A supervision method for multi-attribute community wireless network security

Abstract

The present invention discloses a method for supervising the security of a multi-attribute community wireless network. By building a "node-cluster head-center" grouping key feedback adjustment method, the security management level of the wireless sensor network is improved as much as possible on the basis of ensuring the accuracy of key grouping. The present invention performs a hierarchical design on the encryption authentication method of the security node. The first encryption key and the second encryption key based on the security node identity identification code are both real-time variable. The base station sends the identification code according to the attributes of the security node. In the case of unsuccessful authentication of the security node, the cluster head node can determine whether the security node is attacked or invalid through the secondary authentication of the detection signal. In the case of an attack on a security node, the base station excludes the attacked security node through the valid node set.

Description

Technical Field

[0001] The invention relates to wireless network technology, and in particular to a method for supervising the security of wireless networks in multi-attribute communities. Background Art

[0002] Using keys to improve the security of wireless sensor networks is a common type of authentication and identification security technology. For example, the document "Research on Key Security Perception Management Scheme for Wireless Sensor Networks Based on Clustering" (Li Ming. Wuhan University of Technology. 2011) describes a method for building a multi-key network security management method by using group distribution of security keys. Another example is the cluster key management method published in CN103813317A, which builds a "node-cluster head" two-way key authentication mechanism to improve the security of wireless sensor networks. In the prior art, there are multiple groups of networks in parallel. For example, in a community security network, there are multiple groups of wireless terminals such as access control sensors, smoke sensors, and temperature sensors. The working parameters of different working terminals are different, but they can be connected to the same base station. The two-way key authentication mechanism cannot detect changes in the working parameters of valid nodes. Therefore, the prior art hopes to build a feedback adjustment technology for the group key of "node-cluster head-center" to improve the accuracy of key grouping and strengthen the security management level of wireless sensor networks. Summary of the invention

[0003] In view of the problems described in the background technology, the present invention proposes a multi-attribute community wireless network security supervision method, which can quickly delete the communication rights of invalid security nodes by grouping security nodes into clusters and using two encryption methods according to channel categories. Furthermore, the present invention also combines attribute identification with key authentication to identify changes in security node working parameters and improve the accuracy of wireless monitoring network data.

[0004] The invention objective of this application can be achieved by the following steps:

[0005] A method for supervising the security of a multi-attribute community wireless network comprises the following steps:

[0006] Step 1: multiple security nodes are deployed in the target community. The security nodes have identity identification codes. The base station issues a first encryption key and a second decryption key based on the identity identification code to the security nodes.

[0007] Step 2: The base station generates at least two attribute identification codes according to the working parameters of the security node, and issues the attribute identification code and a second encryption key based on the attribute identification code to the security node;

[0008] Step 3: Multiple security nodes with the same attribute identification code form a self-organizing network to generate at least one cluster link. Multiple security nodes in the cluster link elect a security node as the cluster head node of the cluster link. Any security node communicates with the base station via the cluster head node.

[0009] Step 4: The base station generates a valid node set based on the cluster link and publishes it to any security node of the cluster link;

[0010] Step 5: The security node i encrypts a first plaintext containing security data according to the first encryption key to obtain a first ciphertext, and then encrypts the first ciphertext and a dynamic identification code according to the second encryption key and the valid node set to obtain a second ciphertext;

[0011] Step 6: The security node i sends the second ciphertext to the security node j or the cluster head node based on the cluster link. The security node j or the cluster head node decrypts the second ciphertext according to the second decryption key to obtain the first ciphertext and the dynamic identification code, and feeds back the dynamic identification code to the security node i that sent the second ciphertext.

[0012] Step 7: If the dynamic identification code received by security node i matches the dynamic identification code sent, go to step 8; otherwise, send a third ciphertext to disable security node j based on the cluster link, where the third ciphertext is generated by the second plaintext containing the identity identification code of security node j, and go to step 9;

[0013] Step 8: The base station receives the second ciphertext sent by the cluster head node via the cluster link, obtains the first plaintext security data using the second decryption key and the first decryption key in sequence, and returns to step 5;

[0014] Step 9: The base station sends a detection signal based on the first encryption key to the security node j according to the second plaintext. If the security node j responds, proceed to step 10; otherwise, proceed to step 11;

[0015] Step 10: The base station verifies the working parameters of the security node j and returns to step 3;

[0016] Step 11: The base station sends a packet replenishment request table to the cluster head node. The packet replenishment request table includes the communication process information of the security node under the cluster link and the identification code, signature and status of the target security node. The base station updates the valid node set and sends the updated valid node set to the cluster link. The cluster link excludes security node j and returns to step 5.

[0017] In the present invention, the first encryption key and the first decryption key are a key pair based on the identity identification code. The base station retains the first decryption key and sends the first encryption key to the corresponding security node. The base station identifies the security node through the first encryption key.

[0018] In the present invention, the base station has a key pool, in which the base station generates a second encryption key, the second encryption key encrypts the second ciphertext according to the valid node set, and the second decryption key corresponding to any security node in the valid node set decrypts the second ciphertext into the first ciphertext and a dynamic identification code.

[0019] In the present invention, the second encryption key adopts an attribute re-encryption algorithm, which is composed of the second ciphertext and the subject attributes and object attributes of the security node. The security node uses the working mode, status and identification standard as the subject attributes, and the working environment and action behavior as the object attributes. The subject attributes and object attributes of the security node together constitute the attribute identification code, and the second encryption key is a re-encryption algorithm in which the attribute key is embedded in the second ciphertext.

[0020] In the present invention, the working parameter is the working cycle of the security node, and any second encryption key is mapped to a unique attribute identification code.

[0021] In the present invention, in step 9, the base station deletes the identity identification code of the security node j in the valid node set.

[0022] In the present invention, the base station has a node identity authentication table, and the node identity authentication table stores the identity identification code, attribute identification code and MAC address of the security node.

[0023] In the present invention, the cluster head node is generated by recommendation from the security nodes, the Euclidean distance set between each pair of security nodes is calculated, and the cluster head node is recommended through iteration with the clustering function of the security node itinerary as the target.

[0024] The method for supervising the security of a multi-attribute community wireless network of the present invention has the following beneficial effects: clustering the security nodes to form multi-key management, which effectively improves the security of the wireless sensor network; building a real-time feedback adjustment mechanism for the grouping key of "node-cluster head-base station" can avoid the key leakage problem between the cluster head node and the base station, and the hierarchically designed first encryption key and second encryption key are both real-time variable. When the security node authentication fails, the cluster head node can determine whether the security node is attacked, thereby making adaptive adjustments, and the overall network security is greatly improved. Compared with the traditional multi-layer protocol and multi-variable key management method, data redundancy is reduced, the method is more convenient, and the working energy consumption of the cluster head node is also reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A flowchart of a method for supervising the security of a multi-attribute community wireless network according to the present invention;

[0026] Figure 2 A schematic diagram of the encryption and decryption process of security data transmission between security nodes of the present invention;

[0027] Figure 3 A schematic diagram of a method for forming a double-encrypted value of an attribute identification code by using a random number and an identity identification code according to the present invention;

[0028] Figure 4 A schematic diagram of the process of establishing and applying the first encryption key and the second encryption key of the present invention;

[0029] Figure 5 It is a schematic diagram of the key pool construction method of the present invention. DETAILED DESCRIPTION

[0030] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0031] The communication topology of the wireless sensor network itself is uncertain. As a multi-hop self-organizing network architecture, the communication link is vulnerable to external attacks, flooding and other mechanisms. Taking effective access control management measures is an issue that needs to be considered during the wireless sensor network design phase. Strengthening the information security management of wireless sensor networks through keys is the most direct and effective way to solve this public problem. However, the wireless sensor network communication link lacks entities, and the protection measures are weak, resulting in the key information security method that can be used in the wireless sensor network being too single. This embodiment is a multi-layer, multi-cluster group key management method, which is applied to the wireless sensor network networking environment. By establishing a dual key authentication method, the drawbacks of the traditional cluster key authentication method are solved. Refer to Figure 1 and Figure 2 The multi-attribute community wireless network security supervision method of the present invention specifically includes the following steps.

[0032] Step 1: Multiple security nodes are arranged in the target community. The security nodes have an identity identification code. The base station issues the first encryption key and the second decryption key based on the identity identification code to the security node. The identity identification code is the digital signature of the base station on the security node number. The digital signature is a hash function generated by a random number as the authentication information standard. The security node retains the digital signature sent by the base station and transmits it in the form of an identity identification code during the communication process. The node identity identification code stores the routing information and MAC address of the security node. In addition, the node identity authentication table also contains the authentication information of the first encryption key and the second decryption key.

[0033] In this embodiment, security node i randomly selects a random number x, 0≤x≤q2-1, and calculates After receiving the y information, the base station signs it according to the node code of security node i and obtains z=sig(ID A ,y), where ID Ais the identification code of each security node described in Step 1, where p and q2 are both large prime numbers, and p ≥ 2 512 , q2 | (p - 1), and q2 ≥ 2 160 The signed information is sent by the base station to security node i for storage, and security node i uses y and z together as the identification code

[0034] Step 2: The base station generates at least two types of attribute identification codes according to the working parameters of the security nodes, and distributes the attribute identification codes and the second encryption key based on the attribute identification codes to the security nodes. The attribute identification codes represent different working parameters. The working parameters are, for example, the working cycle of the security node, the working area of the security node, etc. A change in the attribute identification code indicates a change in the working cycle or the working area

[0035] In the present invention, the generation of the attribute identification code is based on the premise that the key is trusted and authorized. Under the condition of selecting parameter k as the security parameter, multiplicative cyclic groups M1 and M2 are set, and M1 and M2 belong to the multiplicative cyclic group of rank large prime number p. According to M1 and M2, the corresponding hash function is defined as the common parameter and the main key component of the attribute identification code

[0036] In this embodiment, referring to Figure 3 , the attribute identification code is jointly composed of the common parameter, the main key component, and the object attribute. Arbitrarily take a random number ε ∈ R Z P *, to obtain the initialized attribute identification code E1 = m1ε, m2ε,..., m n ε, m n ε is the generator sequence of the nth multiplicative cyclic group M n , adding the randomly selected numbers x and y in the common parameter, the obtained attribute identification code is the double encryption value of the multiplicative cyclic group generator sequence . Assign a unique label to the security node. The label is related to the identification code. Combining the characteristics of the security node, a polynomial is set for the multiplicative cyclic group Mt , where c represents the number of attributes included in the multiplicative cyclic group Mt, and p is a large prime number

[0037] The second encryption key received by each security node is a component of the random polynomial randomly selected by the cluster head node within the finite field. When the security node communicates with the cluster head node, by broadcasting the demand for obtaining the key component within the network, the adjacent security nodes judge whether the current security node is in a normal state by obtaining the second encryption key of this security node. If the node request is legal, the allocated cluster key component will be sent to the node, otherwise the node request will be ignored. Further, when the number of the first encryption keys reaches or exceeds the threshold, the cluster head node will decrypt the security node information and delete the key components sent by other nodes in the cluster

[0038] Step 3: Multiple security nodes with the same attribute identification code form a self-organizing network and generate at least one cluster link. Multiple security nodes in the cluster link recommend a security node as the cluster head node of the cluster link. Any security node communicates with the base station via the cluster link. Initially, a number of security nodes are randomly selected as the centroids, and the Euclidean distance set between each node is calculated. The clustering objective function of the number of security nodes is determined through multiple calculations, and the corresponding minimum value is taken. The cluster head node communicates directly with the base station and the security node. The base station contains a key pool, which contains the first encryption key of each cluster link in the entire wireless sensor network. The size of the generated key pool is , where n d and Threshold value, and meets , q1 is a large prime number.

[0039] Step 4: The base station generates a valid node set based on the cluster link and publishes it to any security node of the cluster link. In this embodiment, it is assumed that a threshold is set for the security node with m encoding cluster links in a certain cluster, and a large prime number q3 is randomly selected within the threshold range, and u integers are randomly selected in the finite field GF(q). The second encryption key is composed of a random polynomial g(x) composed of the large prime number q3 and u integers randomly selected in the finite field. The key component K assigned to each individual security node in the cluster is f =g(ID A )modq.

[0040] In this embodiment, the base station includes a key pool. The key pool is composed of the second encryption key of each security node and the first encryption key of the cluster head node communication link, and the key pool also includes the first encryption key as a component element. The first encryption key of each node is unique, and the first encryption keys contained in different cluster head nodes are unique and different. The second encryption key P in the key pool i , P i =PK ni , i is the serial number of the security node, and n is the serial number of the cluster head node described by the security node. In addition, the key pool contains the second encryption key information of each security node. The second encryption key is a set of one-to-one mappings between the second ciphertext of the cluster head node and the security node under the first encryption key. Each node in the key pool is grouped according to the pre-distributed key algorithm. The second encryption keys are in a cascade relationship. The length of each key group in the key pool remains consistent and is stored in the form of a matrix. When storing, it needs to be distributed according to the identity identification code of the node.

[0041] Step 5: The security node i encrypts a first plaintext containing security data according to the first encryption key to obtain a first ciphertext, and then encrypts the first ciphertext and a dynamic identification code according to the second encryption key and the valid node set to obtain a second ciphertext. In the wireless sensor network, the encryption process is implemented through a digital output port. In order to fully ensure the integrity and confidentiality of the data itself, the preferred multiple data encryption method of this embodiment requires the valid node set, the dynamic identification code, and the second encryption key to be composed together. The dynamic identification code is a vector group that shares the encryption scheme with the second encryption key.

[0042] Step 6: Security node i sends the second ciphertext to security node j or cluster head node based on the cluster link. Security node j or cluster head node decrypts the second ciphertext according to the second decryption key to obtain the first ciphertext and the dynamic identification code, and feeds back the dynamic identification code to the security node i that sent the second ciphertext.

[0043] In this embodiment, assuming that the security data to be encrypted by security node i is s, by randomly selecting n non-zero element sets Q={h1,h2,…,h n}, (h1≠h2≠…≠h n ), randomly select t-1 element values ​​in the set Q to construct the polynomial g(h)=s+h1n+h2n 2 +…+h t-1 n t-1 When security node k obtains the encrypted security data transmitted by security node i, it randomly selects t element values ​​in set Q to restore message s. , where y i is the sub-secret of secret s, i=(1,2,…,t), and decryption yields s=g(0). Among them, the encryption of the dynamic identification code and the valid node set is generated according to the identity identification code of security node i, which is the object attribute of security node i.

[0044] Step 7: If the dynamic identification code received by security node i matches the dynamic identification code sent, go to step 8; otherwise, send a third ciphertext to disable security node j based on the cluster link. The third ciphertext is generated by the second plaintext containing the identity identification code of security node j, and go to step 9.

[0045] When the dynamic identification code fails to match, it means that the security node j is in an abnormal state, including being captured, node failure, and not belonging to the pairing group in the valid node set. The current state of the security node j is further determined by sending the third ciphertext. The preferred third ciphertext of this embodiment is access policy encryption, and the second plaintext is encrypted according to the identity identification code of the security node j. If the security node j can be identified, a detection signal is further sent. If the security node j responds to the detection signal, it means that the security node j is in a normal working state, and the security node j and the security node i do not belong to the pairing group in the valid node set. At this time, step 8 is entered; if the security node j does not respond to the detection signal, it means that the security node j is in an abnormal working state, and the security node j is in a captured and failed state. At this time, step 9 is entered.

[0046] Step 8: The base station receives the second ciphertext sent by the cluster head node via the cluster link, obtains the first plaintext security data using the second decryption key and the first decryption key in sequence, and returns to step 5.

[0047] Step 9: The base station sends a detection signal based on the first encryption key to the security node j according to the second plaintext. If the security node j responds, the process proceeds to step 10; otherwise, the process proceeds to step 11.

[0048] Step 10: The base station verifies the working parameters of security node j and returns to step 3. Security node j responds to the detection signal encrypted by the first encryption key of the base station, indicating that the identity of security node j is legal, and the user's authority information can be determined at this time. The specific policy for group user access is indexed and added according to the keyword information, and the base station inserts the file address and identity identification code of security node j into the valid node set, and the mapping association between the identity identification code of security node j and the file address is saved in the base station. In this embodiment, the base station inserts the file address and identity identification code of security node j into the last position of the linked list in the valid node set.

[0049] Step 11: The base station sends a packet replenishment request table to the cluster head node, the base station updates the valid node set and sends the updated valid node set to the security node of the cluster link that deletes the security node j, and returns to step 5. The packet replenishment request table includes the communication process information of the security node under the cluster link, the identity identification code, signature and status of the target security node, and the packet replenishment request table contains all the information that needs to update or delete the target security node, and these information have a unique identifier corresponding to the key pool. In this embodiment, the cluster head node will delete the classification of the captured security node k in the cluster, and send the packet replenishment request table to notify the base station. After receiving the packet replenishment request table, the base station updates the first encryption key in a random manner and sends it to each cluster head node. Further, a new random number is randomly selected in the finite field GF(q), and a message is sent to the cluster head node in an encrypted manner using the first encryption key. The cluster head node then calculates the distribution components of the second encryption key in each cluster and executes a new round of security identification cycle.

[0050] In this embodiment, the cluster head node obtains the identity code and member information of each terminal device in the cluster, and transmits the information to the base station. The base station finds the second encryption key information of the corresponding node in the node information table according to the obtained identity code and member information, and obtains the first encryption key as follows:

[0051]

[0052] Among them, x represents the identity identification code information of the security node, P1 is the second encryption key of the corresponding node, X is the information content contained in the key transmission, and the base station broadcasts the first encryption key to each cluster head node.

[0053] In this embodiment, refer to Figure 4 The base station randomly sets the first encryption key and sends the first encryption key to the cluster head node and the security node. The cluster head node generates a second encryption key and sends it to the base station and the security node. The base station generates a node identity authentication table including the first encryption key, the second encryption key, the security node identity identification code, and the hash summary. The key pool contains the node identity authentication table of each cluster head unique link. In the process of security identification and authentication, the security node sends the identity identification code to the cluster head node. After processing the security node identity identification code, the cluster head node sends the cluster ID to the key pool. The information transmitted between the base station and the node is encrypted by the first encryption key and the second encryption key. The security nodes can authenticate each other and verify whether the identity of the adjacent security node is legal. After a security identification cycle ends, the key pool updates the first encryption key.

[0054] In this embodiment, the cluster head node is selected based on the three dimensions of residual energy, the Euclidean distance of other nodes from the cluster head node, and the range that the node can cover with the largest hop. The cluster head node selection principle must satisfy CT=W1*X1+W2*X2+W3*X3, W1+W2+W3=1, W 1,2,3 >0, where X represents the evaluation results of the above three dimensions, X1, X2, and X3 correspond to the residual energy of the pre-selected nodes under the election algorithm, the Euclidean distance of other nodes from the cluster head node, and the range that the node can cover with the largest hop, respectively, and W is the weight corresponding to X, CT∈[0,1].

[0055] In this embodiment, the key pool is composed of cellular nodes. Figure 5 , V in the key pool represents the cluster, U represents the communication key identifier of the two security nodes, U2,1 represents the communication key identifier of the two communication nodes coded as U2 and U1 in the V key pool, including the first encryption key and the second encryption key under the communication link, and V2,1 represents the key authentication between the security node U2 and the security node U1 in the cluster. Furthermore, in the process of key pool generation, the built-in server allocates several random numbers for multiple cluster combinations. After receiving the random number allocation, the cluster head node establishes a binary irreversible function to generate a node key pair.

[0056] In addition, when the base station verifies or updates the key pool information, in order to avoid overlap between the old and new key pools, the key pool needs to be mixed and constructed. The key generated in the key pool will refer to the original key value. The new key is 3 large prime numbers q3 randomly selected from the key pool. The value simplified by the hash function is mixed with the original key according to the random expansion method to generate a new key pool.

[0057] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for supervising the security of a multi-attribute community wireless network, characterized in that: The following steps are involved: Step 1: multiple security nodes are arranged in the target community, the security nodes have identity identification codes, and the base station issues a second decryption key and a first encryption key based on the identity identification code to the security nodes; Step 2: The base station generates at least two attribute identification codes according to the working parameters of the security node, and issues the attribute identification code and a second encryption key based on the attribute identification code to the security node, wherein the first encryption key and the first decryption key are a key pair based on the identity identification code; Step 3: Multiple security nodes with the same attribute identification code form a self-organizing network to generate at least one cluster link. Multiple security nodes in the cluster link elect a security node as the cluster head node of the cluster link. Any security node in each of the cluster links communicates with the base station via the cluster head node. Step 4: The base station generates a valid node set based on the cluster link and publishes it to any security node of the cluster link; Step 5: The security node i encrypts a first plaintext containing security data according to the first encryption key to obtain a first ciphertext, and then encrypts the first ciphertext and a dynamic identification code according to the second encryption key and the valid node set to obtain a second ciphertext; Step 6: The security node i sends the second ciphertext to the security node j or the cluster head node based on the cluster link. The security node j or the cluster head node decrypts the second ciphertext according to the second decryption key to obtain the first ciphertext and the dynamic identification code, and feeds back the dynamic identification code to the security node i that sent the second ciphertext. Step 7: If the dynamic identification code received by security node i matches the dynamic identification code sent, go to step 8; otherwise, send a third ciphertext to disable security node j based on the cluster link, where the third ciphertext is generated by the second plaintext containing the identity identification code of security node j, and go to step 9; Step 8: The base station receives the second ciphertext sent by the cluster head node via the cluster link, obtains the first plaintext security data using the second decryption key and the first decryption key in sequence, and returns to step 5; Step 9: The base station sends a detection signal based on the first encryption key to the security node j according to the second plaintext. If the security node j responds, proceed to step 10, otherwise proceed to step 11; Step 10: The base station verifies the working parameters of the security node j and returns to step 3; Step 11: The base station sends a packet replenishment request table to the cluster head node. The packet replenishment request table includes the communication process information of the security node under the cluster link and the identity identification code, signature and status of the target security node. The target security node is security node j. The base station updates the valid node set and sends the updated valid node set to the cluster link. The cluster link excludes security node j and returns to step 5.

2. A method for supervising the security of a multi-attribute community wireless network according to claim 1, characterized in that: The base station retains the first decryption key and sends the first encryption key to the corresponding security node, and the base station identifies the security node through the first encryption key.

3. A method for supervising the security of a multi-attribute community wireless network according to claim 1, characterized in that: The working parameter is the working cycle of the security node, and any second encryption key is mapped to a unique attribute identification code.

4. A method for supervising the security of a multi-attribute community wireless network according to claim 1, characterized in that: The cluster head node is generated by recommendation from the security nodes. The Euclidean distance set between each pair of security nodes is calculated. The cluster head node is recommended through iteration with the clustering function formed by the security nodes as the target.

Images