A Cross-Domain Privacy-Preserving Message Authentication Method for Industrial Internet of Things

Abstract

The present invention discloses a cross-domain privacy protection message authentication method for industrial Internet of Things, including system initialization, device registration and gateway registration; generating the system master public and private keys, device request, gateway authentication and token calculation, message sending and message verification, and dynamic update of entities. In the present invention, gateways in each domain implement distributed authentication and token distribution for devices through secret sharing technology, and use pseudonym technology and batch authentication technology to ensure identity privacy and authentication efficiency. After a device mutually authenticates with t gateways to obtain sub-tokens, it can calculate its own identity token, which contains the device's pseudonym, access policy, and token validity time. Finally, devices with legitimate identity tokens can cooperate in production together. The present invention is more computationally efficient and has lower communication costs than related solutions, and can be applied to cross-domain industrial production involving multiple industrial sectors for collaboration.

Description

Technical Field

[0001] The present invention relates to industrial Internet of Things (IIoT) security communication technology, and more particularly to a cross-domain privacy protection message authentication method for the industrial Internet of Things. Background Art

[0002] The industrial Internet of Things (IIoT) is a network of intelligent devices composed of highly connected industrial components, which helps to improve the intelligent processes in industrial scenarios such as manufacturing, mining, and logistics. The industrial Internet of Things has improved the supply chain management system, optimized the production process, and achieved high productivity and low operating costs through a series of tools and technologies such as intelligent sensing, mobile network communication, and intelligent data analysis. However, due to the development of productivity and the continuous refinement of social division of labor, the final product may be the result of the joint efforts of multiple departments in different industrial fields. In recent years, with the frequent occurrence of major disasters around the world, the demand for immediate and large-scale production has been increasing. The architecture of the industrial Internet of Things is gradually changing from a vertical integration structure of cloud servers, edge servers, and terminals to a horizontal structure of interactions between multiple industrial Internet of Things systems. Industrial devices belonging to different systems or factories can communicate and collaborate securely during the production process. For example, after a major disaster, in order to quickly provide protection for the affected people, multiple industrial manufacturers need to cooperate to deploy industrial devices to produce emergency housing and other necessities. Rescue data can be shared between industrial rescue devices deployed by different manufacturers to ensure rapid rescue.

[0003] Compared with device communication in a single domain, cross-domain device communication has higher requirements for privacy protection and security. Industrial Internet of Things devices from different domains require a secure and effective authentication mechanism to ensure the secure exchange of information. If an attacker can forge or modify intercepted industrial data, it will seriously endanger the production stability of multiple industrial manufacturers and cause losses of life and property. Therefore, it is crucial to ensure the integrity and authenticity of industrial data, and message authentication can meet this requirement. In addition, the scheme must provide anonymity to prevent attackers from obtaining source privacy from intercepted messages. However, a completely anonymous scheme cannot be used. If an invaded industrial device endangers normal industrial production, a trusted institution should be able to track its identity and revoke its identity based on the message. The use of group signature and pseudonym technologies can achieve identity privacy protection, but both have certain defects. The group signature technology has a huge computational overhead, and the length of the certificate revocation list in traditional pseudonym technology is proportional to the number of pseudonyms owned by the device.

[0004] In view of the above security problems brought about by the cross - domain communication of industrial Internet of Things (IIoT) devices, some researchers have proposed anonymous cross - domain authentication schemes. However, most cross - domain solutions require a trusted third - party authentication server to conduct authentication centrally. Third - party authorization complicates the interaction process, becomes the bottleneck of the system, and reduces the security and scalability of the system. Therefore, a secure and efficient cross - domain solution is needed to ensure the collaborative production of different industries. Summary of the Invention

[0005] Objective of the Invention: The objective of the present invention is to solve the deficiencies existing in the prior art and provide a cross - domain privacy - protection message authentication method for the industrial Internet of Things.

[0006] Technical Solution: A cross - domain privacy - protection message authentication method for the industrial Internet of Things according to the present invention includes the following steps:

[0007] Step (1), System Initialization: Complete the relevant work of initializing the entire system;

[0008] Given the security parameter θ, the private key generation centers (PKGs) in all domains cooperate to generate the system public parameters {q, P, Q, Q′, G, G T , e, H, H1, H2, H3, t, n}. G is an additive group of order q, P, Q, Q′ are three different generators of G, e: G×G→G T is a bilinear mapping, H: {0, 1} * →G is a secure hash function, n and t respectively represent the number of domains and the threshold of gateway cooperation; then, the private key generation center PKG corresponding to domain D i generates the private key k i of D i and the public key i k k i is a random number selected from ;

[0009] Step (2), Entity Registration, including device registration and gateway registration;

[0010] The PKG of each domain generates corresponding pseudonyms and corresponding private keys for each IIoT device and gateway in the domain;

[0011] Step (3), Generation of System Master Public and Private Keys: All gateways use threshold encryption to cooperate to generate the system master public key P pub and the master private key s, and calculate their own secret shares s i ;

[0012] Step (4), Device Token Generation, including device request, gateway authentication, and token calculation in sequence;

[0013] The device initiating a request means that the device first generates corresponding access control information, which includes the domain information, pseudonym, and expiration time it belongs to; then the device sends the request containing the access control information and timestamp to the nearby gateway.

[0014] The gateway responding to the request means that after receiving the device request, the nearby gateway checks the device pseudonym, access control information, timestamp, and the device's legality. If the check passes, it calculates the token and then sends the token and certificate to the device.

[0015] The device authenticating and generating a token means that when the device receives the tokens and certificates from all nearby gateways, it conducts batch authentication on the gateways. After passing the batch authentication, it obtains the token.

[0016] Step (5), message authentication, including message sending and message verification.

[0017] Step (6), dynamic update of entities, including revocation of devices and registration and revocation of gateways.

[0018] Furthermore, when the device registers in step (2), assuming that the PKG assigns C pseudonyms to each device and the valid time of each pseudonym is ΔT, then for the device DE i at the j-th time slot TS j the valid time range of the pseudonym PID i,j is [j·ΔT, (j + 1)·ΔT], j ∈ [1, C]. The PKG ∈ after receiving the real identity ID i of the device DE to be registered i selects two random seeds SD i,1 and SD i,2 , and calculates the pseudonym of DE i through two hash chains according to the following formula:

[0019]

[0020] In the above formula, S 1，j is the value obtained by performing j hash operations on the hash seed SD i,1 , and S 2，C-j+1 is the value obtained by performing C - j + 1 hash operations on the hash seed SD i,2 ; PID i,j,1 and PID i,j,2 are two parts of the pseudonym PID i,j , and k ∈ , are respectively the private key and public key of the private key generation center of the domain D ∈ to which the device belongs;

[0021] Then, for each kana PID i,j =(PID i,j,1 , PID i,j,2 ), PKG ∈ uses the KIBS scheme to calculate the corresponding private key SK i，j =(T i，j , S i,j ): PKG ∈ Randomly select and calculate T i，j =t i，j P, h i，j =H2(PID i,j , TS j , T i，j ) and S i,j =(k ∈ +h i，j ·t i，j ); Here, t i，j is a random number, h i，j is the hash value of PID i,j , TS j , T i，j , and S i,j , T i，j constitute the private key corresponding to the kana PID i,j ;

[0022] The gateway registration process includes the following steps:

[0023] For the gateway GW j from the domain D i , its private key generation center PKG j selects a random value as the private key of the gateway and calculates its public key G i =υ i P; Then, PKG j calculates the signature on G i PKG j Sends the private key υ i , public key G i and certificate to GW i .

[0024] Furthermore, the specific method for generating the system public key and the system in step (3) is:

[0025] First, the gateway GW i randomly selects a secret and a polynomial function f of degree t-1 i (x)=a i，0 +a i，1 ​x + a i，2 x 2 +…+ a i,t-1 x t-1 mod q, where a i，t-1 represents a random number;

[0026] Then, GW i calculates and publishes a i，j P to all other gateways, and secretly sends f i (k) to other GW k , j ∈ [0, t - 1], k ∈ [1, n], k ≠ i; when receiving the corresponding message f k from GW k (i), GW i verifies whether it holds. If the verification fails, it rejects; if the verification succeeds, then GW i calculates its own secret share and

[0027] where a i，j P represents the corresponding element of a i，j in the group, represents the corresponding element of the secret share s i of GW i in the group G, f i (k) represents the value of f i (x) when x equals k; f k (i) represents the polynomial selected by GW k ;

[0028] Finally, the gateway GW i calculates the system master public key and broadcasts At this point, the private key of the system is distributed to all gateways, and no single gateway knows the exact master private key s.

[0029] Furthermore, the detailed process of step (4) is as follows:

[0030] Step (4.1), the device initiates a request

[0031] The device DE i generates access control information ACI i , and the access control information ACI i includes the affiliated domain information D ∈、 pseudonym PID i，j and expiration time; then DE i generates a random value and calculates R i，j = ri，j P, h i，j ′ = H3(ACI i , tt i , T i，j , R i，j ), and W i，j = h i，j ′S i，j + r i，j Q′, where tt i ∈[TS j ·ΔT, TS j+1 ·ΔT] is the current timestamp; then DE i sends a request (ACI i , tt i , T i，j , R i，j , W i，j ) to t nearby gateways;

[0032] where, h i，j ′ is the hash value of ACI i , tt i , T i，j , R i，j ; R i，j W i，j , T i，j are all intermediate calculation values and jointly form the signature of the message;

[0033] Step (4.2), the gateway responds to the request. After receiving the device's request, t nearby gateways GW k will perform the following operations, k = 1, 2,..., t:

[0034] First, gateway GW k checks the legality of the device's pseudonym PID i，j and ACI i . If PID i，j is in the CRL or ACI i is illegal, the request will be rejected. If both are legal, then GW k obtains TS i through tt j , and then calculates h i，j = H2(PID i，j , TS j , T i，j ) and h i，j ′ = H3(ACI i , tt i , T i，j , R i，j );

[0035]

[0036] Then GW k checks the legitimacy of DE by verifying whether Equation (1) holds. If the verification fails, the request is rejected; if the verification passes, then GW i calculates the sub-token σ k = s i，k ·H(ACI k ) and i then sends to DE ; i ;

[0037] where s k is the secret share of the gateway GW k , SG k is the value after encrypting σ i，k ; υ i is the private key of the gateway GW k ;

[0038] Step (4.3), device authentication and generation of tokens. When the device DE i receives the messages from t gateways , it performs the following operations:

[0039] DE i first checks the legitimacy of GW by executing . If the check passes, it calculates k where G is included in k ; ; is the public key of the PKG of the domain D k to which the gateway GW k belongs, and G k is the public key of GW k ; is the certificate of the gateway GW k ;

[0040] Then DE i batch-authenticates the gateways by verifying whether Equation (2) holds: If for some l ∈ [1, t], the sub-token σ i，l cannot pass the verification, it means that GW l is illegal. DE i reports the illegal GW i to the corresponding PKG and requests sub-tokens from other gateways;

[0041]

[0042] Finally, DE i calculates where ωk For the parameter to restore the secret, Obtain the token σ i After that, DE i will participate in the subsequent message verification.

[0043] Furthermore, the message authentication process in step (5) includes the following steps:

[0044] Message sending: When device DE i needs to send message M i at that time, randomly select a u from i and calculate U i = u i P, c i = H2(ACI i , M i ||tt i , U i ), where tt i is a timestamp; then DE i sends (M i , ACI i , U i , tt i , α i ) to other device receivers;

[0045] Message verification: When the receiver receives the message (M i , ACI i , U i , tt i , α i ) from DE i , first check the validity of tt i and ACI i . If any of them is invalid, reject the reception. If both are valid, then calculate c i = H2(ACI i , M i ||tt i , U i ), and determine whether the message is valid by verifying whether equation (3) holds;

[0046] e(α i , P) = e(c i H(ACI i ), P pub )·e(Q, U i ) Equation (3).

[0047] Furthermore, if there are many messages waiting for authentication, the receiver will spend a lot of time to authenticate them. To reduce the authentication overhead, we use batch authentication to reduce the pairing operations. Suppose there are m signatures to be verified; for (M ∈ ,ACI ∈ , tt ∈ , U ∈ , α ∈ )(∈∈[1, m]), etc., verify whether equation (4) is established for batch verification:

[0048]

[0049] Furthermore, the entity dynamic update in step (6) includes gateway joining, gateway revocation and device revocation, as follows:

[0050] (A) Gateway joins, when the system adds a new gateway GW ζ When, GW ζ You need to obtain your own secret share s, change the number of gateways to n+1, and change the threshold to t′. The update process of secret sharing is as follows:

[0051] First, GWx randomly selects a t′-1 order polynomial function f i (x) = s i +a i，1 x+a i，2 x 2 +…+a i,t-1 x t′-1 mod q, where At this time, i∈[1,n];

[0052] Then, the gateway GW i Calculate and publish s i P and a i,j P to all other gateways, and f i (k) Secretly sent to GW k , k∈[1,n+1], k≠i, j∈[1,t′-1]; after receiving GW k Message f k After (i), GW i check Is it true? If the verification fails, it is rejected;

[0053] The last GW i Calculate the new secret share as well as broadcast

[0054] (B) Gateway revocation, when the gateway GW ζWhen it is revoked, other gateways need to update the secret shares so that the gateway GW ζ cannot participate in subsequent collaborative authentication. At this time, the number of gateways will be changed to n - 1, and the threshold is t'. The update process of the secret shares is as follows:

[0055] First, GW i randomly selects a polynomial function f of degree t′ - 1 i (x) = s i + a i，1 x + a i，2 x 2 + … + a i,t-1 x t′-1 mod q, where here i ∈ [1, n - 1];

[0056] Then, the gateway GW i calculates and publishes s i p and a i,j P to all other gateways, and secretly sends f i (k) to GW k , at this time, j ∈ [1, t′ - 1], k ∈ [1, n - 1], k ≠ i; after receiving the message f k from GW k (i), GW i verifies whether it holds. If the verification fails, it rejects. If the verification is successful, then GW i calculates the new secret shares and broadcasts

[0057] (C) Device revocation. When the device DE ∈ in the domain D i is damaged, the PKG ∈ can revoke the damaged device in time to avoid causing greater harm; first, the PKG ∈ of the domain D ∈ calculates the identity information ID of the device i ; then obtains the corresponding hash seeds SD i and SD i,1 in the database according to ID i,2 and publishes them to revoke all pseudonyms of the device;

[0058]

[0059] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0060] (1) The present invention proposes a distributed cross - domain authentication architecture, which solves the performance and flexibility problems brought by centralized authentication. The PKG in each domain is only responsible for offline registration and device identity tracing. The gateway acts as a distributed certificate authority, and realizes distributed authentication and token distribution for devices through the (t,n) - secret sharing technology. And our scheme supports batch authentication technology, effectively reducing the authentication delay.

[0061] (2) The present invention uses one - way hash chains and identity - based signature technology to generate pseudonyms and keys for devices, realizing conditional privacy protection while reducing the overhead caused by revoked devices.

[0062] (3) The present invention meets the requirements of security and privacy in industrial Internet of Things cross - domain communication. In addition, a comprehensive comparison is made with existing schemes, and the advantages of the scheme in terms of overhead are analyzed, indicating that the protocol is applicable to the industrial Internet of Things cross - domain environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a schematic diagram of the system network structure of the present invention;

[0064] Figure 2 It is a schematic diagram of the token generation stage structure of the present invention;

[0065] Figure 3 It is a comparison diagram of the computational overhead of the present invention;

[0066] Figure 4 It is a comparison diagram of the communication overhead of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0067] The technical solution of the present invention will be described in detail below, but the protection scope of the present invention is not limited to the described embodiments.

[0068] As Figure 1 shown, the present invention mainly has three types of participants: the private key generation center (PKG), the gateway, and industrial Internet of Things devices. The PKG is fully trusted and is responsible for generating the domain keys it belongs to, as well as the registration and key generation of devices and gateways. The PKG is only responsible for offline entity registration and tracking device identities; the gateway is responsible for negotiating the system's main key, authenticating devices, and issuing identity tokens to legitimate devices. The gateway is honest but can be compromised by attackers; the devices have limited computing power and small storage capacity, but are sufficient for public - key encryption calculations and storing pseudonyms. First, the devices and gateways in each domain register with the domain PKG to which they belong; then the gateway nodes cooperate to calculate the system's main public and private keys; before devices cooperate with other devices to produce, they need to obtain their respective identity tokens. After a device mutually authenticates with t gateways and obtains sub - tokens, it can calculate its own identity token, which contains the device's pseudonym, access policy, and token expiration time; finally, devices with legitimate identity tokens can cooperate to produce together.

[0069] To facilitate a further understanding of the technical solution of this embodiment, the following variables are now defined.

[0070]

[0071] The cross - domain privacy - protected message authentication method for industrial Internet of Things in this embodiment includes the following steps:

[0072] Step (1), system initialization: Complete the relevant work for initializing the entire system;

[0073] Given a security parameter θ, the private key generation centers (PKGs) in all domains cooperate to generate system public parameters {q, P, Q, Q′, G, G T , e, H, H1, H2, H3, t, n}, where G is an additive group of order q, P, Q, and Q′ are three different generators of G, e: G×G→G T is a bilinear mapping, H: {0, 1} * →G is a secure hash function, n and t respectively represent the number of domains and the threshold for gateway cooperation; then, the private key generation center (PKG) i corresponding to domain D i generates the private key k i of D i and the public key

[0074] Step (2), entity registration, including device registration and gateway registration;

[0075] The PKG of each domain generates corresponding pseudonyms and corresponding private keys for each IIoT device and gateway in the domain;

[0076] Step (3), generation of system master public and private keys: All gateways use threshold encryption to cooperate to generate the system master public key P pub and the master private key s, and calculate their own secret shares s i ;

[0077] Step (4), device token generation, which successively includes device request, gateway authentication, and token calculation;

[0078] The device's initiation of a request means that the device first generates corresponding access control information, where the access control information includes the domain information, pseudonym, and expiration time to which it belongs; then the device sends a request containing the access control information and timestamp to the nearby gateway;

[0079] The gateway's response to the request means that after the nearby gateway receives the device's request, it checks the device's pseudonym, access control information, timestamp, and the device's legitimacy. If the check passes, it calculates the token and then sends the token and certificate to the device;

[0080] The device's authentication and generation of the token means that when the device receives the tokens and certificates from all nearby gateways, it performs batch authentication on the gateways and obtains the token after passing the batch authentication;

[0081] Step (5), message authentication, includes message sending and message verification;

[0082] Step (6), dynamic update of entities, includes device revocation and gateway registration and revocation.

[0083] As Figure 2 shown, the detailed process of step (4) in this embodiment is as follows:

[0084] Step (4.1), the device initiates a request

[0085] Device DE i generates access control information ACI i , and the access control information ACI i includes the domain information D ∈ , pseudonym PID i，j and expiration time; then DE i generates a random value and calculates R i，j = r i，j P, h i，j ' = H3(AcI i , tt i , T i，j , R i，j ), and W i，j = h i，j 'S i，j + r i，j Q', where tt i ∈ [TS j ·ΔT, TS j+1 ·ΔT] is the current timestamp; then DE i sends the request (ACI i , tt i , T i，j , R i，j , W i，j ) to the nearby t gateways;

[0086] Step (4.2), the gateway responds to the request. After receiving the device's request, the nearby t gateways GW k will perform the following operations, k = 1, 2,..., t:

[0087] First, the gateway GW k checks the legitimacy of the device's pseudonym PID i，j and ACI i . If the PID i，j is in the CRL or the ACI i is illegal, the request will be rejected. If both are legal, then the GW k obtains the TS i through tt j , and then calculates h i，j = H2(PID i，j , TS j , T i，j ) and h i，j ' = H3(ACI i , tt i , T i，j , R i，j );

[0088]

[0089] Then the GW k checks the legitimacy of the DE i by verifying whether equation (1) holds. If the verification fails, the request will be rejected; if the verification passes, the GW k calculates the sub-token σ i，k = s k · slice(ACI i ) and then sends to the DE i ;

[0090] Step (4.3), device authentication and token generation. When the device DE i receives the messages from t gateways , it performs the following operations:

[0091] The DE i first checks the legitimacy of the GW by executing i . If the check passes, it calculates where G k is included in ;

[0092] Then the DE i batch-authenticates the gateways by verifying whether equation (2) holds: If for a certain l ∈ [1, t], the sub-token σ i,l cannot pass the verification, it means that the GW l is illegal, and the DE i will mark the illegal GW lReport to the corresponding PKG and request a sub-token from other gateways;

[0093]

[0094] Finally, DE i Calculate Where Obtain the token σ i After that, DE i Then participate in the subsequent message verification.

[0095] Embodiment:

[0096] In this embodiment, the cryptographic library charm 0.50 of python is used to simulate the operations of the scheme. The programming language is python, and the machine configuration is the Ubuntu20.04 TLS system, Intel Core i5-7500 (3.4 GHZ, 16 GB RAM). The bilinear pairing e: G×G→G T Construct on the curve y with embedding degree 2 2 =x 3 +x, |G| = 102 bits, bits.

[0097] Since the technical solution of the present invention can perform multiple message verifications after obtaining the identity token, the overall computational overhead of comparing multiple message verifications will be considered here. It is assumed that t = 5 gateways, that is, the device needs to be authenticated by at least 5 gateways to obtain the token.

[0098] As Figure 3 shown is the overall computational overhead of generating one token and verifying m messages. The results show that the overall overhead of the technical solution of the present invention is relatively low.

[0099] As Figure 4 shown, when m is greater than 10, the communication cost of the technical solution of the present invention is significantly better than other solutions.

Claims

1. A cross - domain privacy - preserving message authentication method for industrial Internet of Things, characterized in that It includes the following steps: Step (1), System initialization: Complete the relevant work for the initialization of the entire system; Given the security parameter θ, all private key generation centers PKGs in the domain collaborate to generate the system public parameters {q, P, Q, Q′, G, G T , e, H, H1, H2, H3, t, n}, where G is an additive group of order q, and P, Q, Q′ are three different generators of G, and e: G×G→G T is a bilinear map, H1: H2: H3: H: {0, 1} * →G is a secure hash function, and n and t represent the number of domains and the threshold of gateway collaboration respectively; then, the private key generation center PKG i corresponding to the domain D i generates the private key k i of D i and the public key k i where is a random number selected from , i ∈ [1, n]; Step (2), entity registration, including device registration and gateway registration; the PKG for each domain generates corresponding pseudonyms and corresponding private keys for each IIoT device and gateway in the domain. The specific method is as follows: When registering a device, assume that the PKG assigns C pseudonyms to each device, and the validity period of each pseudonym is ΔT. Then, for device DE i at the j-th time slot TS j the pseudonym PID i,j has a validity period range of [j·ΔT, (j + 1)·ΔT], where j ∈ [1, C]. The PKG ∈ after receiving the real identity ID i of the device DE to be registered i selects two random seeds SD i,1 and SD i,2 , and calculates the pseudonym of DE i through two hash chains according to the following formula: In the above formula, S 1,j is the value obtained by performing j hash operations on the hash seed SD i,1 , and S 2,c-j+1 is the value obtained by performing C - j + 1 hash operations on the hash seed SD i,2 ; PID i,j,1 and PID i,j,2 are two parts of the pseudonym PID i,j , and k ∈ , are respectively the private key and the public key of the private key generation center of the domain D ∈ to which the device belongs; Then, for each pseudonym PID i,j =(PID i,j,1 , PID i,j,2 ), PKG ∈ uses the KIBS scheme to calculate the corresponding private key SK i,j =(T i,j , S i,j ): PKG ∈ Randomly select and calculate T i,j = t i,j P, h i,j = H2(PID i,j , TS j , T i,j ) and S i,j =(k ∈ + h i,j ·t i,j ); Here, t i,j is a random number; h i,j is the hash value of PID i,j , TS j , T i,j , and S i,j , T i,j constitute the private key corresponding to the pseudonym PID i,j ; The gateway registration process includes the following steps: For a gateway GW j from the domain D i , its private key generation center PKG j selects a random value as the private key of the gateway and calculates its public key G i = v i P; then, PKG j calculates the signature i on G PKG j sends the private key v i , the public key G i and the certificate of the gateway to GW i ; Step (3), generation of the system master public and private keys. All gateways use threshold encryption to collaboratively generate the system master public key P pub and the master private key s, and calculate their own secret share s i ; Step (4), Device token generation, which sequentially includes device request, gateway authentication, and token calculation; Device request means that the device first generates corresponding access control information, and the access control information includes the affiliated domain information, pseudonym, and expiration time; then the device sends a request containing the access control information and timestamp to the nearby gateway; Gateway authentication means that after receiving the device request, the nearby gateway checks the device pseudonym, access control information, timestamp, and the legality of the device. If the check passes, it calculates the token and then sends the token and certificate to the device; Token calculation means that when the device receives the tokens and certificates from all nearby gateways, it conducts batch authentication on the gateways. After the batch authentication passes, it obtains the token; Step (5), Message authentication, including message sending and message verification; Step (6), Dynamic update of entities, including revocation of devices and registration and revocation of gateways.

2. The cross-domain privacy protection message authentication method for industrial Internet of Things according to claim 1, characterized in that: The specific method for generating the system public key and the system in step (3) is: First, gateway GW i randomly selects a secret and a polynomial function f of degree t - 1 i (x) = a i,0 + a i,1 x + a i,2 x 2 + … + a i,t-1 x t-1 mod q, where a i,t-1 represents a random number; Then, GW i calculates and publishes a i,j P to all other gateways and secretly sends f(k) to other GW k , j ∈ [0, t - 1], k ∈ [1, n], k ≠ i; when receiving the corresponding message f k (i) from GW k (i), GW i verifies whether it holds. If the verification fails, it rejects; if the verification succeeds, then GW i calculates its own secret share and Among them, a i,j P represents the element corresponding to a i,j in the group, represents the secret share s i of GW i corresponding to the element in the group G, f i (k) represents the value of f i (x) when x is equal to k; f k (i) represents the polynomial selected by GW k ; finally, the gateway GW i calculates the system master public key and broadcasts it At this point, the private key of the system is distributed to all gateways, and no single gateway knows the exact master private key s alone.

3. The cross-domain privacy protection message authentication method for industrial Internet of Things according to claim 1, characterized in that: The detailed process of step (4) is: Step (4.1), The device initiates a request Device DE i Generate access control information ACI i , the access control information ACI i includes the domain information D ∈ , pseudonym PID i,j and expiration time; Then DE i Generate a random value And calculate R i,j = r i,j P,h i,j ' = H3(ACI i ,tt i ,T i,j ,R i,j ), and W i,j = h i,j 'S i,j + r i,j Q', where tt i ∈ [TS j ·ΔT, TS j+1 ·ΔT] is the current timestamp; Then DE i Send a request (ACI i ,tt i ,T i,j ,R i,j ,W i,j ) to the nearby t gateways; where h i,j ′ is the hash value of ACI i , tt i , T i,j , R i,j ; R i,j W i,j , T i,j are both intermediate calculated values and jointly form the signature of the message; Step (4.2), the gateway responds to the request. After receiving the request from the device, the t gateways GW nearby k will perform the following operations, where k = 1, 2, …, t: First, the gateway GW k checks the legitimacy of the device's pseudonym PID i,j and ACI i . If the PID i,j is in the CRL or the ACI i is illegal, the request will be rejected. If both are legal, then the GW k obtains the TS i through tt j , and then calculates h i,j = H2(PID i,j , TS j , T i,j ) and h i,j ' = H3(ACI i , tt i , T i,j , R i,j ); Then GW k Check the legitimacy of DE by verifying whether Equation (1) holds. If the verification fails, reject the request; if the verification passes, then GW i calculate the sub-token σ k = s i,k ·H(ACI k ) and Then send to DE i ;​ where s k is the secret share of gateway GW k and SG k is the value after encryption of σ i,k ; v i is the private key of gateway GW k ; Step (4.3), the device is authenticated and generates a token. When device DE i receives messages from t gateways it performs the following operations: DE i First, by executing Check the legality of GW k If the verification passes, calculate where G k is included in ; is the public key of the PKG of the domain D k to which the gateway GW k belongs, and G k is the public key of GW k ; is the certificate of the gateway GW k ; Then DE i Batch authenticate the gateways by checking whether the verification equation (2) holds: If for a certain l ∈ [1, t], the sub - token σ i,l fails the verification, it means that GW l is illegal, and DE i reports the illegal GW l to the corresponding PKG and requests sub - tokens from other gateways; Finally, DE i Calculate wherein l≠k; ω k is a parameter for restoring the secret; Obtain the token σ i After that, DE i will participate in the subsequent message verification.

4. The cross-domain privacy protection message authentication method for industrial Internet of Things according to claim 1, characterized in that: The message authentication process in step (5) includes the following steps: Message sending: When the device DE i Need to send message M i When, from Randomly select a u from i And calculate U i =u i P,c i =H2(ACI i ,M i ||tt i ,U i ), where tt i is a timestamp; then DE i Send to other device receivers (M i ,ACI i ,U i ,tt i ,α i ); Message verification: When the receiver receives a message (M i , ACI i , U i , tt i , α i ) from the DE i , it first checks the validity of tt i and ACI i . If either of them is invalid, the message is rejected. If both are valid, then c i = H2(ACI i , M i || tt i , U i ) is calculated, and it is determined whether the message is valid by verifying whether equation (3) holds; e(α i ,P) = e(c i H(ACI i ),P pub )·e(Q,U i ) Equation (3).

5. The cross-domain privacy protection message authentication method for industrial Internet of Things according to claim 4, wherein: During the message authentication process, if there are many messages waiting for authentication, batch authentication is used to reduce pairing operations. Suppose there are m signatures to be verified; for (M ∈ ,ACI ∈ ,tt ∈ ,U ∈ ,α ∈ ), ∈∈[1, m], etc., verify whether the verification equation (4) holds for batch verification:

6. The cross-domain privacy protection message authentication method for industrial Internet of Things according to claim 1, wherein: The dynamic update of entities in step (6) includes gateway addition, gateway revocation, and device revocation, specifically as follows: (A) Gateway joins. When a new gateway GW is added to the system ζ GW ζ needs to obtain its own secret share s. The number of gateways is modified to n + 1, and the threshold is modified to t'. The update process of the secret sharing is as follows: First, GW i Randomly select a polynomial function f of degree t′ - 1 i (x) = s i + a i,1 x + a i,2 x 2 + … + a i,t-1 x t′-1 mod q, where At this time, i ∈ [1, n]; Then, gateway GW i calculates and publishes s i P and a i,j P to all other gateways, and secretly sends f i (k) to GW k , where k ∈ [1, n + 1], k ≠ i, j ∈ [1, t′ - 1]; upon receiving the message f k from GW k (i), GW i verifies whether it holds. If the verification fails, it rejects; Finally GW i Calculate new secret shares and Broadcast (B) Gateway revocation. When the gateway GW ζ is revoked, other gateways need to update their secret shares so that the gateway GW ζ cannot participate in subsequent collaborative authentication. At this time, the number of gateways will be changed to n - 1, the threshold is t’, and the update process of the secret shares is as follows: First, GW i Randomly select a polynomial function \(f\) of degree \(t'-1\) i (x)=s i +a i,1 x + a i,2 x 2 +…+a i,t-1 x t′-1 mod q, where here \(i\in[1,n - 1]\); Then, the gateway GW i calculates and publishes s i P and a i,j P to all other gateways, and secretly sends f i (k) to GW k , at this time, j ∈ [1, t′ - 1], k ∈ [1, n - 1], k ≠ i; after receiving the message f k from GW k (i), GW i verifies whether it holds. If the verification fails, it rejects. If the verification is successful, then GW i calculates new secret shares and broadcasts (C) Device revocation, when the domain D ∈ in the device DE i is damaged, PKG ∈ can revoke the damaged device in time to avoid greater harm; First, the PKG ∈ of the domain D ∈ calculates the identity information ID of the device i ; Then, according to the ID i obtain the corresponding hash seed SD i,1 and SD i,2 , and disclose them to revoke all the pseudonyms of the device;

Images