Anonymous authentication method based on Hash function group signature in Internet of Vehicles environment

Abstract

This invention discloses an anonymous authentication method based on hash function group signatures in a vehicle-to-everything (V2X) environment. It primarily addresses the shortcomings of existing technologies in achieving anonymous vehicle authentication, such as lack of dynamism and low efficiency in revoking group members and verifying group signatures. The key technical points are: dynamic addition of group members is achieved by constructing two Merkle trees—a main tree and a signature subtree; the group administrator links the new member's signature subtree to the main tree using a hash operation, ensuring the new member generates a correct group signature; group members calculate the hash value of their public key and temporary identifier and send it to the group administrator for authentication, preventing attackers from impersonating members to launch attacks against the group administrator; the verifier verifies the received group signature to determine if the signing user is a legitimate group member, thus achieving anonymous authentication between vehicles in a V2X environment. This invention offers anonymity and security, short group member joining time, and high vehicle authentication efficiency, making it suitable for anonymous authentication in a V2X environment.

Description

Technical fields:

[0001] This invention belongs to the field of information security technology, and specifically relates to an anonymous authentication method that can be used for secure communication in a vehicle-to-everything (V2X) environment. Background technology:

[0002] In recent years, with the rapid development of my country's automobile industry and the improvement of residents' living standards, automobiles have become the main means of transportation for Chinese residents. Intelligent Transportation Systems (ITS), as a typical application of Internet of Things (IoT) technology in the transportation field, have emerged. They combine technologies such as sensing, communication, computing, and artificial intelligence to coordinate the interaction between people, vehicles, and roads, with the aim of establishing an efficient integrated transportation system.

[0003] As a core branch of ITS (Internet of Things), the Internet of Vehicles (IoV) is a large-scale mobile ad hoc network, typically composed of three parts: On-Board Units (OBUs), Roadside Units (RSUs), and Trusted Attorney Centers (TAs). It can provide new solutions for improving the road environment for drivers and passengers, traffic safety, and infotainment dissemination. However, without reliable security authentication and privacy protection mechanisms, attackers can easily impersonate legitimate vehicles to spread false information for malicious purposes, such as causing traffic accidents or monopolizing road resources. They can also easily steal the private information of vehicles, such as their identity and routes, for tracking or preference identification. However, when necessary, authoritative transportation departments still need to be able to quickly and accurately track the true identity of vehicles. Furthermore, due to the high-speed movement of vehicles in IoV, the interaction time between vehicles and between vehicles and roadside units is very limited. Therefore, designing an efficient authentication scheme with conditional privacy protection is essential in IoV. Group signatures, due to their anonymity and traceability, are well-suited to the conditional privacy protection authentication mechanism required in IoV and are therefore widely used in IoV to achieve secure and efficient anonymous authentication of vehicles.

[0004] In a group signature scheme, the overall structure consists of multiple group members and a group administrator. Multiple group members share a single group public key, and each member can anonymously sign messages on behalf of the entire group using their private key. The recipient can verify the signature's validity using the group public key but cannot identify the signer. The group administrator is responsible for registering group members and constructing the group public key during group initialization. When necessary, the administrator can access the group signature to trace the corresponding signer, and can revoke the membership of any member exhibiting dishonest behavior. In a connected vehicle environment, a Vehicle Service Unit (RSU) typically acts as the group administrator for a given group, and all vehicles within that RSU's area constitute the group members.

[0005] Compared to traditional group signature schemes, hash function-based group signature schemes are more resistant to attacks from quantum computers and offer higher security. Furthermore, hash function-based group signature schemes are simple in structure, highly efficient in signing, and do not require updating the group public key when group members join or revoke, making them a hot topic in cryptographic research.

[0006] A hash-based group signature scheme suitable for the Internet of Vehicles (IoV) typically needs to meet three conditions: first, group members can be dynamically added and efficiently revoked; second, signed messages can be quickly verified; and third, it must possess anonymity and traceability. Its application scenarios include... Figure 1 As shown, the model includes four entities: a Trusted Center (TA) responsible for verifying vehicle identity; a group administrator (the RSU); and a dynamic group maintained by each RSU unit, consisting of all vehicles within the RSU's communication range, forming the group members and validators. In this model, users first register with the TA, which verifies their identity. When a user enters an RSU's area, the RSU authenticates the user, issues a private key, and adds them to the group. The user then uses their private key to perform a group signature on a message. Finally, the validator verifies the validity of the group signature. The validator can only verify whether the signature was generated by a legitimate group member, but cannot determine the signer's true identity. If malicious signatures or other improper behavior occur in the group, the RSU can use a signature unlocking algorithm to obtain the signer's true identity for accountability. When the RSU discovers dishonest behavior among group members, it will use an appropriate revocation algorithm to revoke the signature permissions of dishonest users.

[0007] However, existing hash function-based group signature schemes mainly combine one-time signatures and multiple Merkle tree architectures to achieve multiple signatures of messages by group members and the dynamic addition of group members. However, they often cannot simultaneously address the dynamism of group signatures and efficient verification. Furthermore, existing schemes are often inefficient in revoking group members, making them unsuitable for information exchange in a connected vehicle environment.

[0008] The paper "DGM: A Dynamic and Revocable Group Merkle Signature" constructs two types of Merkle trees: a main tree and subtrees. The main tree is only responsible for generating the group public key, while the subtrees are used to verify the group signature. The main tree and subtrees are linked through symmetric encryption. This scheme allows dynamic joining and leaving of group members, but its efficiency is low when revoking group members. The proposed scheme uses punctuated encryption (SPE) to punctuate the information of the revoked member. When verifying the signature, the verifier first performs SPE encryption and decryption on a portion of the signature to check if the signer has been revoked. Only after the check passes does the next step of signature validity verification proceed. While using SPE to revoke group members does not require a revocation list, the SPE encryption and decryption operations themselves have a high computational cost. Furthermore, SPE generates corresponding SPE tags, which the group administrator needs to store, placing high demands on the administrator's storage space.

[0009] The paper "GMMT: A Revocable Group Merkle Multi-tree Signature Scheme" also constructs a multi-tree architecture by building two types of Merkle trees: a main tree and subtrees. However, this scheme links the main tree and subtrees through a one-time signature. Furthermore, this scheme uses a revocation list to revoke group members' signatures. Information about revoked members is added to the revocation list. When verifying a signature, the verifier first checks the revocation list to determine if the current signature was issued by a revoked member. Only after this check is successful does the next step of signature validity verification proceed. While the revocation list used in this method is very convenient to implement and is widely used in dynamic group signatures for revoking group members, the length of the revocation list increases with the number of revoked members, directly impacting the computational cost of verifying group signatures.

[0010] Patent document CN202210689218.7 discloses a blockchain-based certificate authentication method for the Internet of Vehicles (IoV). It primarily addresses the single point of failure, certificate revocation, and lack of trust between cross-nodes in IoV certificate authentication technologies. While this method improves the efficiency of cross-domain identity authentication and reduces authentication costs, it remains a certificate-based authentication method. Each vehicle's identity information is contained within a digital certificate, thus lacking anonymity and making it vulnerable to continuous tracking by adversaries, threatening vehicle safety. Summary of the Invention:

[0011] The purpose of this invention is to address the shortcomings of the prior art by proposing an anonymous authentication method based on hash function group signature in a vehicle-to-everything (V2X) environment, thereby improving the anonymity security of the vehicle authentication process, shortening the time required for group members to join the group, and improving the efficiency of vehicle authentication.

[0012] This technology is suitable for anonymous vehicle authentication in a connected vehicle environment.

[0013] The technical approach to achieving the objective of this invention is as follows: to improve the anonymity and security of the vehicle authentication process by using group signature technology; to shorten the time required for group members to join the group by optimizing the subtree construction process in the hash function-based group signature scheme; and to improve the signature verification efficiency by adding an HMAC-based pre-authentication value to the signature.

[0014] Based on the above ideas, the technical solution of the present invention includes the following steps:

[0015] (1) Adopt a "multi-tree architecture" to realize the dynamic joining and leaving of group members:

[0016] (1a) In the Internet of Vehicles, each roadside unit (RSU) acts as a group administrator and maintains a group. During the initial setup, the RSU constructs a Merkle tree as the main tree using the main tree generation algorithm and uses the root node value of the main tree as the public key gpk of the entire group.

[0017] (1b) When a user requests to join a group, the user uses their one-time public key set as the leaf node of the Merkle tree to build a Merkle tree upwards as the signature subtree. The RSU completes the link between the main tree and the signature subtree, that is, the internal node F closest to the root node of the main tree, except for the root node of the main tree. n Prioritize linking to subtrees; each member joining the group links their own signature subtree to the main tree for dynamic joining.

[0018] (1c) If some members in the group engage in dishonest behavior, the RSU will revoke their membership. The RSU will remove the signature subtree of the revoked member or the member who has left the communication range of the RSU from the main tree to achieve dynamic exit of group members.

[0019] (2) Use certificate authentication to verify the legitimacy of the user's identity through RSU:

[0020] (2a)ID u The user sends their real identity to the Trusted Center (TA) via a secure channel. After receiving the user's real identity, the TA checks the ID in the parameter list IDList. u Is the user whose account has been revoked?

[0021] If so, then a new digital certificate will not be issued to it;

[0022] Otherwise, if you determine that you want to issue a digital certificate to the user, proceed to step (2b);

[0023] (2b) The TA uses its own private key s to issue digital certificates to legitimate users;

[0024] (2c) User ID u After entering a specific RSU area, you send your certificate to the RSU. The RSU verifies the validity of the certificate and then assigns it an ID. u Generate signature key gsk u Temporary Identifier (TID) u Used to calculate the verification key vsk forward key and backward key and the bivariate polynomial f(TID) u (,y), where y is a variable and uses ID. u public key pk u The above information is encrypted and sent to ID. u ;

[0025] (3) User ID u Multiple one-time key pairs are generated, each one-time key pair including a one-time private key OTS.sk and a one-time public key OTS.pk, and a signature subtree is constructed using OTS.pk. The RSU then links the signature subtree to the main tree.

[0026] (4) Users generate a group signature for the message using their own signing private key:

[0027] (4a) User ID u Select an unused one-time private key OTS.sk and generate a one-time signature OTS.σ for the message;

[0028] (4b)ID u Calculate the public key corresponding to the selected private key to the root node r of the signature subtree. SMT The authentication path is path2, and the HMAC value of the one-time signature OTS.σ is calculated using the user's own verification key vsk: hmac = HMAC vsk (OTS.σ);

[0029] (4c) Generate the complete group signature σ based on the results of (4a) and (4b):

[0030] σ={OTS.σ,hmac,OTS.pk,path1,path2,F k}

[0031] Where path1 is the internal node Fn The verification path to the root node of the main tree, F k For internal node F n With the root node r of the signature subtree SMT The link value;

[0032] (5) The verifier performs anonymous authentication of the signing user using the received group signature σ and group public key gpk:

[0033] (5a) After receiving the group signature σ of the message from other users in the group, the verifier uses its own verification key vsk to calculate the HMAC value hmac′ = HMAC of OTS.σ in the group signature. vsk (OTS.σ), and verify whether the user has been revoked: if hmac′ = hmac, then the user has not been revoked, continue to step (5b); otherwise, discard the signature;

[0034] (5b) The verifier uses the one-time public key OTS.pk from the group signature and the one-time signature verification algorithm OTS.verify(OTS.σ, message) to verify whether the one-time signature in the group signature is correct:

[0035] If the signature is correct at once, proceed to step (5c); otherwise, discard the group signature σ.

[0036] (5c) The verifier continues to verify the correctness of the group signature σ using OTS.pk, path1, and path2 in the group signature:

[0037] If the signature is correct, the user who signed it will be authenticated by the verifier.

[0038] Otherwise, the signing user has not been authenticated by the validator, and the group signature σ is discarded.

[0039] Compared with the prior art, the present invention has the following advantages:

[0040] Firstly, the signature of the present invention only includes a pre-authentication value, a one-time signature, and a verification path. The size of the verification path is determined during the initial setup and is independent of the number of group members. This avoids the disadvantage of the existing technical solution, which uses a multi-layer Merkle tree structure, resulting in an increased verification path. Furthermore, since the pre-authentication value is a hash function value, it greatly reduces the signature size compared to the one-time signature that needs to be added in the existing technical solution.

[0041] Secondly, this invention optimizes the construction process of the signature subtree. Each leaf node of the signature subtree is provided by the same user, rather than by multiple users, avoiding the symmetric encryption and sorting operations required in existing schemes, thus significantly accelerating the construction of the signature subtree. Furthermore, because users use temporary identifiers throughout the process, even with simplifications in signature subtree construction, the anonymity of the signature and user privacy are not compromised. In addition, this invention uses a hash function to link subtrees to the main tree, reducing computational overhead during subtree construction and shortening group signature verification time compared to existing schemes that use a one-time signature link between the main tree and signature subtrees.

[0042] Thirdly, this invention introduces an HMAC-based pre-authentication value into the group signature, which allows for the revocation of group members by updating the HMAC verification key. This prevents the revoked member from calculating the new HMAC verification key and thus the correct pre-authentication value, thereby achieving the purpose of revoking the group member. Compared with existing solutions that use time-consuming multiple SPE encryption and decryption to revoke group members or use excessively long revocation lists, this invention improves signature verification efficiency and supports batch revocation of group members, further enhancing the efficiency of revocation.

[0043] Fourth, because this invention introduces an HMAC-based pre-authentication value into group signatures, when verifying group signatures, in addition to verifying the one-time signature of the message and the verification path, it only adds the calculation of the pre-authentication value hmac and the calculation based on F. k and r SMT Calculate F N This approach avoids the additional encryption and decryption operations of SPE in existing schemes, as well as the time-consuming verification of signatures at the root node of the signature subtree and the traditional revocation list mechanism. Simulation results show that, compared with existing dynamic group signatures based on hash functions, this invention reduces the computational overhead in the group signature verification stage by approximately 50%.

[0044] Fifth, in this invention, because a certificate is issued to each legitimate user through a Trusted Center (TA), when a user joins a group, the group administrator verifies the user's certificate to verify the user's identity and completes the information exchange with the user in an encrypted manner in a wireless network environment. Compared with the method of using a secure channel in the existing solution, this invention is more in line with the actual communication needs of the Internet of Vehicles. Attached image description:

[0045] Figure 1 This is a schematic diagram illustrating an application scenario of the present invention;

[0046] Figure 2 This is a schematic diagram of an existing vehicle-to-everything (V2X) model.

[0047] Figure 3 This is a flowchart illustrating the implementation of the present invention;

[0048] Figure 4 This is a schematic diagram of the multi-tree architecture for group signatures in this invention;

[0049] Figure 5 This is a schematic diagram of the verification key chain update in this invention;

[0050] Figure 6 This image shows a simulation comparison of the computational overhead of the present invention and existing hash function-based group signature methods for anonymous vehicle authentication in a vehicle-to-everything (V2X) environment. Detailed implementation method:

[0051] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, other embodiments obtained by those skilled in the art without creative effort should all fall within the protection scope of the present invention.

[0052] Reference Figure 1 The application scenario of this invention is based on an existing interactive system, which includes a Trusted Center (TA), Roadside Units (RSUs), vehicle users, and a verifier. The interaction process is as follows: First, the user registers with the TA, and the TA generates a certificate for the user. When the user enters a certain RSU area, they need to use the digital certificate issued by the TA to authenticate their identity with the RSU. After authentication, the RSU issues a private key to the user and adds them to the group. Then, the user can use their private key to perform a group signature on the message. Finally, the verifier verifies the validity of the group signature, thereby completing the anonymous authentication of the signing user.

[0053] The core idea of ​​this invention is to incorporate an HMAC pre-authentication value into the group signature to achieve efficient signature verification and rapid revocation of group member authorization. When a group member requests to join the group, the group administrator verifies the certificate held by the member. Upon successful verification, a temporary identity identifier (TID) is issued to the member. u The key gsk used to generate the signature uAnd other necessary information. After receiving this information, group members calculate the corresponding verification key vsk. In the subsequent signing phase, in addition to generating a one-time signature of the signed message and the corresponding verification path, group members also need to calculate the HMAC value of the one-time signature under the verification key vsk as part of the entire group signature. The verifier, and other group members, when verifying a signature, first calculate the corresponding HMAC value HMAC based on their own verification key vsk and the one-time signature in the signature. vsk If the HMAC value (OTS.σ) is the same as the HMAC value in the signature, proceed to the next step of signature validity verification; otherwise, it is considered an invalid signature.

[0054] If a group administrator discovers dishonest behavior by some group members, the administrator will remove those members from the group so that they cannot generate a correct group signature.

[0055] This example uses the Internet of Vehicles (IoV) to demonstrate anonymous identity authentication between vehicles.

[0056] like Figure 2 As shown, its vehicle-to-everything (V2X) network includes a Trusted Data Center (TA), Roadside Units (RSUs), and vehicle users. The TA, serving as the computing and storage center for the entire V2X network, possesses strong computing power and storage capacity. It communicates with the RSUs via wired transmission. The V2X network contains multiple RSUs and users; all users are group members, and information exchange between RSUs and users, as well as between users themselves, is conducted wirelessly.

[0057] Reference Figure 3 The implementation steps for this example are as follows:

[0058] Step 1: During the initial setup of the group, the roadside unit (RSU) constructs a Merkle tree as the group master tree.

[0059] 1.1) RSUs can be selected from any 2 H-1 Use a random number as the value of the leaf node of the Merkle tree, and then use the concatenation operation and hash operation on the values ​​of every two adjacent leaf nodes to obtain the value of their parent node;

[0060] 1.2) Perform concatenation and hash operations on the values ​​of every two adjacent parent nodes to obtain the value of the parent node at the next higher level;

[0061] 1.3) Repeat step 1.2) to construct a Merkle tree of height H as the group master tree, as follows: Figure 4 As shown, the root node of the main tree is denoted as gpk and published outwards.

[0062] Step 2: Implement dynamic joining and leaving of group members using a "multi-tree architecture":

[0063] 2.1) When a user requests to join a group, the user uses their one-time public key set as the leaf node of the Merkle tree to build an upward Merkle tree for verifying the one-time signature as the signature subtree. The RSU completes the link between the main tree and the signature subtree, that is, the internal nodes F closest to the root node of the main tree, excluding the root node of the main tree. n Prioritize linking to subtrees; each member joining the group links their own signature subtree to the main tree for dynamic joining.

[0064] 2.2) If some members of the group engage in dishonest behavior, the RSU will remove them from the list:

[0065] 2.2.1) The RSU determines dishonest behavior, including the posting of false information, and lists users who engage in such behavior as revoked members;

[0066] 2.2.2) The RSU broadcasts the key update information B to all users in the group. j+1 :

[0067] B j+1 ={r j+1 (x)}∪{p j+1 (x)}

[0068] Where, r j+1 (x)=(x-TID r1 (x-TID) r2 )…(x-TID rw )

[0069]

[0070] TID r1 …TID rw x is a temporary identifier for the group members whose membership was revoked in this round, and x is a variable;

[0071] 2.2.3) All users in the group will receive the update information B j+1 Then, the key vsk used to calculate the new round of verification is calculated. j+1 forward key and backward key Value:

[0072]

[0073] Among them, TID i A temporary identity identifier for each group member;

[0074] 2.2.4) According to and The value of vsk is used by all non-revoked group members to calculate a new verification key for the next round. j+1 : like Figure 5 As shown,

[0075] in, From the previous round of forward key The result is obtained by performing a hash operation. The hash value is the backward key from the previous round. The value is used to perform addition and hash operations on the corresponding forward and backward keys to obtain the verification key. Both the forward and backward keys are stored by the RSU in the form of a key chain.

[0076] 2.3) Users whose licenses have not been revoked will be verified using a new verification key, vsk. j+1 Continue generating the correct group signature for identity authentication, while all revoked group members must first send their temporary identity identifier (TID). r Substituting the polynomial r j+1 Calculate r in (x) j+1 (TID r The value of ) is determined by the expression r listed in step 2.2.2). j+1 r in (x) j+1 (TID r The value is 0, which is the expression listed in step 2.2.3). The denominator r j+1 (TID r The value is 0, therefore the revoked member cannot perform subsequent calculations to derive the new verification key vsk. j+1 If the value is incorrect, the correct group signature cannot be generated, and the signing qualification will be revoked.

[0077] 2.4) The RSU removes the signature subtree of revoked members or group members that have left the communication range of the RSU from the main tree to enable dynamic exit of group members.

[0078] Step 3: The Trusted Center (TA) issues digital certificates to legitimate users.

[0079] 3.1) ID u The user sends their real identity to the Trusted Center (TA) via a secure channel. After receiving the user's real identity, the TA checks the ID in the parameter list IDList. u Is the user whose account has been revoked?

[0080] If so, a new digital certificate will not be issued to it;

[0081] Otherwise, a digital certificate must be issued to the user, proceeding to step 3.2);

[0082] 3.2) For User ID u TA selects a random number As ID u private key sk u Used for communication with RSU and for generating the corresponding public key pk. u =vP;

[0083] 3.3) The user uses their private key s to access the user ID. u public key pk u Sign the document to create a certificate (Certificate). u :

[0084] Cert u =sign(s,(pk) u ,hash(pk u ))

[0085] Wherein, Sign(s,(pk) u ,hash(pk u ))) refers to TA using private key s to access information (pk) u ,hash(pk u Sign the hash(pk) u ) refers to the user ID u public key pk u The value obtained by performing a hash operation;

[0086] 3.4) TA will sk u and Cert u Securely send to ID u and will pk u and ID u The associated data is stored in the parameter list IDList.

[0087] Step 4: Use certificate authentication to verify the legitimacy of the user's identity through RSU.

[0088] 4.1) User ID u After entering a specific RSU area, you send your certificate to the RSU. The RSU verifies the validity of the certificate and then assigns it an ID. u Generate signature key gsk u Temporary Identifier (TID) u The forward key used to calculate the verification key vsk and backward key and the bivariate polynomial f(TID) u (,y), where y is a variable and uses ID. u public key pku The above information is encrypted and sent to ID. u ;

[0089] 4.2) RSU uses TA's public key Pub to verify the digital certificate Cert. u Decryption is performed to obtain the information (pk) from the digital certificate. u ,hash(pk u ));

[0090] 4.3) RSU on the pk in the certificate u Perform a hash operation to obtain the hash value hash′(pk) u This will determine whether the user's digital certificate is valid.

[0091] If hash′(pk) u = hash(pk) u If the digital certificate is valid, proceed to step 5.

[0092] Otherwise, the digital certificate is invalid.

[0093] Step 5: User ID u Use the signing key gsk u Generate multiple one-time key pairs.

[0094] 5.1) ID u Choose a compression parameter ω (ω∈N, ω>1), which is related to the one-time signature size and signature generation time;

[0095] 5.2)ID u Choose an iteration function: This iterative function is used to compute the user's one-time public key. During the iterative computation, the output value of each iteration is used as the key for the next iteration. Where k is the key value of the iteration function f, i is the number of iterations of the iteration function f, and a is the input of the iteration function f;

[0096] 5.3)ID u Choose a random value x ← {0, 1} n Then, use your own signing private key gsk u 2 is generated as the key seed using the pseudo-random number generator PRNG. h-1 There are 1 one-time signature keys, each containing a random bit string of length l, i.e., OTS.sk = (sk1, ..., sk2) l )←{0,1} (n,l) ,

[0097] Where n is the output length of f, and the formula for calculating l is:

[0098] l = l1 + l2,

[0099] m is the output length of the hash function, and log(*) is the logarithm function with base 2;

[0100] 5.4)ID u Using the l-bit string from the one-time key OTS.sk as the key of the iteration function f, and the random number x as the input to the iteration function f, the calculation is performed ω-1 times to obtain the one-time public key OTS.pk:

[0101]

[0102] Step 6: RSU constructs a signature subtree based on the user's multiple one-time key pairs, and then links the signature subtree to the main tree.

[0103] 6.1)ID u PK your public key u With ID u Temporary Identifier (TID) u The authentication value hash(pk) is obtained by performing concatenation and hash operations sequentially. u ||TID u );

[0104] 6.2)ID u Combine the one-time public key set OTS.pks and the authentication value hash(pk) u ||TID u Send to RSU;

[0105] 6.3) RSU receives ID u After receiving the message, first hash the authentication value (pk). u ||TID u After verification, OTS.pks is used as the leaf node of the signature subtree to construct a Merkle tree of height h, and the root node of this Merkle tree is denoted as r. SMT ;

[0106] 6.4) RSU calculation of internal nodes F of the main tree n The verification path path1 to the root node gpk of the main tree and the path path to the root node r of the subtree, respectively. SMT Link value: This means linking the signature subtree to the group's main tree;

[0107] 6.5) RSU will link value F k And use ID to verify path1 u public key pk uSend to user ID after encryption u .

[0108] Step 7: The user generates a one-time signature for the message using their own signing private key.

[0109] 7.1) User ID u Perform a hash operation on the message to obtain a message digest hash(message), and divide it into l1 groups, denoted as M:

[0110]

[0111] Where M i ∈{0,…,ω-1} is the i-th bit string consisting of log(ω) bits of "0" and "1" in the message digest hash(message), and this bit string is converted into the corresponding decimal number, i = 1,…,l1. ω is the compression parameter, and m is the output length of the hash function;

[0112] 7.2) User ID u Calculate the checksum C based on the grouping:

[0113]

[0114] 7.3) Convert the checksum C to binary, and then convert it to decimal as a group of log(ω) bits of "0" and "1" bits. Finally, represent C as...

[0115] 7.4) Based on the results of steps 7.2) and 7.3), obtain the number of iterations used to generate the one-time signature. denoted as (b1,…,b) l );

[0116] 7.5) Based on the calculation result of step 7.4), User ID u Generate a one-time signature for the message OTS.σ:

[0117]

[0118] in, This represents an iterative function with key value sk1, input x, and iteration count b1.

[0119] This indicates that the key value is sk l The input is x, and the number of iterations is b. l The iterative function.

[0120] Step 8: User IDu Calculate the public key corresponding to the selected one-time private key to the root node r of the signature subtree. SMT The authentication path path2 is determined, and the group signature of the message is calculated.

[0121] 8.1) Select h node values ​​(a0, a1, ..., a) from the signature subtree. n-1 ) is used as the verification path path2, where the value of h is the height of this signature subtree;

[0122] 8.2) Use the sibling node value of the leaf node corresponding to the one-time public key as the value of a0 in path2, use the sibling node value of the parent node of a0 as the value of a1, use the sibling node value of the parent node of a1 as the value of a2, and so on to obtain a3…,a n-1 The value of .

[0123] 8.3) Based on the one-time signature of the message calculated in step 7 and the verification path path2 in step 8.2), calculate the HMAC value of the one-time signature OTS.σ using your own verification key vsk: hmac = HMAC vsk (OTS.σ) yields the group signature σ of the message:

[0124] σ={OTS.σ,hmac,OTS.pk,path1,path2,F k}

[0125] Step 9: The verifier performs anonymous authentication of the signing user using the received group signature σ and group public key gpk.

[0126] 9.1) After receiving the group signature σ of the message from other users in the group, the verifier uses its own verification key vsk to calculate the HMAC value hmac′ = HMAC of OTS.σ in the group signature. vsk (OTS.σ), and verify whether the user has been revoked:

[0127] If hmac′ = hmac, then the user has not been revoked, continue to step 9.2);

[0128] Otherwise, discard the signature;

[0129] 9.2) The verifier uses the one-time public key OTS.pk from the group signature and the one-time signature verification algorithm OTS.verify(OTS.σ, message) to verify whether the one-time signature in the group signature is correct:

[0130] 9.2.1) The verifier calculates B = (b1, ..., b) based on the signed message. l The value of );

[0131] 9.2.2) The verifier calculates the verification signature formula based on the calculation result of step 9.2.1):

[0132]

[0133] in, This represents an iterative function with key value σ1, input pk0, and iteration count ω-1-b1;

[0134] Indicates a key value of σ l The input is pk0, and the number of iterations is ω-1-b. l The iterative function;

[0135] 9.2.3) The verifier compares the calculation result of step 9.2.2) with the one-time public key OTS.pk:

[0136] like If the one-time signature is correct, proceed to step 9.3);

[0137] Otherwise, the one-time signature is incorrect and should be discarded.

[0138] 9.3) The verifier continues to verify the correctness of the group signature σ using OTS.pk, path1, and path2 in the group signature:

[0139] 9.3.1) The verifier uses OTS.pk and path2 from the group signature to calculate the root node value r′ of the signature subtree. SMT ;

[0140] 9.3.2) The verifier uses r′ SMT F in group signature k Calculate the values ​​of internal nodes in the main tree linked to the signature subtree.

[0141] 9.3.2) According to F′ n The value of the root node of the main tree, gpk′, is calculated using the Merkle path verification algorithm, along with the value of path1. Figure 4 As shown;

[0142] 9.3.4) The verifier compares the calculated gpk′ value with the group public key gpk value:

[0143] If gpk′ = gpk, then the signature is valid and the user has been authenticated by the verifier.

[0144] Otherwise, the signature is invalid, the user who signed it has not passed the verifier's identity authentication, and the group signature σ is discarded, thus completing the anonymous identity authentication between users in the vehicle network environment.

[0145] The effects of this invention can be further illustrated by the following simulation experiments.

[0146] I. Simulation Conditions: The experiments of this invention were run on a 64-bit Linux server (Debian 10.x), with an AMD Ryzen 7-5800H CPU and 16GB of memory. The Crypto++700 cryptographic library was used in the experiments.

[0147] II. Simulation Content:

[0148] Under the above conditions, the computational overhead of the present invention and existing hash function-based group signature methods DGM and GMMT in the group signature verification stage were simulated, and the results are as follows. Figure 6 As shown.

[0149] from Figure 6 It can be seen that the computational cost of this invention in the group signature verification stage is 3.4ms, while the computational cost of the existing hash function-based group signature method DGM is 5.23ms and the computational cost of the existing hash function-based group signature method GMMT is 6.455ms. Compared with the DGM method, the computational cost of this invention is reduced by about 30%, and compared with the GMMT method, the computational cost is reduced by about 50%. This shows that this invention can greatly improve the efficiency of group signature verification, accelerate the anonymous identity authentication between vehicles, and improve the efficiency of vehicle authentication.

[0150] It should be noted that the step numbers in the specification and claims of this invention are only for the purpose of clearly describing the embodiments of this invention and facilitating understanding, and their order is not limited.

Claims

1. An anonymous authentication method based on hash function group signature in a vehicle-to-everything (V2X) environment, characterized in that, Includes the following steps: (1) Adopt a "multi-tree architecture" to realize the dynamic joining and leaving of group members: (1a) In the Internet of Vehicles, each roadside unit (RSU) acts as a group administrator and maintains a group. During the initial setup, the RSU constructs a Merkle tree as the main tree using the main tree generation algorithm and uses the root node value of the main tree as the public key gpk of the entire group. (1b) When a user requests to join a group, the user uses their one-time public key set as the leaf node of the Merkle tree to build a Merkle tree upwards as the signature subtree. The RSU completes the link between the main tree and the signature subtree, that is, the internal node F closest to the root node of the main tree, except for the root node of the main tree. n Prioritize linking to subtrees; each member joining the group links their own signature subtree to the main tree for dynamic joining. (1c) If some members in the group engage in dishonest behavior, the RSU will revoke their membership. The RSU will remove the signature subtree of the revoked member or the member who has left the communication range of the RSU from the main tree to achieve dynamic exit of group members. (2) Use certificate authentication to verify the legitimacy of the user's identity through RSU: (2a)ID u The user sends their real identity to the Trusted Center (TA) via a secure channel. After receiving the user's real identity, the TA checks the ID in the parameter list IDList. u Is the user whose account has been revoked? If so, then a new digital certificate will not be issued to it; Otherwise, if you determine that you want to issue a digital certificate to the user, proceed to step (2b); (2b) The TA uses its own private key s to issue digital certificates to legitimate users; (2c) User ID u After entering a specific RSU area, you send your certificate to the RSU. The RSU verifies the validity of the certificate and then assigns it an ID. u Generate signature key gsk u Temporary Identifier (TID) u The forward key used to calculate the verification key vsk and backward key and the bivariate polynomial f(TID) u (,y), where y is a variable and uses ID. u public key pk u GSK u , TID u and f(TID) u ,y) The information is encrypted and sent to ID u ; (3) User ID u Multiple one-time key pairs are generated, each one-time key pair including a one-time private key OTS.sk and a one-time public key OTS.pk, and a signature subtree is constructed using OTS.pk. The RSU then links the signature subtree to the main tree. (4) Users generate a group signature for the message using their own signing private key: (4a) User ID u Select an unused one-time private key OTS.sk and generate a one-time signature OTS.σ for the message; (4b)ID u Calculate the public key corresponding to the selected private key to the root node r of the signature subtree. SMT The authentication path is path2, and the HMAC value of the one-time signature OTS.σ is calculated using the user's own verification key vsk: hmac = HMAC vsk (OTS.σ); (4c) Generate the complete group signature σ based on the results of (4a) and (4b): σ={OTS.σ,hmac,OTS.pk,path1,path2,F k } Where path1 is the internal node F n The verification path to the root node of the main tree, F k For internal node F n With the root node r of the signature subtree SMT The link value; (5) The verifier performs anonymous authentication of the signing user using the received group signature σ and group public key gpk: (5a) After receiving the group signature σ of the message from other users in the group, the verifier uses its own verification key vsk to calculate the HMAC value hmac′ = HMAC of OTS.σ in the group signature. vsk (OTS.σ), and verify whether the user has been revoked: if hmac′ = hmac, then the user has not been revoked, continue to step (5b); otherwise, discard the signature; (5b) The verifier uses the one-time public key OTS.pk from the group signature and the one-time signature verification algorithm OTS.verify(OTS.σ, message) to verify whether the one-time signature in the group signature is correct: If the signature is correct in one go, proceed to step (5c); otherwise, discard the group signature σ. (5c) The verifier continues to verify the correctness of the group signature σ using OTS.pk, path1, and path2 in the group signature: If the signature is correct, the user who signed it will be authenticated by the verifier. Otherwise, the user who signed the signature failed the verifier's authentication, and the group signature σ was discarded.

2. The method according to claim 1, characterized in that, Step (1a) The roadside unit (RSU) constructs a Merkle tree as the group master tree using a master tree generation algorithm, as follows: (1a1) Select any 2 from each RSU H-1 Use a random number as the value of the leaf node of the Merkle tree, and then use the concatenation operation and hash operation on the values ​​of every two adjacent leaf nodes to obtain the value of their parent node; (1a2) Perform concatenation and hash operations on the values ​​of every two adjacent parent nodes obtained from the calculation to obtain the value of the parent node at the next higher level. (1a3) Repeat step (1a2) to build a Merkle tree of height H as the group master tree.

3. The method according to claim 1, characterized in that, In step (1c), the RSU revoked the membership of some members in the group for dishonest behavior, as follows: (1c1) The RSU identifies dishonest behavior as including the posting of false information and lists users who engage in such behavior as revoked members; (1c2) RSU broadcasts key update information to all users in the group. j+1 : B j+1 ={r j+1 (x)}∪{p j+1 (x)} Where, r j+1 (x)=(x-TID r1 (x-TID) r2 )…(x-TID rw ) TID r1 …TID rw x is a temporary identifier for the group members whose membership was revoked in this round, and x is a variable. (1c3) All users in the group will receive the update information B j+1 Then, the key vsk used to calculate the new round of verification is calculated. j+1 forward key and backward key Value: Among them, TID i A temporary identity identifier for each group member; (1c4) According to and The value of vsk is used by all non-revoked group members to calculate a new verification key for the next round. j+1 : (1c5) Based on the new round of verification key vsk j+1 Continue generating the correct group signature for identity verification, while all revoked group members are removed due to r j+1 (TID r If the value of ) is 0, then the new verification key vsk cannot be calculated. j+1 If the value is too low, the correct group signature cannot be generated, and the signing qualification will be revoked.

4. The method according to claim 1, characterized in that, In step (2b), the Trusted Center (TA) uses its own private key s to issue digital certificates to legitimate users, as follows: (2b1) For user ID u TA selects a random number As user ID u private key sk u Used for communication with RSU and for generating the corresponding public key pk. u =vP; (2b2)TA uses their own private key s to access the user ID. u public key pk u Sign the document to create a certificate (Certificate). u : Cert u =Sign(s,(pk u ,hash(pk u ))), Wherein, Sign(s,(pk) u ,hash(pk u ))) refers to TA using private key s to access information (pk) u ,hash(pk u Sign the hash(pk) u ) refers to the user ID u public key pk u The value obtained by performing a hash operation; (2b3)TA will sk u and Cert u Securely send to ID u and will pk u and ID u The associated data is stored in the parameter list IDList.

5. The method according to claim 1, characterized in that, In step (2c), the roadside unit (RSU) checks the user's digital certificate Cert. u Perform a legality check, as follows: (2c1) RSU uses TA's public key Pub to verify the digital certificate Cert. u Decryption is performed to obtain the information (pk) from the digital certificate. u ,hash(pk u )); (2c2)RSU on the pk in the certificate u Perform a hash operation to obtain the hash value hash′(pk) u This will determine whether the user's digital certificate is valid. If hash′(pk) u = hash(pk) u If the digital certificate is valid, then it is valid. Otherwise, the digital certificate is invalid.

6. The method according to claim 1, characterized in that, User ID in step (3) u Multiple one-time key pairs are generated to construct a signature subtree, which is then linked to the main tree by RSU, as follows: (3a)ID u Choose a compression parameter ω (ω∈N, ω>1), which is related to the one-time signature size and signature generation time; (3b)ID u Choose an iteration function: k is the key value of the iteration function f, i is the iteration number of the iteration function f, and a is the input of the iteration function f; during iterative calculation, the output value of each iteration is used as the key value for the next iteration, such as... (3c)ID u Choose a random value x ← {0, 1} n Then, use your own signing private key gsk u 2 is generated as the key seed using the pseudo-random number generator PRNG. h-1 There are 1 one-time signature keys, each containing a random bit string of length l, i.e., OTS.sk = (sk1, ..., sk2) l )←{0,1} (n,l) , Where n is the output length of f, and the formula for calculating l is: l＝l1+l2， Where m is the output length of the hash function, and log(*) is the logarithmic function with base 2; (3d)ID u Using the l-bit string from the one-time key OTS.sk as the key of the iteration function f, with x as the input to f, the iteration is performed ω-1 times to obtain the one-time public key OTS.pk: (3e)ID u PK your public key u With ID u Temporary Identifier (TID) u The authentication value hash(pk) is obtained by performing concatenation and hash operations sequentially. u ||TID u ); (3f)ID u Combine the one-time public key set OTS.pks and the authentication value hash(pk) u ||TID u Send to RSU; (3g)RSU received ID u After receiving the message, hash(pk) of the authentication value. u ||TID u After verification, OTS.pks is used as the leaf node of the signature subtree to construct a Merkle tree of height h, and the root node of this Merkle tree is denoted as r. SMT ; (3h) RSU calculates the internal node F of the main tree. n and subtree root node r SMT link value and the internal node F of the main tree n The verification path path1 to the root node gpk of the main tree; (3i)RSU will link value F k And use ID to verify path1 u public key pk u Send to ID after encryption u .

7. The method according to claim 1, characterized in that, User ID in step (4a) u Select an unused one-time private key OTS.sk to perform a one-time signature on the message, as follows: (4a1) User ID u Perform a hash operation on the message to obtain a message digest hash(message), and divide the hash(message) into l1 groups, denoted as M: Where M i ∈{0,…,ω-1} is the i-th bit sequence, where each log(ω) bits of the message digest hash (message) is grouped into a set of "0" and "1" bits, and this set of bits is converted into its corresponding decimal number, i = 1,…,l1. ω is the compression parameter, and m is the output length of the hash function; (4a2) User ID u Calculate the checksum C: (4a3) Convert the checksum C to binary, and then convert it to decimal as a group of "0" and "1" bits per log(ω) bit. Finally, represent C as... (4a4) Based on the results of steps (4a1) and (4a3), obtain the number of iterations used to generate the one-time signature. denoted as (b1,…,b) l ); (4a5) Based on the calculation result of step (4a4), User ID u Generate a one-time signature for the message OTS.σ: in, This represents an iterative function with key value sk1, input x, and iteration count b1. This indicates that the key value is sk l The input is x, and the number of iterations is b. l The iterative function.

8. The method according to claim 1, characterized in that, ID in step (4b) u Calculate the public key corresponding to the selected private key to the root node r of the signature subtree. SMT The authentication path path2 is implemented as follows: (4b1) Select h node values ​​(a0, a1, ..., a) from the signature subtree. n-1 ) is used as the verification path path2, where the value of h is the height of this signature subtree; (4b2) Take the sibling value of the leaf node corresponding to the one-time public key as the value of a0 in path2, take the sibling value of the parent node of a0 as the value of a1, take the sibling value of the parent node of a1 as the value of a2, and so on to obtain a3...,a n-1 The value of .

9. The method according to claim 1, characterized in that, In step (5b), the verifier uses the one-time public key OTS.pk from the group signature and the one-time signature verification algorithm OTS.verify(OTS.σ, message) to verify whether the one-time signature in the group signature is correct, as follows: (5b1) The verifier calculates B = (b1, ..., b) based on the signed message. l The value of ); (5b2) The verifier calculates the verification signature formula based on the calculation result of step (5b1): in, This represents an iterative function with key value σ1, input pk0, and iteration count ω-1-b1; Indicates a key value of σ l The input is pk0, and the number of iterations is ω-1-b. l The iterative function; (5b3) The verifier compares the result of step (5b2) with the one-time public key OTS.pk: like Then the one-time signature is correct; Otherwise, the one-time signature is incorrect.

10. The method according to claim 1, characterized in that, In step (5c), the verifier continues to verify the correctness of the group signature σ using OTS.pk, path1, and path2 in the group signature, as follows: (5c1) The verifier uses OTS.pk and path2 from the group signature to calculate the root node value r′ of the signature subtree. SMT ; (5c2) The validator uses r′ SMT F in group signature k Calculate the values ​​of internal nodes in the main tree linked to the signature subtree. Using F′ n The value of the root node of the main tree, gpk′, is calculated using path1; (5c3) The verifier compares the calculated gpk′ value with the group public key gpk value: If gpk′=gpk, then the group signature is a valid signature; Otherwise, the group signature is invalid.

Images