A data trusted transmission protection method and communication system based on edge computing

Abstract

The present invention proposes a method for trusted data transmission and protection based on edge computing, comprising: 1) trusted authentication of a trusted edge computing gateway by a trusted server; and 2) trusted authentication of a trusted device terminal by the trusted edge computing gateway. A communication system for implementing this method includes a trusted device terminal, a trusted edge computing gateway, and a trusted server. The system implements trusted authentication by embedding a non-pluggable trusted platform module in a hardware device, verifying the legitimacy of the device based on the trusted platform module. The device's identity is then authenticated by performing a one-way hash operation on a negotiated shared key.

Description

Technical Field

[0001] The present invention relates to a data trusted transmission protection method and communication system based on edge computing, belonging to the technical field of data information security and communication confidentiality. Background Art

[0002] Edge computing, another wave of information technology revolution following cloud computing and artificial intelligence, processes part of the data at the terminal, moving computing from the original central server to the edge of the network close to the data source, thereby effectively avoiding problems such as data latency, high data centralization, and network jitter. The unique advantages of low latency, easy mobility, and low cost have led to a continuous increase in the application areas of edge computing, promoting the innovation and development of traditional technologies and businesses.

[0003] Although edge computing has been widely used in multiple valuable industries such as electricity, transportation, manufacturing, and smart cities, since computing nodes are usually deployed in open environments, data security issues in edge computing nodes during data collection and data analysis are more prominent than in cloud data processing.

[0004] Edge computing achieves the interconnection of IoT devices and sensors by integrating multiple communication networks such as wireless networks, mobile center networks, and the Internet. In this integrated network, its network infrastructure is extremely vulnerable to attacks. Attackers can start from any vulnerable network and break through the security line of the entire network. Once the network infrastructure is breached, data will face security issues such as loss, tampering, and forgery. The authorized entities in edge computing are not absolutely trustworthy. Once an entity faces a trust threat, it will cause security issues such as leakage and tampering of important industrial Internet data. Edge computing usually performs local calculations first and uploads important calculation results to the cloud for storage and analysis. However, during the upload process of important data, the data confidentiality, integrity, and availability will be destroyed in the data transmission channel. Edge devices are more vulnerable to theft, man-in-the-middle attacks, counterfeiting, and other attacks than cloud centers, which poses a huge challenge to identity authentication and subsequent authorization in edge networks.

[0005] To address the above security issues, the present invention establishes a trusted system environment through a built-in trusted platform module, and performs device authentication and data integrity authentication based on the trusted environment to prevent security issues such as hardware device counterfeiting and transmitted data tampering. Summary of the Invention

[0006] The present invention proposes a data trusted transmission protection method and communication system based on edge computing, which aims to solve the problem that the confidentiality, integrity and availability of data in the data transmission channel of edge computing nodes are easily damaged during data transmission.

[0007] The technical solution of the present invention is a data trusted transmission protection method based on edge computing, which includes:

[0008] 1) Trusted authentication of the trusted edge computing gateway by the trusted server;

[0009] 2) Trusted edge computing gateway authenticates trusted device terminals.

[0010] Furthermore, a communication system for operating a data trusted transmission protection method based on edge computing is provided, the system comprising a trusted device terminal, a trusted edge computing gateway, and a trusted server; the trusted device terminal is a device terminal formed by a built-in non-pluggable trusted platform module on an edge device; the trusted edge computing gateway is an edge computing gateway formed by a built-in non-pluggable trusted platform module on an edge node or edge server; the trusted server is a computing center formed by a built-in non-pluggable trusted platform module on a central server.

[0011] Furthermore, the trusted server authenticates the trusted edge computing gateway, specifically including:

[0012] 1-1) The trusted server generates the system public parameters to implement system initialization;

[0013] 1-2) Key negotiation;

[0014] 1-3) Data transmission and data integrity verification are completed.

[0015] Furthermore, the trusted server generates system public parameters of the system to implement system initialization, specifically including:

[0016] 1-1-1) The trusted server selects a prime number p, q is p-1 or a factor of p-1; selects a random number is the group of integers modulo q under multiplication, and satisfies g q -1 is divisible by p; choose a one-way hash function H(): n is the length of the hash value, and the first key is randomly generated And calculate the first public key The system public parameters are {p, q, g, y1, H()};

[0017] 1-1-2) The trusted edge computing gateway randomly generates a second key before registering on the network And calculate the second public key

[0018] 1-1-3) The trusted edge computing gateway initiates a network registration request to the trusted server and sends the following message: AIK certificate, second public key y2, and related identity information;

[0019] 1-1-4) Upon receiving the network registration request message from the trusted edge computing gateway, the trusted server first determines the legitimacy of the trusted edge computing gateway. If the gateway is not legitimate, the network registration is rejected. If the gateway is legitimate, the trusted server responds to the registration message and sends the following message: the first public key y1, the one-way hash function H(), and the relevant identity information, and then performs key negotiation.

[0020] Furthermore, the determining of the legitimacy of the trusted edge computing gateway is specifically: identifying the legitimacy of the trusted edge computing gateway based on the AIK certificate.

[0021] Furthermore, the relevant identity information includes the device number and manufacturer; the AIK certificate is an identity authentication key generated by the EK certificate.

[0022] Furthermore, the key negotiation specifically includes: the trusted server receives the second public key from the trusted edge computing gateway Then calculate the first part of the key The trusted edge computing gateway receives the first public key from the trusted server Then calculate the second part of the key A first common key K=k1=k2 is negotiated.

[0023] Furthermore, the data transmission completes data integrity verification, specifically including: after the trusted server and the trusted edge computing gateway negotiate a common key, the trusted edge computing gateway securely uploads the tamper-proof edge data {m, H(m||k2)} to the trusted server, where m is the edge data that has not been tamper-proofed. After the trusted server receives the edge data {m, H(m||k2)} from the trusted edge computing gateway, it performs data integrity verification, first calculating H(m||k1) and determining whether H(m||k2) is equal to H(m||k1). If they are equal, the data is considered to be credible and not tampered with. If they are not equal, the data is considered to be tampered with.

[0024] Furthermore, the trusted edge computing gateway performs trusted authentication on the trusted device terminal, specifically including:

[0025] 2-1) The trusted edge computing gateway and the trusted device terminal perform key negotiation to obtain a second common key K'. The trusted edge computing gateway calculates a third key k3, and the trusted device terminal calculates a fourth partial key k4, and the second common key K'=k3=k4 is negotiated.

[0026] 2-2) When the trusted device terminal is powered on and connected to the trusted edge computing gateway, the trusted edge computing gateway randomly generates a random number N0 and sends N0 to the trusted device terminal;

[0027] 2-3) The trusted edge computing gateway calculates H2 = H(N0||k3);

[0028] 2-4) After receiving the random number N0 from the trusted edge computing gateway, the trusted device terminal calculates H1 = H(N0||k4) and sends H1 to the trusted edge computing gateway;

[0029] 2-5) After receiving H1, the trusted edge computing gateway determines whether H1 and H2 are equal. H1 and H2 are hash values calculated using the one-way hash function H(). If they are equal, the device terminal is considered a trusted device terminal. If they are not equal, the device is considered an illegally accessed terminal device.

[0030] Furthermore, the negotiated second common key K' specifically includes: the trusted edge computing gateway calculates the third key k3, the trusted device terminal calculates the fourth partial key k4, and negotiates the second common key K'=k3=k4.

[0031] Beneficial effects of the present invention:

[0032] 1) By embedding a non-pluggable trusted platform module in the hardware device, the legitimacy of the device is identified based on the trusted platform module, and the trusted authentication of the device is achieved. The identity of the device is authenticated by performing a one-way hash operation on the negotiated shared key;

[0033] 2) Based on the trustworthy identity, the uploaded data and the shared key are hashed using a one-way hash function to ensure that the data uploaded by the trusted edge computing gateway is not replaced or tampered with;

[0034] 3) Through the one-way hash function, data is prevented from being tampered with during transmission, ensuring the authenticity and reliability of edge data;

[0035] 4) By authenticating the AIK (Attestation Identity Key) to verify the legitimacy of the platform identity, it effectively prevents illegal or untrusted devices from accessing the system;

[0036] 5) By embedding a trusted platform module into edge computing-based system devices, a trusted environment for hardware devices is established. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Attachment Figure 1 This is a schematic diagram of the architecture of the trusted transmission system based on edge computing data.

[0038] Attachment Figure 2 This is a diagram of the trusted authentication process of the trusted server to the trusted edge computing gateway. Figure 3This is a diagram of the trusted authentication process of a trusted edge computing gateway for a trusted device terminal. DETAILED DESCRIPTION

[0039] A data trusted transmission protection method based on edge computing, the method comprising the following steps:

[0040] 1) Trusted authentication of the trusted edge computing gateway by the trusted server;

[0041] 2) Trusted edge computing gateway authenticates trusted device terminals.

[0042] As attached Figure 1 As shown, a communication system for operating a data trusted transmission protection method based on edge computing, the system includes a trusted device terminal, a trusted edge computing gateway, and a trusted server.

[0043] The trusted device terminal is a device terminal formed by a non-pluggable trusted platform module built into the edge device; the edge device includes terminal data acquisition devices such as smart cameras, atmospheric environment sensors, monitoring, smart lamp poles, etc.

[0044] The trusted edge computing gateway is an edge computing gateway formed by a non-pluggable trusted platform module built into the edge node or edge server; the trusted edge computing gateway is responsible for intelligent perception, intelligent computing, data analysis, real-time control, process optimization, etc. of the trusted device terminal or the data uploaded by it, and uploading the processed information data to the trusted server.

[0045] The trusted server is a computing center formed by a non-pluggable trusted platform module built into the central server; the trusted server is responsible for processing data uploaded from the trusted edge computing gateway, implementing global scheduling and intelligent decision-making, and providing services to end users.

[0046] The present invention provides a trusted execution environment that can be applied to edge computing by embedding a non-pluggable trusted platform module on the basis of current devices; the current devices include edge devices, edge nodes or edge servers, central servers, etc.

[0047] As attached Figure 2 As shown, the trusted authentication of the trusted edge computing gateway by the trusted server specifically includes the following steps:

[0048] 1-1) The trusted server generates the system public parameters to implement system initialization;

[0049] 1-2) Key negotiation;

[0050] 1-3) Data transmission and data integrity verification are completed.

[0051] The trusted server generates system public parameters of the system to implement system initialization, specifically including the following steps:

[0052] 1-1-1) The trusted server selects a prime number p, q is p-1 or a factor of p-1; selects a random number is the group of integers modulo q under multiplication, and satisfies g q -1 is divisible by p; choose a one-way hash function H(): n is the length of the hash value, and the first key is randomly generated using the key generation center (KGC) function of the trusted platform module (TPM) built into the trusted server. Use the storage root key (SRK) of the trusted platform module built into the trusted server for secret protection and calculate the first public key If the outside world wants to crack x1 based on the first public key y1, it is equivalent to solving the discrete logarithm problem, which is computationally difficult to achieve, ensuring the security of the first key x1. The public parameters of the system are {p, q, g, y1, H()}; H() is specifically expressed as:

[0053] 1-1-2) Before the trusted edge computing gateway registers on the network, it uses the key generation center function of the trusted platform module built into the trusted edge computing gateway to randomly generate a second key. Use the storage root key of the trusted platform module built into the trusted edge computing gateway for secret protection and calculate the second public key g, x1, and x2 are three randomly generated numbers, and g, x1, and x2 are not necessarily equal. Preferably, g, x1, and x2 are three unequal numbers generated randomly;

[0054] 1-1-3) The trusted edge computing gateway initiates a network registration request to the trusted server and sends a message: AIK certificate, second public key y2, and relevant identity information; the relevant identity information includes the device number and manufacturer; the AIK certificate is the identity proof key generated by the EK certificate;

[0055] 1-1-4) The trusted server receives the network registration request message from the trusted edge computing gateway.

[0056] First, the legitimacy of the trusted edge computing gateway is authenticated based on the AIK certificate. If it is not legal, network registration is rejected. If it is legal, the trusted server responds to the registration and sends a message to the trusted edge computing gateway: the first public key y1, the one-way hash function H(), and the relevant identity information, and then performs key negotiation; the relevant identity information includes the device number and manufacturer.

[0057] The key negotiation specifically includes: the trusted server receives the second public key from the trusted edge computing gateway Then calculate the first part of the key The trusted edge computing gateway receives the first public key from the trusted server Then calculate the second part of the key That is, the first common key K=k1=k2 is negotiated.

[0058] The data transmission completes the data integrity verification, specifically including: after the trusted server and the trusted edge computing gateway negotiate a common key, the trusted edge computing gateway securely uploads the tamper-proof edge data {m, H(m||k2)} to the trusted server, where m is the edge data that has not been tamper-proofed. After receiving the edge data {m, H(m||k2)} from the trusted edge computing gateway, the trusted server performs data integrity verification, first calculating H(m||k1) and judging whether H(m||k2) is equal to H(m||k1). If they are equal, the data is considered to be authentic and not tampered with; if they are not equal, the data is considered to be tampered with; the trusted server masters K1, and the trusted edge computing gateway masters K2. K1 and K2 are calculated using different public keys. Theoretically, K1 and K2 are equal, so the obtained H(m||k2) should also be equal to H(m||k1). However, if the data is tampered with, H(m||k2) will not be equal to H(m||k1).

[0059] When a trusted device terminal needs to reconnect to the trusted edge computing gateway due to power outage, maintenance, or restart, in order to prevent illegal terminal devices from accessing, the trusted edge computing gateway needs to perform trusted authentication on the trusted device terminal, as shown in the attached Figure 3 As shown, the trusted edge computing gateway authenticates the trusted device terminal, specifically including the following steps:

[0060] 2-1) The trusted edge computing gateway and the trusted device terminal perform key negotiation to negotiate a second common key K'. The key negotiation between the edge computing gateway and the trusted device terminal is the same as the key negotiation method in the trusted authentication of the trusted edge computing gateway by the trusted server described above. The trusted edge computing gateway calculates the third key k3, and the trusted device terminal calculates the fourth partial key k4, that is, the second common key K'=k3=k4 is negotiated.

[0061] 2-2) When the trusted device terminal is powered on and connected to the trusted edge computing gateway, the trusted edge computing gateway randomly generates a random number N0 and sends N0 to the trusted device terminal;

[0062] 2-3) The trusted edge computing gateway calculates H2 = H(N0||k3);

[0063] 2-4) After receiving the random number N0 from the trusted edge computing gateway, the trusted device terminal calculates H1 = H(N0||k4) and sends H1 to the trusted edge computing gateway;

[0064] 2-5) After receiving H1, the trusted edge computing gateway determines whether H1 and H2 are equal. H1 and H2 are hash values calculated by the hash function H(). If they are equal, the device terminal is considered to be a trusted device terminal (corresponding to the attached Figure 3 If they are not equal, the device is considered to be an illegally accessed terminal device (corresponding to the attached Figure 3 N in ).

[0065] Definitions of Abbreviations and Key Words

[0066] One-way hash function H(): also known as hash function; it transforms an input of arbitrary length into an output of fixed length through a hash algorithm. The output value is called a hash value or message digest. Simply put, it is a function that compresses an input message of arbitrary length into a message digest of a fixed length; it has three security features: 1. For any given hash value h, it is computationally infeasible to find x that satisfies H(x) = h, which is called one-way property; 2. For any given group x, it is computationally infeasible to find y that satisfies y≠x and H(x) = H(y), which is called weak collision resistance; 3. It is computationally infeasible to find any pair x = y that satisfies H(x) = H(y), which is called strong collision resistance.

[0067] Key negotiation: Two or more entities negotiate to jointly establish a session key. Any participant can influence the result, without the need for any trusted third party.

[0068] Trusted Platform Module (TPM): A protected, packaged microcontroller security chip embedded in a computer that provides a root of trust for the computer. It has specially implemented security features, including symmetric and asymmetric encryption, hashing, and storage and management of digital certificates. It can be used in computing devices other than PCs, such as receivers or network devices.

[0069] EK certificate: also known as endorsement certificate, is generally created by the TPM manufacturer or embedded in the TPM, and sometimes can be issued by the platform manufacturer; a TPM can only have one EK certificate in its lifetime. The EK certificate is the unique identifier of the TPM chip and can generate an identity authentication key AIK (Attestation Identity Key) for the platform to prove the legitimacy of the identity.

Claims

1. A data trusted transmission protection method based on edge computing, characterized by The method includes: 1) Trusted authentication of the trusted edge computing gateway by the trusted server; 2) Trusted authentication of the trusted edge computing gateway to the trusted device terminal; the trusted device terminal, the trusted edge computing gateway, and the trusted server each have a built-in non-pluggable trusted platform module; the trusted server's trusted authentication of the trusted edge computing gateway specifically includes: 1-1) The trusted server generates the system public parameters to implement system initialization; 1-2) Key negotiation; 1-3) Data transmission and data integrity verification; The trusted server generates the system public parameters of the system to implement system initialization, specifically including: 1-1-1) the trusted server selects a prime number p, q is p-1 or a factor of p-1; selects a random number is the group of integers modulo q under multiplication, and satisfies g q -1 is divisible by p; choose a one-way hash function n is the length of the hash value, and the first key is randomly generated And calculate the first public key The system public parameters are {p, q, g, y1, H()}; 1-1-2) The trusted edge computing gateway randomly generates a second key before registering on the network And calculate the second public key 1-1-3) The trusted edge computing gateway initiates a network registration request to the trusted server and sends the following message: AIK certificate, second public key y2, and related identity information; 1-1-4) Upon receiving the network registration request message from the trusted edge computing gateway, the trusted server first determines the legitimacy of the trusted edge computing gateway; if it is illegal, the network registration is rejected; if it is legal, the trusted server responds to the registration with a message containing the first public key y1, the one-way hash function H(), and relevant identity information, and then performs key negotiation; determining the legitimacy of the trusted edge computing gateway is specifically performed by identifying the legitimacy of the trusted edge computing gateway based on the AIK certificate.

2. The data trusted transmission protection method based on edge computing according to claim 1 is characterized by The relevant identity information includes the device number and manufacturer; the AIK certificate is the identity proof key generated by the EK certificate.

3. The data trusted transmission protection method based on edge computing according to claim 1 is characterized in that The key negotiation specifically includes: the trusted server receives the second public key from the trusted edge computing gateway Then calculate the first part of the key The trusted edge computing gateway receives the first public key from the trusted server Then calculate the second part of the key A first common key K=k1=k2 is negotiated.

4. The data trusted transmission protection method based on edge computing according to claim 1 is characterized by The data transmission completes the data integrity verification, specifically including: after the trusted server and the trusted edge computing gateway negotiate a common key, the trusted edge computing gateway securely uploads the tamper-proof edge data {m, H(m||k2)} to the trusted server, where m is the edge data that has not been tamper-proofed. After the trusted server receives the edge data {m, H(m||k2)} from the trusted edge computing gateway, it performs data integrity verification, first calculating H(m||k1) and determining whether H(m||k2) is equal to H(m||k1). If they are equal, the data is considered to be credible and not tampered with. If they are not equal, the data is considered to be tampered with.

5. The data trusted transmission protection method based on edge computing according to claim 1 is characterized by The trusted edge The computing gateway performs trusted authentication on trusted device terminals, specifically including: 2-1) The trusted edge computing gateway and the trusted device terminal perform key negotiation to obtain a second common key K'. The trusted edge computing gateway calculates a third key k3, and the trusted device terminal calculates a fourth partial key k4, and the second common key K'=k3=k4 is negotiated. 2-2) When the trusted device terminal is powered on and connected to the trusted edge computing gateway, the trusted edge computing gateway randomly generates a random number N0 and sends N0 to the trusted device terminal; 2-3) The trusted edge computing gateway calculates H2 = H(N0||k3); 2-4) After receiving the random number N0 from the trusted edge computing gateway, the trusted device terminal calculates H1 = H(N0||k4) and sends H1 to the trusted edge computing gateway; 2-5) After receiving H1, the trusted edge computing gateway determines whether H1 and H2 are equal. H1 and H2 are hash values calculated using the one-way hash function H(). If they are equal, the device terminal is considered a trusted device terminal. If they are not equal, the device is considered an illegally accessed terminal device.

6. A communication system for operating the data trusted transmission protection method based on edge computing according to any one of claims 1 to 5, characterized in that It includes a trusted device terminal, a trusted edge computing gateway, and a trusted server; the trusted device terminal is a device terminal formed by a non-pluggable trusted platform module built into the edge device; The trusted edge computing gateway is an edge computing gateway formed by a built-in non-pluggable trusted platform module on an edge node or edge server; the trusted server is a computing center formed by a built-in non-pluggable trusted platform module on a central server.

Images