GBA-based certificate issuance method and device

Abstract

The present application relates to the field of security authentication technology, and provides a certificate issuance method and device based on GBA. The method includes: obtaining preset confidential parameters set by a registration certificate authority; generating a symmetric key and an identity authentication value according to the preset confidential parameters, and encrypting the identity authentication value according to the symmetric key to obtain encrypted information; generating an application request for certificate registration according to the encrypted information, and sending the application request to the registration certificate authority through an authentication and authorization system, wherein the registration certificate authority determines the registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system; receiving the encrypted registration certificate sent by the authentication and authorization system, and decrypting the encrypted registration certificate according to the symmetric key to obtain the registration certificate. Based on the authentication and authorization system, the present application adds an anonymous authentication mechanism to hide the identity of the terminal user, protect user privacy, and improve the security of certificate sending.

Description

Technical Field

[0001] The present application relates to the field of security authentication technology, and in particular to a GBA-based certificate issuance method and device. Background Art

[0002] In the 5G era, everything is connected, and the car-centric V2X (Vehicle-to-Everything) vehicle-road collaboration has gradually entered people's lives. The Internet of Vehicles needs to solve communication security issues, including the identity confirmation of legitimate base stations during connection, the identity confirmation of vehicles, the integrity, confidentiality and non-repudiation of communication data, and the leakage of vehicle privacy information. To solve these problems, the Internet of Vehicles needs to adopt appropriate cryptographic schemes and identity authentication technologies. Public key encryption authentication based on digital certificates is a V2X security mechanism commonly used by domestic and foreign standard organizations. The premise of applying digital certificates is to safely complete the initial configuration, distribution and management of digital certificates and private keys for Internet of Vehicles devices.

[0003] At present, the 5GAA standard organization uses the GBA network security standard solution defined by 3GPP as an initial configuration solution for Internet of Vehicles terminals, and applies GBA technology to V2X business security communications to meet the needs of securely importing multiple certificates without pre-setting root certificates. GBA authentication technology has many advantages in mutual authentication between terminals and V2X certificate authentication and authorization systems, but there are also some security issues due to some information. For example, the registration certificate request information forwarded through the GBA mechanism contains important privacy information such as the user's vehicle or device SN, which brings privacy leakage problems. Summary of the invention

[0004] The embodiments of the present application provide a GBA-based certificate issuance method and device to solve the security problem of certificate issuance.

[0005] In a first aspect, an embodiment of the present application provides a GBA-based certificate issuance method, which is applied to a vehicle-road cooperative device, including:

[0006] Get the preset secret parameters set by the registration certificate authority;

[0007] Generate a symmetric key and an identity authentication value according to the preset confidentiality parameter, and encrypt the identity authentication value according to the symmetric key to obtain encrypted information;

[0008] Generate an application request for certificate registration according to the encrypted information, and send the application request to the registration certificate authority through the authentication and authorization system, wherein the registration certificate authority determines the registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system;

[0009] The encrypted registration certificate sent by the authentication and authorization system is received, and the encrypted registration certificate is decrypted according to the symmetric key to obtain the registration certificate.

[0010] In one embodiment, before obtaining the preset confidentiality parameters set by the registration certificate authority, the process includes:

[0011] The preset password and the vehicle identification code are sent to the registration certificate authority in an offline manner, wherein the registration certificate authority determines the preset confidential parameters based on the preset parameters and the received preset password and the vehicle identification code, and sends the preset confidential parameters to the vehicle-road cooperative device in an offline manner.

[0012] In one embodiment, after obtaining the preset confidentiality parameters set by the registration certificate authority, the method includes:

[0013] When logging into the vehicle-road cooperative device, determining the identity password record according to the preset password and the vehicle identification code;

[0014] If the identity password record is consistent with the target identity password record, the step of generating a symmetric key and an identity authentication value according to the preset confidentiality parameters is performed.

[0015] In a second aspect, an embodiment of the present application provides a GBA-based certificate issuance method, which is applied to a registered certificate authority, including:

[0016] Determine preset confidential parameters, and send the preset confidential parameters to the vehicle-road cooperative device in an offline manner;

[0017] Receiving an application request for certificate registration sent by the authentication and authorization system, and generating a symmetric key according to the preset confidentiality parameters;

[0018] Decrypting the application request according to the symmetric key to obtain an identity authentication value;

[0019] A registration certificate is determined according to the identity authentication value, the registration certificate is encrypted according to the symmetric key, and the encrypted registration certificate is sent to the vehicle-road cooperative device through the authentication and authorization system.

[0020] In one embodiment, determining a registration certificate according to the identity authentication value includes:

[0021] If the identity authentication value is consistent with the target identity authentication value, the registration certificate is generated according to the application request.

[0022] In one embodiment, determining the preset confidentiality parameters includes:

[0023] Obtaining a preset password and a vehicle identification code of the vehicle-road cooperative device;

[0024] The preset confidential parameters are determined according to the preset password, the vehicle identification code and preset parameters.

[0025] In a third aspect, an embodiment of the present application provides a GBA-based certificate issuance device, including:

[0026] A first receiving module, used to obtain preset confidential parameters set by a registration certificate authority;

[0027] An encryption module, used to generate a symmetric key and an identity authentication value according to the preset confidentiality parameters, and encrypt the identity authentication value according to the symmetric key to obtain encrypted information;

[0028] A first sending module, configured to generate an application request for certificate registration according to the encrypted information, and send the application request to the registration certificate authority through an authentication and authorization system, wherein the registration certificate authority determines a registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system;

[0029] The second receiving module is used to receive the encrypted registration certificate sent by the authentication and authorization system, and decrypt the encrypted registration certificate according to the symmetric key to obtain the registration certificate.

[0030] In a fourth aspect, an embodiment of the present application provides a GBA-based certificate issuance device, including:

[0031] A determination module, used to determine preset confidential parameters and send the preset confidential parameters to the vehicle-road cooperative device in an offline manner;

[0032] A third receiving module is used to receive an application request for certificate registration sent by the authentication and authorization system, and generate a symmetric key according to the preset confidential parameters;

[0033] A decryption module, used to decrypt the application request according to the symmetric key to obtain an identity authentication value;

[0034] The second sending module is used to determine the registration certificate according to the identity authentication value, encrypt the registration certificate according to the symmetric key, and send the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system.

[0035] In a fifth aspect, an embodiment of the present application provides an electronic device, including a processor and a memory storing a computer program, wherein when the processor executes the program, the steps of the GBA-based certificate issuance method described in the first aspect are implemented.

[0036] In a sixth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the GBA-based certificate issuance method described in the first aspect.

[0037] The GBA-based certificate issuance method and device provided in the embodiment of the present application obtains the preset confidential parameters set by the registration certificate authority; generates a symmetric key and an identity authentication value according to the preset confidential parameters, and encrypts the identity authentication value according to the symmetric key to obtain encrypted information; generates an application request for certificate registration according to the encrypted information, and sends the application request to the registration certificate authority through the authentication and authorization system, wherein the registration certificate authority determines the registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system; receives the encrypted registration certificate sent by the authentication and authorization system, and decrypts the encrypted registration certificate according to the symmetric key to obtain the registration certificate. This application is based on the GBA authentication and authorization system, and adds an anonymous authentication mechanism to the user's V2X device and the registration certificate authority ECA to hide the true identity of the terminal user, thereby protecting user privacy and improving the security of certificate sending. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 This is one of the flow charts of the GBA-based certificate issuance method provided in the embodiment of the present application;

[0040] Figure 2 This is the second flow chart of the GBA-based certificate issuance method provided in the embodiment of the present application;

[0041] Figure 3 This is the third flow chart of the GBA-based certificate issuance method provided in the embodiment of the present application;

[0042] Figure 4 This is one of the structural diagrams of the GBA-based certificate issuing device provided in the embodiment of the present application;

[0043] Figure 5 This is the second structural diagram of the GBA-based certificate issuing device provided in the embodiment of the present application;

[0044] Figure 6 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] Figure 1 This is one of the flow charts of the GBA-based certificate issuance method provided in the embodiment of the present application. Figure 1 The embodiment of the present application provides a GBA-based certificate issuance method, which is applied to a vehicle-road cooperative device and may include:

[0047] Step S10, obtaining preset confidential parameters set by the registration certificate authority;

[0048] It should be noted that the embodiment of the present application is based on the GBA (General Bootstrapping Architecture) authentication and authorization system, and adds an anonymous authentication mechanism on the user's V2X (Vehicle-to-Everything) device side and the registration certificate authority ECA (Enrollment Certificate Authority) side to hide the true identity of the terminal user, thereby protecting user privacy.

[0049] Specifically, in the stage of presetting confidential parameters, the V2X device sends the preset password and vehicle identification code to the registration certificate authority offline, where the vehicle identification code includes the SN code and the VIN code. The SN (Serial Number) code can be understood as a machine code, authentication code, registration application code, etc., which is used to verify the "legal identity of the product"; the VIN (Vehicle Identification Number) code can be understood as a vehicle identification code, commonly known as the "frame number", which is a set of codes assigned to a vehicle by the manufacturer for identification, and has unique identification of the vehicle. The registration certificate authority then determines the preset confidential parameters based on the preset parameters and the received preset password and vehicle identification code, and sends the preset confidential parameters to the vehicle-road cooperative device (i.e., the V2X device) offline. For example, the V2X device sends the SN / VIN code and the selected password PW to the registration certificate authority ECA offline. The registration certificate authority ECA determines the preset confidential parameters based on security parameters (such as prime numbers p, q and generator g), secret values and secure hash functions Random value r iThe password PW and SN / VIN code determine the preset confidential parameters. For example, the calculation process of ECA is explained using the VIN code as an example:

[0050] Login verification auxiliary items:

[0051] Device authentication value generation auxiliary items:

[0052] Auxiliary items for generating temporary symmetric keys:

[0053] After determining V, V' and C, the registration certificate authority ECA will preset the confidential parameters {V, V', C, g, p, q, h, r i}Sent to the V2X device offline, and the V2X device writes the preset confidential parameters into the secure storage area.

[0054] By adding a preset confidential parameter stage on the V2X device side to initialize anonymous authentication information, information leakage can be avoided and information security can be improved.

[0055] In one embodiment, after obtaining the preset confidentiality parameters set by the registration certificate authority, the method includes:

[0056] Step S11, when logging into the vehicle-road cooperative device, determining the identity password record according to the preset password and the vehicle identification code;

[0057] Step S12: If the identity password record is consistent with the target identity password record, the step of generating a symmetric key and an identity authentication value according to the preset confidential parameters is executed.

[0058] During the V2X device login phase, the password file in the V2X device stores the plain text of the user password. When logging into the V2X device, the user enters the SN / VIN code and the corresponding password PW on the V2X device side. The V2X device searches the password file for the identity password record that matches the password PW based on the SN / VIN code. The identity password record includes the C value in the preset confidentiality parameter. Then verify Whether it is equal to the C value in the V2X device, if it is equal, the verification is successful, indicating that the current user is legitimate. At this time, a symmetric key and identity authentication value are generated according to the preset confidential parameters; if it is not equal, the verification fails, indicating that the current user is not legitimate, and the authentication process is terminated.

[0059] The embodiment of the present application performs identity password authentication during the V2X device login phase to determine the legitimacy of the user. Based on this, the legitimacy of the user can be ensured, information leakage problems can be avoided, and information security can be improved.

[0060] Step S20, generating a symmetric key and an identity authentication value according to the preset confidentiality parameter, and encrypting the identity authentication value according to the symmetric key to obtain encrypted information;

[0061] The V2X device generates a symmetric key and an authentication value according to preset confidential parameters, and encrypts the authentication value according to the symmetric key to obtain encrypted information. For example, in the authentication phase, a number x is randomly selected based on the anonymous function module of the V2X device. Calculate the temporary public key X based on x, the formula is as follows:

[0062] X=g x mod q;

[0063] Calculate and encrypt the temporary symmetric key SK for the device VIN code information sent by V2X T , the formula is as follows:

[0064] SK T =C x mod q;

[0065] Calculate the identity authentication value ID V , the formula is as follows:

[0066]

[0067] Using the symmetric key SK T Encrypt the information sent, that is, the encrypted identity authentication value ID V Get the encrypted information E, the formula is as follows:

[0068]

[0069] Among them, T V The timestamp of the device.

[0070] Step S30, generating an application request for certificate registration according to the encrypted information, and sending the application request to the registration certificate authority through the authentication and authorization system, wherein the registration certificate authority determines the registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system;

[0071] Using the symmetric key SK T Authentication value ID VAfter encryption is performed to obtain the encrypted information, an application request for certificate registration is generated based on the encrypted information, and the application request is sent to the registration certificate authority through the authentication and authorization system. For example, the encrypted information E is encapsulated into the certificate registration application information, such as encapsulated into the certificate registration application request, and then the application request is sent to the authentication and authorization system, wherein the authentication and authorization system completes the authentication of the V2X device and sends the encrypted application request of the V2X device to the registration certificate authority. The registration certificate authority determines the registration certificate based on the application request, encrypts the registration certificate, and then sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system, or downloads the registration certificate by downloading the V2X device offline.

[0072] Step S40: receiving the encrypted registration certificate sent by the authentication and authorization system, and decrypting the encrypted registration certificate according to the symmetric key to obtain the registration certificate.

[0073] After the V2X device receives the encrypted registration certificate sent by the authentication and authorization system, it decrypts the encrypted registration certificate according to the symmetric key to obtain the registration certificate. For example, the symmetric key SK T The encrypted registration certificate is decrypted to obtain the registration certificate.

[0074] The GBA-based certificate issuance method provided in the embodiment of the present application obtains the preset confidential parameters set by the registration certificate authority; generates a symmetric key and an identity authentication value according to the preset confidential parameters, and encrypts the identity authentication value according to the symmetric key to obtain encrypted information; generates an application request for certificate registration according to the encrypted information, and sends the application request to the registration certificate authority through the authentication and authorization system, wherein the registration certificate authority determines the registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system; receives the encrypted registration certificate sent by the authentication and authorization system, and decrypts the encrypted registration certificate according to the symmetric key to obtain the registration certificate. This application is based on the GBA authentication and authorization system, and adds an anonymous authentication mechanism to the user's V2X device and the registration certificate authority ECA to hide the true identity of the terminal user, thereby protecting user privacy and improving the security of certificate sending.

[0075] refer to Figure 2 , Figure 2 This is the second flow chart of the GBA-based certificate issuance method provided in the embodiment of the present application. The embodiment of the present application provides a GBA-based certificate issuance method, which is applied to a registered certificate authority and may include:

[0076] Step S50, determining a preset confidential parameter, and sending the preset confidential parameter to the vehicle-road cooperative device in an offline manner;

[0077] In the presetting confidential parameters stage, the registration certificate authority determines the presetting confidential parameters and sends the presetting confidential parameters to the vehicle-road cooperative device in an offline manner. For example, the registration certificate authority ECA selects security parameters, such as prime numbers p, q and generator g, where p = 2q + 1, and g is the generator of the group of order q. At the same time, the registration certificate authority ECA randomly selects the secret value and a secure hash function

[0078] The V2X device sends the SN / VIN code and the selected password PW to the registration certificate authority ECA in an offline manner. The calculation process of ECA is explained using the VIN code as an example. For example, the registration certificate authority ECA selects a random value r i , then calculate:

[0079] Login verification auxiliary items:

[0080] Device authentication value generation auxiliary items:

[0081] Auxiliary items for generating temporary symmetric keys:

[0082] After determining V, V' and C, the registration certificate authority ECA will preset the confidential parameters {V, V', C, g, p, q, h, r i}Sent to the V2X device offline, and the V2X device writes the preset confidential parameters into the secure storage area.

[0083] By adding a preset confidential parameter stage on the V2X device side to initialize anonymous authentication information, information leakage can be avoided and information security can be improved.

[0084] Step S60, receiving a certificate registration application request sent by the authentication and authorization system, and generating a symmetric key according to the preset confidentiality parameters;

[0085] After receiving the certificate registration application request sent by the authentication authority, the registration certificate authority generates a symmetric key based on the preset confidential parameters. For example, after receiving the V2X device certificate registration application request forwarded by GBA, the registration certificate authority ECA generates a symmetric key SK' based on the preset confidential parameters. T , the formula is as follows:

[0086]

[0087] Among them, the symmetric key SK' T With the symmetric key SK T Same, that is, SK' T =SK T .

[0088] Step S70, decrypting the application request according to the symmetric key to obtain an identity authentication value;

[0089] Generate a symmetric key SK' based on the preset secret parameters T Then, the symmetric key SK' is used T Decrypt the application request to obtain the identity authentication value, for example, using the symmetric key SK' T Decrypt the information E of the V2X device to obtain the information VIN' sent by the V2X device, and then the registration certificate authority calculates the identity authentication value ID' based on VIN' V , the formula is as follows:

[0090] ID' V =h(S||ID ECA ||VIN')

[0091] Step S80, determining a registration certificate according to the identity authentication value, encrypting the registration certificate according to the symmetric key, and sending the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system.

[0092] After decryption, the authentication value ID' V After that, the identity authentication value ID' V The target authentication value ID V After comparison, if the two are equal, the V2X device is considered to be a legal user and the production phase of the registration certificate is carried out; if the two are not equal, the V2X device is considered to be an illegal user.

[0093] After completing the V2X device certification, the registration certificate authority ECA generates a registration certificate based on the certificate registration request information. The certificate issuance can use SK' T After encryption, it is sent to the GBA authentication system, which then forwards it to the V2X device; or it can be downloaded by the V2X device offline.

[0094] The GBA-based certificate issuance method provided in the embodiment of the present application determines preset confidential parameters and sends the preset confidential parameters to the vehicle-road cooperative device in an offline manner; receives the application request for certificate registration sent by the authentication and authorization system, and generates a symmetric key according to the preset confidential parameters; decrypts the application request according to the symmetric key to obtain an identity authentication value; determines the registration certificate according to the identity authentication value, encrypts the registration certificate according to the symmetric key, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system. This application is based on the GBA authentication and authorization system, and adds an anonymous authentication mechanism to the user's V2X device and the registration certificate authority ECA to hide the true identity of the terminal user, thereby protecting user privacy and improving the security of certificate transmission.

[0095] refer to Figure 3 , Figure 3 This is the third flow chart of the GBA-based certificate issuance method provided in the embodiment of the present application.

[0096] Based on the original GBA authentication process, the embodiment of the present application adds a preset confidential parameter stage on the user's V2X device side to initialize anonymous authentication information, and at the same time, adds identity password authentication during the device login stage. After the login authentication is completed, the V2X device generates a temporary symmetric key and identity authentication value based on the preset confidential parameters, encrypts the identity authentication value with the symmetric key, and generates an application request for certificate registration based on the encrypted identity authentication value, and sends the application request to the registration certificate authority ECA through the GBA authentication and authorization system. After ECA completes the authentication and certificate registration, it uses the symmetric key SKT to encrypt the registration certificate and sends it to the V2X device side through the GBA authentication and authorization system, or the V2X device completes the registration certificate application by offline download. Specifically, the application process for the V2X device to perform anonymous authentication of the V2X registration certificate is as follows:

[0097] T1, the stage of presetting confidential parameters, completes the generation and setting of confidential parameters of the anonymous scheme of the registration certificate authority ECA and the V2X device.

[0098] When T2 and V2X devices send authentication messages to the GBA authentication and authorization system for the first time, the anonymous authentication login process is triggered to authenticate the legitimacy of the user.

[0099] T3. The V2X device sends an authentication and authorization request to the GBA authentication and authorization system.

[0100] T4. The GBA authentication and authorization system authenticates the V2X device based on the USIM information and returns the user's temporary identification B-TID and life cycle.

[0101] T5. The V2X device calls the anonymous scheme interface to anonymize the private information such as the VIN code and the device SN, and encapsulates the anonymized device SN / VIN code private information and the generated public key and other information to generate an application request for certificate registration.

[0102] T6. The V2X device generates a symmetric key SKT using the security parameters in the preset confidential parameters, uses the symmetric key to encrypt the certificate registration application request, and sends the encrypted certificate registration application request to the GBA authentication and authorization system.

[0103] T7. After the GBA authentication and authorization system passes the authentication, it sends an encrypted certificate registration application request to the registration certificate authority ECA.

[0104] T8. The registration certificate authority ECA uses the security parameters and the received information to generate the same symmetric key SKT as the V2X device side, and uses the symmetric key SKT to decrypt the application request for encrypted certificate registration forwarded by the GBA authentication and authorization system, and authenticates the correctness of the real device SN and vehicle VIN code contained in the user's anonymous information. After the authentication is passed, enter T9, otherwise terminate the application process.

[0105] T9. The registration certificate authority ECA issues a registration certificate and uses the symmetric key SKT to encrypt the registration certificate.

[0106] T10. The registration certificate authority ECA returns the encrypted registration certificate application response to the GBA certification authority system.

[0107] T11. The GBA authentication and authorization system returns the encrypted registration certificate application response to the V2X device.

[0108] T12. After receiving the registration certificate application response, the V2X device decrypts and verifies the validity of the registration certificate.

[0109] The embodiment of the present application performs anonymous processing on the user privacy data in the information sent by the V2X device to the GBA authentication and authorization system. The GBA authentication and authorization system receives the information of the V2X device. While completing the authentication of the V2X device, it cannot obtain any real identity information of the user. After the registration certificate authority ECA receives the device registration application and other information authenticated by the GBA authentication and authorization system, it processes the anonymous information therein to obtain the real identity information of the user. By adding an anonymous authentication mechanism on the user's V2X device side and the registration certificate authority ECA based on the GBA authentication and authorization system to hide the real identity of the terminal user, the user's privacy is protected and the security of certificate transmission is improved.

[0110] The following is a description of a GBA-based certificate issuing device provided in an embodiment of the present application. The GBA-based certificate issuing device described below and the GBA-based certificate issuing method described above can refer to each other.

[0111] refer to Figure 4 , Figure 4 It is one of the structural diagrams of the GBA-based certificate issuing device provided in the embodiment of the present application. The GBA-based certificate issuing device provided in the embodiment of the present application includes a first receiving module 401, an encryption module 402, a first sending module 403 and a second receiving module 404.

[0112] The first receiving module 401 is used to obtain preset confidential parameters set by the registration certificate authority;

[0113] The encryption module 402 is used to generate a symmetric key and an identity authentication value according to the preset confidentiality parameters, and encrypt the identity authentication value according to the symmetric key to obtain encrypted information;

[0114] The first sending module 403 is used to generate an application request for certificate registration according to the encrypted information, and send the application request to the registration certificate authority through the authentication and authorization system, wherein the registration certificate authority determines the registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system;

[0115] The second receiving module 404 is used to receive the encrypted registration certificate sent by the authentication and authorization system, and decrypt the encrypted registration certificate according to the symmetric key to obtain the registration certificate.

[0116] The GBA-based certificate issuing device provided in the embodiment of the present application obtains the preset confidential parameters set by the registration certificate authority; generates a symmetric key and an identity authentication value according to the preset confidential parameters, and encrypts the identity authentication value according to the symmetric key to obtain encrypted information; generates an application request for certificate registration according to the encrypted information, and sends the application request to the registration certificate authority through the authentication and authorization system, wherein the registration certificate authority determines the registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system; receives the encrypted registration certificate sent by the authentication and authorization system, and decrypts the encrypted registration certificate according to the symmetric key to obtain the registration certificate. This application is based on the GBA authentication and authorization system, and adds an anonymous authentication mechanism to the user's V2X device and the registration certificate authority ECA to hide the true identity of the terminal user, thereby protecting user privacy and improving the security of certificate sending.

[0117] In one embodiment, the first receiving module 401 is specifically configured to:

[0118] The preset password and the vehicle identification code are sent to the registration certificate authority in an offline manner, wherein the registration certificate authority determines the preset confidential parameters based on the preset parameters and the received preset password and the vehicle identification code, and sends the preset confidential parameters to the vehicle-road cooperative device in an offline manner.

[0119] In one embodiment, the first receiving module 401 is specifically configured to:

[0120] When logging into the vehicle-road cooperative device, determining the identity password record according to the preset password and the vehicle identification code;

[0121] If the identity password record is consistent with the target identity password record, the step of generating a symmetric key and an identity authentication value according to the preset confidentiality parameters is performed.

[0122] refer to Figure 5 , Figure 5 This is the second structural diagram of the GBA-based certificate issuing device provided in the embodiment of the present application. The GBA-based certificate issuing device provided in the embodiment of the present application includes a determination module 501, a third receiving module 502, a decryption module 503 and a second sending module 504.

[0123] The determination module 501 is used to determine the preset confidential parameters and send the preset confidential parameters to the vehicle-road cooperative device in an offline manner;

[0124] The third receiving module 502 is used to receive an application request for certificate registration sent by the authentication and authorization system, and generate a symmetric key according to the preset confidentiality parameters;

[0125] The decryption module 503 is used to decrypt the application request according to the symmetric key to obtain an identity authentication value;

[0126] The second sending module 504 is used to determine the registration certificate according to the identity authentication value, encrypt the registration certificate according to the symmetric key, and send the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system.

[0127] The GBA-based certificate issuing device provided in the embodiment of the present application determines preset confidential parameters and sends the preset confidential parameters to the vehicle-road cooperative device in an offline manner; receives the application request for certificate registration sent by the authentication and authorization system, and generates a symmetric key according to the preset confidential parameters; decrypts the application request according to the symmetric key to obtain an identity authentication value; determines the registration certificate according to the identity authentication value, encrypts the registration certificate according to the symmetric key, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system. This application is based on the GBA authentication and authorization system, and adds an anonymous authentication mechanism to the user's V2X device and the registration certificate authority ECA to hide the true identity of the terminal user, thereby protecting user privacy and improving the security of certificate transmission.

[0128] In one embodiment, the determining module 501 is specifically configured to:

[0129] If the identity authentication value is consistent with the target identity authentication value, the registration certificate is generated according to the application request.

[0130] In one embodiment, the determining module 501 is specifically configured to:

[0131] Obtaining a preset password and a vehicle identification code of the vehicle-road cooperative device;

[0132] The preset confidential parameters are determined according to the preset password, the vehicle identification code and preset parameters.

[0133] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call a computer program in the memory 630 to execute the steps of the GBA-based certificate issuance method, for example, including:

[0134] Get the preset secret parameters set by the registration certificate authority;

[0135] Generate a symmetric key and an identity authentication value according to the preset confidentiality parameter, and encrypt the identity authentication value according to the symmetric key to obtain encrypted information;

[0136] Generate an application request for certificate registration according to the encrypted information, and send the application request to the registration certificate authority through the authentication and authorization system, wherein the registration certificate authority determines the registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system;

[0137] The encrypted registration certificate sent by the authentication and authorization system is received, and the encrypted registration certificate is decrypted according to the symmetric key to obtain the registration certificate.

[0138] or,

[0139] Determine preset confidential parameters, and send the preset confidential parameters to the vehicle-road cooperative device in an offline manner;

[0140] Receiving an application request for certificate registration sent by the authentication and authorization system, and generating a symmetric key according to the preset confidentiality parameters;

[0141] Decrypting the application request according to the symmetric key to obtain an identity authentication value;

[0142] A registration certificate is determined according to the identity authentication value, the registration certificate is encrypted according to the symmetric key, and the encrypted registration certificate is sent to the vehicle-road cooperative device through the authentication and authorization system.

[0143] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0144] On the other hand, an embodiment of the present application further provides a computer program product, the computer program product including a computer program, the computer program may be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the steps of the GBA-based certificate issuance method provided in the above embodiments, for example, including:

[0145] Get the preset secret parameters set by the registration certificate authority;

[0146] Generate a symmetric key and an identity authentication value according to the preset confidentiality parameter, and encrypt the identity authentication value according to the symmetric key to obtain encrypted information;

[0147] Generate an application request for certificate registration according to the encrypted information, and send the application request to the registration certificate authority through the authentication and authorization system, wherein the registration certificate authority determines the registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system;

[0148] The encrypted registration certificate sent by the authentication and authorization system is received, and the encrypted registration certificate is decrypted according to the symmetric key to obtain the registration certificate.

[0149] or,

[0150] Determine preset confidential parameters, and send the preset confidential parameters to the vehicle-road cooperative device in an offline manner;

[0151] Receiving an application request for certificate registration sent by the authentication and authorization system, and generating a symmetric key according to the preset confidentiality parameters;

[0152] Decrypting the application request according to the symmetric key to obtain an identity authentication value;

[0153] A registration certificate is determined according to the identity authentication value, the registration certificate is encrypted according to the symmetric key, and the encrypted registration certificate is sent to the vehicle-road cooperative device through the authentication and authorization system.

[0154] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0155] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0156] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A certificate issuance method based on GBA, characterized in that: Applied to vehicle-road cooperative equipment, including: Get the preset secret parameters set by the registration certificate authority; Generate a symmetric key and an identity authentication value according to the preset confidentiality parameter, and encrypt the identity authentication value according to the symmetric key to obtain encrypted information; Generate an application request for certificate registration according to the encrypted information, and send the application request to the registration certificate authority through the authentication and authorization system, wherein the registration certificate authority determines the registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system; Receiving the encrypted registration certificate sent by the authentication and authorization system, and decrypting the encrypted registration certificate according to the symmetric key to obtain the registration certificate; The preset confidentiality parameters include ,in, To assist with login verification, Generate auxiliary items for device authentication values, Generate auxiliary items for symmetric keys, is the generator, is a prime number, is a secure hash function, is a random value; Login verification auxiliary items: ; Device authentication value generation auxiliary items: ; Symmetric key generation aids: ; The step of generating a symmetric key and an identity authentication value according to the preset confidentiality parameter, and encrypting the identity authentication value according to the symmetric key to obtain encrypted information includes: In the authentication phase, a random number is selected based on the anonymous function module of the vehicle-road cooperative device. , ,based on Calculate temporary public key , the formula is as follows: ； Calculate the symmetric key , the formula is as follows: ； Calculate the authentication value , the formula is as follows: ； in, is a preset password, which is used to determine the identity password record of the vehicle-road cooperative device; for code; is the secret value, ; for identity identifier; Using symmetric keys Authentication value Encrypt to get encrypted information , the formula is as follows: ； in, Timestamp of the vehicle-road cooperative device.

2. The GBA-based certificate issuance method according to claim 1, characterized in that: Before obtaining the preset confidential parameters set by the registration certificate authority, the method includes: The preset password and the vehicle identification code are sent to the registration certificate authority in an offline manner, wherein the registration certificate authority determines the preset confidential parameters based on the preset parameters and the received preset password and the vehicle identification code, and sends the preset confidential parameters to the vehicle-road cooperative device in an offline manner.

3. The GBA-based certificate issuance method according to claim 2, characterized in that: After obtaining the preset confidential parameters set by the registration certificate authority, the method includes: When logging into the vehicle-road cooperative device, determining the identity password record according to the preset password and the vehicle identification code; If the identity password record is consistent with the target identity password record, the step of generating a symmetric key and an identity authentication value according to the preset confidentiality parameters is performed.

4. A certificate issuance method based on GBA, characterized in that: Applicable to registered certificate authorities, including: Determine preset confidential parameters, and send the preset confidential parameters to the vehicle-road cooperative device in an offline manner; Receiving an application request for certificate registration sent by the authentication and authorization system, and generating a symmetric key according to the preset confidentiality parameters; Decrypting the application request according to the symmetric key to obtain an identity authentication value; Determine a registration certificate according to the identity authentication value, encrypt the registration certificate according to the symmetric key, and send the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system; The preset confidentiality parameters include ,in, To assist with login verification, Generate auxiliary items for device authentication values, Generate auxiliary items for symmetric keys, is the generator, is a prime number, is a secure hash function, is a random value; Login verification auxiliary items: ; Device authentication value generation auxiliary items: ; Symmetric key generation aids: ; in, is a preset password, which is used to determine the identity password record of the vehicle-road cooperative device; for code; is the secret value, ; for Identification of the The formula for generating a symmetric key according to the preset confidential parameters is as follows: ； Among them, the symmetric key With symmetric key The same, that is .

5. The GBA-based certificate issuance method according to claim 4, characterized in that: Determining a registration certificate according to the identity authentication value includes: If the identity authentication value is consistent with the target identity authentication value, the registration certificate is generated according to the application request.

6. The GBA-based certificate issuance method according to claim 4, characterized in that: Determine the pre-set confidentiality parameters, including: Obtaining a preset password and a vehicle identification code of the vehicle-road cooperative device; The preset confidential parameters are determined according to the preset password, the vehicle identification code and preset parameters.

7. A certificate issuing device based on GBA, characterized in that: include: A first receiving module, used to obtain preset confidential parameters set by a registration certificate authority; An encryption module, used to generate a symmetric key and an identity authentication value according to the preset confidentiality parameters, and encrypt the identity authentication value according to the symmetric key to obtain encrypted information; A first sending module, configured to generate an application request for certificate registration according to the encrypted information, and send the application request to the registration certificate authority through an authentication and authorization system, wherein the registration certificate authority determines a registration certificate according to the application request, encrypts the registration certificate, and sends the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system; A second receiving module is used to receive the encrypted registration certificate sent by the authentication and authorization system, and decrypt the encrypted registration certificate according to the symmetric key to obtain the registration certificate; The preset confidentiality parameters include ,in, To assist with login verification, Generate auxiliary items for device authentication values, Generate auxiliary items for symmetric keys, is the generator, is a prime number, is a secure hash function, is a random value; Login verification auxiliary items: ; Device authentication value generation auxiliary items: ; Symmetric key generation aids: ; The encryption module is also used to: randomly select a number based on the anonymous function module of the vehicle-road cooperative device during the authentication stage. , ,based on Calculate temporary public key , the formula is as follows: ； Calculate the symmetric key , the formula is as follows: ； Calculate the authentication value , the formula is as follows: ； in, is a preset password, which is used to determine the identity password record of the vehicle-road cooperative device; for code; is the secret value, ; for Identification of the Using symmetric keys Authentication value Encrypt to get encrypted information , the formula is as follows: ； in, Timestamp of the vehicle-road cooperative device.

8. A certificate issuing device based on GBA, characterized in that: include: A determination module, used to determine preset confidential parameters and send the preset confidential parameters to the vehicle-road cooperative device in an offline manner; A third receiving module is used to receive an application request for certificate registration sent by the authentication and authorization system, and generate a symmetric key according to the preset confidential parameters; A decryption module, used to decrypt the application request according to the symmetric key to obtain an identity authentication value; A second sending module, configured to determine a registration certificate according to the identity authentication value, encrypt the registration certificate according to the symmetric key, and send the encrypted registration certificate to the vehicle-road cooperative device through the authentication and authorization system; The preset confidentiality parameters include ,in, To assist with login verification, Generate auxiliary items for device authentication values, Generate auxiliary items for symmetric keys, is the generator, is a prime number, is a secure hash function, is a random value; Login verification auxiliary items: ; Device authentication value generation auxiliary items: ; Symmetric key generation aids: ; in, is a preset password, which is used to determine the identity password record of the vehicle-road cooperative device; for code; is the secret value, ; for Identification of the The formula for generating a symmetric key according to the preset confidential parameters is as follows: ； Among them, the symmetric key With symmetric key The same, that is .

9. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, the steps of the GBA-based certificate issuance method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the GBA-based certificate issuance method according to any one of claims 1 to 6 are implemented.

Images