Method for key management in multi-domain optical network based on hierarchical PCE and certificateless public key cryptography

Abstract

The application discloses a multi-domain optical network key management method based on layered PCE and certificateless public key cryptography. Firstly, a supergraph model of optical network key reflecting the hierarchical relationship of the key is constructed by using supergraph theory; then, public and private keys are established on the basis of the certificateless public key cryptography system, thus solving the single-point failure problem; meanwhile, the MQV key exchange protocol is adopted to negotiate the session key, thus avoiding the security threat caused by impersonation attack; finally, group key is established based on the idea of member characteristic value, and the group key is updated by using the method when a member joins or exits. The method has the capabilities of forward security, backward security, resistance to man-in-the-middle attack, resistance to impersonation attack and safe key establishment. Compared with typical decentralized methods and the existing optical network key management method under the layered PCE architecture, the method can improve the security while slightly reducing the key storage overhead, communication overhead and key usage times, and the performance is improved.

Description

Technical Field

[0001] This invention belongs to the field of multi-domain optical network technology, specifically relating to a multi-domain optical network key management method based on hierarchical PCE and certificateless public key cryptography. Background Technology

[0002] Security is a primary concern and a problem that must be addressed in every network, and multi-domain optical networks are no exception. [1] Security can be divided into physical security and information security. Due to limitations in physical layer security research, information security has become a key focus in addressing optical network security issues. In multi-domain optical networks, solving information security problems requires establishing suitable methods for managing various keys based on different optical network architectures, thereby mitigating security threats such as identity spoofing, man-in-the-middle attacks, and key leakage during communication. [2,3] While there are many research findings on key management methods, most of them are conducted in general network environments such as wireless sensors, with relatively few studies on optical networks that are evolving into multi-domain applications. Therefore, further exploration is still needed.

[0003] To date, three key management methods have emerged: centralized, distributed, and decentralized, which can be applied to various network environments. [4] The first typical method of centralized key management is GKMP. [5] LKH [6] and OFT [7] The second typical method of distributed key management is Iolus. [8] Saroit [9] And Du

[10] The third typical method of distributed key management includes GDH.

[11] D-LKH

[12] and DH-LKH

[13] Among these, centralized methods, due to their over-reliance on a single central node for key management, suffer from single-point-of-failure problems and low overall efficiency, making them unsuitable for distributed network environments. While distributed methods proposed to overcome these issues have largely solved the problems, when the number of nodes is large, maintaining normal key relationships among members requires more computational resources to adapt to changes in the network. Therefore, the subsequently proposed decentralized methods achieve a better balance between communication quality and efficiency by dividing the overall membership into different groups, each managed by its own central node, making them more suitable for large-scale dynamic group key management.

[14] .

[0004] In summary, key management methods for optical networks under a layered PCE (Path Computation Element) architecture are better suited to a combination of centralized and decentralized approaches, employing a centralized method at the PCE layer and a decentralized method at the autonomous system layer. However, typical decentralized methods cannot be directly applied to optical networks. Firstly, typical decentralized methods require further improvement. For example, the original Iolus method, due to its flat key management structure, incurs significant costs for key updates when nodes change. To reduce the overhead caused by node changes, researchers subsequently proposed the Saroit method, which not only greatly reduces overhead but also solves the single point of failure problem; however, it cannot prevent collusion attacks and poses certain security threats. Secondly, most of the key management models in currently proposed methods use logical key trees, which are not well-suited to the key relationships between nodes in multi-domain optical networks, and therefore cannot be directly applied to multi-domain optical networks. To address this issue, the KMS-KI method proposed in the literature...

[15] This study is the first to apply hypergraph theory to a key management model for multi-domain optical networks based on a hierarchical PCE architecture. This makes the improved model more consistent with the key relationships between nodes in an optical network. It also solves the problem that the Saroit method cannot resist collusion attacks. However, this method cannot resist man-in-the-middle attacks and still has some security vulnerabilities.

[0005] The following are relevant references retrieved by the applicant, which are used in this invention.

[0006] 1. FANGL, BEHRINGERM, CALLONR, et al. Security Framework for MPLS and GMPLS Networks [S / OL]. http: / / www.ietf.org / internet-drafts / draft-ietf-mpls-mpls-and-gmpls-security-framework-02.txt, 2008.

[0007] 2. Takeda T, Dios O, Martensson J, et al. Path Computation ElementCommunication Protocol (PCEP) Requirements for Wavelength Switched OpticalNetwork (WSON) Routing and Wavelength Assignment[J]. 2015.

[0008] 3.Fork M P,Wang Z X,DengY H.Optical Layer Security in Fiber-OpticalNetwork[J].IEEE Transaction on Information Forensics and Security,2012,6(3):725-736。

[0009] 4.HardjonoT,DondetiL.Multicastandgroupsecurity[M].London:ArtechHouse,2003。

[0010] 5.Harney H,Muckenhirn C.RFC 2094,Group key management protocol(GKMP)architecture[S].New York:IETF,1997。

[0011] 6.Wong C K,Gouda M,Lam S S.Secure Group Communication Using KeyGraphs[J].IEEE / ACM Transactions on Networking,2000,8(1):16-30。

[0012] 7.Balenson D,Mcgrew D,Sherman A.Key management for large dynamicgroups:one-way function trees and amortized initialization[J].1999。

[0013] 8.Mittra S.IoIus:aframework for scalable secure multicasting[J].AcmSigcomm Computer Communication Review,1997,27(4):277-288。

[0014] 9.Saroit I A,El-Zoghdy S F,Matar M.A scalable and distributedsecurity protocol for multicast communications[J].International Journal ofNetwork Security,2011,12(1):50-64。

[0015] 10.Du X Q,Bao W,Fu X Q.A Multicast Key Management Scheme Based onCharacteristic Values of Members[J].Journal of Electronics(China),2012,29(3):294-301。

[0016] 11.Steiner M,TsudikG,WaidnerM.Key Agreementin Dynamic Peer Groups[J].IEEE Transactionson Parallel&Distributed Systems,2000,11(8):769-780。

[0017] 12.O.Rodeh,K.P.Birman,D.Dolev.Optimized group rekey for groupcommunication systems[R].Technical Report 2,Department of Computer Science,Hebrew Univesity,1999。

[0018] 13.A.Perrig.Efficient collaborative key management protocols forsecure autonomous group communication[C].In Proceedings of InternationalWorkshop on Cryptographic Techniques and E-Commerce,1999,192-202。

[0019] 14. Havashemi rezaeipour Kokab, Barati Hamid. A hierarchical keymanagement method for wireless sensor networks [J]. Microprocessors and Microsystems, 2022, 90.

[0020] 15. Wu Qiwu, Wen Wen. Key management scheme for multi-domain optical networks based on key hypergraph and identity cryptography [J]. Journal of Sichuan University, 2017, 49(5):85-92.

[0021] 16. IETF RFC4655-2006, A Path Computation Element (PCE) Based Architecture [S].

[0022] 17. King D, Farrel A. RFC6805, The Application of the Path ComputationElement Architecture to the Determination of a Sequence of Domains in MPLS and GMPLS Internet Engineering Task Force [S]. New York: IETF, 2012.

[0023] 18.BERGE C. Graphs and Hypergraphs[M]. Amsterdam: North holland, 1973.

[0024] 19. Zhang Yulei, Liu Xiangzhen, Lang Xiaoli, Zhang Yongjie, WangCaifen.VCLPKES: Verifiable Certificateless Public Key Searchable EncryptionScheme for Industrial Internet of Things[J]. IEEE Access, 2020, 8.

[0025] 20. Nait-Hamoud Othmane, Kenaza Tayeb, Challal Yacine. CertificatelessPublic Key Systems Aggregation: An enabling technique for 5G multi-domainsecurity management and delegation[J]. Computer Networks, 2021, 199.

[0026] 21. LawL, MenezesA, QuM, et al. An Efficient Protocol for Authenticated KeyAgreement[J]. Designs Codes and Cryptography, 1999, 28(2).

[0027] 22. Wang Yong, Li Ming, Cao Yuanda. A dynamic and authenticable group key negotiation scheme [J]. Computer Applications Research, 2005(09):118-120.

[0028] 23. Hu Yu. Design and Implementation of OTP-Based Authentication and Key Negotiation Scheme [D]. Sichuan Normal University, 2010.

[0029] 24. Abusukhon Ahmad, Mohammad Zeyad, Al Thaher Ali. An authenticated, secure, and mutable multiple-session-keys protocol based on elliptic curvecryptography and text-to-image encryption algorithm [J]. Concurrency and Computation: Practice and Experience, 2021, 34(4). Summary of the Invention

[0030] To address the security issues arising from key management in multi-domain optical networks under a layered PCE architecture, the present invention aims to provide a multi-domain optical network key management method (KMS-HC) based on layered PCE and certificateless public key cryptography.

[0031] To achieve the above objectives, the present invention adopts the following technical solution:

[0032] A multi-domain optical network key management method based on hierarchical PCE and certificateless public-key cryptography is characterized by first constructing an optical network key hypergraph model reflecting the hierarchical relationship of keys using hypergraph theory; then establishing public and private keys based on the certificateless public-key cryptography system, while using the MQV key exchange protocol to negotiate the session key; finally establishing a group key, and updating the group key when members join or leave.

[0033] According to the present invention, the optical network key hypergraph model is a hierarchical key hypergraph model G = (N, E) composed of vertices and hyperedges. Based on the key relationship between nodes in the optical network, the model can be divided into PCE layer and autonomous system layer.

[0034] The vertex set is represented as N = (n0, n1, ..., nn) n-1 );

[0035] The hyperedge set is represented as E = (E0(K0), ..., E d (K d ),e i-j (k i-j ),...);

[0036] In this context, the number of domains divided in the network is denoted by d, i and j represent the indexes of the nodes, and K represents the number of nodes. i or K i-j This represents the group key for all nodes covered by each hyperedge;

[0037] In the PCE layer, pPCE is the private key generator (PKG) or key generation center (KGC) of each cPCE, while in the autonomous system layer, cPCE is the private key generator (PKG) or key generation center (KGC) of that autonomous system.

[0038] The certificateless multi-domain optical network key management method based on a layered PCE architecture of the present invention has forward security, backward security, resistance to man-in-the-middle attacks, resistance to impersonation attacks, and the ability to securely establish keys. Compared with typical distributed methods and existing optical network key management methods under a layered PCE architecture, it can be seen that while improving security, key storage overhead, communication overhead, and key usage frequency are all slightly reduced, resulting in improved performance. Attached Figure Description

[0039] Figure 1 This is a schematic diagram of a multi-domain optical network model under a layered PCE architecture;

[0040] Figure 2 This is a schematic diagram of a hypergraph model;

[0041] Figure 3 This is a flowchart illustrating the design of the multi-domain optical network key management method based on layered PCE and certificateless public key cryptography of the present invention.

[0042] Figure 4 This is a schematic diagram of the key hypergraph model;

[0043] Figure 5 This is a flowchart of the public / private key establishment process;

[0044] Figure 6 This is a diagram of the session key negotiation process;

[0045] Figure 7 This is a diagram of the key establishment process;

[0046] Figure 8 This is a diagram illustrating the group key update process when a member joins.

[0047] Figure 9 This is a diagram illustrating the group key update process when a member leaves.

[0048] Figure 10 This is a comparison chart of cPCE key storage overhead;

[0049] Figure 11 This is a comparison chart of node key storage overhead;

[0050] Figure 12 This is a comparison chart of cPCE communication overhead when a node exits;

[0051] Figure 13 This is a graph showing the number of times the cPCE key is used when a new node joins.

[0052] Figure 14 This is a graph showing the number of times the cPCE key was used when a node exited.

[0053] Figure 15 This is a diagram of the multi-domain optical network key hypergraph model of a certain detachment in the embodiment;

[0054] Figure 16 This is a multi-domain optical network topology diagram of a certain detachment in the embodiment;

[0055] Figure 17 This is a diagram of the public-private key establishment and distribution process;

[0056] Figure 18 This is a diagram of the session key exchange process;

[0057] Figure 19 This is a diagram of the layer group key establishment process;

[0058] Figure 20 This is a diagram illustrating the key update process after the new brigade participates in the mission;

[0059] Figure 21 This is a diagram illustrating the key update process after a squadron exits a mission;

[0060] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Detailed Implementation

[0061] 1. Relevant Theories

[0062] 1.1 Multi-domain optical network model under layered PCE architecture

[0063] Path Calculation Unit PCE

[16] A PCE is an entity capable of performing path calculations or routing based on network topology, as well as path calculations under certain constraints. In multi-domain optical networks, a PCE entity can exist as a module within a network node or component, or it can operate independently as a server.

[0064] To better achieve cross-domain routing, researchers have proposed two PCE-based multi-domain optical network architectures, namely, a hierarchical PCE architecture and a distributed PCE architecture, combining the PCE structural model and communication mechanism. The main idea is to divide the optical network into multiple domains as needed, and then assign a PCE responsible for path calculation and maintaining local TED information to each domain.

[0065] The following introduces a multi-domain optical network model based on hierarchical PCE:

[0066] Figure 1 A schematic diagram of a multi-domain optical network model under a hierarchical PCE architecture is given.

[17] Assume that all nodes in the model are numbered from n1 to n2. 12 The source node is n1, and the destination node is n8. The network is divided into 3 domains, and 1 parent path computation unit pPCE (parent-PCE) and 3 child path computation units cPCE (child-PCE) are configured.

[0067] The following describes the path calculation and establishment process of optical networks under a layered PCE architecture:

[0068] Step 1: The source node n1, acting as a path computation client, sends a path computation request (PCReq) to cPCE1 within its own domain. After receiving the request, cPCE1 then sends the request message to pPCE.

[0069] Step 2: After receiving the message, pPCE calculates a logical route from n1 to n8, and sends PCReq to cPCE in the domain where n8 is located. The two work together to calculate the paths between n1 and the boundary node n4 of its domain, between n4 and the boundary node n5 of the domain where n8 is located, and between n5 and the destination node n8, and send the results to pPCE.

[0070] Step 3: After receiving the calculation results, pPCE merges the path calculation results to obtain multiple cross-domain paths from n1 to n8, selects the optimal path that meets the constraints, and finally sends the result to cPCE1.

[0071] Step 4: After receiving the path calculation result, cPCE1 sends this message to the source node n1, thus completing the cross-domain path calculation from n1 to n8.

[0072] Step 5: In order to collect and allocate relevant resources to establish the path, n1 initiates the relevant signaling protocols (such as RSVP-TE or CR-LDP) so that the optical network path from n1 to n8 is successfully established.

[0073] 1.2 Hypergraph Theory

[0074] Hypergraphs are a branch of graph theory, belonging to the field of discrete mathematics. They are one of the most common graph structures and also a subset of a finite set. Hypergraph theory first appeared in 1973, proposed by C. Berger.

[18] In traditional graph structures, each edge can only connect two vertices. However, in hypergraphs, a new type of edge, the hyperedge, can connect more than two vertices simultaneously. Therefore, compared to ordinary graphs, hypergraphs better represent the diverse relationships between members. The definition is as follows:

[0075] A hypergraph typically consists of a non-empty set of vertices (nodes) and a non-empty subset of that set, which can be represented as G = (N, E), as shown below. Figure 2 As shown in the diagram. The vertex set is N, and its number is equal to the order of the hypergraph; the subset cluster is E, and its number of elements is equal to the size of the hypergraph. In the diagram, n1 to n8 represent 8 vertices, and e1 to e3 represent three hyperedges, i.e., the three ellipses in the diagram.

[0076] 1.3 Certificate-free public-key cryptography

[0077] In a PKI (Public Key Infrastructure) environment, users' public keys require specially generated certificates to ensure their authenticity and reliability. This results in a large amount of resources being needed to ensure the generation, storage, updating, and verification of certificates. Therefore, in a network environment with an increasing number of users, this inevitably leads to resource waste and reduced efficiency.

[0078] Because it eliminates the need for certificate management and verification, the identity cryptography system proposed by scholars solves various complex problems in certificate management, ensuring the rational utilization of network resources and communication efficiency. However, this system relies on a trusted Private Key Generator (PKG) to generate the private keys for all nodes in the network, thus introducing single points of failure and key escrow issues. While threshold sharing or layered techniques can mitigate the security risks posed by key escrow, they cannot completely solve these problems.

[0079] To overcome the private key escrow problem in this system, Al-Riyami et al. combined the advantages of public key infrastructure and identity cryptography.

[19] A certificate-free cryptosystem, called certificateless public-key cryptography, is proposed. In this system, a user's private key consists of two parts: a partial private key generated by a key generation center based on the user's identity, and a secret value randomly selected by the user. The public key, used for encryption, is generated from the user's private key and public parameters, and its reliability is not guaranteed by a certificate.

[20] Therefore, this system eliminates the need for public key certificate management and avoids the problems associated with key escrow, making it a high-performance cryptographic system for today's optical network environment.

[21] .

[0080] 1.4 MQV Key Negotiation Protocol

[0081] An extended version of the standard Diffie-Hellman (DH) key exchange protocol is called MQV (Menezes-Qu-Vanstone). [22,23] The main idea is to incorporate an authentication mechanism during key negotiation between nodes, allowing them to verify each other's legitimacy.

[24] .

[0082] Let g be a generator of the cyclic group G of prime order q. The specific negotiation process of MQV is as follows:

[25] :

[0083] (1) Alice and Bob's private keys are a and b respectively, and their public keys are A = g. a B = g b .

[0084] (2) Alice selects a random number x and calculates X = g. x Bob selects a random number y and calculates Y = g. y .

[0085] (3) After Alice and Bob have each calculated d = H(X,"Bob") and e = H(Y,"Alice"), they send the results to each other.

[0086] (4) Alice calculates σ=(YB e ) x+da Bob calculates σ = (XA) d ) y+eb .

[0087] (5) The key is K = H(σ).

[0088] 2 Scheme Design

[0089] This embodiment proposes a key management scheme for multi-domain optical networks based on hierarchical PCE and certificateless public-key cryptography (KMS-HC) using the concept of a key hypergraph and the MQV key exchange protocol. The scheme constructs a key hypergraph model of the optical network under a hierarchical PCE structure. Then, it integrates the MQV key exchange protocol and the concept of member eigenvalues ​​into the certificateless public-key cryptography framework to complete the scheme design. Finally, the correctness and security of the proposed scheme are analyzed, and its performance is compared with that of typical distributed methods and optical network methods under a hierarchical PCE architecture.

[0090] 2.1 Parameters and Definitions

[0091] According to the relevant provisions in RFC5440, the parameter symbols and definitions are shown in Table 1.

[0092] Table 1: Parameters and Definitions

[0093]

[0094] 2.2 Overall Design Flowchart

[0095] The overall design process of the scheme is as follows: Figure 3As shown. To address the problems existing in the key management process of multi-domain optical networks, this embodiment takes an optical network under a hierarchical PCE architecture as the research object, establishes an optical network key hypergraph model, and proposes a multi-domain optical network key management method based on hierarchical PCE and certificateless public-key cryptography. First, an optical network key hypergraph model reflecting the key hierarchy is constructed. Then, public and private keys are established on the basis of certificateless public-key cryptography, and the MQV key exchange protocol is used to negotiate the session key. Finally, a group key is established and updated when members join or leave.

[0096] This method mainly consists of four aspects: model construction, public and private key establishment, session key negotiation, and group key establishment and update. The optical network key hypergraph model construction primarily utilizes hypergraph theory to design a multi-domain optical network model under a layered PCE architecture. The public and private keys are established based on this model and combined with certificateless cryptography theory. The session key is negotiated using the MQV key exchange protocol after the public and private keys are established. Finally, the group key is established and updated based on the concept of member feature values ​​within the certificateless cryptography framework.

[0097] The following is the specific implementation process.

[0098] 2.3 Construction of Optical Network Key Hypergraph Model

[0099] In the past, key management models in various distributed schemes mostly adopted the form of logical key trees. However, in optical networks, this form does not fully reflect the key relationships between nodes. Therefore, using hypergraph theory to construct a multi-domain optical network key management model based on a hierarchical PCE structure can better reflect the relationship characteristics between nodes.

[0100] The optical network key hypergraph model is a hierarchical key hypergraph model G = (N, E) mainly composed of vertices and hyperedges. Based on the key relationships between nodes in the optical network, the model can be divided into PCE layers and autonomous system layers. The vertex set is represented as N = (n0, n1, ..., n...). n-1 The hyperedge set is represented as E = (E0(K0), ..., E d (K d ),ei-j(k i-j ),...), where the number of domains divided in the network is represented by d, i and j represent the indexes of the nodes, and K is the index of the node. i or K i-j This represents the group key of all nodes covered by each hyperedge. In the PCE layer, pPCE (parent PCE) is the private key generator (PKG) or key generation center (KGC) of each cPCE (child PCE), while in the autonomous system layer, cPCE is the PKG or KGC of that autonomous system.

[0101] Assuming there are 22 nodes in a multi-domain optical network, the constructed two-layer key hypergraph model is as follows: Figure 4 As shown:

[0102] Where n0 is pPCE; n 19 n 20 n 21 For cPCE; E0(k0) represents the hyperedge where pPCE shares the group key k0 with each cPCE; E1(k1), E2(k2), and E3(k3) represent the hyperedges where nodes in autonomous systems 1, 2, and 3 share the group keys k1, k2, and k3, respectively; e 6-7 (k 6-7 ) and e 12-13 (k 12-13 The group key k is shared between the boundary nodes of autonomous systems 1 and 2, and 2 and 3. 6-7 and k 12-13 The super-edge.

[0103] 2.4 Public and Private Key Establishment and Distribution

[0104] (1) Establishment of pPCE public and private keys

[0105] like Figure 5 As shown, in this embodiment, KGC, which serves as the PCE layer, first inputs the security parameter λ, selects a group G1 on the elliptic curve E, and defines the generator f∈G1 of group G1. E lies in the finite field F. q Given a group whose order q is a large prime number, define a hash function H: pPCE selection Use this as the master key, i.e., your own private key, and then calculate P. kp =S kp f∈G1 is used as the public key, and the system parameters M=(E, G1, f, q, H, P) are made public. kp ).

[0106] (2) Establishment of cPCE public and private keys

[0107] cPCE i Select random number As part of the private key, calculate the corresponding part of the public key X. i =x i P kp ∈G1. Then, the identity information ID. ci and X i Send to pPCE, pPCE selects a random number. And calculate R i =r i ·P kp ∈G1,d i =r i +S kp ·H(IDci R i X i ), R i As cPCE i Part of the public key, d i As cPCE i Send part of the private key to cPCE i cPCE i The two parts of the key are combined to obtain the private key S. kci =(x i d i ), public key P kci =(X i R i ).

[0108] (3) Distribution of public and private keys of nodes

[0109] At the autonomous system layer, the cPCE acts as the KGC for the domain, distributing public and private keys to various nodes within the domain. At this point, the cPCE... j The domain's system master key is set to S kcj =x j +d j P kcj =S kcj The parameters are set to M = (E, G1, q, f, P) kcj H).

[0110] In autonomous region cPCE j Inside, in order to calculate part of the public key T i Node n i You need to select a random number first. Use it as part of your own private key and calculate T i =t i P kcj Then, the identity information ID ni and T i Send to cPCE j cPCE j Random selection And calculate U i =u i ·P kcj and v i =u i +P kc ·(ID ni U i T i Finally, n i Send U i and v i This serves as part of the node's public and private keys. After receiving the message and merging the two key parts, n i You can then obtain the private key Skni =(t i v i ) and public key P kni =(T i U i ).

[0111] 2.5 Session Key Negotiation

[0112] like Figure 6 As shown, in this embodiment, each node n i With each of the cPCE i First, merge your private keys to get S. kni =t i +v i S kci =x i +d i Choose the multiplicative cyclic group G2 and the generator g∈G2, and compute the public key P. kni =g Skni ∈G2, P kci =g Skci ∈G2, and then use the MQV key exchange protocol to exchange session keys, the specific process is as follows:

[0113] (1) Establish PCE layer session key

[0114] Step 1: pPCE and cPCE i When negotiating the session key, pPCE selects a random number w and calculates W = g. w ∈G2, cPCE i Choose a random number y and calculate Y = g. y ∈G2, exposes W and Y. pPCE and cPCE i Calculate a = H(W,"cPCE) separately. i b = H(Y,"pPCE"). Finally, pPCE is calculated. cPCE i calculate Both sides calculate Obtain the session key

[0115] Step 2: When negotiating the session key between each cPCE, the cPCE i Choose a random number c and calculate C = g. c ∈G2, cPCE j Choose a random number l and calculate L = g. l ∈G2. Then cPCE i and cPCE j Calculate o = H(C,"cPCE) j ") and p=H(L,"cPCEi Finally, cPCE i calculate cPCE j calculate Both sides calculate Obtain the session key

[0116] (2) Establish an autonomous region layer session key

[0117] Since the pPCE in the PCE layer acts as the key manager for the cPCE, and within an autonomous system, the cPCE acts as the manager for each node within the system, the basic idea for creating session keys between nodes within the system is equivalent to the key establishment method between pPCEs and cPCEs. Furthermore, because the relationships between nodes within the system are equal, and the cPCEs are also equal, the idea for establishing session keys between nodes within the system is also the same as the method for establishing keys between individual cPCEs.

[0118] This section only needs to describe the establishment of session keys between the domain boundary nodes with special key hyperedges, using boundary node n as an example. i and n j Taking a space as an example, the specific steps are as follows:

[0119] First, domain A node n i Select random number To calculate use For W i Encrypt and send to cPCE A cPCE A After receiving and decrypting the message, use Encrypt the message and send it to cPCE B cPCE B Decrypt the message after receiving it, and then use it. The information is encrypted and sent to node n. j Node n j After receiving and decrypting the message, randomly select To calculate X j According to the received W i Send to node n in the reverse order i Node n i With node n j First, calculate u = H(W) separately. i "n j "), v=H(X j "n i "), then node n i calculate and k j-i=H(σ), node n j calculate and k i-j =H(σ). According to the MQV key exchange principle, k i-j =k j-i Finally, cPCE A Generate inter-domain key hyperedge e i-j (k i-j ).

[0120] 2.6 Key Establishment and Update

[0121] (1) Group key establishment Figure 7 )

[0122] ①Establishment of PCE layer group key

[0123] Let the number of autonomous systems be d, and pPCE selects random numbers. Leveraging cPCE i(1≤i≤d) Identity identifier Calculate the PCE layer group key Generate the hyperedge E0(K0). pPCE is used. Encrypt K0 and send the encrypted K0 to each PCE in the PCE layer. Each cPCE i(1≤i≤d) use Decrypt to obtain K0.

[0124] ② Establishment of Autonomous System Layer Key

[0125] Let f be the number of nodes in the domain, and cPCE i Select random number And utilize the node n within the domain j(1≤j≤f) Identity ID nj(1≤j≤f) To calculate This generates the hyperedge E. i (K i Then use Encryption K i And send to n j(1≤j≤f) After receiving the encrypted message, each node in the domain uses... Decrypt to obtain group key K i .

[0126] (2) Group key update when a member joins

[0127] Please see Figure 8 :

[0128] ① Group key update when a new cPCE joins the PCE layer

[0129] New cPCE jUpon joining, you first obtain your own public and private keys, exchange session keys with pPCE, and then publish your public key and identity ID. cj Finally, in order for a new cPCE to join the group and participate in the session, the pPCE needs to update the group key, as follows:

[0130] First, pPCE and cPCE i Using the original key and cPCE j Use identity to calculate new group key Then, the superedge E0(K0) is updated to obtain E0(K'0). Then, the session key is used. After encrypting the updated K'0, pPCE sends a message to cPCE. j Send the message. Upon receiving the encrypted message, cPCE j use Decrypt the message to obtain K'0.

[0131] ② Group key update when a new node joins an autonomous system

[0132] When a new node joins, it first obtains its own public and private keys, then exchanges a session key with pPCE, and then publishes its public key and identity. Finally, in order for the new node to join the group and participate in the session, cPCE needs to update the group key, as follows:

[0133] Assuming the identity is ID nj New node n j Apply to join cPCE i Autonomous systems, first of all, are controlled by cPCE i And all original nodes within the domain using the original group key and n j Use identity to calculate new group key And by cPCE i For the superedge E i (K i Updated to get E i (K i Then, cPCE i New key K i 'Use session key After encryption, send to n j Finally, n j Using session keys Decrypt to obtain K i '.

[0134] (3) Group key update when a member leaves

[0135] Please see Figure 9 :

[0136] ① Group key update upon cPCE exit

[0137] Assuming cPCE i It is necessary to exit the PCE layer, i.e., exit the superedge E0(K0). For system security, pPCE will update the group key of the PCE layer. First, pPCE updates the superedge E0(K0) to E0(K0'). Then, a random number is selected. calculate Use the remaining cPCE j(j≠i) The session key is encrypted to K0' and sent to cPCE j(j≠i) Finally, cPCE j(j≠i) After receiving the encrypted K0', each person decrypts it using their respective session key to obtain the group key K0'.

[0138] ② Group key update when an autonomous system member leaves

[0139] Assuming the identity is ID nk node n k Exit cPCE i Autonomous system, by cPCE i The initiated key update process is as follows: n k Request to withdraw from Hyperedge E i (K i If n k If it is not a boundary node, then cPCE i Select random number To calculate Then to n j(j≠k) Send K' encrypted using other nodes' session keys i After receiving the message, n j(j≠k) By using Decrypt it to obtain the group key K' i .

[0140] If n k If it is a boundary node, then cPCE i First, broadcast n at the PCE layer. k Exit cPCE i Information about autonomous regions, and n k After the associated domain's cPCE receives the broadcast message, it forwards it to n. k The associated nodes within this domain are then destroyed by the associated nodes, and n is the node that is linked to them. k The session key between them. Finally, cPCE i Select random number Calculate K i '=H(K i ||m||ID k ), and use the session keys of the remaining nodes to pair K' i Encrypt and send to nj(j≠k) n j(j≠k) Received encrypted K' i Then, they decrypt using their respective session keys to obtain the group key K'. i .

[0141] 3 Scheme Analysis

[0142] 3.1 Proof of Correctness

[0143] (1) pPCE and cPCE i When negotiating session keys, pPCE and cPCE i After the interaction, the parameters Y, b, w, and a are held, and the cPCE is known. i public key P kci and its own private key S kp Therefore, it can be calculated cPCE i After interacting with pPCE, it holds parameters W, b, and a, and its private key S is known. kci and the public key P of pPCE kp Therefore, it can be calculated The following proof of correctness shows that Therefore, both parties negotiate to obtain the same value σ, and thus calculate H(σ) to obtain the same session key.

[0144]

[0145] (2) When cPCEs negotiate session keys, cPCE i In relation to cPCE j After the interaction, the parameters L, p, c, and o are held, and cPCE is known. i public key P kcj and its own private key S kci Therefore, it can be calculated cPCE j With cPCE i After the interaction, you possess parameters C, o, l, p, and know your own private key S. kcj and cPCE i public key P kci Therefore, it can be calculated The following proof of correctness shows that Therefore, both parties negotiate to obtain the same value σ, and thus calculate H(σ) to obtain the same session key.

[0146]

[0147] 3.2 Security Analysis

[0148] (1) Forward security

[0149] During the session key calculation phase, assuming cPCE i After joining the PCE layer, it needs to interact with pPCE and other cPCEs to obtain the session key. Because cPCE i Only the system's public parameters and the public keys of each node can be obtained. Therefore, based on the difficulty of the discrete logarithm problem, cPCE... i Without being able to calculate the private keys of other nodes, it is impossible to know the session keys between the nodes.

[0150] During the calculation of the group key, when cPCE i When a new cPCE joins the PCE layer, the pPCE, acting as the administrator, updates the original random number to update the original group key and superedge. Other existing cPCEs also use their session key with the pPCE to obtain the new group key. Therefore, the newly joined cPCE... i Therefore, the previous group key cannot be obtained. Similarly, newly joined intra-domain nodes also cannot obtain the previous group key.

[0151] In summary, when a new node or cPCE joins the domain, it cannot obtain the previous session key and group key, indicating that the scheme guarantees forward security.

[0152] (2) Backward security

[0153] During the session key calculation phase, assuming cPCE j Leaving the PCE layer, due to cPCE j Without knowing the intermediate parameters generated during the private key exchange between other nodes, it's impossible to determine their session keys. Furthermore, the MQV key exchange process requires hashing the other party's identity for authentication; hence, cPCE... j It also cannot impersonate other nodes to communicate.

[0154] During the calculation of the group key, assuming cPCE j When a member leaves the PCE layer, the pPCE will initiate a key update, which involves recalculating the group key using a random number and sending it to each cPCE via the session key. Because the cPCE... j The node has left the group and therefore cannot obtain future group key values. Similarly, a node that leaves the domain cannot obtain future autonomous system layer group keys.

[0155] In summary, once a node or cPCE leaves the domain, it cannot obtain subsequent session keys and group keys, indicating that the scheme satisfies backward security.

[0156] (3) Resistance to man-in-the-middle attacks

[0157] In conventional Depth-Rayet (DH) protocols, an adversary can act as a man-in-the-middle, impersonating both communicating parties to exchange keys and conduct subsequent communication. To address this issue, this embodiment uses the MQV key exchange protocol, which is resistant to such attacks. The basic idea is as follows:

[0158] Assuming in cPCE i and cPCE j cPCE during key exchange k CPCE (Center for Intermediate Attack) i Secretly holding the private key S kci And the selected random number c, cPCE j Secretly holding the private key S kcj and the selected random number l. cPCE k Able to obtain cPCE i and cPCE j The exchange sends c and L, but S is unknown. kci c, S kcj and l. If cPCE k Randomly select a random number To calculate k = g k And by replacing c and L with K respectively, cPCE i calculate cPCE j calculate Due to cPCE k For S kci c, S kcj Since l is unknown, σ cannot be calculated. k To satisfy σ k =σ i or σ k =σ j Therefore, this solution can resist man-in-the-middle attacks.

[0159] (4) Anti-impersonation attack

[0160] In traditional session key exchange protocols, adversaries can impersonate both communicating parties, forwarding information intended for one node to other nodes, leading to various security problems. For example, in cPCE... i and cPCE j During the key exchange process, cPCE k CPCE launched an impersonation attack as an adversary. i The message is encrypted using the session key σ and sent to cPCE. j Because calculating the session key σ requires calculating the intermediate parameter o = H(C,"cPCE) j ") and p=H(L,"cPCE i"), while o and p need to perform hash operations on the identities of the communicating parties. If cPCE k When an encrypted message is sent to other nodes, the other nodes cannot calculate the correct σ because the received identity information is incorrect, and therefore cannot obtain the true content of the message. Thus, the solution is resistant to impersonation attacks.

[0161] (5) Private key confidentiality

[0162] The scheme uses certificateless cryptography to distribute public and private keys during session key exchange. Each cPCE's private key is generated collaboratively with the pPCE, and the pPCE cannot know the complete private key of the cPCE, thus avoiding key escrow issues. Even if the pPCE leaks its database due to security issues, adversaries cannot obtain the complete private keys of each cPCE. Furthermore, each node's private key is kept secret by itself, only its public key is published. Due to the difficulty of the discrete logarithm problem, adversaries cannot calculate the private key from the public key. Similarly, the private key cannot be calculated during group key negotiation. Therefore, the private keys in this scheme have strong confidentiality.

[0163] 3.3 Performance Analysis and Comparison

[0164] To better compare Iolus with typical distributed solutions and existing layered PCE architectures, this embodiment evaluates Iolus from three aspects: key storage overhead, communication overhead, and key usage frequency. [8] Saroit [9] KMS-KI

[14] The performance of KMS-HC in this embodiment is compared. Assuming the total number of nodes in the network is n, the number of cPCEs is m, and the number of nodes in each domain is generally divided equally, so it is expressed as n / m.

[0165] (1) Key storage overhead analysis and comparison

[0166] In this embodiment, the pPCE needs to store its own public and private keys, the keys constructed with lower-level cPCE nodes, and the group keys of its own layer. As shown in the scheme design section, the pPCE has 2 public and private keys and 1 layer group key. When the number of cPCEs in the network is m, the pPCE will construct m session keys. Therefore, the storage overhead for key management by the pPCE is m+3.

[0167] For cPCE, its own public and private key count is 2. Because it needs to exchange keys with pPCE, other cPCEs, and nodes within the domain, the number of these three session keys are 1, m-1, and n / m, respectively. Since cPCE acts as a bridge between the PCE layer and the autonomous system layer, it also needs to store the group keys for both layers separately. Therefore, the key storage overhead for cPCE is 4 + m + n / m.

[0168] For nodes within each autonomous system, the public / private key storage overhead is 2, requiring only the storage of one group key for the autonomous system layer. However, due to key exchange with the cPCE and other nodes within the domain, and sometimes with boundary nodes of other domains, the session key overhead for these three relationships is 1, (n / m)-1, and m-1 respectively. Therefore, the total storage overhead for key management by nodes within the domain is 2+m+n / m.

[0169] The comparison results of storage overhead of Iolus, Saroit, and KMS-KI are shown in Table 3.

[0170] Table 2: Comparison of Key Storage Overhead of Each Scheme

[0171] Iolus m+1 n / m 2 Saroit m+1 2(n / m) <![CDATA[log2(n / m)+(n / m)]]> KMS-KI m+3 5+m+n / m 4+2(n / m) KMS-HC m+3 4+m+n / m 2+m+n / m

[0172] As shown in Table 2, the key storage overhead of pPCE in this embodiment is the same as that of KMS-KI and only slightly greater than that of other solutions.

[0173] Figure 10 and Figure 11 A comparison of cPCE key storage overhead and node key storage overhead is presented separately. The comparison of cPCE key storage overhead is based on... Figure 10 (n=50) It can be seen that when m<6, the storage overhead of this scheme cPCE is greater than that of Iolus, but less than that of the other two schemes; when m≥6, the storage overhead of this scheme cPCE is higher than that of Iolus and Saroit, but slightly less than that of KMS-KI.

[0174] When comparing node key storage overhead Figure 11 (n=50) It can be seen that when m<4, the key storage overhead of the node in this scheme is less than that of Saroit and KMS-KI, but greater than that of Iolus; when 4≤m≤8, the overhead of this scheme is greater than that of Iolus and Saroit but less than that of KMS-KI; when m≥8, the overhead of this scheme is slightly greater than that of KMS-KI, but much greater than that of Iolus and Saroit.

[0175] (2) Communication overhead analysis and comparison

[0176] Regardless of the partitioning method, the number of nodes in each domain is greater than the total number of cPCEs. Since the partitioning follows the principle of equal distribution, analyzing the communication overhead of the scheme only requires analyzing the communication overhead between the cPCEs and each node within a single domain.

[0177] When a new node joins an autonomous system, the cPCE sends a unicast message containing the new group key to the new node for storage or use. Therefore, the communication overhead of the cPCE when a new member joins is 1.

[0178] When a node leaves an autonomous system (AS), different scenarios need to be analyzed due to the existence of both ordinary nodes and boundary nodes. If a boundary node leaves, the cPCE within the AS needs to send (n / m)-1 unicast messages containing the session key information between the departing node and the destroyed node to the remaining nodes. Simultaneously, to ensure the security and reliability of communication between ASs in the optical network, the session key between the boundary nodes that the departing node participated in building needs to be destroyed. Therefore, the cPCE also needs to send multicast messages to the cPCEs in the other affected ASs to notify them. If an ordinary node leaves, the cPCE only needs to send unicast messages to the remaining nodes. Therefore, the maximum cPCE communication overhead when a node leaves is n / m, and the minimum is (n / m)-1.

[0179] The comparison results of the cPCE communication overhead of this scheme with other schemes are shown in Table 3 below.

[0180] Table 3: Comparison of CPCE Communication Overhead

[0181] Iolus 2 (n / m)-1 Saroit <![CDATA[log2(n / m)+1]]> 1 KMS-KI 2 n / m or (n / m)-1 KMS-HC 1 n / m or (n / m)-1

[0182] Table 3 shows that when a new node joins, the communication overhead of this scheme is lower than that of other schemes; when a node leaves, the comparison of cPCE communication overhead is as follows: Figure 12 As shown (n=50). This scheme has the same communication overhead as KMS-KI, slightly higher than Iolus, while Saroit has the lowest communication overhead, but this scheme has the highest security.

[0183] (3) Key usage frequency analysis and comparison

[0184] Keys are typically used when the number of autonomous system nodes changes, which will be analyzed below.

[0185] When a new node joins, cPCE sends a message encrypted using the session key to the new node. Therefore, when a new node joins, both the cPCE and the new node use their keys once.

[0186] When a node leaves, the situation needs to be described separately due to the different node types. If a boundary node leaves, the cPCE will send a multicast message encrypted with the PCE layer group key to the relevant domain's cPCEs, and simultaneously send a unicast message encrypted with the session key to each remaining node. If a regular node leaves, the cPCE only needs to send a unicast message to each remaining node. In summary, when a boundary node leaves, the cPCE key is used n / m times, and the remaining node key is used 1 time; when a regular node leaves, the cPCE key is used (n / m)-1 times, and the remaining node key is used 1 time.

[0187] Table 4 shows a comparison of the key usage frequency of the KMS-HC scheme with the other three schemes.

[0188] Table 4: Comparison of the Number of Times cPCE Keys Are Used

[0189]

[0190] When a new node joins, by Figure 13 (n=50) and Table 4 show that the cPCE scheme has the fewest key usages, while the remaining nodes use the key less frequently than the Saroit scheme, similar to the other two schemes. When a node exits, [the remaining nodes use the key less frequently than the Saroit scheme]. Figure 14 As shown in Table 4 (n=50), the number of times the key is used in cPCE of this scheme is the same as that of KMS-KI, but slightly greater than that of Iolus, while the number of times the key is used in the remaining nodes is 1. Saroit has the fewest cPCE and the fewest number of times the key is used in the remaining nodes, but its security is the lowest. Overall, this scheme has better performance.

[0191] 4 Application Examples

[0192] This section uses a large-scale support mission conducted by a certain detachment as a case study, and details the process of key management for the communication optical network during the mission using the KMS-HC scheme. Based on the main idea of ​​the scheme, this detachment is considered the pPCE (multi-domain optical network) to be constructed in this support mission, the two participating battalions are the cPCEs of two autonomous domains, and the six subordinate squadrons are the nodes in the network. The resulting multi-domain optical network key hypergraph model of this detachment is as follows: Figure 15 As shown. For ease of observation and analysis, the model is simplified to... Figure 16 The topology diagram shown.

[0193] (1) Establishment of public and private keys

[0194] In the initial stage of key management, it is necessary to first establish public and private keys at the branch level under a certificateless public-key cryptography system. Then, after each brigade has established its own public and private keys, the corresponding public and private keys are calculated and distributed to the squadrons under its jurisdiction. The specific process for establishing public and private keys at each level is as follows: Figure 17 As shown. Since the principles for establishing public and private keys are the same across different autonomous domains, this section will only explain the process of establishing public and private keys for the detachment, the 1st battalion, and the three squadrons under the 1st battalion.

[0195] In the diagram, solid lines represent unicast messages sent by the 1st Battalion to the detachment and its subordinate squadrons, dashed lines represent unicast messages sent by the detachment to the 1st Battalion, and dotted lines represent unicast messages sent by each squadron to the 1st Battalion. The text next to the nodes represents the public and private keys calculated by the detachment, the 1st Battalion, and the three squadrons. The text next to the dashed lines represents the message content sent by the detachment to the 1st Battalion, the text next to the solid lines represents the message content sent by the 1st Battalion to the detachment and each squadron, and the text next to the dotted lines represents the message content sent by each squadron to the 1st Battalion.

[0196] (2) Session key negotiation

[0197] The detachment negotiates session keys with the battalion, the battalion with each other, and the battalion with its subordinate squadrons using the MQV key exchange protocol. Since the key exchange between the battalion and the squadron, and between non-boundary squadrons, follows the same principle as the key negotiation between the detachment and the battalion, and between battalions, for ease of subsequent observation, this section only describes the key negotiation process between the detachment and Battalion 1, Battalion 1 and Battalion 2, and the domain boundary squadron. Figure 18 As shown.

[0198] In the diagram, solid lines represent unicast messages sent by Battalion 1 to Battalion 2 or Squadron, dashed lines represent unicast messages sent by Squadrons to Battalion, and double dashed lines represent the key hyperedge formed between Squadron 3 and Squadron 4. The text next to the nodes represents the session keys exchanged between Battalions, between Detachments and Major Battalions, between Battalions and Squadrons, and between Squadrons. The text next to solid lines represents the content of messages sent by Battalion 1 to Battalion 2 or Squadron, and the text next to dashed lines represents the content of messages sent by Squadrons to Battalion 1.

[0199] (3) Group key establishment

[0200] The idea of ​​member characteristic values ​​is used to calculate the layered keys at the detachment and battalion levels, thereby establishing the initial state of key management. The process is as follows: Figure 19 As shown in the diagram. Dashed lines represent unicast messages sent from the detachment to the battalion, and solid lines represent unicast messages sent from the battalion to the company. The text next to the dashed lines represents the content of the messages sent from the detachment to the battalion, and the text next to the solid lines represents the content of the messages sent from the 1st Battalion to each company.

[0201] (4) Group key update when a member joins.

[0202] If insufficient personnel are discovered during the support process, and additional personnel are needed, the key update principle is the same when arranging support from squadrons or battalions; therefore, only the latter will be explained here. Assuming that 3 battalions (containing three squadrons) are arranged to provide support, after 3 battalions obtain their own public and private keys and exchange session keys with the headquarters, the branch and the original battalion need to update the group key and super-edge, and send the new group key to 3 battalions. The process is as follows: Figure 20 As shown.

[0203] In the diagram, the dashed line represents the detachment sending a unicast message to the 3rd battalion. The text next to the node represents the calculated new group key and the session key between the detachment and the squadron. The text on the dashed line represents the new group key or session key. The text outside the autonomous system represents the updated key superedge.

[0204] (5) Group key update when a member leaves.

[0205] When a brigade or squadron needs to leave the network after completing its mission in the later stages of execution, there are two scenarios when a squadron leaves. The principle for updating the group key when a squadron that is not at the boundary leaves is the same as the principle for a brigade leaving. Therefore, this explanation only addresses the scenario of a squadron leaving the multi-domain optical network. Figure 21 As shown.

[0206] In the diagram, the solid lines represent unicast messages sent from the brigade to each squadron, the text next to the solid lines represents the content of the sent messages, and the text outside the autonomous system represents the updated key superedge.

[0207] 5. Conclusion

[0208] With the expansion of optical network scale and the increase in technological complexity, security issues in communication processes are also increasing. Solutions to these security issues generally employ various security protection mechanisms, the smooth operation of which relies heavily on key management and usage. Therefore, researching efficient and reliable key management schemes has become an important direction in exploring optical network security. In this regard, this embodiment presents a certificateless multi-domain optical network key management method, KMS-HC, based on a layered PCE architecture. While completing the scheme design, its security and performance were analyzed and compared with typical cases. The analysis and comparison results with previous typical methods show that this method not only possesses forward and backward security, resistance to man-in-the-middle attacks, resistance to impersonation attacks, and strong key confidentiality, but also reduces key storage overhead, communication overhead, and key usage frequency, resulting in better overall performance.

Claims

1. A key management method for multi-domain optical networks based on hierarchical PCE and certificateless public-key cryptography, characterized in that, First, a key hypergraph model of the optical network that reflects the key hierarchy is constructed. Then, public and private keys are established on the basis of certificateless public key cryptography, and the MQV key exchange protocol is used to negotiate the session key. Finally, a group key is established and updated when a member joins or leaves. The optical network key hypergraph model is a hierarchical key hypergraph model composed of vertices and hyperedges. G =( N , E Based on the key relationships between nodes in the optical network, the model can be divided into the PCE layer and the autonomous region layer. The vertex set is represented as ; The superedge set is represented as ; The number of domains divided in the network is used as... d express, i , j These represent the sequence numbers corresponding to the nodes. K i or K i-j This represents the group key for all nodes covered by each hyperedge; In the PCE layer, pPCE is the private key generator PKG or key generation center KGC of each cPCE, while in the autonomous system layer, cPCE is the private key generator PKG or key generation center KGC of that autonomous system. Specifically, the following operations are included: Assuming there are 22 nodes in the multi-domain optical network, in the constructed two-layer key hypergraph model, n 0 represents pPCE; n 19 , n 20 , n 21 For cPCE; E 0 ( k 0) indicates that the pPCE shares a group key with each cPCE. k 0 superedge; E 1 ( k 1) E 2 ( k 2) and E 3 ( k 3) These represent the group keys shared by nodes in autonomous systems 1, 2, and 3, respectively. k 1. k 2 and k 3 superedges; e 6-7 ( k 6-7 )and e 12-13 ( k 12-13 () is the group key shared between the boundary nodes of autonomous systems 1 and 2, and 2 and 3. k 6-7 and k 12-13 The superedge; Step 1: Public and private key establishment and distribution (1) Establishment of pPCE public and private keys The KGC, which will serve as the PCE layer, will first input security parameters. λ Select elliptic curve E The group on G 1. Define the group G 1 generator f ∈ G 1; E In a finite field Fq Above, the hierarchy of the group q It is a large prime number, define a hash function. pPCE selection Use it as the master key, i.e., your own private key, and then calculate... P kp =S kp f ∈ G 1 is used as the public key to expose system parameters. M =( E , G 1, f , q , H , P kp ); (2) Establishment of cPCE public and private keys cPCE i Select random number As part of the private key, calculate the corresponding part of the public key. X i =x i P kp ∈ G 1; then the identity information ID ci and X i Send to pPCE, pPCE selects a random number. and calculate R i =r i ·P kp ∈ G 1, d i =r i +S kp ·H (ID) ci , R i , X i ),Will R i As cPCE i Part of the public key, d i As cPCE i Send part of the private key to cPCE i cPCE i Combine the two parts of the key to obtain the private key. S kci =( x i , d i ), public key P kci =( X i , R i ); (3) Distribution of public and private keys of nodes At the autonomous system layer, the cPCE acts as the KGC for the domain, distributing public and private keys to various nodes within the domain; at this time, the cPCE... j The domain's system master key is set to S kcj =x j +d j , P kcj =S kcj ， Parameters are set to M =( E , G 1, q , f , P kcj , H ); In autonomous region cPCE j Inside, in order to calculate part of the public key T i ,node n i First, select a random number. Used as part of its own private key and calculated T i =t i P kcj Then, the identity information ID ni and T i Send to cPCE j cPCE j Random selection and calculate U i = u i · P kcj and v i =u i +P kc · (ID) ni , U i , T i Finally to n i send U i and v i This serves as part of the node's public and private keys; after receiving the message and merging the two parts of the key... n i Obtain the private key S kni = ( t i , v i ) and public key P kni = ( T i , U i ); Step 2, Session Key Negotiation Each node n i With each of the cPCE i First, merge your private keys to obtain S kni =t i +v i , S kci =x i +d i Choose the multiplication cyclic group G 2 and generator g ∈ G 2. Calculate the public key P kni =g Skni ∈ G 2, P kci =g Skci ∈ G 2. Then, the session key is exchanged using the MQV key exchange protocol. The specific process is as follows: (1) Establish PCE layer session key Step 1: pPCE and cPCE i When negotiating the session key, pPCE selects a random number. w ,calculate W = g w ∈G 2, cPCE i Select random number y ,calculate Y = g y ∈G 2. Public W and Y pPCE and cPCE i Calculate each , Finally, pPCE calculation. cPCE i calculate Both sides calculated Obtain the session key ; Step 2: Each When negotiating session keys, cPCE i Select random number c ,calculate C = g c ∈G 2, cPCE j Select random number l ,calculate L = g l ∈G 2; then cPCE i and cPCE j calculate as well as Finally, cPCE i calculate cPCE j calculate Both sides calculated Obtain the session key ; (2) Establish autonomous system layer session keys The establishment of session keys between domain boundary nodes with special key hyperedges is described, using boundary nodes as an example. n i and n j Taking the boundary node as an example, the other boundary nodes are similarly handled, and the specific steps are as follows: First, domain A node n i Select random number To calculate ;use right W i Encrypt and send to cPCE A cPCE A After receiving and decrypting the message, use Encrypt the message and send it to cPCE B cPCE B Decrypt the message after receiving it, and then use it. Encrypt the information and send it to the node. n j ;node n j After receiving and decrypting the message, randomly select To calculate ,Will X j According to the receipt W i Send to the node in the reverse order n i ;node n i With nodes n j Calculate separately first , Then the node n i calculate and k j-i =H ( σ ),node n j calculate and k i-j =H ( σ According to the MQV key exchange principle, it is known that... k i-j =k j-i Finally, cPCE A Generate inter-domain key hyperedge ; Step 3, Group Key Establishment and Update (1) Group key establishment ①Establishment of PCE layer group key Set the number of autonomous regions to be d pPCE selects random numbers ,use Identity identifier Calculate the PCE layer group key Generate hyperedge E 0 ( K 0);pPCE use right K Encrypt 0, and then encrypt the result. K 0 is sent to each PCE in the PCE layer; each use Decryption ; ; ② Establishment of Autonomous System Layer Key Let the number of nodes in the domain be f cPCE i Select random number And utilize intra-domain nodes n j Identity ID nj To calculate This generates a hyperedge. E i ( K i ); then use encryption K i And send to n j After receiving the encrypted message, each node in the domain uses... Decrypt to obtain group key K i ; ; (2) Group key update when a member joins ① Group key update when a new cPCE joins the PCE layer New cPCE j Upon joining, you first obtain your own public and private keys, exchange session keys with pPCE, and then publicly reveal your public key and identity. ID cj Finally, in order for a new cPCE to join the group and participate in the session, the pPCE needs to update the group key, as follows: First, pPCE and cPCE i Using the original key and cPCE j Use identity to calculate new group key and for the super-edge E 0 ( K 0) Updated Then use the session key For the updated After encryption, pPCE sends a message to cPCE. j Send the message; upon receiving the encrypted message, cPCE j use Decrypt the message to obtain ; ② Group key update when a new node joins an autonomous system When a new node joins, it first obtains its own public and private keys, then exchanges session keys with pPCE, and then publishes its public key and identity. Finally, in order for the new node to join the group and participate in the session, cPCE needs to update the group key, as follows: Assuming identity is ID nj new node n j Apply to join cPCE i Autonomous systems, first of all, are controlled by cPCE i and all original nodes within the domain using the original group key and n j Use identity to calculate new group key And by cPCE i For superedge E i ( K i Updated Then, cPCE i New group key Using session keys After encryption, send n j ;at last, n j Using session keys Decryption ; (3) Group key update when a member leaves ① Group key update upon cPCE exit Assuming cPCE i You need to exit the PCE layer, i.e., exit the hyperedge. E 0 ( K 0), for system security, pPCE will update the group key of the PCE layer; first, pPCE updates the hyperedge E 0 ( K 0) Update to become Then, select a random number. ,calculate and use the remaining cPCEs j Session key pair Encrypt and send to cPCE j Finally, cPCE j Received encrypted Then, each session key is used to decrypt the data to obtain the group key. ; j ≠ i ; ② Group key update when an autonomous system member leaves Assuming the identity is ID nk nodes n k Exit cPCE i Autonomous system, by cPCE i The initiated key update process is as follows: n k Request to withdraw from Hyperborder E i ( K i ),like n k If it is not a boundary node, then cPCE i Select random number To calculate Then to n j Sending data encrypted using other nodes' session keys. After receiving the message, n j By using Decrypt it to obtain the group key ; j ≠ k ; like n k If it is a boundary node, then cPCE i First, broadcast at the PCE layer. n k Exit cPCE i Information about autonomous regions, and n k After receiving the broadcast message, the associated domain's cPCE forwards it to the relevant domain. n k The associated nodes within this domain are then destroyed by the associated nodes. n k The session key between them; finally, cPCE i Select random number ,calculate and use the session keys of the remaining nodes. Encrypt and send n j , n j Received encrypted Then, each session key is used to decrypt the data to obtain the group key. , j ≠ k .

Images