A group key management system and method for ad hoc networks based on combined public keys

Abstract

The application relates to the technical field of self-organizing networks and discloses a self-organizing network group key management system and method based on a combined public key, which comprises a key management center and user terminals capable of communicating; the key management center stores private key matrix information, and the user terminals store public key information; the key management center is used for registering, applying, distributing and uniformly managing the keys of the user terminals, clustering the user terminals, applying group keys for each cluster and ensuring the safe communication of the user terminals in each cluster; and when a user terminal joins or leaves a cluster, the group keys are dynamically updated; the application solves the problems that the existing combined public key key management means cannot safely perform self-organizing network group key management, the authentication steps are many, the time delay is long and the like.

Description

Technical Field

[0001] This invention relates to the field of ad hoc network technology, specifically to an ad hoc network group key management system and method based on combined public keys. Background Technology

[0002] Ad hoc networks are a combination of mobile communication and computer networks. Information exchange in these networks utilizes packet switching mechanisms found in computer networks. User terminals are typically mobile, portable devices, and each user terminal in an ad hoc network functions as both a router and a host. Ad hoc networks enable the rapid assembly of a decentralized network environment, aiming for speed, accuracy, and efficiency. They seek precise and usable routing information in the shortest possible time, adapting to rapid changes in network topology while minimizing introduced latency and control information for maintaining routes. This also reduces the overhead of routing protocols to accommodate the limitations of mobile terminals and wireless sensors in terms of computing power, storage space, and power supply.

[0003] In hierarchical ad hoc networks, the network channels are open, and the communication process faces numerous security challenges such as identity spoofing and data theft. The cluster key serves as the first line of defense for secure communication within and between clusters, while the cluster key management mechanism, a key technology for ensuring the secure generation and updating of cluster keys, plays a crucial role in hierarchical ad hoc networks. Therefore, designing a secure and effective cluster key management scheme has become a critical issue that urgently needs to be addressed in hierarchical ad hoc network communication.

[0004] Traditional group key management primarily employs a certificate-based Public Key Infrastructure (PKI) authentication system. PKI provides a secure platform for network applications. Built on asymmetric algorithms, PKI ensures the security, authenticity, integrity, and non-repudiation of network communication through key management and certificate management services. The core of PKI security lies in the security of the Certificate Authority (CA), requiring the CA to maintain a high level of both network and physical security, necessitating significant financial and material investment in its construction and maintenance. Furthermore, to verify the authenticity of digital certificates online, a reliable network connection must be maintained between the terminal and the CA, placing relatively high demands on network bandwidth and making it unsuitable for wireless hierarchical ad hoc networks with limited bandwidth resources.

[0005] CPK (Combined Public Key) is a novel centralized public key management model. Its basic idea is that a management center generates multiple key factors, which, combined with the unique identifier of the user terminal, form multiple public and private key pairs. All private key factors are stored in a secure chip, while the identifier is directly sent to the user terminal by the center. The CPK algorithm constructs the user terminal's identity key based on the combined key. The construction and management of public and private keys do not require online certificate transmission to verify the authenticity of the public key, solving the complex management problems in PKI identity authentication. CPK has advantages such as ultra-large-scale key management capabilities, flexible authentication mechanisms, simple and efficient operation, and ease of integrated product design, effectively solving the problem of key scalability in key management. Current CPK group key management methods do not address the single point of failure of the management center, resulting in a lack of system reliability. Furthermore, due to dynamic network changes, when group members are offline, the entire group may be unable to calculate and update the group key in a timely manner, affecting continuous and secure data communication. Existing combined public key management methods cannot securely manage group keys in self-organizing networks.

[0006] Blockchain, as a decentralized distributed digital ledger technology, is widely used in distributed ad hoc networks to record transaction data and ensure that the data is traceable and tamper-proof. Currently, while blockchain's decentralized technology reduces the computational and communication overhead for each participant in an ad hoc network, it lacks a process for participants to autonomously update their keys. Asynchronous Ratchet Tress (ART) is a distributed protocol where multiple parties can collaboratively derive a group key. It does not require multiple group members to be online simultaneously; it is pre-deployed by an initiating member, and then the remaining group members asynchronously compute the key, achieving dynamic key updates.

[0007] The existing technology has the following problems:

[0008] 1) The certification process relying on certificate authorities involves numerous steps and extended processing times;

[0009] 2) CPK-based self-organizing network group key management has a single point of failure problem, and the offline status of user terminals has a significant impact on the group;

[0010] 3) Blockchain-based methods do not have the problem of dynamic key updates. Summary of the Invention

[0011] To overcome the shortcomings of existing technologies, this invention provides a self-organizing network group key management system and method based on combined public keys, which solves the problems of existing combined public key key management methods being unable to securely manage self-organizing network group keys, having multiple authentication steps, and extending the time required.

[0012] The technical solution adopted by the present invention to solve the above problems is:

[0013] A self-organizing network group key management system based on combined public keys includes a key management center capable of communication and user terminals. The key management center stores private key matrix information, and the user terminals store public key information. The key management center is used to: provide user terminal registration, application, distribution, and unified management of keys; cluster user terminals; apply for group keys for each cluster; ensure secure communication between user terminals in each cluster; and dynamically update the group keys when a user terminal joins or leaves a cluster.

[0014] As a preferred technical solution, the user terminal includes a cluster head user terminal and cluster member user terminals. The key management center can communicate with the cluster head user terminal, and the cluster head user terminal can communicate with the cluster member user terminals.

[0015] As a preferred technical solution, the key management center is used to: provide registration and authentication for user terminals, divide the registered user terminals into m clusters, assign a task area to each cluster, each cluster has n nodes, and each node includes 1 cluster head user terminal and n-1 cluster member user terminals; and send instructions to user terminals or receive data information collected by them.

[0016] The cluster head user terminal is used for: deploying user terminal groups, calculating group keys; and, as a blockchain consensus node in the system, maintaining the key management blockchain; wherein, the cluster head user terminal can perform inter-cluster communication;

[0017] Cluster member user terminals are used to: perform tasks and keep the blockchain up-to-date; among them, cluster member user terminals within the same cluster can communicate with each other.

[0018] A method for managing group keys in ad hoc networks based on combined public keys, employing the aforementioned ad hoc network group key management system based on combined public keys, includes the following steps:

[0019] S1, User terminal key generation: The user terminal applies for a key from the key management center, and the user terminal joins the hierarchical self-organizing network divided by the key management center to perform tasks;

[0020] S2, User terminal write: Write the user terminal to the blockchain;

[0021] S3, Group Key Generation: The group key is calculated by constructing a key tree;

[0022] S4, Group Key Update: The user terminal updates the public key list.

[0023] As a preferred technical solution, step S1 includes the following steps:

[0024] S11, the user terminal sends its own identity identifier to the key management center through a secure channel;

[0025] S12, the key management center verifies the identity identifier and checks whether the identity identifier has been registered: if it has not been registered, the identity identifier is used as the private key of each user terminal, the public key is calculated, the data item is stored locally, and the user terminal key is returned through a secure channel;

[0026] S13, the user terminal receives and saves the key:

[0027] Once each user terminal obtains a key from the key management center, each user terminal becomes an authorized node and obtains a related identity key pair. Other user terminals can retrieve its public key based on the identity identifier.

[0028] After all user terminals obtain the key, the user terminals are divided into m clusters. After the division is completed, the key management center assigns a user terminal to each cluster as the cluster head user terminal.

[0029] As a preferred technical solution, step S2 includes the following steps:

[0030] S21. After the existing user terminal keys in the system are generated, the key management center generates a corresponding list of user terminal identity public keys and a list of group public keys for each cluster, and sends a message containing these two lists to the witness node.

[0031] S22, when a witness node receives a message, it uses the public key previously issued by the key management center to verify the public key and signature in the message; if the verification fails, the message is discarded; if the verification succeeds, the message will be packaged into an initial transaction by the witness node under the consensus mechanism.

[0032] S23, after the witness node writes the user terminal into a new block, the witness broadcasts the block;

[0033] S24. When more than a set proportion of consensus nodes in the blockchain have verified this block, it indicates that the user terminal has been recorded on the blockchain.

[0034] As a preferred technical solution, step S3 includes the following steps:

[0035] S31. After a block is verified and deployed to the blockchain, the cluster head user terminal of each cluster deploys the group key, and the other cluster member user terminals will asynchronously calculate the group key. This group key is used for secure communication within this cluster.

[0036] S32, the cluster head user terminal, as the communication initiator within the group, is responsible for the construction of the ART, dynamically updates the cluster according to changes in the cluster member composition, and updates the cluster's group key based on the ART;

[0037] S33, the cluster head user terminal is responsible for building the ART, and the key of the corresponding root node is the group key; before the key tree is created, the cluster head user terminal uses the public key list received by the key management center to build the ART, and uses the identity public key list to authenticate the identity of the user terminal when each user terminal builds the ART.

[0038] S34. After the cluster head user terminal completes the key tree construction, it sends its own location index, the public key of the cluster head user terminal, the list of group public keys, and the auxiliary path public key corresponding to a certain section in the key tree to the cluster member user terminals in the group, in order to support the asynchronous calculation of the group key. After sending the key, the cluster head user terminal will clear the private keys of other cluster member user terminal nodes.

[0039] As a preferred technical solution, step S4, when a new user terminal joins the cluster, includes the following steps:

[0040] SA41, the new user terminal sends its identity identifier and the cluster identifier information it requests to join to the key management center to request registration;

[0041] SA42: After receiving the message, the key management center verifies whether the message is valid and generates a public-private key pair for the legitimate user terminal.

[0042] SA43, the key management center sends a new user terminal request to join a new cluster in the blockchain to the cluster head user terminal of the corresponding cluster. After receiving the message, the cluster head user terminal verifies whether the message is valid.

[0043] After successful verification of SA44, the cluster head user terminal broadcasts this block to the entire blockchain. When more than a set proportion of cluster head user terminals in the blockchain pass the verification of this block, the block is written into the blockchain. The cluster head user terminal and other cluster head user terminals update their public key lists based on the previously generated message information.

[0044] As a preferred technical solution, step S4 includes the following steps when the user terminal leaves a cluster:

[0045] SB41 sends a leave request to the cluster head user terminal. After receiving the message, the cluster head user terminal verifies the message's validity.

[0046] SB42, after successful verification, the cluster head user terminal broadcasts this block to the entire blockchain. When more than a set proportion of cluster head user terminals in the blockchain pass the verification of this block, the block is written into the blockchain. The cluster head user terminal and other cluster head user terminals update the public key list according to the previously generated transactions.

[0047] As a preferred technical solution, in step SB41, the cluster head user terminal verifies the validity of the received message based on the following rules:

[0048] Verify identity legitimacy: Check if the public key in the message exists in the cluster's public key list. If it does, the identity is legitimate.

[0049] as well as,

[0050] Verify identity validity: Use the user terminal's public key to verify the signature in the message. If the verification is successful, the identity is valid.

[0051] Compared with the prior art, the present invention has the following advantages:

[0052] (1) High security: In this invention, all user terminals are clustered. In the hierarchical self-organizing network, communication between user terminals within a cluster is encrypted by a group key; once a cluster member leaves, its identity is revoked, and all clusters will update the group key; when a new user terminal joins, the cluster head user terminal will update the group key to ensure dynamic security; in addition, both cluster head user terminals and cluster member user terminals need to undergo legitimate identity verification before calculating the group key to prevent spoofing attacks.

[0053] (2) High authentication efficiency: The authentication method based on digital certificates requires the digital certificate to be transmitted before each communication, which not only increases the communication content, but also increases the number of steps in the secure communication protocol. Moreover, the certificate must be verified before it is used. In contrast, secure communication based on combined public keys can directly look up the other party's public key in the public key matrix and initiate secure communication immediately. The efficiency is significantly higher than that of the digital certificate mode.

[0054] (3) Preventing single point of failure: The distributed protocol ART for group keys is introduced to pre-deploy group keys, and each group member can perform asynchronous calculations and autonomous updates of the group key; by utilizing the decentralized characteristics of blockchain technology, the problem of single point of failure is solved, and the transparency and fairness of group key management are improved. Attached Figure Description

[0055] Figure 1 This is a schematic diagram of the CPK key management system.

[0056] Figure 2 This is a schematic diagram of the composition of a self-organizing network group key management system based on combined public keys as described in this invention;

[0057] Figure 3 A diagram illustrating the generation of user terminal keys;

[0058] Figure 4 A diagram illustrating the generation of group keys;

[0059] Figure 5 A diagram illustrating the dynamic addition of key updates;

[0060] Figure 6 This is a diagram illustrating dynamic exit key updates. Detailed Implementation

[0061] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0062] Example 1

[0063] like Figures 1 to 6 As shown, this invention provides a group key management system and method based on combined public keys, aiming to solve the problem that existing combined public key management methods cannot securely manage group keys in self-organizing networks. This mainly includes issues such as single point of failure in CPK-based group key management methods, offline group members causing the entire group to be unable to compute, and timely updates of group keys. The CPK-based group key management method proposed in this invention, on the one hand, utilizes the decentralized nature of blockchain technology to solve the single point of failure problem, reducing the computational and communication overhead of each participant in the self-organizing network, while improving the transparency and fairness of group key management; on the other hand, it introduces an asynchronous ratchet tree distributed protocol for group keys, pre-deploying group keys, allowing each group member to asynchronously compute and autonomously update the group key.

[0064] This invention provides a self-organizing network group key management system and method based on combined public keys. It constructs a key management system based on a CPK (Key Management Center), including elements such as a CPK key management center, cluster head nodes, and member user terminals. In the self-organizing network, all user terminals send identity identifiers to the key management center in the CPK in batches to apply for registration. The key management center generates public and private keys for the identity and returns them to the user terminals through a secure channel. After all user terminals receive their keys, the key management center clusters all user terminals. Each cluster has a group key managed by the cluster head user terminal for secure communication within the cluster. When a user terminal joins or leaves a cluster, the group key is updated to ensure secure communication between user terminals and maintain group communication within and between groups.

[0065] CPK, as an identity-based cryptographic management method, eliminates the need for a dedicated certificate authority, avoiding the complexities of key management inherent in public key certificates. This invention fully leverages the certificate-free and localized characteristics of CPK to construct a CPK-based self-organizing network group key management system, achieving secure and efficient management of user terminal keys. Drawing inspiration from blockchain and the Group Management ART protocol, it proposes a decentralized group key management scheme for self-organizing networks.

[0066] This invention solves the following technical problems:

[0067] 1) To address the issues of lengthy and time-consuming authentication steps associated with certificate authority-based methods, a self-organizing network group key management system based on CPK is constructed.

[0068] 2) To address the single point of failure issue in CPK-based self-organizing network group key management, cluster head user terminals are treated as peer nodes in the blockchain network to jointly manage group keys, reducing the impact of user terminal offline on the group.

[0069] 3) To address the issue of the lack of dynamic key updates in blockchain-based methods, the cluster head user terminal is used as the initiator of ART to pre-deploy the group key, enabling asynchronous calculation and autonomous updates of the group key by cluster member user terminals.

[0070] More specifically, as follows:

[0071] 1. CPK Key Management System:

[0072] CPK key management system is a new centralized public key management model. The process of user terminals applying for CPK combination keys is as follows: Figure 1 As shown.

[0073] The dynamic key management system based on combined public keys consists of a CPK key management center and user terminal nodes. The CPK key management center contains a dedicated cryptographic chip for storing important information such as the private key matrix. The user terminal contains terminal identification hardware for storing the user terminal's public key information.

[0074] The dynamic key management system authentication based on combined public keys avoids the problem of CA centers by setting up dynamic public key matrices and private key matrices.

[0075] The CPK system is built upon the composite principle of ECC. CPK uses ECC as its asymmetric algorithm, rather than the algorithms commonly used in PKI systems. CPK replaces the function of a central CA by constructing a key matrix consisting of a public key matrix and a private key matrix. The system establishes a 32×32 public key matrix and a private key matrix of the same size. The combinations of keys within the key matrix are infinitely probable, forming a huge key space that ensures key non-duplication.

[0076] The public key matrix is ​​securely stored on the user terminal's storage medium. During communication, the other party's public key is reconstructed from the public key matrix using the other party's unique identifier to verify the other party's signature and complete the other party's identity authentication.

[0077] 2. System Composition:

[0078] like Figure 2 As shown, the present invention includes three participating entities: a key management center, a cluster head user terminal, and a cluster member user terminal.

[0079] 1) Key Management Center: Provides registration and authentication for user terminals, and divides the registered user terminals into m clusters, assigning a task area to each cluster. Each cluster has n nodes, including one cluster head user terminal and n-1 cluster member user terminals. The Key Management Center sends instructions to the user terminals or receives the data information they collect via a wireless link.

[0080] 2) Cluster Head User Terminals: These terminals possess high computing and storage capabilities, enabling them to pre-deploy user terminal groups and apply for group keys from the key management center. As blockchain consensus nodes within the system, the cluster head user terminals maintain the key management blockchain. Inter-cluster communication is possible between cluster heads.

[0081] 3) Cluster member user terminals: These have relatively limited capabilities, only able to perform lightweight tasks and keep the blockchain up-to-date. Cluster members within each cluster can communicate with each other.

[0082] 3. Application process:

[0083] The group key management system based on combined public keys includes user terminal key generation, block user terminal writing, group key generation, and group key update.

[0084] 1) User terminal key generation:

[0085] The process of generating a user terminal key is as follows: Figure 3 As shown. In this stage, a batch of user terminals request keys from the key management center, a process that takes place over a secure channel. After this stage is completed, the user terminals will join the hierarchical ad hoc network defined by the key management center to perform tasks.

[0086] ① The user terminal sends its identity identifier to the key management center through a secure channel.

[0087] ② The key management center verifies the identifier to check if it has been registered. If it has not been registered, it generates a long-term identity private key for each user terminal, calculates the public key, stores the data item locally, and returns it through a secure channel.

[0088] ③ The user terminal receives and saves the key.

[0089] Once each user terminal obtains a key from the key management center, it will become an authorized node and acquire a corresponding identity key pair. Other user terminals can retrieve its public key based on the identifier.

[0090] After all user terminals receive their keys, they are divided into m clusters based on their needs, with each cluster containing n nodes. Each cluster contains two types of user terminals: cluster head terminals and cluster member terminals. After the division, the key management center will assign a user terminal with high computing and storage capabilities to each cluster as its cluster head terminal.

[0091] 2) User terminal writes:

[0092] The process of writing to the user terminal is as follows:

[0093] Once the existing batch of user terminal keys in the system are generated, the key management center will generate a corresponding list of identity public keys and a list of group public keys for each cluster's member user terminals. A message containing these two lists will be sent to the witness nodes (witness nodes are key nodes selected by the blockchain according to certain rules, used for consensus and verification of blocks). Upon receiving the message, the witness node will use the public key previously issued by the key management center to verify the public key and signature in the message. If verification fails, the message will be discarded; if verification succeeds, it will be packaged into an initial transaction by the witness node under the consensus mechanism. After the witness node writes it into a new block, it will immediately broadcast the block. When more than 50% of the consensus nodes in the blockchain have verified this block, it indicates that the user terminal has been recorded on the blockchain.

[0094] 3) Group key generation:

[0095] The process for generating group keys is as follows:

[0096] Once a block is verified and deployed to the blockchain, the cluster head user terminal of each cluster will apply for a group key from the key management center, and the other cluster member user terminals will perform asynchronous calculations on it. This group key is used for secure communication within this cluster.

[0097] The cluster head user terminal, as the communication initiator within the group, is responsible for building the ART, dynamically updating the cluster based on changes in the cluster member composition, and updating the cluster's group key based on the ART to ensure secure communication within the cluster.

[0098] The cluster head user terminal is responsible for constructing the ART, and the key of the corresponding root node is the group key. Before the key tree is created, the cluster head user terminal uses the public key list received from the key management center to construct the ART, and uses the identity public key list for authentication of each user terminal when constructing the ART. The construction of the key tree can be reduced to the calculation of the group key. Figure 4 The process of generating the cluster 3 group key is demonstrated.

[0099] After completing the key tree construction, the cluster head user terminal sends its respective location index, public key, group public key list, and auxiliary path public key corresponding to a specific section of the key tree to the cluster member user terminals within the group to support asynchronous group key computation. To ensure the security of group key computation, the cluster head user terminal clears the private keys of other cluster member user terminal nodes after sending the key.

[0100] Similarly, a group key also needs to be established between cluster head user terminals to maintain inter-cluster group communication. At this time, the witness node of the production block pre-deploys the inter-cluster group key, and the subsequent calculation steps are the same as described above.

[0101] 4) Group key update:

[0102] The group key update process is as follows: To cope with dynamic changes in user terminals, a key update method is provided to ensure secure communication within the cluster.

[0103] ① New user terminals are dynamically added. The specific process is as follows: Figure 5 As shown.

[0104] When a new user terminal joins a cluster, it needs to send information such as its identity identifier and the cluster identifier it is requesting to join to the key management center to request registration. After receiving the message, the key management center will verify its legitimacy and generate a public-private key pair for the legitimate user terminal.

[0105] The key management center sends a new user terminal request to join the corresponding cluster in the blockchain. Upon receiving the message, the cluster head user terminal will verify its validity.

[0106] After successful verification, the cluster head user terminal will broadcast this block to the entire blockchain network. When more than 50% of the cluster head user terminals in the blockchain have passed the verification of this block, the block will be written into the blockchain. The cluster head user terminal and other cluster head user terminals update their public key lists based on the previously generated message information.

[0107] ② The user terminal dynamically leaves. The specific process is as follows: Figure 6 As shown.

[0108] When a user terminal leaves a cluster, it sends a leave request to the cluster head user terminal. Upon receiving the message, the cluster head user terminal will verify the message's validity based on the following rules:

[0109] a. Verify identity legitimacy. Check if the public key in the message exists in the cluster's public key list; if it does, the identity is legitimate.

[0110] b. Verify identity validity. Verify the signature in the message using the user terminal's public key. If the verification passes, the identity is valid.

[0111] After successful verification, the cluster head user terminal will broadcast this block to the entire blockchain network. When more than 50% of the cluster head user terminals in the blockchain have passed the verification of the block, the block will be written into the blockchain. The cluster head user terminal and other cluster head user terminals will also update their public key lists based on previously generated transactions.

[0112] As described above, the present invention can be implemented well.

[0113] All features disclosed in all embodiments of this specification, or steps in all methods or processes implied in the disclosure, may be combined and / or extended or replaced in any way, except for mutually exclusive features and / or steps.

[0114] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Based on the technical essence of the present invention, any simple modifications, equivalent substitutions, and improvements made to the above embodiments within the spirit and principles of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A self-organizing network group key management system based on combined public keys, characterized in that, It includes a key management center capable of communication and user terminals; the key management center stores private key matrix information, and the user terminals store public key information; the key management center is used to: provide user terminal registration, application, distribution and unified management of keys, divide user terminals into clusters, apply for group keys for each cluster, and ensure secure communication of user terminals in each cluster; and dynamically update the group keys when a user terminal joins or leaves a cluster. User terminals include cluster head user terminals and cluster member user terminals. The key management center can communicate with the cluster head user terminals, and the cluster head user terminals can communicate with the cluster member user terminals. The key management center is used to: provide user terminal registration and authentication, divide the registered user terminals into m clusters, assign a task area to each cluster, each cluster has n nodes, and each node includes 1 cluster head user terminal and n-1 cluster member user terminals; and send instructions to user terminals or receive data information collected by them. The cluster head user terminal is used for: deploying user terminal groups, applying for group keys from the key management center; and, as a blockchain consensus node in the system, maintaining the key management blockchain; wherein, the cluster head user terminal can perform inter-cluster communication; Cluster member user terminals are used to: perform tasks and keep the blockchain up-to-date; among them, cluster member user terminals within the same cluster can communicate with each other.

2. A method for managing group keys in ad hoc networks based on combined public keys, characterized in that, The self-organizing network group key management system based on combined public keys as described in claim 1 includes the following steps: S1, User terminal key generation: The user terminal applies for a key from the key management center, and the user terminal joins the hierarchical self-organizing network divided by the key management center to perform tasks; S2, User terminal write: Write the user terminal to the blockchain; S3, Group Key Generation: The group key is calculated by constructing a key tree; S4, Group Key Update: The user terminal updates the public key list.

3. The method for managing group keys in a self-organizing network based on a combined public key, as described in claim 2, is characterized in that... Step S1 includes the following steps: S11, the user terminal sends its own identity identifier to the key management center through a secure channel; S12, the key management center verifies the identity identifier and checks whether the identity identifier has been registered: if it has not been registered, the identity identifier is used as the private key of each user terminal, the public key is calculated, the data item is stored locally, and the user terminal key is returned through a secure channel; S13, the user terminal receives and saves the key: Once each user terminal obtains a key from the key management center, each user terminal becomes an authorized node and obtains a related identity key pair. Other user terminals can retrieve its public key based on the identity identifier. After all user terminals obtain the key, the user terminals are divided into m clusters. After the division is completed, the key management center assigns a user terminal to each cluster as the cluster head user terminal.

4. The method for managing group keys in a self-organizing network based on a combined public key as described in claim 3, characterized in that, Step S2 includes the following steps: S21. After the existing user terminal keys in the system are generated, the key management center generates a corresponding list of user terminal identity public keys and a list of group public keys for each cluster, and sends a message containing these two lists to the witness node. S22, when a witness node receives a message, it uses the public key previously issued by the key management center to verify the public key and signature in the message; if the verification fails, the message is discarded; if the verification succeeds, the message will be packaged into an initial transaction by the witness node under the consensus mechanism. S23, after the witness node writes the user terminal into a new block, the witness broadcasts the block; S24. When more than a set proportion of consensus nodes in the blockchain have verified this block, it indicates that the user terminal has been recorded on the blockchain.

5. The method for managing group keys in a self-organizing network based on a combined public key, as described in claim 4, is characterized in that... Step S3 includes the following steps: S31. After a block is verified and deployed to the blockchain, the cluster head user terminal of each cluster applies for a group key from the key management center. The other cluster member user terminals will perform asynchronous calculation on the group key, which is used for secure communication within the cluster. S32, the cluster head user terminal, as the communication initiator within the group, is responsible for the construction of the ART, dynamically updates the cluster according to changes in the cluster member composition, and updates the cluster's group key based on the ART; S33, the cluster head user terminal is responsible for building the ART, and the key of the corresponding root node is the group key; before the key tree is created, the cluster head user terminal uses the public key list received by the key management center to build the ART, and uses the identity public key list to authenticate the identity of the user terminal when each user terminal builds the ART. S34. After the cluster head user terminal completes the key tree construction, it sends its own location index, the public key of the cluster head user terminal, the list of group public keys, and the auxiliary path public key corresponding to a certain section in the key tree to the cluster member user terminals in the group, in order to support the asynchronous calculation of the group key. After sending the key, the cluster head user terminal will clear the private keys of other cluster member user terminal nodes.

6. The method for managing group keys in a self-organizing network based on a combined public key as described in claim 5, characterized in that, In step S4, when a new user terminal joins the cluster, the following steps are included: SA41, the new user terminal sends its identity identifier and the cluster identifier information it requests to join to the key management center to request registration; SA42: After receiving the message, the key management center verifies whether the message is valid and generates a public-private key pair for the legitimate user terminal. SA43, the key management center sends a new user terminal request to join a new cluster in the blockchain to the cluster head user terminal of the corresponding cluster. After receiving the message, the cluster head user terminal verifies whether the message is valid. After successful verification of SA44, the cluster head user terminal broadcasts this block to the entire blockchain. When more than a set proportion of cluster head user terminals in the blockchain pass the verification of this block, the block is written into the blockchain. The cluster head user terminal and other cluster head user terminals update their public key lists based on the previously generated message information.

7. A method for managing group keys in a self-organizing network based on a combined public key, as described in claim 5, is characterized in that... In step S4, when a user terminal leaves a cluster, the following steps are included: SB41 sends a leave request to the cluster head user terminal. After receiving the message, the cluster head user terminal verifies the message's validity. SB42, after successful verification, the cluster head user terminal broadcasts this block to the entire blockchain. When more than a set proportion of cluster head user terminals in the blockchain pass the verification of this block, the block is written into the blockchain. The cluster head user terminal and other cluster head user terminals update the public key list according to the previously generated transactions.

8. A method for managing group keys in a self-organizing network based on a combined public key, as described in claim 7, is characterized in that... In step SB41, the cluster head user terminal will verify the validity of the received message based on the following rules: Verify identity legitimacy: Check if the public key in the message exists in the cluster's public key list. If it does, the identity is legitimate. as well as, Verify identity validity: Use the user terminal's public key to verify the signature in the message. If the verification is successful, the identity is valid.

Images