An efficient message authentication method based on zero-knowledge proof in a vehicle networking environment

Abstract

The application provides a high-efficiency message authentication method based on zero-knowledge proof in a vehicle networking environment, and belongs to the technical field of vehicle networking security. The technical scheme is as follows: S1, a trusted authentication center (TA) generates a series of public parameters and publishes them; S2, the TA initializes and registers the entity vehicles and RSUs that access the network; S3, the RSU and the access vehicles perform bidirectional identity authentication; S4, the vehicles and the surrounding group member vehicles perform secure communication; and S5, the malicious entities are tracked and revoked. The application has the beneficial effects that the application realizes conditional privacy protection, and through the introduction of an authentication method based on discrete logarithm zero-knowledge proof, high-efficiency message authentication is realized, and through the design of a verification tuple of a group signature private key pair in a domain, the problem of group signature key update calculation difficulty is solved.

Description

Technical Field

[0001] This invention relates to the field of vehicle network security technology, and in particular to an efficient message authentication method based on zero-knowledge proof in a vehicle network environment. Background Technology

[0002] With the development of the automotive industry, the number of cars on the road has continued to grow rapidly. While bringing convenience, this has also brought a series of problems such as severe traffic congestion and frequent traffic accidents. Against this backdrop, the Internet of Vehicles (IoV) has emerged. IoV is a ubiquitous network based on in-vehicle networks, inter-vehicle networks, and in-vehicle mobile internet, using specific communication protocols and data exchange standards to achieve information interconnection and interoperability between V2X (Vehicle to Everything). The V2X interaction modes mainly include V2V (Vehicle), V2N (Network, cloud platform), and...

[0003] Communication and interaction between V2I (Vehicle-to-Infrastructure) and roadside infrastructure. In a vehicle-to-everything (V2I) environment, vehicles are equipped with wireless units and use a dedicated short-range communication protocol (DSRC) (which will evolve into LTE or 5G communication in the future) to communicate with vehicles or roadside units. Each vehicle periodically broadcasts information such as its speed, location, and road conditions. Upon receiving the broadcast information, vehicles obtain surrounding road condition information and can perform actions such as lane changing, acceleration, and deceleration. In addition to receiving information broadcast by surrounding vehicles, vehicles can also communicate with roadside units and upload their own information for big data software analysis and mining to provide users with more convenient and safer experiences.

[0004] The Internet of Vehicles brings great convenience to users, but also brings security risks. As pointed out by Chen Xue et al. in the literature "Security Risks and Countermeasures of Internet of Vehicles", if the access control, data encryption and other security protection measures of the vehicle network protocol are not perfect, the vehicle network may be subject to security attack threats such as eavesdropping, theft, forgery, tampering, and replay. Defects in identity authentication or data encryption when vehicles interact with external entities and platforms may lead to security risks such as communication hijacking and tampering. Lack of a unified and trusted "digital identity" makes it impossible to perform identity verification and security authentication, which may result in the "digital identity" being forged and the vehicle being maliciously controlled. The reason for the above security problems is that the Internet of Vehicles mostly uses wireless networks to form a multi-domain, open network environment during communication, making the information in the vehicle communication process extremely vulnerable to attacks such as forgery or tampering. Malicious attackers can achieve their illegal purposes by attacking communication information, resulting in user privacy leaks or traffic accidents and other serious consequences. In addition, due to the high dynamicity and self-organization of the topology of vehicle communication, there is a requirement for low latency and high efficiency in the communication process, and traditional Internet security communication solutions cannot be directly used in the Internet of Vehicles environment.

[0005] Therefore, in recent years, domestic and foreign scholars have done a lot of targeted research on identity security authentication and message privacy protection in the process of Internet of Vehicles communication, and have proposed various solutions, which can be roughly divided into anonymous message authentication schemes based on public key infrastructure, anonymous message authentication schemes based on group signature, and anonymous message authentication schemes based on identity. For example, CHAUM and other scholars proposed an anonymous message authentication scheme based on public key infrastructure in the literature "Security without identification: Transaction systems to make big brother obsolete". Entities achieve anonymous communication by using pseudo-random names to hide real identity information, but the legality of the message source can still be determined by verifying the pseudo-random signature. Hubaux and other scholars use anonymous certificates to achieve the purpose of anonymous message authentication in the literature "Securing vehicular ad hoc networks". Vehicles generate anonymous public keys to sign messages, and each anonymous public key can only generate a certain number of signatures before being discarded. Most anonymous message authentication schemes based on public key infrastructure use pseudonyms instead of real names during communication, and use pseudonym certificates to hide the real identity of the user and protect the privacy of the sender's identity. However, using this method requires vehicles to store a large number of pseudonyms, making it difficult to manage and store pseudonym certificates. Certificate list maintenance is complex and difficult, and is not suitable for the Internet of Vehicles environment. Zheng Minghui and other scholars use anonymous message authentication schemes based on group signature to achieve the purpose of anonymous message authentication in the literature "Research on identity authentication protocol based on group signature in Internet of Vehicles". RSU distributes group public keys and system parameters to vehicle units, and group private keys are managed by group administrators. The sender signs the message using the valid certificate and group public key, and the receiver decrypts the message using the group public key. Most anonymous message authentication schemes based on group signature use a logical group composed of some members during communication. Each group has a group public key, and the group administrator assigns a member private key to each group member. The message sender uses his own group private key to sign the message, and the receiver uses the group public key to verify the message signature. In this way, the message receiver can determine whether the message is from a legitimate group member, but it cannot know the real identity of the message sender. At the same time, the receiver cannot link any two messages sent by the same sender, which achieves identity and location privacy protection for the message sender. However, most group signature algorithms are based on bilinear mapping technology, which has high computational overhead. In addition, for each member's addition and exit, traditional group signature algorithms need to update all group member private keys and group public keys, resulting in high computational overhead, which is not suitable for the high dynamic topology of the Internet of Vehicles environment.

[0006] To solve the certificate management burden brought by traditional PKI technology, Shamir et al. proposed an identity-based anonymous message authentication scheme in the document "Identity-based cryptosystems and signature schemes", in which the existing public information of the user is used as the public key to eliminate the problem of certificate management difficulty. The private key is generated and distributed to the vehicle by the private key generator (PKG), so the problem of public key certificate management difficulty is solved in this scheme. However, the master key of the vehicle in this scheme is generated by the PKG, which cannot avoid the privileged behavior of the PKG. The PKG can abuse its key generation right to sign and decrypt any message, which threatens the privacy and security of the vehicle, so the technology still has the problem of key escrow. Zhang et al. proposed an identity-based anonymous message authentication scheme in the document "An efficient Identity-Based batch verification scheme for vehicular sensor networks", which uses the user identity attribute as the user public key. The sender does not need to send the certificate with the message during message verification, reducing the communication and storage overhead.

[0007] Since the aforementioned traditional solutions cannot completely solve the problem of efficient anonymous message authentication in the vehicle-to-everything (V2X) environment, researchers have proposed a V2X secure communication scheme based on hybrid technologies. This scheme integrates information security technologies such as anonymous message authentication, group signatures, identity-based message authentication, and homomorphic encryption. It leverages the advantages of various security technologies while mitigating their disadvantages. By integrating and modifying these technologies, it adapts to the high demands of the V2X communication environment, resulting in a hybrid scheme that achieves superior performance compared to individual information security technologies. For example, in the paper "A local identity-based anonymous message authentication protocol in VANETs", Wang et al. proposed a localized anonymous message authentication scheme based on bilinear mapping. The scheme uses a combination of identity-based message authentication and PKI-based certificate decryption to ensure authentication efficiency and achieve conditional privacy protection for vehicles. In the paper "Privacy-preserving vehicular communication authentication with hierarchical aggregation and fast response", Zhang et al. proposed an identity-based aggregation signature and identity encryption scheme. The scheme uses a combination of hierarchical aggregation signature and batch signature verification methods to avoid certificate management and certificate verification. In the paper "A Data Security Storage and Sharing Scheme for Vehicle Networking Based on Blockchain and Cloud-Edge Computing Hybrid Architecture", Wu Guangfu et al. adopted a decentralized storage structure to ensure the security of communication data and used an identity-based digital signature encryption algorithm to solve security problems in the communication process. In the paper "A group signature based secure and privacy-preserving vehicular communication framework", Guo et al. proposed an improved group signature scheme. The scheme uses a combination of PKI-based certificate decryption and group signature technology.The message sender signs the message through the group key of the message sender, the message receiver determines whether the identity of the message sender is legal by querying the CRL table, if the information of the vehicle is found in the CRL list, it is indicated that the vehicle is not legal and the information is refused to be received, when a malicious event occurs, the group administrator can trace the real identity according to the message signature; but in the above scheme, the scheme of WANG et al. cannot effectively protect the privacy of the identity and location of the vehicle due to the use of long-term certificates for communication; the scheme of ZHANG et al. uses a bilinear mapping technology, and the calculation consumption is large and the hierarchical management has a large communication delay; the scheme of Wu Guangfu et al. decentralized block chain data uploading affects the communication efficiency of data, resulting in a large delay; the scheme of Guo et al. needs each vehicle to store and update the CRL list, and the vehicle calculation and storage overhead is too large.

[0008] How to solve the above technical problems is the problem faced by the present application. SUMMARY

[0009] The present application provides a hybrid anonymous efficient message authentication method based on local pseudo-identity and group signature hybrid privacy protection and zero-knowledge proof; the method combines global pseudo-identity and local pseudo-identity to realize conditional privacy protection of vehicles, and avoids using the bilinear mapping method used in the traditional group signature algorithm, only using hash function and pre-computed modular exponentiation operation, and completing the group signature through discrete logarithm zero-knowledge proof, reducing the calculation overhead of the group signature.

[0010] The technical scheme of the present application is as follows: in the authentication stage of V2I vehicle and road side infrastructure RSU, the local pseudo-identity is used for authentication, and after successful authentication, the improved intra-domain group signature key is obtained from the RSU to sign the message, realizing the safe message authentication of V2V. At the same time, a verification tuple is generated for each intra-domain group signature private key, and each message receiver can use the verification tuple to judge whether the intra-domain group signature private key of the message sender is expired to judge whether the message sender is legal, and the addition and exit of the group members do not need to update the group private key of the existing group members, solving the problem of difficult calculation of group signature key update.

[0011] The present application is realized through the following measures: a kind of efficient message authentication method based on zero-knowledge proof in Internet of Vehicles environment, comprising the following steps:

[0012] S1, the trusted authentication center TA initializes system parameters, and generates the public key and private key of TA using elliptic curve algorithm;The public key and system parameters are published.

[0013] S2, TA verifies the basic information submitted by the vehicle, generates a global pseudo identity and part of the private key for the vehicle, and stores the real identity and the global pseudo identity in the trusted identity mapping table; the vehicle generates its own another part of the private key and the public key; the RSU generates public and private keys, issues a certificate, and initializes the intra-domain group signature parameters.

[0014] S3, the vehicle first generates a local pseudo identity when entering a new RSU domain, and completes the two-way identity authentication with the RSU with the assistance of the TA; the RSU generates a legal intra-domain group signature private key pair for the vehicle.

[0015] S4, the vehicle and the surrounding group member vehicles implement efficient and secure communication by signing and authenticating messages using the intra-domain group signature private key pair and the method based on discrete logarithm zero-knowledge proof.

[0016] S5, the receiving vehicle transfers the malicious false message to the RSU; the RSU calculates and retrieves the mapping relationship table to obtain the local pseudo identity and the verification tuple of the malicious vehicle, and broadcasts the verification tuple in the domain; the RSU reports the local pseudo identity to the TA, and the TA calculates the global pseudo identity and traces the real identity of the vehicle through the trusted identity mapping table, and deletes the tuple.

[0017] Further, the S1 step comprises:

[0018] S11, the TA selects a non-singular elliptic curve: E p (a, b): y 2 = x 3 + ax + b mod p (p is a large prime number, a, b ∈ F p ) and selects a point P on E p (a, b) as the generator of group G, and sets the order of G as q (G contains an infinite point Q).

[0019] S12, the TA randomly selects as the master key of the system, and calculates the system public key P TA = sP.

[0020] S13, the TA selects four anti-collision one-way hash functions:

[0021] S14, the TA publishes the system parameters Params = {E p (a, b), p, q, G, P, P TA , H0, H1, H2, H3}, and retains the master key s.

[0022] Further, the S2 step comprises:

[0023] S21, vehicle registration, network entity vehicle Vi Initial registration is performed via TA; Vehicle V i Send your real identity information to them, and they will be the vehicle owner (V). i Calculate the global pseudo-identity and generate a partial key, which is then stored in the trusted identity mapping table. The vehicle generates its own additional private key and public key.

[0024] S211. The vehicle submits basic information (license plate number, vehicle owner's identity information, etc.) and real identity ID to the TA. i Complete registration.

[0025] S212, TA is to ensure vehicle V i Real Identity ID i To ensure privacy, a global pseudo-identity Q is generated for it. i Used for communication between network entities, where: Q i =tH0(ID) i ,TS i )modq, random number TS i The system records the vehicle's registration time and generates a trusted identity mapping record for the vehicle, which is then entered into a trusted identity mapping table to enable the tracking and revocation of the true identity information of malicious vehicles.

[0026] S213, TA uses its master key s and the vehicle's global pseudo-identity Q. i Calculate and generate a partial key Y for the vehicle i The calculation method is as follows: Y i =sQ i modq.

[0027] S214, Vehicle V i The global pseudo-identity Q generated during registration i and part of the key Y i Stored in an unalterable device.

[0028] S215, Vehicle V i Randomly select privacy value As part of the private key, retain the private key pair S V ={α i ,Y i}, calculate and generate public key P V =α i P and published.

[0029] S22. RSU Registration: The RSU initializes its registration via the TA, which generates public and private keys, issues certificates, and initializes the intra-domain group signature parameters for the RSU.

[0030] S221, the vehicle department purchases RSU equipment and initializes it, and the RSU selects a random number As its private key S R , the RSU calculates to generate the RSU public key P R = β j P; the TA generates a certificate Cert for the RSU using RSU identity information RID i , public key P R , and timestamp information. R

[0031] S222, the TA initializes the intra-domain group signature parameters {G l , g l , N, P, Q} for this RSU, where G l is a cyclic group, g l is the generator of the group, |G l | = P x Q = N, P and Q are two large prime numbers, and |P| = |Q| = k.

[0032] Further, the S3 step includes:

[0033] S31, RSU identity authentication, the RSU broadcasts its own certificate and signature in the area: Where T i is the timestamp. After receiving the broadcast packet, the vehicle V i verifies the validity of the public key certificate Cert TA using the TA's public key P R , completes the identity authentication of the RSU, and obtains the public key P R and RID value of the RSU from the certificate.

[0034] S32, vehicle V i identity authentication, the RSU completes the identity authentication of the entering vehicle V i with the assistance of the TA:

[0035] S321, after the vehicle V i enters the area of the RSU and completes the authentication of the RSU, a random number is selected to generate a temporary local pseudo-identity Where RID i is the ID value of the RSU where the vehicle V i is located, used to limit the use range of the local pseudo-identity.

[0036] S322, the vehicle V i sends a verification request message message to the TA with the TA public key P TA ​Encryption prevents tampering and impersonation attacks; the message contains the current RSU's ID value (RID). i and public key P V Vehicle Local Area Fake Identity F i Timestamp T i Fields such as σ i =α i Q i +Y i F i .

[0037] S323. After using the private key s to decrypt the verification request message, TA verifies the legitimacy of the vehicle's identity in two steps:

[0038] S3231. First, check the legality of the vehicle registration, specifically: verify the timestamp T. i After excluding replay attacks, calculate Z. i =P V Q i +P TA Q i F i Check Z i =σ i Is P true?

[0039] Because of P V =α i P, therefore α i Q i P = P V Q i ;

[0040] Because of Y i =sQ i TA's public key P TA =sP, therefore Y i F i P = sQ i F i P = P TA Q i F i ;

[0041] Therefore (α) i Q i +Y i F i P = α i Q i P+Y i F i P = P V Q i +P TA Q i F i =Z i; therefore, from the above derivation, when Z i equals σ i P, it is known that the partial private key Y i of the vehicle is calculated by the TA in combination with its own private key s, thereby indicating that the vehicle is a legally registered vehicle.

[0042] S3232, check whether the legal identity of the vehicle is revoked, specifically: use the global pseudo-identity Q i of the vehicle V i to search the trusted identity mapping table, if it exists, it indicates that the vehicle identity has not been revoked, and the verification is passed.

[0043] S324, the TA sends a vehicle identity confirmation message to the RSU , which is encrypted with the RSU public key P R , wherein: F i is the local pseudo-identity of the vehicle V i , P V is the public key of the vehicle V i , and T i is the timestamp.

[0044] S325, the RSU uses the private key S R to decrypt the vehicle identity confirmation message, obtains the local pseudo-identity F i and the public key P i of the vehicle V V , and uses the public key P TA of the TA to verify the signature to prevent tampering attacks; after the verification is passed, the RSU and the vehicle V i complete the mutual identity authentication.

[0045] S33, the RSU generates and distributes the intra-domain group signature private key pair for the vehicle V i and records the mapping into the member mapping table:

[0046] S331, after the mutual identity authentication is completed, the RSU distributes the intra-domain group signature private key pair GK i = {δ i , ε i} for the vehicle V i , δ i and ε j are both generators of the intra-domain group signature parameter group, wherein At the same time, the RSU generates a verification tuple for GK i to judge whether the validity period of the sender's intra-domain group signature private key pair is trusted and expired by the receiver. Among them, is the generation time of the group signature private key pair, is the e-th power of the group signature private key δ j , and the random number

[0047] S332, RSU will vehicle V i Local pseudo-identity F i Intra-domain signature private key δ i and verification tuples Member mapping records are generated and stored in the member mapping table. When a malicious event occurs, they are used to track vehicle local pseudo-identities and broadcast verification tuples.

[0048] S333, RSU vehicle V i public key P V Encrypt and send Among them GK j For group signature private key pairs within the domain; T i The 'e' is a timestamp used to prevent replay attacks; 'e' is used by the message receiver to prevent spoofing attacks and to assist in verifying the generated time. RSU group signature private key pair GK j and timestamp T i The signature is used to prevent tampering attacks.

[0049] Further, step S4 includes:

[0050] S41. Message Signing: Secure communication between a vehicle and surrounding group member vehicles uses an intra-domain group signature private key based on discrete logarithm zero-knowledge proof to sign messages.

[0051] S411. For the message m to be sent, calculate M = H2(m, T) i ), where T i For timestamps.

[0052] S412, Calculation Where K1 is the group signature private key δ i The M power, K2 is the generator g of the group. l The power of M.

[0053] S413, Select random number calculate A = H3(g) l ,K1,K2,a1,a2,m),S1=γ1-ε i S2 = γ2 - M, S3 = e - ε i Where A is the hash value, using the generator g l K1, K2, a1, a2, message m are generated by hash operation; S1 is the random number γ1 minus the private key ε. i S2 is a random number γ2 minus M, and S3 is a random number e minus the private key ε. i .

[0054] S414、vehicle V i to the receiving vehicle V j sending information packet: wherein m is the message to be sent; T i is the time stamp, used to prevent replay attacks; A is the signature package, used to prevent tampering attacks; K1, K2, S1, S2 are verification parameters, used to assist the message recipient to verify the signature; S3 is an auxiliary verification parameter, used to verify whether the sender is trustworthy.

[0055] S42, the legality of the message authentication is mainly from the prevention of replay attacks, data integrity, sender identity legitimacy, group signature private key trustworthiness and other aspects:

[0056] S421, the receiving vehicle V j After receiving the message packet, first check the time stamp T i to prevent replay attacks.

[0057] S422, data integrity verification. Calculate M' = H2(m, T i ), verify whether the equation is equal to K2, if not, it means that the message has been tampered with, discard the packet; Otherwise, the data integrity of the message packet is verified, and the next step is turned.

[0058] S423, the identity legitimacy verification of the sending vehicle. The receiving vehicle uses the RSU public key P R decryption field to obtain the generation time and Calculate Judge S whether it is equal to The process is as follows:

[0059]

[0060] From the above derivation, the sending vehicle calculates S based on the method of discrete logarithm zero-knowledge proof, and the auxiliary parameters K1, K2, S3, and the auxiliary parameters S3 = e-ε i , will not leak any information of the sending vehicle. When the value of S is equal to the verification tuple , since any entity cannot match the verification tuple of others using its own group signature private key in the domain, it means that the sending vehicle correctly possesses the private key δ i and e, and the identity legitimacy verification of the message packet is passed, otherwise the message packet is discarded.

[0061] S424, the receiving vehicle V jJudging the state of the sender's intra-domain group signature private key pair, the method is: first, obtaining the generation time of the sender's intra-domain group signature private key pair signed by the RSU from the verification tuple After the inspection, further check the intra-domain revocation list, verify whether the state of the sender's intra-domain group signature private key pair is revoked, if it has been revoked, it means that the sender's group signature private key pair belongs to an untrusted state, discard the message. Otherwise, go to the next step.

[0062] S425, sending vehicle intra-domain group signature private key legality verification. For receiving vehicle V j Calculate And judge whether A' is equal to A, A = H3(g l , K1, K2, a1, a2, m) The specific verification process is as follows:

[0063] Because Then it can be deduced as follows:

[0064]

[0065]

[0066] According to the above deduction, if Then A' = A; The reason is: based on the discrete logarithm zero-knowledge proof, the auxiliary parameters sent by the sending vehicle to the receiving vehicle do not leak any information of the sending vehicle, but prove to the receiving vehicle that it has a legal intra-domain group signature private key pair GK j = {δ i , ε i}; Therefore, any entity must have a legal intra-domain group signature private key pair before it can communicate with other members in the group, when A' = A, it proves that the sending vehicle has a legal intra-domain group signature private key pair, the message is valid, otherwise discard the message.

[0067] Further, the S5 step includes:

[0068] S51, if the sending vehicle V i Sends a malicious false message to the receiving vehicle V j Vehicle V j Turns this message to the RSU, and the RSU calculates M = H2(m, T i ), Get the intra-domain group signature private key pair, retrieve the mapping relationship table, and obtain the local pseudo-identity F i Of vehicle V i And the verification tuple

[0069] S52, the RSU will ​Broadcast to the domain, all vehicles get the verification tuple stored in the domain revocation list, in order to maintain the brevity of the revocation list, the vehicle will clear the revocation list after entering the new RSU area.

[0070] S53, the RSU will update the local pseudo identity F i Report to TA, TA through calculation Get the global pseudo identity Q of the vehicle i , the process is as follows:

[0071]

[0072]

[0073]

[0074] Q i = Q i

[0075] S54, TA tracks the real identity ID of the vehicle through the trusted identity mapping table i , and deletes the tuple where the real identity ID i is located, updates the trusted identity mapping table, and completes the tracking and revocation of the malicious vehicle.

[0076] The symbols and meanings involved in the application are shown in the following table:

[0077] Symbol and meaning

[0078]

[0079]

[0080] Compared with the prior art, the application has the following beneficial effects:

[0081] (1) The mixed anonymous efficient message authentication method based on zero-knowledge proof, the method of combining global pseudo identity and local pseudo identity is designed, in the method, the global pseudo identity is used for communication between network entities, the local pseudo identity is used for communication in the RSU domain, and the local pseudo identity of the vehicle is updated every time a new RSU is passed; thereby stronger privacy protection of the vehicle is realized, and attacks such as trajectory analysis are effectively prevented.

[0082] (2) The mixed anonymous efficient message authentication method based on zero-knowledge proof, a verification tuple of a group signature private key pair in a domain is designed, in the verification tuple, the validity period of the group signature private key pair in the domain and verification parameters are contained, each message receiver can use the verification tuple to judge whether the group signature private key of the message sender in the domain is expired to judge whether the message sender is legal; therefore, the joining and exiting of the group members do not need to update the group private key of the existing group members, and the problem of difficult key update calculation of the group signature is solved.

[0083] (3) The mixed anonymous efficient message authentication method based on zero-knowledge proof, a message signature and authentication algorithm based on zero-knowledge proof of discrete logarithm is designed, the double linear mapping method used in the traditional group signature algorithm is avoided, only the hash function and pre-computed modular exponentiation operation are used for operation, the safe message authentication of V2V can be completed, the time cost required by the group members in the domain for communication is greatly reduced, and the low time delay and high efficiency requirement of communication in the vehicle networking environment is met. BRIEF DESCRIPTION OF DRAWINGS

[0084] The accompanying drawings are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the application, and do not limit the application.

[0085] Figure 1 A high-efficiency message authentication method based on zero-knowledge proof in a vehicle networking environment provided by the application is shown in the whole flow chart.

[0086] Figure 2 The vehicle networking architecture in the application is shown in the schematic diagram.

[0087] Figure 3 The framework of the high-efficiency message authentication method based on zero-knowledge proof in a vehicle networking environment provided by the application is shown in the schematic diagram.

[0088] Figure 4 The entity registration process in the application is shown in the schematic diagram.

[0089] Figure 5 The online initialization process in the application is shown in the schematic diagram.

[0090] Figure 6 The total calculation cost analysis comparison chart of the V2I identity authentication stage in the application is shown in the schematic diagram.

[0091] Figure 7 The calculation cost analysis comparison chart of the V2V message authentication stage in the application is shown in the schematic diagram. DETAILED DESCRIPTION

[0092] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in combination with the drawings and examples. Of course, the specific examples described herein are only used to explain the present application and not to limit the present application.

[0093] Embodiments

[0094] The present embodiment provides an efficient message authentication method based on zero-knowledge proof in a vehicle networking environment, as shown in Figure 1 , which comprises the following steps:

[0095] S1, the trusted authentication center TA generates a series of public parameters and publishes them;

[0096] S2, the TA initializes and registers the entity vehicles and RSUs entering the network;

[0097] S3, the RSU and the access vehicle perform bidirectional identity authentication;

[0098] S4, the vehicle and the surrounding group member vehicles perform secure communication;

[0099] S5, tracking and revocation of malicious entities.

[0100] As shown in Figure 2 , the vehicle networking architecture in the hybrid anonymous efficient message authentication method based on zero-knowledge proof comprises:

[0101] 1) On board unit (OBU): the on board unit of the vehicle has certain computing and storage capabilities. As a communication entity with mobile properties, it perceives underlying data through various types of intelligent sensors deployed, and communicates with other OBUs, RSUs using wireless communication devices.

[0102] 2) Road side unit (RSU): the road side unit is usually fixed on both sides of the road and at crossroads, and has stronger computing and storage capabilities than the on board unit, providing services for the on board unit to access the network.

[0103] 3) Trusted authority center (TA): the trusted authority center is an authoritative institution, usually undertaken by the traffic management bureau of the region, and its key distribution mechanism is mainly used to publish system security parameters, providing registration and authentication services for system nodes.

[0104] As shown in Figure 3 , the technical solution framework diagram of the message authentication method based on local area pseudo identity and group signature hybridization is divided into three levels, the bottom layer is the network composed of vehicle on board units OBUS, the middle layer is the road side infrastructure RSUS access network, and the top layer is the trusted authentication center TA.

[0105] 1) Trusted Authentication Center TA is the highest authority of the whole system, which is built and managed by the trusted national traffic management department and is considered completely trusted. In this embodiment, TA is responsible for the network registration and revocation of all entities such as RSU vehicles and public key certificate management. TA generates a global pseudo-identity and a partial private key for the vehicle, and assists the vehicle in bidirectional authentication with RSU. TA can restore the local pseudo-identity of the vehicle, reveal or revoke the real identity information of the global pseudo-identity, and also can revoke the RSU that is maliciously attacked from the list of RSUs trusted by the roadside infrastructure.

[0106] 2) Roadside infrastructure RSU is responsible for managing the base station of the roadside specific area. RSU is responsible for identity authentication of vehicles entering its own area, assigns the corresponding intra-domain group signature key to the vehicle that passes the authentication, and assists TA in tracing the real identity of the vehicle in special cases. Since RSU is generally deployed on the roadside and has the possibility of being invaded and untrusted, it is a semi-trusted entity.

[0107] 3) Each vehicle is equipped with an on-board unit OBU module, which has certain computing, storage and communication functions. In this embodiment, the vehicle calculates its own private key in combination with the partial private key of TA and generates a local pseudo-identity when entering each RSU to complete bidirectional identity authentication with RSU. After bidirectional authentication, the intra-domain group signature key assigned by RSU is used to sign messages when communicating with other vehicles.

[0108] S1 includes the following steps:

[0109] S11, TA selects a non-singular elliptic curve: E p (a, b): y 2 = x 3 + ax + b mod p (p is a large prime number, a, b ∈ F p ) and selects a point P on E p (a, b) as the generator of group G, and the order of G is q (G contains an infinite point Q).

[0110] S12, TA randomly selects as the master key of the system, and calculates the system public key P TA = sP.

[0111] S13, TA selects four anti-collision one-way hash functions:

[0112] S14, TA publishes system parameters Params = {E p (a, b), p, q, G, P, P TA{H0, H1, H2, H3}, and a master key s is reserved.

[0113] As shown in FIG. 2, the specific content of S2 includes the following steps: Figure 4

[0114] S21, vehicle registration. A network entity vehicle V i is initialized and registered by a TA. The vehicle V i sends its real identity related information to the TA. The TA calculates a global pseudo identity for the vehicle and generates a partial key, and stores it in the trusted identity mapping table as shown in the following table:

[0115]

[0116] The vehicle generates another partial private key and a public key of its own:

[0117] S211, the vehicle submits basic information (license plate number, vehicle owner identity information, etc.) and real identity ID to the TA i for registration.

[0118] S212, the TA calculates and generates a global pseudo identity Q i for the vehicle V i to ensure the privacy of the real identity ID i for communication between network entities, where: Q i = tH0(ID i , TS i ) mod q, a random number TS i is the registration time of the vehicle. At the same time, the TA generates a trusted identity mapping record for this vehicle and records it in the trusted identity mapping table to realize malicious vehicle real identity information tracking and revocation operation.

[0119] S213, the TA calculates and generates a partial key Y i for the vehicle using its master key s and the global pseudo identity Q i of the vehicle, and the calculation method is: Y i = sQ i mod q

[0120] S214, the vehicle V i stores the global pseudo identity Q i and the partial key Y i generated by registration in a tamper-proof device.

[0121] S215, the vehicle V i randomly selects a private value as a partial private key, and the private key pair S V = {α i , Y i ​}, calculate and generate public key P V =α i P and published.

[0122] S22, RSU Registration. The RSU is initialized and registered via the TA. The TA generates public and private keys for the RSU, issues certificates, and initializes the intra-domain group signature parameters.

[0123] S221. The vehicle management office shall purchase and initialize RSU equipment. RSU selects a random number. As its private key S R Calculate and generate the RSU public key P R TA uses RSU identity information RID i Public key P R The certificate Cert is generated for the RSU using information such as timestamps. R .

[0124] S222, TA initializes the intra-domain group signature parameter {G} for this RSU. l ,g l ,N,P,Q}. Where G l For a cyclic group, g l Let |G be a generator of this group. l |=P×Q=N, where P and Q are two large prime numbers, and |P|=|Q|=k.

[0125] like Figure 5 S3 specifically includes the following steps:

[0126] S31, RSU Identity Authentication. The RSU broadcasts its own certificates and signatures within the region: Where T i For timestamps. Vehicle V i After receiving the broadcast packet, use TA's public key P TA Cert Public Key Certificate Verification R The validity of the certificate is verified to complete the authentication of the RSU and obtain the public key P of this RSU from the certificate. R and RID value.

[0127] S32, Vehicle V i Identity verification. The RSU, with the assistance of the TA, completes the verification of the incoming vehicle's identity. i Authentication:

[0128] S321, Vehicle V i After entering the RSU's area and completing RSU authentication, select a random number. Generate temporary local pseudo-identities in RID iFor vehicle V i The ID value of the RSU is used to restrict the scope of use of the local pseudo-identity.

[0129] S322, Vehicle V i Send a verification request message to TA The message uses the TA public key P TA Encryption is used to prevent tampering and impersonation attacks. The message contains the current RSU's ID value, RID. i and public key P V Vehicle Local Area Fake Identity F i Timestamp T i Fields such as: σ i =α i Q i +Y i F i .

[0130] S323. After using the private key s to decrypt the verification request message, TA verifies the legitimacy of the vehicle's identity in two steps:

[0131] S3231. Check the legality of the vehicle registration, specifically: verify the timestamp T. i After excluding replay attacks, calculate Z. i =P V Q i +P TA Q i F i Check Z i =σ i Does P hold true? Because P... V =α i P, therefore α i Q i P = P V Q i ; Due to Y i =sQ i TA's public key P TA =sP, therefore Y i F i P = sQ i F i P = P TA Q i F i Therefore (α) i Q i +Y i F i P = α i Q i P+Y i F i P = P V Q i +P TAQ i F i =Z i Therefore, from the above derivation, we can see that when Z i equal to σ i When P is reached, a portion of the vehicle's private key Y can be determined. i It is calculated by the TA after the vehicle has been legally verified by the TA, using the TA's own private key s, thus proving that the vehicle is a legally registered vehicle.

[0132] S3232. Check whether the vehicle's legal status has been revoked, specifically: using vehicle V i Global Fake Identity Q i Search the trusted identity mapping table. If it exists, it means that the vehicle identity has not been revoked, and the verification is successful.

[0133] S324, TA sends a vehicle identification confirmation message to RSU. The message uses the RSU public key P R Encryption, where: F i For vehicle V i Local pseudo-identity, P V For vehicle V i public key, T i For timestamps.

[0134] S325, RSU uses private key S R Decrypt the vehicle identification message to obtain the vehicle's V. i Local pseudo-identity F i and public key P V and using TA's public key P TA The signature is verified to prevent tampering attacks. Once verification is successful, the RSU and vehicle V... i Complete two-way identity authentication.

[0135] S33, RSU refers to vehicle V i Generate and distribute group signature private key pairs within the domain and store the mapping records in the member mapping table:

[0136] S331. After two-way identity authentication is completed, the RSU will register the vehicle's V. i Distribute in-domain group signature private key pair GK j ={δ i ,ε i}, δ i , ε i All are generators of the domain-specific group signature parameter group, where Meanwhile, RSU is GK j Generate verification tuples This is used by the receiver to determine whether the private key pair for the group signature within the sender's domain is trustworthy and has expired. Among them, Generation time of group signature private key pair, Group signature private key δ i e times, random number

[0137] S332, RSU generates the local pseudo identity F i of the vehicle V i , the domain signature private key δ i and the verification tuple Generates a member mapping record and stores it in the member mapping table as shown in the following table:

[0138]

[0139] This table is used to track the local pseudo identity of the vehicle and the broadcast verification tuple when malicious events occur.

[0140] S333, RSU encrypts and sends i the public key P V of the vehicle V Where GK j is the domain group signature private key pair; T i is the timestamp, which is used to prevent replay attacks; e is used to prevent forgery attacks and assist in time verification of the message receiver, is the signature of the RSU on the group signature private key pair GK j and the timestamp T i , which is used to prevent tampering attacks.

[0141] The specific content of step S4 includes the following steps:

[0142] S41, message signature, the secure communication between the vehicle and the surrounding group member vehicles uses the domain group signature private key pair based on discrete logarithm zero-knowledge proof to sign the message:

[0143] S411, for the message m to be sent, calculate M = H2(m, T i ), where T i is the timestamp.

[0144] S412, calculate Where K1 is M times of the group signature private key δ i , and K2 is M times of the generator g l of the group.

[0145] S413, select a random number Calculate A = H3(g l , K1, K2, a1, a2, m), S1 = γ1-ε i , S2 = γ2-M, S3 = e-ε iWherein, A is a hash value, using the generator g l , K1, K2, a1, a2, message m hash operation generation; S1 is a random number γ1 minus the private key ε i , S2 is a random number γ2 minus M, S3 is a random number e minus the private key ε i .

[0146] S414, vehicle V i To receive vehicle V j Send information packet: Wherein, m is the message to be sent; T i is the time stamp, used to prevent replay attacks; A is the signature package, used to prevent tampering attacks; K1, K2, S1, S2 are verification parameters, used to assist the message recipient to verify the signature; S3 is an auxiliary verification parameter, used to verify whether the sender is trusted.

[0147] S42, the legitimacy of the message authentication is mainly from the prevention of replay attacks, data integrity, sender identity legitimacy, group signature private key trustworthiness and so on:

[0148] S421, receiving vehicle V j After receiving the message packet, first check the time stamp T i To prevent replay attacks.

[0149] S422, data integrity verification, M' = H2(m, T i ) is calculated, and whether the equation Is equal to K2, if not, it means that the message has been tampered with, discard the packet; Otherwise, the data integrity of the message packet is verified, and the next step is turned.

[0150] S423, the identity of the sending vehicle verification, the receiving vehicle uses the RSU public key P R Decryption Field, get the generation time And Calculate Judge S whether equal to The process is as follows:

[0151]

[0152] From the above derivation, the sending vehicle based on the discrete logarithm zero-knowledge proof method, through the auxiliary parameters K1, K2, S3 to calculate S, and the auxiliary parameters S3 = e-ε i , will not leak any information of the sending vehicle; When the value of S is equal to the verification tuple At this time, since any entity cannot match the verification tuple with his own domain group signature private key pair, it is proved that the sending vehicle correctly possesses the private key δ i If yes, the identity of the message packet is verified, otherwise, the message packet is discarded.

[0153] S424, receiving vehicle V j The state of the sending domain group signature private key pair is judged by the following method: first, the generation time of the sending domain group signature private key pair signed by the RSU is obtained from the verification tuple After the verification, the domain revocation list is further checked to verify whether the state of the sending domain group signature private key pair is revoked. If it is revoked, it is proved that the sending group signature private key pair belongs to an untrusted state, and the packet is discarded. Otherwise, the next step is entered.

[0154] S425, sending vehicle domain group signature private key legality verification. The sending vehicle V j Calculation And judge whether A' is equal to A, A = H3(g l , K1, K2, a1, a2, m), and the specific verification process is as follows:

[0155] Because Then it can be deduced as follows:

[0156]

[0157]

[0158]

[0159] According to the above deduction, if Then A' = A; the reason is that based on the discrete logarithm zero-knowledge proof, the auxiliary parameters provided by the sending vehicle to the receiving vehicle do not leak any information of the sending vehicle, but prove to the receiving vehicle that it possesses a legal domain group signature private key pair GK j = {δ i , ε i}; Therefore, any entity must possess a legal domain group signature private key pair before it can communicate with other members in the group. When A' = A, it is proved that the sending vehicle possesses a legal domain group signature private key pair, and the message is valid, otherwise, the message is discarded.

[0160] The specific content of step S5 includes the following steps:

[0161] S51, if the sending vehicle V i sends a malicious false message to the receiving vehicle V j during communication vehicle V jThis message is forwarded to the RSU, which calculates M = H2(m,T) i ), Obtain the private key pair for the group signature within the domain, retrieve the mapping table, and obtain the vehicle V. i Local pseudo-identity F i With verification tuples

[0162] S52, RSU will The message is broadcast to the domain, and all vehicles obtain the verification tuple and store it in the domain's revocation list. To maintain the brevity of the revocation list, it will be cleared when a vehicle enters a new RSU area.

[0163] S53, RSU will use partial pseudo-identity F i Reported to TA, TA calculates... Obtain the vehicle's global pseudo-identity Q i The process is as follows:

[0164]

[0165]

[0166]

[0167] Q i =Q i

[0168] S54, TA tracks the vehicle's real identity ID through a trusted identity mapping table. i and will real identity ID i The tuple is deleted, the trusted identity mapping table is updated, and the tracking and revocation of malicious vehicles are completed.

[0169] To verify the feasibility of this embodiment, the correctness of the present invention and the feasibility of the method are analyzed.

[0170] 1. Security Analysis

[0171] 1) Vehicle identity anonymity

[0172] In a connected vehicle environment, vehicles use pseudonyms to communicate with other entities, ensuring the anonymity of the vehicle's identity and the untraceability of its location. In this embodiment, only the TA (Transporter) can reconstruct the vehicle's true identity through a trusted identity mapping table; other network entities can only communicate with the vehicle using its pseudonym. During the two-way authentication phase with the RSU (Real-State Unit), the vehicle uses a global pseudonym Q. i =tH0(ID) i ,TS i )modq communicates with TA using a local pseudo-identity. Communicating with entities within the RSU domain, where, Because only TA and vehicle V i Holding the vehicle's real identity information ID generated during vehicle registration i Based on the collision-resistant properties of secure hash functions, attackers cannot exploit this global pseudo-identity Q. i To restore the real identity information ID i The purpose. If the attacker wants to obtain a fake identity from the local area... i Obtain the vehicle's full-domain pseudo identity Q i Then it is necessary to calculate Since s is TA's private key, and due to the elliptic curve hardness problem, no entity can compute s. Therefore, this embodiment provides anonymity protection for the vehicle against other entities.

[0173] 2) Vehicle identity authentication security

[0174] During the two-way authentication process between the RSU and the vehicle, the vehicle authenticates its identity with the RSU using the certificate in the RSU broadcast packet. The RSU authenticates the vehicle's identity with the assistance of the TA. If an attacker wants to impersonate a trusted vehicle to enter the RSU area, they need to forge a trusted global pseudo-identity Q. i With the corresponding private key pair S V ={α i ,Y i}, where Y i =sQ i modq. Without TA's private key s, due to the elliptic curve hardness problem, no entity can compute s, thus failing to successfully forge a trusted global pseudo-identity Q. i The corresponding private key Y i This allows for verification via TA (Technical Expert Provider). Therefore, this embodiment ensures the reliability of vehicle identity authentication.

[0175] 3) Message authentication security

[0176] During the message authentication phase between vehicles, if an attacker wants to impersonate a group member and generate a valid message signature, they need to obtain a valid intra-domain group signature private key pair (GK). j ={δ i ,ε i There are two ways to obtain this information: one is through the encrypted message transmitted to the vehicle via the RSU after V2I authentication. To obtain and crack this ciphertext, one needs to possess the private key pair of the legitimate vehicle. V However, due to the elliptic curve puzzle, it is impossible for an attacker to obtain the private key pair S of the legitimate vehicle through the ciphertext. V Another method is through the V2V message signature stage, using the signature... However, based on the discrete logarithm problem, under the current computing conditions, the attacker cannot obtain the legitimate intra-domain group signature private key pair GK j i , ε i Therefore, the embodiment realizes message authentication security.

[0177] 4) Revocation security

[0178] Even if the trusted identity is difficult to forge, the attacker still has other ways to attack the device. If the trusted vehicle sends a false or malicious message within the RSU area, the TA should remove the vehicle identity from the trusted identity mapping table. The process is as follows: the message receiver V i ' reports this message to the RSU, which calculates M = H2(m, T i ), obtains the intra-domain group signature private key pair, and obtains the local pseudo identity F i of the vehicle V i and the verification tuple First, broadcast to the domain, and the domain vehicles store the verification tuple to the intra-domain revocation list, and then report the local pseudo identity to the TA. The TA obtains the global pseudo identity Q i of the vehicle by calculating , traces its real identity through the trusted identity mapping table, and deletes the real identity ID i from the tuple and updates the trusted identity mapping table. Before the current intra-domain group signature private key pair expires, the malicious vehicle cannot continue communication through the receiver's verification because the verification tuple of the malicious vehicle exists in the intra-domain revocation list of each vehicle in the domain. The malicious vehicle applies for a group key to the current RSU through the TA after entering the next RSU area or the current intra-domain group signature private key expires. Since the tuple of the vehicle's real identity ID i has been deleted from the trusted identity mapping table, it cannot pass the global pseudo identity authentication link of the TA. Therefore, once revoked, the malicious vehicle cannot successfully pass the identity authentication of the TA to obtain a legitimate intra-domain group signature private key and communicate with other vehicles, so the embodiment realizes revocation security.

[0179] 2. Performance analysis

[0180] Since the embodiment aims to improve the efficiency of V2I identity authentication and V2V message authentication in the Internet of Vehicles environment by utilizing elliptic curve-based cryptographic calculations and pre-computed modular exponentiation calculations, the performance of the V2I identity authentication and V2V message authentication of the embodiment will be analyzed respectively.

[0181] ​For the performance analysis of the protocol, first use the multi-precision integer and rational number algorithm C / C++ library (MIRACL) to experimentally evaluate the computational time overhead of the main cryptographic algorithms used in the protocol. In the experimental environment of hardware platform Intel i7-7500U CPU, 2.7Ghz frequency, 8G RAM memory, Linux Ubuntu-18.10-desktop-amd64, 1000 operations are performed for each cryptographic operation, and the average value is taken as the final result. The experimental results are shown in the following table:

[0182]

[0183] It should be noted that the computational overhead of the modular exponentiation in the table is the time required for the vehicle to perform modular exponentiation after pre-computation. In the Internet of Vehicles environment, vehicles need to send and receive a large number of messages during communication. The message signature and verification in this embodiment use a lot of modular exponentiation, so the pre-computation method is adopted.

[0184] First, the modular exponentiation is converted into the product of multiple modular multiplication operations, and the pre-computation result is stored in a query table. In this way, the modular exponentiation can be converted into modular multiplication and table query operations, which can greatly reduce the time overhead caused by modular exponentiation, and the cost is that the vehicle needs 512M of storage space to store the query table.

[0185] The performance of this embodiment is analyzed and compared with the HDMA scheme proposed by Peng W et al. in the literature "HDMA: Hybrid D2D Message Authentication Scheme for 5G-Enabled VANETs", the TAAP scheme proposed by SHAO J et al. in the literature "A threshold anonymous authentication protocol for VANETs", the EABAS scheme proposed by JIANG S et al. in the literature "An efficient anonymous batch authentication scheme based on HMAC for VANETs", and the EPAS scheme proposed by SUN Y et al. in the literature "An efficient pseudonymous authentication scheme with strong privacy preservation for vehicular communications". The main consideration is the V2I identity authentication stage and the V2V message authentication two communication scenarios, which are as follows:

[0186] 1) Computational overhead of the V2I authentication phase

[0187] The computational overhead of the V2I identity authentication phase is mainly due to the TA (Task Agent) assisting the RSU (Responsible Unit) in authenticating all newly arriving vehicles. The authentication time overhead of the collaboration between the vehicle, TA, and RSU is the main component of identity authentication and a key factor determining efficiency. Therefore, considering the required computational overhead of the operations of the vehicle, TA, and RSU constitutes the computational overhead of the identity authentication phase in this embodiment. This embodiment primarily calculates the time required to complete a single identity authentication. The computational overhead of this embodiment compared to other schemes is shown in the table below:

[0188]

[0189] The percentage reduction in computational cost in this embodiment compared to other solutions is calculated as follows:

[0190] The percentage reduction compared to the TAAP solution in this embodiment:

[0191] The percentage reduction compared to the EABAS scheme in this embodiment:

[0192] The percentage reduction compared to the EPAS scheme in this embodiment:

[0193] The percentage reduction compared to the HDMA scheme in this embodiment:

[0194] This embodiment uses elliptic curve computing to implement V2I authentication, which has a significant advantage in computational overhead compared to the bilinear mapping-based schemes used in TAAP, EABAS, and EPAS. Furthermore, under the same security conditions, elliptic curve computing requires shorter keys and less computation than RSA-based schemes, thus offering advantages over the RSA-based schemes used in HDMA. Moreover, compared to HDMA, this embodiment uses TA-assisted authentication to complete mutual authentication between the vehicle and the semi-trusted RSU, providing strong security and privacy while reducing the burden of trust list management for RSUs and OBUs.

[0195] Depend on Figure 6 As can be seen, the computational overhead of this embodiment has a significant advantage over the TAAP, EABAS, and EPAS schemes as the number of authentication attempts increases. It also has certain advantages over the HDMA scheme.

[0196] 2) Computational overhead of the V2V message authentication phase

[0197] The computation overhead in the V2V message authentication phase is mainly caused by the sending vehicle V i The overhead of generating the message packet after the computation of the message to be sent m, and the receiving vehicle V j The verification overhead of the message packet.

[0198] This embodiment mainly calculates the time required for completing a single message authentication. The computation overhead of this embodiment and the comparative scheme is shown in the following table:

[0199]

[0200] The percentage of reduction of the computation overhead of this embodiment relative to other schemes is respectively:

[0201] The percentage of reduction of this embodiment relative to TAAP:

[0202] The percentage of reduction of this embodiment relative to EABAS:

[0203] The percentage of reduction of this embodiment relative to EPAS:

[0204] The percentage of reduction of this embodiment relative to HDMA:

[0205] Since this embodiment and the HDMA scheme use pre-computed based modular exponentiation to achieve V2V message authentication, compared with TAAP, EABAS, EPAS and other schemes which use bilinear mapping operation, the computation overhead is greatly reduced. Although the computation overhead of this embodiment is only slightly reduced compared with the HDMA scheme, the security of this embodiment is improved compared with the HDMA scheme. This embodiment adds a verification tuple of the validity period of the group signature private key pair in the message, and the receiver can obtain the validity and legality of the group signature private key pair of the other party in real time by verifying the verification tuple in the message. Then, the RSU can broadcast the verification tuple of the malicious vehicle, and the expired vehicle needs to actively perform identity verification to obtain the legal group signature private key pair distributed by the RSU. The HDMA scheme is designed as follows: the TA generates new group signature local parameters for the RSU every fixed time, the RSU performs re-identity authentication on all vehicles in the domain and then generates and distributes new group signature private key pairs, and the revoked malicious vehicle can still communicate normally when the validity period of the group signature private key pair of the malicious vehicle has not expired, and the malicious vehicle cannot be timely expelled. Therefore, compared with the HDMA scheme, this embodiment has higher security and smaller overall time overhead.

[0206] By Figure 7It can be seen that, with the increasing number of identity authentication, compared with TAAP, EABAS and EPAS schemes, the embodiment has obvious calculation advantage. Compared with the HDMA scheme, the embodiment has certain calculation advantage while improving security.

[0207] The above merely describes the preferred embodiments of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An efficient message authentication method based on zero-knowledge proof in a vehicle-to-everything environment, characterized in that, It comprises the following steps: S1, the trusted authentication center TA initializes system parameters, and generates the public key and the private key of the TA by using an elliptic curve algorithm, and publishes the public key and the system parameters; S2, the TA verifies the basic information submitted by the vehicle, generates a global pseudo identity and a partial private key for the vehicle, and stores the real identity and the global pseudo identity in the trusted identity mapping table, and the vehicle generates another partial private key and a public key for itself, generates a public key and a private key for the RSU, issues a certificate, and initializes the group signature parameters in the domain; S3, the vehicle generates a local pseudo identity when entering a new RSU domain, and completes the two-way identity authentication with the RSU with the assistance of the TA, and the RSU generates a legal group signature private key pair for the vehicle; S4, the vehicle and the surrounding group member vehicles sign and authenticate the messages by using the group signature private key pair in the domain and by using the method based on the discrete logarithm zero-knowledge proof, and realize efficient and secure communication; S5, the receiving vehicle transfers the malicious false message to the RSU, the RSU calculates and retrieves the mapping relationship table to obtain the local pseudo identity and the verification tuple of the malicious vehicle, and broadcasts the verification tuple in the domain; the RSU reports the local pseudo identity to the TA, the TA calculates the global pseudo identity and traces the real identity of the vehicle through the trusted identity mapping table, and deletes the tuple.

2. The method of claim 1, wherein, The S1 step comprises the following steps: S11, TA selects a non-singular elliptic curve: E p (a, b): y 2 = x 3 + ax + b mod p, p is a large prime number, a, b ∈ F p , and selects a point P on E p (a, b) as the generator of the group G, and let the order of G be q, and G contains the point at infinity Q; S12, TA randomly selects As the master key of the system, the system public key P is calculated TA = sP; S13, TA selects 4 anti-collision one-way hash functions: S14, the TA issues system parameters Params = {E p (a, b), p, q, G, P, P TA , H0, H1, H2, H3}, and retains the master key s.

3. The method of claim 1, wherein, The S2 step comprises the following steps: S21, vehicle registration, network entity vehicle V i Initialization registration by TA; vehicle V i Send its own real identity related information to TA, and TA generates a part of the key for vehicle V i Calculate the global pseudo-identity and generate a part of the key, and store it in the trusted identity mapping table, and the vehicle generates another part of the private key and the public key S22, RSU registration, the RSU is initialized and registered by the TA, and the TA generates a public key and a private key for the RSU, issues a certificate, and initializes the group signature parameters in the domain.

4. The method of claim 3, wherein, In the step S21, the vehicle registration process comprises the following steps: S211, the vehicle submits basic information and real identity ID to the TA i registration is completed; S212, TA is to ensure the vehicle V i Real identity ID i Privacy, generate a global pseudo identity Q for it i For communication between network entities, where: Q i = tH0(ID i , TS i ) mod q, random number TS i Vehicle registration time; TA generates a trusted identity mapping record for this vehicle, and records it in the trusted identity mapping table to realize malicious vehicle real identity information tracking and revocation operation; S213, TA uses its own master key s and the vehicle's global pseudo-identity Q i Compute partial key Y for the vehicle i The computation method is: Y i = sQ i mod q; S214, vehicle V i The registration generates a global pseudonym Q i and a partial key Y i is stored in an unforgeable device; S215、 vehicle V i randomly selected private value as part of the private key, the private key pair S V = {α i , Y i}, the public key P V = α i P is computed and published.

5. The method of claim 3, wherein, In the step S22, the RSU registration process comprises the following steps: S221, the vehicle department purchases RSU equipment and initializes it, and the RSU selects a random number As its private key S R , calculate the RSU public key P R = β j P; TA utilizes RSU identity information RID i , public key P R and timestamp information to generate a certificate Cert for the RSU R ; S222, the TA initializes the intra-domain group signature parameters {G l ,g l ,N, P, Q} for the RSU, wherein G l is a cyclic group, g l is a generator of the group, |G l | = P x Q = N, P and Q are two large prime numbers, and |P| = |Q| = k.

6. The method of claim 1, wherein, The S3 step comprises the following steps: S31, RSU identity authentication, the RSU broadcasts its own certificate and signature in the area: Where T i is a time stamp, the vehicle V i receives the broadcast packet, and uses the TA public key P TA to verify the validity of the public key certificate Cert R , complete the identity authentication of the RSU, and obtain the public key P R and the RID value of the RSU from the certificate; S32, vehicle V i Identity authentication, the RSU completes the identity authentication of the incoming vehicle V with the assistance of the TA i ; S33, the RSU generates a group signature private key pair for the vehicle V i Generate and distribute the intra-domain group signature private key pair and record the mapping in the member mapping table.

7. The method of claim 6, wherein, In the step S32, the RSU authenticates the identity of the incoming vehicle V i includes the following steps: S321、vehicle V i drives into the area where the RSU is located and completes authentication to the RSU, selects a random number generates a temporary local pseudo-identity wherein F1 i = χP, RID i is an ID value of the RSU where the vehicle V i is located, used to limit the use range of the local pseudo-identity; S322、 vehicle V i Sending a verification request message to TA The message contains the TA public key P TA Encryption, prevent tampering attacks and impersonation attacks, the message contains the current RSU ID value RID i And the public key P V , vehicle local area pseudo identity F i , timestamp T i Field, wherein; σ i = a i Q i + Y i F i ; S323, after the TA decrypts the verification request message by using the private key s, the legality of the vehicle identity is verified in two steps S3231 and S3232: S3231, first check the registration legality of the vehicle, specifically: in the verification timestamp T i After excluding the replay attack, calculate Z i = P V Q i + P TA Q i F i , check whether Z i = σ i P is true: Since P V = α i P, α i = Q i P = P V Q i ; Since Y i = sQ i , the public key P TA of TA, so Y i F i P = sQ i F i P = P TA Q i F i ; (α i Q i +Y i F i )P = α i Q i P + Y i F i P = P V Q i + P TA Q i F i = Z i ; From the above derivation, when Z i is equal to σ i P, it is known that the partial private key Y i of the vehicle is calculated by the TA in combination with its own private key s, thereby indicating that the vehicle is a legally registered vehicle. S3232, check if the legal identity of the vehicle is revoked, specifically: use the vehicle V i global pseudo identity Q i retrieve the trusted identity mapping table, if it exists, it indicates that the vehicle identity has not been revoked, and the verification is passed; S324, the TA sends a vehicle identity confirmation message to the RSU The message is encrypted with the RSU public key P R , where: F i is a local pseudo-identity of the vehicle V i , P V is a public key of the vehicle V i , T i is a time stamp; S325, RSU uses the private key S R decrypts the vehicle identity confirmation message, and obtains the vehicle V i local pseudo identity F i and the public key P V uses the public key P TA of the TA to verify the signature, prevents tampering attacks; after verification, the RSU and the vehicle V i complete the mutual identity authentication.

8. The method of claim 6, wherein, In the step S33, the RSU generates a group signature private key pair for the vehicle V i The process of generating and distributing an intra-domain group signature private key pair includes the following steps: S331. After two-way identity authentication is completed, the RSU will register the vehicle's V. i Distribute in-domain group signature private key pair GK j ={δ i ,ε i }, δ i , ε i All are generators of the domain-specific group signature parameter group, where RSU is GK j Generate verification tuples This is used by the receiver to determine whether the private key pair for the group signature within the sender's domain is trustworthy and has expired, where T Vi The generation time of the group signature private key pair. Group signature private key δ i e-th power, random number S332, the RSU stores the local pseudo identity F i of the vehicle V i , the intra-domain signature private key δ i and the verification tuple in the member mapping table, and when a malicious event occurs, the local pseudo identity of the vehicle and the broadcast verification tuple when the malicious event occurs are tracked. S333, RSU uses the public key P of the vehicle V i V encrypts and sends where GK j is a group signature private key pair in the domain; T i is a timestamp to prevent replay attacks; e is used by the message receiver to prevent forgery attacks and assist in generating a verification of the time, is a signature of the RSU on the group signature private key pair GK j and the timestamp T i to prevent tampering attacks.​ 9. The method of claim 1, wherein, The S4 step comprises the following steps: S41, message signing, the secure communication between the vehicle and the surrounding group member vehicles adopts the group signature private key pair in the domain based on the discrete logarithm zero-knowledge proof to sign the message; S42, the legality of the message is authenticated from the aspects of anti-replay attack, data integrity, sender identity legality, and group signature private key pair credibility; In the step S41, the message signing process comprises the following steps: S411, for a message m to be sent, compute M = H2(m, T i ), where T i is a timestamp; S412、calculate wherein K1 is a group signature private key δ i M times of the group generator g l M times of the group generator g S413, select a random number computing A = H3(g l , K1, K2, a1, a2, m), S1 = γ1 - ε i , S2 = γ2 - M, S3 = e - ε i where A is a hash value, generated using a generator g l , K1, K2, a1, a2, m hash operation; S1 is a random number γ1 minus the private key ε i , S2 is a random number γ2 minus M, S3 is a random number e minus the private key ε i ; S414, the vehicle V i to the receiving vehicle V j Sending information messages: wherein m is the message to be sent, T i is the timestamp; A is the signature package for preventing tampering attacks; K1, K2, S1, S2 are verification parameters for assisting the message recipient to verify the signature; S3 is the auxiliary verification parameter for verifying whether the sender is trustworthy. In the step S42, the message authentication process comprises the following steps: S421. receiving a vehicle V j Upon receipt of the message packet, the time stamp T is first checked i to prevent replay attacks; S422, data integrity verification, calculate M' = H2(m, T i ), verify the equation whether K2 is equal, if not, it means that the message is tampered with attack, discard the message; otherwise, the data integrity verification of the message is passed, the next step; S423, send vehicle identity legitimacy verification, receive vehicle using RSU public key P R decrypt field, obtain generation time with calculate determine whether S is equal to The process is as follows: From the above derivation, the sending vehicle calculates S based on the discrete logarithm zero-knowledge proof method through the auxiliary parameters K1, K2, and S3 S3=e-ε i , and the auxiliary parameters When the value of S is equal to the verification tuple , since any entity cannot match the verification tuple of others using its own domain group signature private key, it indicates that the sending vehicle correctly possesses the private key δ i and e, the identity legitimacy verification of the message packet is passed, otherwise the message packet is discarded; S424、receiving the vehicle V j The method for judging the status of the sender intra-domain group signature private key pair is as follows: first, the generation time of the sender intra-domain group signature private key pair signed by the RSU is obtained from the verification tuple After the verification, the intra-domain revocation list is further checked to verify whether the status of the sender intra-domain group signature private key pair is revoked. If the status is revoked, it indicates that the sender group signature private key pair belongs to an untrusted status, and the message is discarded. Otherwise, the next step is entered. S425, sending vehicle domain group signature private key legitimacy verification, connecting with the receiving vehicle V j Computing And determine whether A' is equal to A, A = H3(g l ,K1,K2,a1,a2,m), the specific verification process is as follows: Because then it can be derived that: According to the above derivation, if then A' = A; the reason is that based on the discrete logarithm zero-knowledge proof, the sending vehicle gives the receiving vehicle the auxiliary parameters without revealing any information of the sending vehicle, but proves to the receiving vehicle that it has a legal domain group signature private key pair GK j = {δ i , ε i}; Therefore, any entity must have a legal domain group signature private key pair before it can communicate with other members in the group, and when A ' = A, it proves that the sending vehicle has a legal domain group signature private key pair, the message is valid, otherwise the message is discarded.

10. The method of claim 1, wherein, The S5 comprises the following steps: S51, if the sending vehicle V i to the receiving vehicle V j sending malicious false messages vehicle V j to the RSU, the RSU calculates M = H2(m, T i ), a domain group signature private key pair, retrieves a mapping table, obtains a local pseudo identity F i of the vehicle V i and a verification tuple S52, RSU will The verification tuple is broadcast to the domain, and all vehicles obtain it and store it in the domain's revocation list. To maintain the brevity of the revocation list, the revocation list will be cleared when a vehicle enters a new RSU area. S53, the RSU reports the local pseudo identity F to the TA, and the TA calculates the global pseudo identity Q of the vehicle through calculation i and reports it to the RSU The RSU obtains the global pseudo identity Q of the vehicle i The process is as follows: Q i = Q i S54, TA tracks the real identity ID of the vehicle through the trusted identity mapping table i and deletes the tuple where the real identity ID i is located, updates the trusted identity mapping table, and completes the tracking and revocation of the malicious vehicle.

Images