A vehicular network privacy protection efficient data sharing method based on CP-ABE

Abstract

The application provides a kind of CP-ABE-based privacy protection efficient data sharing method of vehicle-mounted network, it is related to data sharing technical field, and the application is divided into three stages, the first stage is system initialization stage, trusted authority TA generates and publishes system parameter to other entities in system in system initialization stage, and stores system master key locally.The system initialization stage is the basis for the establishment of data sharing service.This stage includes system initialization protocol;The second stage is OBU registration stage, in order to obtain the legal identity in the system for participating in data sharing service, OBU must send its real identity to TA, so as to register, and TA generates corresponding attribute private key for OBU.This stage includes OBU registration protocol;The third stage is data sharing stage, encrypted data can be generated by data owner vehicle (Data Owner, DO) and sent to trusted RSU.Encrypted data can also be provided to other data user vehicles (Data User, DU) that meet the access policy set by DO vehicle.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data sharing, and particularly relates to a CP-ABE-based private protection efficient data sharing method for VANET. BACKGROUND

[0002] With the development of intelligent transportation and smart city, Vechicle Ad hoc network (VANETs) is applied more and more, and its advantages and importance in intelligent transportation system are significantly shown. At present, VANET is used to provide various services about efficiency, safety, entertainment and the like. As an important service of VANET, data sharing service not only ensures that vehicles can obtain required contents from service providers, but also enables vehicles to share necessary information with other vehicles, thereby providing better travel experience for drivers and passengers. Meanwhile, through communication with Road Side Unit (RSU), vehicles and traffic control center can share traffic data to improve traffic efficiency, for example, traffic control center can change traffic signal lights to prevent road congestion. Other service providers can also process and analyze data in the cloud, thereby providing suggestion information for GPS or performing traffic control research.

[0003] Ciphertext policy attribute-based encryption (CP-ABE) algorithm is proposed by Bethencourt et al. in 2007. Its main feature is to associate the key of a user with the attributes possessed by the user, and to embed an access structure into a ciphertext. When the attributes of a user meet the access policy, the user has the right to decrypt the ciphertext. That is, a data owner can define an access structure to determine which users meeting attribute conditions can decrypt the ciphertext and obtain corresponding data.

[0004] Chinese patent "CN202310636636.4 A blockchain-based secure data sharing method for Internet of Vehicles". This invention establishes two architectures: 1) a three-layer network model in the vehicle network scenario, namely a cloud layer, an edge device layer, and a terminal layer; 2) a double-layer blockchain architecture, thereby realizing an asynchronous data sharing mechanism that protects user vehicle data privacy in the vehicle network scenario. The intelligent cloud layer is responsible for providing AI services and deploying cross-zone sharing strategies; the edge service layer is responsible for defining sharing strategies within the partition and submitting transactions to the blockchain; and the terminal is responsible for collecting local data and participating in partition data sharing tasks and model training functions. The purpose of this invention is to provide a blockchain-based secure data sharing method for vehicle networks, thereby solving the security and efficiency problems of large-scale data sharing in vehicle networks.

[0005] Chinese patent "CN202311279817.2 A high-efficiency and secure data sharing method based on blockchain sharding in Internet of Vehicles", this method improves throughput and efficiency through sharding based on Byzantine fault-tolerant consensus, selects nodes with higher reliability to form a consensus group, thereby improving the success rate of consensus, and weakens the influence of Byzantine nodes to ensure the accuracy and security of data on the chain.

[0006] Vehicle network is a kind of wireless sensor network. Due to the openness of wireless network environment, the enemy can collect the data transmitted by surrounding vehicles during data sharing. If there is no effective access control mechanism to protect the security of data, the data sharing service may leak the user's privacy to the enemy. In addition, if a malicious vehicle shares malicious data with nearby vehicles, it is easy to threaten the driving safety of other vehicles. In summary, the shared data for privacy protection need to be transmitted in the form of ciphertext, and access control permissions are set for other entities. Only vehicles that meet the access permissions can access the corresponding shared data. At the same time, due to the high real-time requirement of vehicles in vehicle network for traffic data, i.e., the acquired data cannot have too high delay, otherwise the shared data loses its significance.

[0007] The patents "CN202310636636.4" and "CN202311279817.2" are both based on blockchain data sharing applications, and there are the following problems in the vehicle network scene based on blockchain data sharing applications: In large-scale Internet of Vehicles communication, the constantly moving traffic flow will generate massive data, and due to the limitation of blockchain throughput, it will seriously affect the efficiency of data sharing, especially in the sharing of some traffic data, the meaning of sharing is the real-time nature of data, so it will seriously affect the effect of data sharing service. In addition, since the two inventions are in plaintext in data sharing, although the blockchain stores data to ensure the data's non-tamperability, they cannot guarantee the security of the vehicle's private data in the vehicle network (such as vehicle location, driving route, etc.). Due to the openness of the Internet of Vehicles, these privacy leakage problems may be exploited by the enemy, causing property loss of the vehicle owner and even threatening personal safety.

[0008] In the patent "CN202310636636.4", the data sharing vehicle needs to initiate a data sharing request and obtain the current model and the optimal sharing strategy before data sharing, then obtain the model from the RSU or BS, and after verification and aggregation, it is used as a trained model. Later, the vehicle needs to use the local data set to train the trained model to obtain an updated global model. Finally, the global model is uploaded to the blockchain network. Repeat the steps until the partition model converges. Obviously, considering the training in the middle, model generation and transmission, and blockchain chaining process, the high delay accumulation will inevitably cause the real-time nature of the data to decline. The main purpose of the patent "CN202311279817.2" is to improve the throughput and efficiency of the blockchain through sharding, and effectively improve the success rate of consensus in the blockchain to ensure the accuracy and security of the data on the chain, which also has the problem of high delay in efficiency. SUMMARY

[0009] In view of the deficiencies of the prior art, the application provides a CP-ABE-based privacy protection efficient data sharing method for a vehicular network, which can provide safe and efficient data sharing services for vehicles in the vehicular network. Unlike other methods that use cloud or blockchain as a data storage center to provide data sharing services, in the method, a road-side unit (RSU) will provide a center for data collection and sharing services for vehicles nearby, thereby solving the problems of high transmission delay caused by cloud storage or insufficient throughput, insufficient storage and low query efficiency caused by blockchain in other methods. Moreover, the method designs an efficient CP-ABE algorithm to support the data sender to independently set access control permissions, and only the receiver meeting the attribute requirements can access the data. In addition, the method can resist tampering and forgery of the RSU to the data, and the data receiver does not need to frequently authenticate each other with the RSU, and after the data receiver completes registration at the trusted authority (TA), the data receiver can timely receive reliable data. In addition, the scheme provides privacy protection for the attribute set of the vehicle as the data owner by designing an anonymous access policy.

[0010] A CP-ABE-based privacy protection efficient data sharing method for a vehicular network, comprising the following steps:

[0011] Step 1: system initialization phase;

[0012] The trusted authority TA generates and publishes system public parameters to the road-side unit RSU and the on-board unit OBU in the system initialization phase, and stores the system master key locally at the trusted authority TA;

[0013] Step 1.1: the trusted authority TA first selects an additive cyclic group G1 and a multiplicative cyclic group G T of a prime number q as a group order, and defines a bilinear pairing e: G1x G1→ G T ;

[0014] Step 1.2: the trusted authority TA defines an attribute attribute set U = {A1, A2,..., A n} with n attributes, and each attribute {A i} i∈[1,n] has three attribute values Each attribute value corresponds to an integer and

[0015] For a vehicle with an attribute list List = {L[i]} i∈[1,n] , each attribute value in the list, and L[i] corresponds to the attribute Ai The attribute value. If This indicates that the vehicle possesses attribute A. i ;like This indicates that the vehicle does not possess attribute A. i .

[0016] For the form W = {W[i]} i∈[1,n] The access strategy, in practice, means that the attribute values ​​of n attributes are accessed through a conjunction normal form consisting of AND gates; each attribute value... And W[i] corresponds to attribute A in the strategy. i The attribute value. If This means that in order to satisfy this access policy, the corresponding vehicle must have attribute A. i That is, vehicle attribute A i The attribute value is like This means that for this access policy to be satisfied, the corresponding vehicle must not have attribute A. i That is, vehicle attribute A i The attribute value is like This means that regardless of the corresponding vehicle's attribute A i The attribute value is regardless of still They all satisfy this access policy.

[0017] For a vehicle, if its attribute list List satisfies access strategy W, then for each attribute A i The attribute values ​​L[i] all satisfy the requirements of W[i]. In this invention, the attribute list List of vehicle W is used to satisfy the access strategy W.

[0018] Step 1.3: The trusted organization TA defines an integer N = 3n and selects a random element P ∈ from the cyclic group G1. R G1 is a generator;

[0019] Step 1.4: Trusted Institution TA in Integer Group Select two random numbers above

[0020] Step 1.5: Trusted Institution (TA) calculates TA public key (PK). TA ={Z,PK1,PK2,…,PK N PK N+2 PK N+3 ,…,PK 2N}, where {PK i} i∈[1,N]∪[N+2,2N] =α i ·P,PKi ∈G1, Z=β·P, Z∈G1;

[0021] Step 1.6: Trusted organization (TA) publishes public parameters param = {G1, G...} T ,q,e,P,PK TA}, and store the master key MK={α,β} in the local storage system.

[0022] Step 2: OBU registration phase;

[0023] On-board unit (OBU) Vec The system sends its real identity to a trusted authority (TA) for registration. After the trusted authority (TA) verifies the identity of the On-Board Unit (OBU), it issues an attribute key to the OBU.

[0024] Step 2.1: Any OBU that corresponds one-to-one with the vehicle Vec Before joining the sharing mechanism, its real identity ID for service purposes had already been obtained from the vehicle management department. Vec ∈G1;

[0025] Step 2.2: OBU Vec A session key is generated based on the ElGamal mechanism, and its real identity ID is encrypted. Vec From the group of integers Choose a random number And calculate the vehicle's OBU Vec Symmetric ciphertext C sent to trusted authority TA Vec-TA =Enc_Z{ID Vec}={V1,V2}, where V1=t·P,V1∈G1,V2=ID Vec +t·Z,V2∈G1, while Enc_K{M} represents symmetric encryption of message M using the ElGamal mechanism with K as the symmetric key;

[0026] Step 2.3: OBU Vec Ciphertext C Vec-TA Package it into the registration request and transmit the registration request to the trusted authority (TA);

[0027] Step 2.4: The trusted organization (TA) parses the registration request to obtain the ciphertext and calculates the ID. Vec =V2-β·V1 to decrypt ciphertext C Vec-TA Obtain OBU Vec Real identity ID v ;

[0028] Step 2.5: Trusted TA verifies the vehicle's OBU Vec Real identity ID Vec Configure the vehicle OBU according to the vehicle's identity.Vec List of attributes Vec ={L Vec [i]} i∈[1,n] Where L Vec [i]∈[1,2n];

[0029] Step 2.6: Corresponding OBU Vec List of attributes Vec The n attributes in the integer group, the trusted organization TA Select n random integers And calculate

[0030] Step 2.7: The Trusted Authority (TA) calculates the OBU based on the attribute list. Vec SK attribute private key component Vec ={T,{T i} i∈[1,n] ,{F i} i∈[1,n]}. Where T = r·Z, T∈G1, F i =(α 2n+i +r i )·Z,F i ∈G1.

[0031] Step 2.8: The trusted institution (TA) generates the session key K according to the ElGamal mechanism. TA-Vec And use the key pair attribute private key SK Vec Perform AES symmetric encryption Enc_K TA-Vec {SK Vec}: TA calculates session key K TA-Vec =β·V1, and use AES symmetric encryption mechanism to encrypt the on-board unit (OBU). Vec SK private key Vec Received from a trusted authority (TA) sent to the vehicle's OBU Vec The ciphertext C TA-Vec =Enc_K TA-Vec {SK Vec};

[0032] Step 2.9: Trusted Authority (TA) transmits ciphertext C TA-Vec Give to OBU Vec ;

[0033] Step 2.10: OBU Vec Establish session key K TA-Vec =t·Z, and decrypt the received ciphertext C using the AES mechanism. TA-Vec To obtain the corresponding attribute private key SK v .

[0034] Step 3: Data sharing phase;

[0035] When a vehicle discovers valuable data such as special road conditions or roadside service areas while driving, the vehicle's OBU, as the data owner, can share this information. u The system communicates with the Roadside Unit (RSU) via a Data Upload Protocol (V2I), encrypts shared data using a hybrid encryption algorithm, and then uploads the encrypted data (ShareData) to an edge server (Server) connected to the RSU via the backbone network for storage and management. The data is then processed by the On-Board Unit (OBU) of the vehicle. v According to the data download protocol, V2I communication is performed with the roadside unit (RSU) to download specific encrypted data. v If the attribute list satisfies the access policy, then use OBU v The attribute private key is used to decrypt ShareData using a hybrid decryption algorithm to obtain the shared data;

[0036] Step 3.1: The data owner's onboard unit communicates with the RSU and executes the data upload protocol; the onboard unit (OBU) of the vehicle acting as the data owner... u Encrypt the data that needs to be shared, set the access policy for the shared data, and then send the encrypted shared data and the anonymization access policy to the RSU according to the protocol;

[0037] Step 3.1.1: On-Board Unit (OBU) of the data owner u Configure the access policy for the data to be shared. u ={W u [i]} i∈[1,n] ,in The access strategy is the conjunctive normal form of n attribute values;

[0038] Step 3.1.2: OBU u From the group of integers Choose a random number

[0039] Step 3.1.3: OBU u Using the public parameter PK published by the trusted organization TA N PK1 is used to calculate the symmetric key K. u-TA =e(PK) N ,PK1) n·d ;

[0040] Step 3.1.4: OBUu The AES symmetric encryption mechanism is used to encrypt data M, with input data M and symmetric key K. u-TA , obtain ciphertext C u =Enc_K u-TA {M};

[0041] Step 3.1.5: OBU u Calculate other ciphertext components

[0042] Step 3.1.6: OBU u By deleting strategy W u In addition to the attribute value Other attribute values ​​are used to anonymize the access policy. This anonymization policy is used to inform the server which attributes are mandatory for the shared data, and neither the server nor the data user knows the OBU's requirements. u By corresponding to the specific attribute values ​​of the vehicle, the anonymization of vehicle features is achieved, thus protecting the vehicle's attributes; that is, generating an anonymization access strategy W. u ',in

[0043] Step 3.1.7: OBU u Generate shared data ciphertext It then sends encrypted data to the Roadside Unit (RSU) via a secure channel.

[0044] Step 3.1.8: Upon receiving the OBU u Real identity information IdInfo u and shared encrypted data C u-RSU The roadside unit (RSU) stores its data in a storage server connected to the backbone network.

[0045] Step 3.2: On-board unit (OBU) of the data user vehicle v Communicates with the RSU and executes the data download protocol; the vehicle's on-board unit (OBU) acts as the data user. v By constructing a guessing access strategy, the system obtains the encrypted data of interest from the Roadside Unit (RSU) and decrypts the encrypted data to obtain the shared data.

[0046] Step 3.2.1: The OBU as a data user v Construct a guessing access strategy W based on the attributes of the data sources you are interested in. v and W v Submitted to the Roadside Unit (RSU), and retrieved from the RSU the encrypted shared data shared by the data owner, vehicle u.

[0047] Step 3.2.2: OBU v Local guess access policy W v where W v = {W v [i]} i∈[1,n] For each attribute value W v [i] in the policy, compute

[0048] Step 3.2.3: OBU v According to the local guess access policy W v where W v = {W v [i]} i∈[1,n] For each attribute value in the policy, if the attribute belongs to the attribute list of the vehicle v, i.e., W v [i] == List v [i]} i∈[1,n] i.e., the vehicle v owns the attribute, then compute If i.e., the policy does not care about the value of the attribute then compute

[0049] Step 3.2.4: OBU v Compute:

[0050]

[0051] Step 3.2.5: OBU v Compute

[0052] Step 3.2.6: Decrypt the encrypted data C u by the CP-ABE algorithm to get the symmetric key K:

[0053]

[0054] Step 3.2.7: OBU v Decrypt the ciphertext C u using the symmetric key K to get the shared data M;

[0055] On the other hand, a CP-ABE-based vehicular network privacy protection efficient data sharing method is based on the following system implementation, including: trusted authority TA, roadside unit RSU, on-board unit OBU, edge server Server;

[0056] The trusted authority TA is responsible for system initialization in the scheme, including generating and issuing system parameters, and is responsible for providing registration services for the on-board units OBU of the data owner Data owner and the data user Data user, that is, generating attribute private keys for the on-board units OBU and managing the identity information of the on-board units OBU.

[0057] The roadside unit RSU is a data sharing center, responsible for collecting and forwarding shared data; after the on-board unit OBU and the attribute authority AA complete mutual authentication, the OBU is identified as legal by the system; the roadside unit RSU collects shared data sent by nearby legal OBUs as data owners through V2I communication, and delivers the data to the edge server Server connected through the backbone network for storage and management; when the surrounding OBU as a data user applies for specific data from the RSU, the RSU needs to share the data with the corresponding surrounding vehicles in time;

[0058] The on-board unit OBU: each OBU corresponds to a vehicle, and all OBUs need to complete authentication at the TA before participating in the data sharing system. The vehicle as a data owner Data owner can encrypt shared data and set the access strategy of the data; the data owner can send encrypted shared data to the trusted RSU, and the vehicle as a data user Data user obtains the encrypted data corresponding to the strategy from the roadside unit RSU by constructing a guess access strategy; if its attribute list meets the access strategy, the encrypted data is decrypted to obtain the shared data and complete data sharing; all vehicles are both data owners and data users.

[0059] The edge server Server: connected with the roadside unit RSU through the backbone network, providing data storage and download services for the roadside unit RSU, and storing and managing the encrypted data uploaded by the on-board unit OBU.

[0060] The beneficial effects produced by the above technical scheme are:

[0061] The application provides a kind of based on CP-ABE's privacy protection efficient data sharing method of vehicle-mounted network, this method can provide safe and efficient data sharing service for vehicle in vehicle-mounted network.Different from other methods using cloud or blockchain to provide data sharing service, in the method, RSU will provide data collection and sharing service for nearby vehicles, thereby solving the problems of high transmission delay caused by using cloud storage or insufficient throughput, insufficient storage and low query efficiency caused by using blockchain in other methods.And the method supports the access control authority set by the data sender independently by using efficient CP-ABE algorithm, and only the receiver who meets the attribute requirements can access the data.In addition, the method can resist the tampering and forgery of RSU to data, and the data receiver does not need to frequently authenticate each other with RSU, so that the data receiver can receive reliable data in time.Through security analysis and performance analysis, the method is safe and effective.Through theoretical analysis and performance analysis compared with multiple recent schemes, it is shown that the method can realize privacy protection and efficient data sharing in vehicle-mounted network scene.Specifically, the following beneficial effects are achieved:

[0062] 1, different from the traditional use of cloud or blockchain as data sharing service provider, the scheme uses RSU to provide data collection and sharing service for nearby vehicles, thereby greatly reducing the delay of cloud communication and solving the problem of low throughput in blockchain.

[0063] 2, the attribute-based encryption mechanism based on ciphertext is introduced, the shared data is encrypted based on attribute and uploaded, so that the storage server Server connected to RSU cannot tamper with the content of the data, thereby ensuring the confidentiality and integrity of the data.

[0064] 3, the attribute-based encryption feature is used to realize efficient and access-controlled data sharing.Firstly, according to the attributes of data users, the access structure in CP-ABE is used to control the access rights of shared data, and if there is no permission, the data ciphertext cannot be successfully decrypted.Secondly, when the data owner shares data with multiple data users, it only needs to be encrypted once, without the need to use the public key of each data user for encryption, which greatly improves the efficiency of data sharing.

[0065] 4, a data sharing mechanism is constructed, including OBU registration protocol and data sharing protocol two parts, wherein the data sharing protocol contains two sub-protocols, data upload protocol and data download protocol, so as to realize efficient data sharing with privacy protection. BRIEF DESCRIPTION OF DRAWINGS

[0066] Figure 1 is the overall flowchart of the system operation of the application;

[0067] Figure 2System architecture diagram of the present application;

[0068] Figure 3 System initialization protocol timing diagram of the present application;

[0069] Figure 4 OBU registration protocol timing diagram of the present application;

[0070] Figure 5 Data upload and data download protocol timing diagram of the present application;

[0071] Figure 6 Data sharing stage example schematic diagram of the present application; DETAILED DESCRIPTION

[0072] The specific embodiments of the present application are described in further detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present application, but are not used to limit the scope of the present application.

[0073] A CP-ABE-based privacy protection efficient data sharing method for vehicular networks, as shown in Figure 1 , includes the following steps:

[0074] Step 1: System initialization stage, system initialization protocol timing diagram as shown in Figure 3 ;

[0075] The trusted authority TA generates and publishes system public parameters to the roadside unit RSU and the on-board unit OBU in the system initialization stage, and stores the system master key locally in the trusted authority TA; the system initialization stage is the basis for establishing data sharing services. The process of the system initialization stage is as follows:

[0076] Step 1.1: The trusted authority TA first selects an additive cyclic group G1 and a multiplicative cyclic group G T with a prime number q as the group order, and defines a bilinear pairing e: G1×G1→G T ; In this embodiment, the symbols involved in the parameters are explained as shown in Table 1:

[0077] Table 1 Parameter Explanation

[0078]

[0079] Step 1.2: The trusted authority TA defines attributes an attribute universe U = {A1, A2, …, An} with n attributes, and each attribute {A n} i} i∈[1,n] Each attribute value corresponds to an integer , and , and

[0080] For a vehicle with attribute list List={L[i]} i∈[1,n] , each attribute value of which corresponds to the attribute value of attribute A i in the list L[i]. If , it means that the vehicle has attribute A i ; if , it means that the vehicle does not have attribute A i .

[0081] And for an access policy in the form of W={W[i]} i∈[1,n] , its actual meaning is that the attribute values of n attributes are combined by an And-gate group to form a conjunctive normal form; each attribute value of which corresponds to the attribute value of attribute A i in the policy W[i]. If , it means that if the access policy is to be met, the corresponding vehicle must have attribute A i , i.e., the attribute value of attribute A i of the vehicle is If , it means that if the access policy is to be met, the corresponding vehicle must not have attribute A i , i.e., the attribute value of attribute A i of the vehicle is If , it means that no matter whether the attribute value of attribute A i of the corresponding vehicle is or , it all meets the access policy.

[0082] For a vehicle, if its attribute list List meets the access policy W, it means that for each attribute value of attribute A i , L[i] meets the requirement of W[i]. In the present application, the attribute list List of the vehicle using List|=W meets the access policy W.

[0083] The attribute-based encryption mechanism involved in the present application can refer to the PP-CP-ABE scheme of Zhou, attributes and attribute mapping table, as shown in Table 2:

[0084] Table 2 Attributes and attribute mapping

[0085]

[0086] Step 1.3: The trusted authority TA defines an integer N=3n, and selects a random element P∈ R G1 as a generator from the cyclic group G1;

[0087] Step 1.4: Trusted authority TA computes TA public key PK Two random numbers are selected above

[0088] Step 1.5: Trusted authority TA computes TA public key PK TA = {Z, PK1, PK2, …, PK N , PK N+2 , PK N+3 , …, PK 2N}, where {PK i} i∈[1,N]∪[N+2,2N] = a i · P, PK i ∈ G1, Z = β· P, Z ∈ G1;

[0089] Step 1.6: Trusted authority TA publishes public parameters param = {G1, G T , q, e, P, PK TA} and stores system master key MK = {a, β} locally.

[0090] Step 2: OBU registration phase;

[0091] In order to participate in the data sharing service, communicate with the RSU and legally perform the data upload and data download protocol. The on-board unit OBU Vec sends its real identity to the trusted authority TA for registration, and after the trusted authority TA determines the identity of the on-board unit OBU, the on-board unit OBU is issued an attribute key. It is assumed that the on-board unit OBU Vec of any vehicle submits an OBU registration request to the trusted authority TA. The timing diagram of the OBU registration protocol contained in this phase is shown in Figure 4 .

[0092] Step 2.1: Any OBU Vec corresponding to a vehicle has obtained its real identity ID Vec ∈ G1 in the service from the vehicle management department before joining the sharing mechanism.

[0093] Step 2.2: OBU Vec generates a session key according to the ElGamal mechanism and encrypts its real identity ID Vec : Select a random number from the integer group and calculate the symmetric ciphertext C Vec sent by the vehicle OBU to the trusted authority TA Vec-TA = Enc_Z{ID Vec} = {V1, V2}, where V1 = t· P, V1 ∈ G1, V2 = ID Vec+t·Z,V2∈G1, while Enc_K{M} represents symmetric encryption of message M using the ElGamal mechanism with K as the symmetric key;

[0094] Step 2.3: OBU Vec Ciphertext C Vec-TA Package it into the registration request and transmit the registration request to the trusted authority (TA);

[0095] Step 2.4: The trusted organization (TA) parses the registration request to obtain the ciphertext and calculates the ID. Vec =V2-β·V1 to decrypt ciphertext C Vec-TA Obtain OBU Vec Real identity ID v ;

[0096] Step 2.5: Trusted TA verifies the vehicle's OBU Vec Real identity ID Vec Configure the vehicle OBU according to the vehicle's identity. Vec List of attributes Vec ={L Vec [i]} i∈[1,n] Where L Vec [i]∈[1,2n];

[0097] Step 2.6: Corresponding OBU Vec List of attributes Vec The n attributes in the integer group, the trusted organization TA Select n random integers And calculate

[0098] Step 2.7: The Trusted Authority (TA) calculates the OBU based on the attribute list. Vec SK attribute private key component Vec ={T,{T i} i∈[1,n] ,{F i} i∈[1,n]}. Where T = r·Z, T∈G1, F i =(α 2n+i +r i )·Z,F i ∈G1.

[0099] Step 2.8: The trusted institution (TA) generates the session key K according to the ElGamal mechanism. TA-Vec And use the key pair attribute private key SK Vec Perform AES symmetric encryption Enc_K TA-Vec {SK Vec}: TA calculates session key KTA-Vec =β·V1, and use AES symmetric encryption mechanism to encrypt the on-board unit (OBU). Vec SK private key Vec Received from the trusted authority TA sent to the vehicle's OBU Vec The ciphertext C TA-Vec =Enc_K TA-Vec {SK Vec};

[0100] Step 2.9: Trusted Authority (TA) transmits ciphertext C TA-Vec Give to OBU Vec ;

[0101] Step 2.10: OBU Vec Establish session key K TA-Vec =t·Z, and decrypt the received ciphertext C using the AES mechanism. TA-Vec To obtain the corresponding attribute private key SK v .

[0102] Step 3: Data sharing phase;

[0103] When a vehicle discovers valuable data such as special road conditions or roadside service areas while driving, the vehicle's OBU, as the data owner, can share this information. u The system communicates with the Roadside Unit (RSU) via a Data Upload Protocol (V2I) and encrypts shared data using a hybrid encryption algorithm (including the CP-ABE algorithm used in this solution). The encrypted data, ShareData, is then uploaded by the RSU to an edge server (Server) connected to the RSU via the backbone network for storage and management. The data is then processed by the On-Board Unit (OBU) of the vehicle. v According to the data download protocol, V2I communication is performed with the roadside unit (RSU) to download specific encrypted data. v If the attribute list satisfies the access policy, then use OBU v The private key is used to decrypt ShareData using a hybrid decryption algorithm to obtain the shared data. This stage includes two protocols: a data upload protocol and a data download protocol. The sequence diagrams for the data upload and download protocols are shown below. Figure 5 As shown:

[0104] The data in this embodiment refers to the data collected by the vehicle during driving, which is intended to be shared with other vehicles, such as the vehicle finding a gas station at a certain coordinate on the edge of a road, which will encrypt and share such data to the RSU. Vehicles interested in such data can download and decrypt the data to obtain the location of the gas station.

[0105] For the convenience of understanding, an example of the data sharing stage is given as follows: assuming that the attribute set in the system is U = {A1 = ADAS, A2 = 4 + seats, A3 = Taxi, A4 = EV}, wherein A1 = ADAS represents that the vehicle is equipped with an advanced driving assistance system (ADAS), A2 = 4 + seats represents that the vehicle is a four-seater, A3 = Taxi represents that the vehicle is a taxi, and A4 = EV represents that the vehicle is an electric vehicle. The schematic diagram of the example is shown in FIG. 1. Figure 6 The vehicle V1 is a four-seater electric private car equipped with an ADAS, and the attribute list corresponding to the vehicle V1 is At this time, the vehicle detects a charging station near the vehicle through a sensor, but it is determined that the surrounding road condition is complex and the vehicle needs to be equipped with an ADAS system to drive in for safety. Therefore, the vehicle V1 shares the charging station location with electric vehicles equipped with an ADAS system through a data upload protocol; the vehicle V1 packs the charging station coordinate data into ciphertext and sets the access strategy as and then delivers the ciphertext of the shared data to the RSU for storage. At this time, there are two other vehicles V2 and V3 in the region, and the attributes of the two vehicles are Both vehicles want to obtain some electric vehicle related content, so they use the guessing strategy to obtain the data given by the surrounding electric vehicles, so they both obtain the data shared by the vehicle V1 from the RSU. However, the vehicle V2 does not have the ADAS attribute, so it cannot correctly decrypt the ciphertext, and the vehicle V3 has the attribute, thereby obtaining the charging station location shared by the vehicle V1 from the ciphertext. The schematic diagram of the example of the data sharing stage is shown in FIG. 2. Figure 6 .

[0106] Step 3.1: The on-board unit of the data owner communicates with the RSU and executes the data upload protocol; the on-board unit OBU of the vehicle as the data owner u encrypts the data to be shared, sets the access strategy of the shared data, and then sends the encrypted shared data and the anonymized access strategy to the RSU according to the protocol;

[0107] Step 3.1.1: The on-board unit OBU of the data owner u, set the access policy W of the data to be shared u = {W u [i]} i∈[1,n] , wherein The access policy is a conjunction normal form of n attribute values;

[0108] Step 3.1.2: OBU u Selects a random number r from an integer group Z

[0109] Step 3.1.3: OBU u Calculates the symmetric key K using the public parameters PK N , PK1 published by the trusted authority TA u-TA = e(PK N , PK1) n·d ;

[0110] Step 3.1.4: OBU u Encrypts the data M using the AES symmetric encryption mechanism, inputs the data M and the symmetric key K u-TA , and obtains the ciphertext C u = Enc_K u-TA {M};

[0111] Step 3.1.5: OBU u Calculates other ciphertext components

[0112] Step 3.1.6: OBU u Anonymizes the access policy by deleting attribute values other than the attribute value in the access policy W u , and the anonymized access policy is used to prompt the server to which attributes the shared data has mandatory requirements, and the server and the data user cannot know the specific attribute values of the OBU u corresponding to the vehicle, thereby realizing the effect of anonymizing the vehicle characteristics and protecting the attributes of the vehicle; that is, generating an anonymized access policy W u ', wherein

[0113] Step 3.1.7: OBU u Generates the shared data ciphertext and sends the encrypted ciphertext to the roadside unit RSU through a secure channel.

[0114] Step 3.1.8: Upon receiving the real identity information IdInfo u and the shared data ciphertext C u of the OBU u-RSU ​The roadside unit (RSU) stores its data in a storage server connected to the backbone network.

[0115] Step 3.2: On-board unit (OBU) of the data user vehicle v Communicates with the RSU and executes the data download protocol; the vehicle's on-board unit (OBU) acts as the data user. v A guessing access strategy is constructed to obtain the encrypted data of interest from the Roadside Unit (RSU), and then the encrypted data is decrypted to obtain the shared data. For ease of understanding, we assume here that the data user vehicle v obtains the shared data from the data owner vehicle u.

[0116] Step 3.2.1: The OBU as a data user v Construct a guessing access strategy W based on the attributes of the data sources you are interested in. v and W v Submitted to the Roadside Unit (RSU), and retrieved from the RSU the encrypted shared data shared by the data owner, vehicle u.

[0117] Step 3.2.2: OBU v Local guessing access strategy W v W v ={W v [i]} i∈[1,n] For each attribute value W of the strategy v [i], calculate

[0118] Step 3.2.3: OBU v Based on local guessing access strategy W v W v ={W v [i]} i∈[1,n] For each attribute value in the strategy, if the attribute belongs to the attribute list of vehicle v, i.e., {W} v [i] == List v [i]} i∈[1,n] If vehicle v possesses this attribute, then the calculation is performed. like That is, the strategy does not care about the value of this attribute. Then calculate

[0119] Step 3.2.4: OBU v calculate:

[0120]

[0121] Step 3.2.5: OBU v Compute

[0122] Step 3.2.6: Decrypt the encrypted data C by CP-ABE algorithm u The symmetric key K:

[0123]

[0124] Step 3.2.7: OBU v Decrypt the ciphertext C using the symmetric key K u To get the shared data M;

[0125] On the other hand, a CP-ABE-based vehicle network privacy protection efficient data sharing method is based on the following system implementation, the system architecture is as shown in Figure 2 , including: trusted authority TA, roadside unit RSU, on-board unit OBU, edge server Server;

[0126] The trusted authority TA (Trust Authority): responsible for the system initialization in this scheme, including generating and publishing system parameters, and responsible for providing registration services for the on-board unit OBU of the data owner Data owner and data user Data user, that is, generating attribute private key for the on-board unit OBU and managing the identity information of the on-board unit OBU.

[0127] The roadside unit RSU (Road Side Units): the data sharing center, responsible for collecting and forwarding shared data; after the on-board unit OBU and the attribute authority AA complete mutual authentication, the OBU is recognized as legal by the system; the roadside unit RSU collects the shared data sent by the nearby legal OBU as the data owner through V2I communication, and hands over these data to the edge server Server connected through the backbone network for storage and management; when the surrounding OBU as the data user applies for specific data to the RSU, the RSU needs to share the data with the corresponding surrounding vehicles in time;

[0128] The on-board unit OBU: each OBU corresponds to a vehicle, and all OBUs need to complete authentication at the TA before participating in the data sharing system. The vehicle as a data owner can encrypt the shared data and set the access strategy of the data; the data owner can send the encrypted shared data to the trusted RSU, and the vehicle as a data user obtains the encrypted data corresponding to the strategy from the roadside unit RSU by constructing a guess access strategy; if the attribute list meets the access strategy, the encrypted data is decrypted to obtain the shared data to complete data sharing; all vehicles are both data owners and data users.

[0129] The edge server Server: connected with the roadside unit RSU through the backbone network, providing data storage and download services for the roadside unit RSU, and storing and managing the encrypted data uploaded by the on-board unit OBU.

[0130] The above description is only the preferred embodiment of the present disclosure and the explanation of the applied technical principles. Those skilled in the art should understand that the scope of the application involved in the embodiments of the present disclosure is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with the technical features disclosed in the embodiments of the present disclosure (but not limited to) having similar functions to form technical solutions.

Claims

1. A CP-ABE-based privacy protection efficient data sharing system for vehicular networks, characterized in that, include: Trusted Authority (TA), Roadside Unit (RSU), Onboard Unit (OBU), Edge Server; The Trusted Authority (TA) is responsible for system initialization in this scheme, including generating and publishing system parameters, and for providing registration services for the On-Board Units (OBUs) of the Data Owner and Data User, namely generating attribute private keys for the OBUs and managing the identity information of the OBUs. The Roadside Unit (RSU) serves as a data sharing center, responsible for collecting and forwarding shared data. After the On-Board Unit (OBU) and the Attribute Authority (AA) complete mutual authentication, the OBU is recognized as legitimate by the system. The RSU collects shared data sent by nearby legitimate OBUs that are data owners via V2I communication and hands this data over to the Edge Server (Server) connected through the Backbone Network for storage and management. When a nearby OBU, acting as a data user, requests specific data from the RSU, the RSU needs to promptly share the data with the corresponding nearby vehicles. The On-Board Unit (OBU): Each OBU corresponds to a specific vehicle. All OBUs need to complete authentication at the TA before participating in the data sharing system. The vehicle, as the data owner, encrypts the shared data and sets the access policy for the data. The data owner sends the encrypted shared data to the trusted RSU. The vehicle, as the data user, obtains the encrypted data corresponding to the policy from the roadside unit RSU by constructing a guessing access policy. If its attribute list satisfies the access policy, the encrypted data is decrypted to obtain the shared data and complete the data sharing; all vehicles are both data owners and data users. The edge server (Server) is connected to the roadside unit (RSU) via the backbone network, providing data storage and download services for the RSU, and storing and managing encrypted data uploaded by the on-board unit (OBU).

2. A CP-ABE-based privacy protection efficient data sharing method for a vehicular network, implemented by the CP-ABE-based privacy protection efficient data sharing system for a vehicular network of claim 1, characterized in that, Includes the following steps: Step 1: System initialization phase; During the system initialization phase, the Trusted Authority (TA) generates and publishes common system parameters to the Roadside Unit (RSU) and the On-Board Unit (OBU), and stores the system master key locally on the Trusted Authority (TA). Step 2: OBU registration phase; On-board unit OBU Vec sends its real identity to the trusted authority TA for registration, and the trusted authority TA issues an attribute key to the on-board unit OBU after determining the identity of the on-board unit OBU. Step 3: Data sharing phase; When the vehicle finds special road condition information, roadside service area and other data worth sharing during driving, the OBU of the vehicle as the data owner u communicates with the roadside unit RSU through the data upload protocol Data upload protocol, encrypts the shared data through the hybrid encryption algorithm, and uploads the encrypted data ShareData to the edge server Server connected with the RSU through the backbone network through the RSU for storage and management; the on-board unit OBU of the data user vehicle v communicates with the roadside unit RSU through the data download protocol Data download protocol to download specific encrypted data, and if the attribute list of the OBU v satisfies the access strategy, the attribute private key of the OBU v is used to decrypt ShareData through the hybrid decryption algorithm to obtain the shared data.

3. The CP-ABE-based privacy protection and efficient data sharing method for vehicular networks according to claim 2, characterized in that, Step 1 specifically includes the following steps: Step 1.1: The trusted authority TA first selects an additive cyclic group G1 of prime order q and a multiplicative cyclic group G T , and defines a bilinear pairing e: G1 x G1→ G T ; Step 1.2: Trusted Authority TA defines attributes A universe of attributes U = {A1, A2,..., An} is defined, where n is the number of attributes. For each attribute {A n} i} i∈[1,n] There are three attribute values where each attribute value corresponds to an integer and For a vehicle with a list of attributes List = {L[i]} i∈[1,n] , where each attribute value L[i] corresponds to the attribute value of attribute A i in the list; if , it means that the vehicle has attribute A i ; if , it means that the vehicle does not have attribute A i ; And the access policy in the form of W = {W[i]} i∈[1,n] has the practical meaning that the attribute values of n attributes are combined by an And-gate; each attribute value in the And-gate corresponds to the attribute value of attribute A i in the policy; if , it means that if the access policy is to be satisfied, the corresponding vehicle must have attribute A i , that is, the attribute value of attribute A i of the vehicle is if , it means that if the access policy is to be satisfied, the corresponding vehicle must not have attribute A i , that is, the attribute value of attribute A i of the vehicle is if , it means that no matter whether the attribute value of attribute A i of the corresponding vehicle is or , it satisfies the access policy; For a vehicle, if its attribute list List satisfies the access policy W, it means that for each attribute A i of the vehicle, L[i] satisfies the requirement of W[i]; in the present application, the attribute list List of the vehicle satisfies the access policy W using List|=W; Step 1.3: The trusted authority TA defines an integer N = 3n and selects a random element P e G1 as the generator element R G1 as the generator element; Step 1.4: Trusted Authority TA selects two random numbers above selects two random numbers Step 1.5: Trusted Authority TA computes TA public key PK TA = {Z, PK1, PK2,..., PK N , PK N+2 , PK N+3 ,..., PK 2N}, where {PK i} i∈[1,N]∪[N+2,2N] = a i · P, PK i ∈ G1, Z = β· P, Z ∈ G1; Step 1.6: Trusted Authority TA publishes public parameters param = {G1, G2, q, e, P, PK} and stores locally system master key MK = {a, b}. T TA}​ 4. The CP-ABE-based privacy protection and efficient data sharing method for vehicular networks according to claim 2, characterized in that, Step 2 specifically includes the following steps: Step 2.1: Any OBU corresponding to a vehicle Vec Before joining the sharing mechanism, it has obtained its real identity ID in the service from the vehicle management department Vec ∈G1; Step 2.2: OBU Vec A session key is generated based on the ElGamal mechanism, and its real identity ID is encrypted. Vec From the group of integers Choose a random number And calculate the vehicle's OBU Vec Symmetric ciphertext C sent to trusted authority TA Vec-TA =Enc_Z{ID Vec }={V1,V2}, where V1=t·P,V1∈G1,V2=ID Vec +t·Z,V2∈G1, while Enc_K{M} represents symmetric encryption of message M using the ElGamal mechanism with K as the symmetric key; Step 2.3: OBU Vec The ciphertext C Vec-TA is packed into the registration request and the registration request is transmitted to the trusted authority TA; Step 2.4: The TA decrypts the ciphertext C by calculating ID Vec = V2 - β · V1 Vec-TA obtains the real identity ID Vec of the OBU v ; Step 2.5: Trusted TA verifies the vehicle's OBU Vec Real identity ID Vec Configure the vehicle OBU according to the vehicle's identity. Vec List of attributes Vec ={L Vec [i]} i∈[1,n] Where L Vec [i]∈[1,2n]; Step 2.6: Corresponding OBU Vec List of attributes List Vec of n attributes, the trusted authority TA selects n random integers in the integer group and calculates Step 2.7: Trusted Authority TA computes OBU's attribute private key component SK Vec from the list of attributes Vec = {T, {T i} i∈[1,n] , {F i} i∈[1,n]}; where T = r · Z, T G1, F i = (a 2n+i + r i ) · Z, F i G1; Step 2.8: The trusted institution (TA) generates the session key K according to the ElGamal mechanism. TA-Vec And use the key pair attribute private key SK Vec Perform AES symmetric encryption Enc_K TA-Vec {SK Vec }: TA calculates session key K TA-Vec =β·V1, and use AES symmetric encryption mechanism to encrypt the on-board unit (OBU). Vec SK private key Vec Received from a trusted authority (TA) sent to the vehicle's OBU Vec The ciphertext C TA-Vec =Enc_K TA-Vec {SK Vec }; Step 2.9: Trusted Authority TA transmits ciphertext C TA-Vec To OBU Vec ; Step 2.10: OBU Vec Establish session key K TA-Vec = t · Z, and decrypt the received ciphertext C by AES mechanism to obtain the corresponding attribute private key SK TA-Vec = t · Z, and decrypt the received ciphertext C by AES mechanism to obtain the corresponding attribute private key SK v .

5. The CP-ABE-based privacy protection and efficient data sharing method for vehicular networks according to claim 2, characterized in that, Step 3 specifically includes the following steps: Step 3.1: The data owner's on-board unit communicates with the RSU and performs the data upload protocol; as the on-board unit OBU of the data owner vehicle u The data to be shared is encrypted, the access strategy of the shared data is set, and then the encrypted shared data and the anonymized access strategy are sent to the RSU according to the protocol; Step 3.2: On-board unit OBU of data consumer vehicle v communicates with the RSU and performs the data download protocol; on-board unit OBU of the vehicle as data consumer v obtain the encrypted data of interest from the roadside unit RSU by constructing a guessing access strategy and decrypt the encrypted data to obtain the shared data.

6. The CP-ABE-based privacy protection and efficient data sharing method for vehicular networks according to claim 5, wherein, Step 3.1 specifically includes the following steps: Step 3.1.1: On-Board Unit OBU of the data owner u , setting an access policy W for the data to be shared u = {W u [i]} i∈[1,n] wherein The access policy is a conjunctive normal form of n attribute values; Step 3.1.2: OBU u From the integer group select a random number Step 3.1.3: OBU u Public parameters PK issued by the trusted authority TA N , PK1 to compute the symmetric key K u-TA = e(PK N , PK1) n·d ; Step 3.1.4: OBU u Using the AES symmetric encryption mechanism to encrypt the data M, input the data M and the symmetric key K u-TA , get the ciphertext C u = Enc_K u-TA {M}; Step 3.1.5: OBU u Computing other cryptographic components Step 3.1.6: OBU u By deleting the policy W u Anonymize the access policy by deleting the attribute values other than the attribute value of the access policy, the anonymized access policy is used to prompt the server to indicate which attributes have mandatory requirements for the shared data, and the server and data user cannot know the attribute value u of the corresponding vehicle, thereby achieving the effect of anonymizing the characteristics of the vehicle and protecting the attributes of the vehicle; that is, generating an anonymized access policy W u ′, wherein Step 3.1.7: OBU u Generating shared data cipher and sending the encryption to a roadside unit, RSU, over a secure channel; Step 3.1.8: Upon receiving the OBU u Real identity information IdInfo u and shared encrypted data C u-RSU The roadside unit (RSU) stores its data in a storage server connected to the backbone network.

7. The CP-ABE-based privacy protection and efficient data sharing method for in-vehicle networks according to claim 5, characterized in that, Step 3.2 specifically includes the following steps: Step 3.2.1 : OBU as data user v Building a guess access policy W according to the properties of the data source of interest v and submitting W to the Road Side Unit RSU v and getting from the Road Side Unit RSU the encrypted shared data shared by the data owner vehicle u Step 3.2.2: OBU v Local guess access policy W v where W v = {W v [i]} i∈[1,n] For each attribute value W v [i] of the policy, compute Step 3.2.3: OBU v According to local guess access policy W v where W v = {W v [i]} i∈[1,n] ; for each attribute value in the policy, if the attribute belongs to the attribute list of vehicle v, i.e. W v [i] == List v [i]} i∈[1,n] , i.e. vehicle v owns the attribute, then compute if i.e. the policy does not care about the value of the attribute then compute Step 3.2.4: OBU v Calculation: Step 3.2.5: OBU v Computing Step 3.2.6: Decryption of the encrypted data C by the CP-ABE algorithm u the symmetric key K: Step 3.2.7: OBU v Decrypt the ciphertext C using the symmetric key K u Obtain the shared data M.

Images