loss. The digital signature technology makes the transmitted information anti-counterfeiting and traceable, and can further complete the identity authentication work. At the same time, the digital signature has a message authentication function to prevent the information from being illegally tampered with. The present invention can detect abnormal nodes in time and count the abnormal conditions of the nodes. When the abnormal conditions reach the threshold, data interaction with the node should be stopped. Using a distributed identity authentication method, each node can perform identity authentication, and the new node can perform identity authentication nearby, which improves the efficiency of identity authentication, reduces network overhead, and enhances the network's anti-damage capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0057] Figure 1 A flow chart of an identity authentication and data encryption transmission method based on a wireless self-organizing network according to an embodiment of the present invention is shown;

[0058] Figure 2 An overall flow chart of an identity authentication and data encryption transmission method according to an embodiment of the present invention is shown;

[0059] Figure 3 A flow chart of generating a digital signature according to an embodiment of the present invention is shown;

[0060] Figure 4 A flowchart of encryption and decryption transmission of identity authentication information according to an embodiment of the present invention is shown; and

[0061] Figure 5 A data encryption and decryption transmission flow chart according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Similar components in the drawings are represented by the same figure marks. Those skilled in the art should understand that the content described specifically below is illustrative rather than restrictive, and should not be used to limit the scope of protection of the present application. It should also be noted that, for ease of description, the parts related to the present application are not shown in the drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0063] A wireless ad hoc network is a temporary network built by a group of mobile terminals with wireless network interfaces without the assistance of fixed network facilities and centralized management. The nodes in a wireless ad hoc network have both the functions of terminals and routers, and data can be forwarded from the sender to the destination node via multiple hops. The network has the characteristics of self-organization, decentralization, dynamic topology, and multi-hop routing. However, these characteristics make it impossible to directly apply the central authentication service in the wireless ad hoc network. At the same time, due to its characteristics of using wireless signals to transmit data, frequent topology changes, and no third-party authentication, the wireless ad hoc network is more vulnerable to external security attacks.

[0064] At present, research on wireless self-organizing networks includes:

[0065] 1. The patent "Secure Boot Model for Distributed Identity Authentication in Mobile Ad Hoc Networks" (application number CN200610124572.6, application publication number CN1953374) applied by the 709th Institute of China Shipbuilding Industry Corporation discloses a secure boot module for distributed authentication in wireless ad hoc networks, and introduces an identity authentication method based on threshold digital signatures into wireless ad hoc networks to perform identity authentication hop by hop.

[0066] The advantage of this method is that it can ensure that the source route will not be tampered with during the route request phase, and place a legitimate participant to perform a false "partial signature" to prevent signature verification, and it has the ability to prevent eavesdropping and replay attacks. However, this method can only generate a digital signature when there are no less than t nodes in the network, otherwise only partial signatures can be performed, and strict threshold signatures cannot be performed. In this case, the security will be reduced. At the same time, the hop-by-hop authentication method greatly increases the time and complexity of information processing, which is not conducive to the rapid flow of information.

[0067] 2. The patent "Anti-deception and anti-attack data transmission method based on wireless ad hoc network" (application number 201510344412.1 application publication number 104883372) applied by the 54th Institute of China Electronics Technology Group Corporation discloses a method for fast authentication and key negotiation of nodes in wireless ad hoc network using a signcryption algorithm protocol and a data encapsulation protocol based on stream encryption. This method uses the signcryption algorithm to process the request authentication message, communication key, and local timestamp and then broadcasts it. After decryption, the receiving authentication node checks whether the timestamp matches the local time, and verifies the legitimacy of the authentication message. After verification, the data is encrypted using a stream encryption algorithm, and the communication key is used as a symmetric key for information transmission.

[0068] The advantage of this method is that only one round of signcryption algorithm is used to complete fast authentication during identity authentication, and the algorithm based on stream encryption can encrypt and transmit data in real time to ensure data security. However, this method has bound the public and private key pairs of all members during the initial authentication. When new members outside the group join, the public and private key pairs of each node need to be reset before they can enter the network, which is not conducive to the random access of new nodes in the wireless self-organizing network. At the same time, using timestamp verification as a condition for identity authentication will prevent legitimate nodes with abnormal time from joining the network normally.

[0069] That is to say, the above-mentioned existing technologies fail to properly handle the above-mentioned problems regarding wireless ad hoc networks.

[0070] In order to solve at least one of the above problems, the inventors have studied and explored digital signature technology, distributed identity authentication technology and data encryption technology, and proposed a distributed identity authentication and data encryption transmission method based on a mobile wireless ad hoc network.

[0071] A digital signature, also known as a public key digital signature, is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also an effective proof of the authenticity of the information sent by the sender of the information. It is a method for identifying digital information similar to an ordinary physical signature written on paper, but it is implemented using the technology in the field of public key encryption. A set of digital signatures usually defines two complementary operations, one for signing and the other for verification. Digital signature is the application of asymmetric key encryption technology and digital summary technology. In the present invention, the digital signature technology ensures the anti-counterfeiting and traceability capabilities of information transmitted between nodes in a wireless ad hoc network, has the attribute of being authenticatable, and identity authentication is performed on this basis.

[0072] Identity authentication, also known as identity verification, refers to the confirmation of user identity through certain means. There are many methods of identity verification, which can basically be divided into: identity verification based on shared keys, identity verification based on biological characteristics, and identity verification based on public key encryption algorithms. In the present invention, the distributed identity authentication method can shorten the data transmission path of identity authentication and improve network efficiency, and finally realize distributed identity authentication and data encryption transmission based on wireless self-organizing networks.

[0073] Data encryption refers to converting plaintext into ciphertext through encryption algorithms and encryption keys, while decryption refers to restoring ciphertext to plaintext through decryption algorithms and decryption keys. The core of data encryption is cryptography, which uses cryptographic technology to encrypt information and achieve information hiding, thereby playing a role in protecting the security of information. It is the most reliable way for computer systems to protect information. In the present invention, the subsequent transmitted data is encrypted according to the other party's public key obtained during the identity authentication process to ensure the security of data transmission.

[0074] like Figure 1 As shown, in an embodiment of the present invention, a method for identity authentication and data encryption transmission based on a wireless self-organizing network is provided, which is applied to a wireless self-organizing network. The wireless self-organizing network includes a plurality of nodes. The method includes: initializing each node, wherein each node has a unique identifier and a built-in first global shared single key K D and the second global shared key K A ; Generate a digital signature, where: the node uses the corresponding unique identifier and the request authentication message as the initialization input M, and based on the first global shared single key K D and a dual-key digital signature method to perform encryption calculation to generate a digital signature; perform distributed identity authentication, wherein the nodes include new network nodes and existing network nodes, and perform distributed identity authentication on the new network nodes and the existing network nodes respectively; and perform data encryption and data decryption, wherein, based on the second global shared single key K A Perform data encryption and data decryption.

[0075] The following is a detailed introduction to each process.

[0076] (1) Node initialization: Each node joining the wireless ad hoc network has a unique identifier and a built-in global shared key K D And dual-key digital signature algorithm, global shared single key K A and single-key encryption algorithms;

[0077] (2) Generate digital signature: The node uses its own unique identifier and the authentication request message as the initialization input M, runs the dual-key digital signature algorithm, randomly selects a prime number p and a prime factor q of (p-1), performs a hash operation to obtain g = H (M, p, q), and generates the user key K based on this. X1 and the corresponding public key K Y1 , select a secret random number k, use the key K X1 and the global shared key K D Encrypt the message M and get the signature (r, s) = Sig k (M,p,q,g,K X1 ).

[0078] (3) Identity authentication process: If the node is just powered on and connected to the network, the node should send the original identity information, digital signature, coefficient q, coefficient p, public key K Y1 Cascade to form the identity authentication message M' to be sent, M'=M||(r,s)||q||p||K Y1 , use the global shared key K for M' A The single-key algorithm is used for encryption, and then it is sent by broadcast. After receiving the broadcast information, any other node should use the locally stored global shared key K A Perform single-key algorithm decryption, and then use the parsed K Y1 and the global shared public key K D Perform digital signature verification. If v = Ver (M, s, q, p) is consistent with r in the signature, it can be proved that the other party is a legitimate node and its identity is included in the routing table. In this process, this node may receive identity authentication messages from other nodes. At this time, this node authenticates the identity of other nodes according to the above authentication process.

[0079] If this node has completed the construction of a wireless self-organizing network with other nodes, when it receives the identity authentication message of a new node joining the network, after verifying the legitimacy of its identity, it should re-send its own identity authentication message on demand to the new node so that the new node can authenticate its own identity, and at the same time send its own digital signature public key to the new node.

[0080] (4) Data encryption and decryption process: Before sending the message M to the user in the routing table, the digital signature public key K generated by the other party is used Y1 And my digital signature private key K X Sign the data (r, s), concatenate the original message M, signature (r, s), coefficient q, coefficient p, and public key KY1 to get the message to be sent M'=M||(r, s)||q||p||K Y1 , use K for M' A Perform single-key algorithm encryption and send the encrypted message C to the peer end.

[0081] After receiving the message C, the peer uses the locally stored global shared key K A The original information M can be obtained by decrypting it with a single key algorithm, and then the digital signature public key K Y1 , combined with the local private key K X1 Perform digital signature verification. If v = Ver (M, s, q, p) is consistent with r in the signature, it can be proved that the other party is a legitimate node and the message has not been tampered with, completing the distributed identity authentication and data encryption transmission process based on the mobile wireless ad hoc network. If v is inconsistent with r, the message may have been tampered with by a third party, and the node's untrustworthiness value in the local routing table should be increased by 1. If more than 3 times of identity authentication inconsistency information is received, data interaction with the node should be stopped.

[0082] In a specific application scenario, the distributed identity authentication and data encryption transmission method based on a mobile wireless ad hoc network adopts digital signature technology, distributed identity authentication technology and data encryption and decryption technology, and specifically includes the following steps:

[0083] Step 1: Node initialization: Each node joining the wireless ad hoc network has a unique identifier and a built-in global shared key K. D And dual-key digital signature algorithm, global shared single key K A And single key encryption algorithm, the process is as follows Figure 2 As shown, both node A and node B have completed parameter preset;

[0084] Step 2: Node A and Node B read the global shared key K respectively D , global shared key K A and its own identifier;

[0085] Step 3: Node A and Node B respectively run the dual-key digital signature algorithm, randomly select a prime number p and a prime factor q of (p-1), perform a hash operation to obtain g=H(M,p,q), and generate a user key and the corresponding public key based on this. Then, a secret random number k is selected and the key and the global shared key K are used to generate the user key and the corresponding public key. D Encrypt the message M and get the signature (r, s), such as Figure 3 As shown, node A generates the user private key K XA and user public key K YA , and generate a digital signature (r A ,s A ), node B generates the user private key K XB and user public key K YB , and generate a digital signature (r B ,s B );

[0086] Step 4: Node A and node B synthesize the message M' to be sent, such as Figure 4 As shown;

[0087] Step 5: Node A and Node B use the global shared key K A The message M' to be sent is encrypted using a single-key algorithm to generate an encrypted identity authentication message C, such as Figure 4 As shown;

[0088] Step 6: Node A and Node B broadcast their own encrypted messages respectively. When a new node is powered on and joins the network, the identity authentication message should be broadcast three times in succession.

[0089] Step 7, Node A and Node B receive messages from external nodes respectively;

[0090] Step 8: Node A and Node B use the global shared key K to A Decrypt the encrypted message C using a single-key algorithm to obtain the message M;

[0091] Step 9: Node A decomposes message M' and obtains the original message M and the other party's public key K YB , digital signature (r B ,s B ), node B decomposes message M', obtains the original message M, and the other party's public key K YA , digital signature (r A ,s A );

[0092] Step 10: Node A and Node B respectively determine whether the other party's public key already exists in the local routing table. If so, proceed to step 11; if not, proceed directly to step 14.

[0093] Step 11, Node A and Node B respectively determine whether the corresponding value of the user's untrustworthiness in the local routing table corresponding to the other party's public key is less than 3. If it is less than 3, proceed to step 12; if it is not less than 3, directly execute step 7;

[0094] Step 12: Node A and Node B respectively run the dual-key digital signature algorithm, substitute the user's private key and the other party's user's public key to calculate the digital signature v;

[0095] Step 13, node A and node B respectively compare the calculated v with r in the original information. If v=r, the credibility of the other node information is set to 0 and jump to step 16. Otherwise, the credibility value of the other node is increased by 1 and step 7 is executed.

[0096] Step 14: Node A and Node B run the dual-key digital signature algorithm respectively, substituting the global shared single key K D And the other party's user public key calculates the digital signature v;

[0097] Step 15, Node A and Node B compare the calculated v with r in the original information respectively. If v=r, the other node information is added to the local routing table and step 16 is performed. Otherwise, step 7 is performed.

[0098] Step 16, Node A and Node B respectively obtain each other's real message M;

[0099] Step 17: For the official message M to be sent, node A and node B respectively run the dual-key digital signature algorithm, using node A to use the user's private key K XA and the other user's public key K YB , generate a digital signature (r A ,s A ), using the user's private key K XB and the other user's public key K YA , generate a digital signature (r B ,s B ),like Figure 5 As shown, then return to step 4.

[0100] At this point, the distributed identity authentication and data encryption transmission based on the mobile wireless ad hoc network are completed.

[0101] In the present invention, when initializing the parameters, it is not necessary to bind the identity information of other nodes, so new nodes can be added to the network at any time, and other nodes do not need to be reinitialized. A single-key encryption method is used in the information transmission process to enhance the security of data transmission and prevent eavesdropping. Compared with the stream encryption algorithm, it has stronger robustness in the case of poor wireless channel environment and information packet loss. The digital signature technology makes the transmitted information anti-counterfeiting and traceable, and can further complete the identity authentication work. At the same time, the digital signature has a message authentication function to prevent the information from being illegally tampered with. The present invention can detect abnormal nodes in time and count the abnormal conditions of the nodes. When the abnormal conditions reach the threshold, data interaction with the node should be stopped. Using a distributed identity authentication method, each node can perform identity authentication, and the new node can perform identity authentication nearby, which improves the efficiency of identity authentication, reduces network overhead, and enhances the network's anti-damage capability.

[0102] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0103] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0104] Specific examples are used herein to illustrate the principles and implementation methods of the present application, and the description of the above embodiments is only used to help understand the technical solution and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0105] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not limitations on the implementation methods of the present invention. For ordinary technicians in the relevant field, other different forms of changes or modifications can be made based on the above description. It is impossible to list all the implementation methods here. All obvious changes or modifications derived from the technical solution of the present invention are still within the protection scope of the present invention.

Claims

1. A method for identity authentication and data encryption transmission based on a wireless self-organizing network, applied to a wireless self-organizing network, wherein the wireless self-organizing network includes a plurality of nodes, characterized in that: The method comprises: Initialize each node, where each node has a unique identifier and a built-in first global shared key K D and the second global shared key K A ; Generate a digital signature, wherein: the node uses the corresponding unique identifier and the authentication request message as the initialization input M, and based on the first global shared single key K D and dual-key digital signature method to perform encryption calculation to generate a digital signature; Performing distributed identity authentication, wherein the nodes include newly connected nodes and existing nodes, and performing distributed identity authentication on the newly connected nodes and the existing nodes respectively; and Data encryption and data decryption are performed, wherein the second global shared single key K A Perform data encryption and data decryption; The first global shared single key K D The new node cooperates with the dual-key digital signature method to generate a digital signature, and the second global shared key K A For transmission and encryption; Generating a digital signature comprises: Randomly select prime factors q of prime numbers p and p-1; Perform a hash operation based on the initialization input M, the prime number p, and the prime factor q of p-1 to obtain a hash operation result g, wherein the initialization input M is the original message, g=H(M, p, q); Generate a user key K based on the hash operation result g X1 and the corresponding public key K Y1 ; Select a secret random number k; and Based on the user key K X1 and the first and global shared key K D Perform encryption operation on the initialization input M to obtain a digital signature (r, s) = Sig k (M,p,q,g,K X1 ); The performing distributed identity authentication on the new network node includes: The newly joined node is based on the initialization input M, the digital signature (r, s), the prime number p, the prime factor q and the public key K Y1 Determine the identity authentication message M', wherein M'=M||(r, s)||q||p||K Y1 ; The identity authentication message M' is based on the second global shared key K A Perform single key method encryption; Broadcasting the encrypted identity authentication message M'; After receiving the broadcast information, any other node uses the second global shared key K stored locally to A Perform single key method decryption; Based on the public key K Y1 and the first global shared key K D Perform digital signature verification to obtain the digital signature to be verified v=Ver(M, s, q, p); and If the digital signature to be verified v=Ver(M, s, q, p) is consistent with r in the signature (r, s), the node is determined to be a legitimate node, and the node identity is included in the routing table; The performing distributed identity authentication on the new network node also includes: Any other node determines the corresponding node's initialization input M, digital signature (r, s), prime number p, prime factor q and public key K Y1 ; Based on the initialization input M, digital signature (r, s), prime number p, prime factor q and public key K of any other node Y1 Determine the identity authentication message M' of any other node, where M'=M||(r, s)||q||p||K Y1 ; The identity authentication message M' of the other arbitrary node is based on the second global shared single key K A Perform single key encryption; Broadcasting the encrypted identity authentication message M'; After receiving the broadcast information, the newly connected node uses the second globally shared key K stored locally to A Perform single key method decryption; Based on the public key K Y1 and the first global shared key K D Perform digital signature verification to obtain the digital signature to be verified v=Ver(M, s, q, p); and If the digital signature to be verified v=Ver(M, s, q, p) is consistent with r in the digital signature (r, s), then the other arbitrary node is determined to be a legal node, and the node identity of the other arbitrary node is included in the routing table.

2. The method according to claim 1, characterized in that The performing distributed identity authentication on the networked node includes: When the networked node receives the identity authentication message of the new networked node, the node authenticates the new networked node; If the newly connected node is verified to be a legitimate identity, the identity authentication message of the connected node is re-sent on demand to the newly connected node; The newly connected node performs identity authentication on the connected node; and The node that has joined the network sends the public key K Y1 Send to the new node.

3. The method according to claim 2, characterized in that Before sending the initialization input M to the user in the routing table, the data encryption includes: Based on the digital signature public key K generated by the other party Y1 and local digital signature private key K X Sign the data and obtain a digital signature (r, s); Based on the initialization input M, the digital signature (r, s), the prime number p, the prime factor q and the public key K Y1 Determine the identity authentication message M', wherein M'=M||(r, s)||q||p||K Y1 ; The identity authentication message M' is based on the second global shared key K A Perform single key encryption to obtain encrypted message C; and The encrypted message C is sent to the peer end.

4. The method according to claim 3, characterized in that The data decryption includes: The opposite end receives the encrypted message C; Based on the second globally shared key K stored locally A Perform single-key decryption to obtain the initialization input M; Based on the public key K Y1 and local private key K X1 Perform digital signature verification to obtain the digital signature to be verified v=Ver(M, s, q, p); If the digital signature to be verified v=Ver(M, s, q, p) is consistent with r in the signature (r, s), it is determined that the node is a legitimate node and the message has not been tampered with, completing the identity authentication and data encryption transmission process based on the wireless ad hoc network; and If the digital signature to be verified v=Ver(M, s, q, p) is inconsistent with r in the signature (r, s), the untrustworthiness value in the local routing table of the corresponding node is increased by 1.

5. The method according to claim 4, characterized in that The data decryption also includes: If the number of inconsistencies between the to-be-verified digital signature v=Ver(M, s, q, p) and r in the signature (r, s) is greater than or equal to 3, data interaction with the node is stopped.

6. The method according to claim 4, characterized in that If it is determined that the node is a legitimate node and the message has not been tampered with, the untrustworthiness value in the local routing table of the corresponding node is set to zero.

Images