A data security transmission system for vehicle networking

Abstract

The present invention discloses a data security transmission system for vehicle networking, which belongs to the technical field. In the present invention, a multi-receiver signcryption scheme can be used to realize encryption and authentication of multiple receivers in one logical step, which has lower communication cost and computational complexity, and adopts lattice cryptographic encryption to achieve resistance to quantum attacks; at the same time, a one-to-many multi-receiver signcryption scheme is realized, which can transform a message sent to multiple receivers into one ciphertext instead of multiple ciphertexts, effectively reducing the computational cost and transmission cost of message processing while ensuring the confidentiality and authentication of the transmitted message; a heterogeneous signcryption scheme is constructed, which realizes the transition from a certificateless public key cryptography system CLC to a public key cryptography system PKC scheme based on a public key infrastructure, thereby improving the security and reliability of the overall system.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security transmission, and specifically relates to a data security transmission system for an Internet of Vehicles. Background Art

[0002] With the continuous development of information networks, when communicating parties transmit or share information, they need to ensure that the communication data in the open network is transmitted securely. The security of early public key cryptographic schemes is mostly based on the difficulty of solving traditional difficult mathematical problems, such as the difficulty of solving discrete logarithm problems. Due to the limited efficiency of early operations, public key cryptographic schemes constructed based on traditional difficult mathematical problems may not be cracked within the effective time limit, or after the plaintext is cracked, the plaintext is no longer important. For difficult mathematical problems such as discrete logarithms, Shor gave a quantum polynomial time algorithm that greatly shortened the time limit for cracking early passwords, making traditional public key cryptographic schemes based on the difficulty of solving difficult mathematical problems threatened. With the continuous development of quantum computing, cryptographic schemes that are resistant to quantum attacks have become an important research topic.

[0003] However, in the existing data security transmission system, when conducting network communication, the signcrypted ciphertext needs to be sent to multiple recipients. If the signcrypted ciphertext is sent point-to-point to different users in sequence, it is obviously very inefficient and the communication cost is also very high. At the same time, when users of the same system conduct secure communication, they can conveniently use the same cryptographic system, but there are technical difficulties in secure communication between users of different systems. Summary of the invention

[0004] The purpose of the present invention is to provide a data security transmission system for vehicle networking in order to solve the above-mentioned problems.

[0005] The technical solution adopted by the present invention is as follows: a data security transmission system for vehicle networking, characterized in that: the system includes: a trusted agency TA, a key production center KGC, a vehicle unit OBU, a vehicle computing server VEC, an authorized third-party user AU and a core cloud server CS;

[0006] The trusted institution TA is provided with a registration module. Before each vehicle shares data, the vehicle station and the third-party user register with the trusted institution TA;

[0007] The KGC key production center generates a public-private key pair;

[0008] The vehicle computing server VEC is internally provided with an information storage module, and the vehicle generates a random key to encrypt the collected data information and save it to the vehicle computing server VEC;

[0009] The core cloud server CS stores the signed information and the security index of the vehicle data;

[0010] When the key generation center KGC generates a key, the trusted institution TA generates a partial private key T0=sk for the vehicle through a secure and trusted key generation center KGC. ID0 , and generate corresponding public and private keys for third-party users. The public key pair of d recipients is (A r1 , T r1 ),…,(A rd , T rd ); After the vehicle sender receives T0, it randomly selects T1 and calculates

[0011] The sender's public and private key pair is (A s ,T s );

[0012] The key generation algorithm of the key generation center KGC includes:

[0013] After OUB (referred to as the sender) and the authorized third-party user AU (referred to as the receiver) complete registration with the trusted institution TA, they generate their own public and private keys;

[0014] 1. Vehicle key generation:

[0015] (1) For the vehicle sender whose identity is IDs, KGC runs the key generation algorithm and obtains the sender's partial key T0=sk ID0 , KGC sends T0 to the sender

[0016] (2) After receiving T0, the sender randomly selects T1∈{-d,…,0,…,d} m*k， and And calculate From the generation process of T0 and T1, we know that:

[0017]

[0018] The sender's public and private key pair is (A s ,T s );

[0019] 2. Authorized third-party user AU third-party user key generation:

[0020] (1) For the authorized third-party user AU whose identity is IDr, KGC calls the trap generation algorithm TrapGen(q,n,m) to obtain the matrix pair As the public-private key pair of the authorized third-party user AU, here A r T ＝ 0modq, Less than or equal to L

[0021] (2). The public key pair of d recipients is (A r1 , T r1 ),…,(A rd , T rd ).

[0022] In a preferred embodiment, the vehicle computing server VEC performs encryption operation on the data before sending it to the edge computing server. The vehicle generates a random symmetric session key α, which is used to encrypt the data collected by the vehicle in real time. encryption The encrypted ciphertext ψ is stored in the vehicle computing server VEC, and the vehicle computing server VEC returns The storage position pos.

[0023] In a preferred embodiment, the vehicle unit OBU uses the signcryption key T s , the random symmetric session key α is used to perform multi-recipient signcryption operation at storage location pos, and the signcrypted ciphertext C corresponding to the random key α and storage location pos is returned, and the signcrypted ciphertext C is placed in the core cloud server CS.

[0024] In a preferred embodiment, the authorized third-party user AU obtains the signcrypted ciphertext C from the core cloud server CS, and uses its own private key to perform a decryption algorithm to obtain a decryption data The random key α and the storage location pos of the ciphertext C.

[0025] In a preferred embodiment, the authorized third-party user AU obtains the ciphertext ψ in the vehicle computing server VEC according to the storage location pos, and performs a decryption operation using the random key α to obtain the data .

[0026] In a preferred embodiment, the initialization algorithm Setup of the data security transmission system includes:

[0027] The trusted authority TA inputs the security parameter n

[0028] (1) Order δ1∈(0,1) is a constant, is the Gaussian parameter;

[0029] (2) k is the number of authorized third-party users (AUs), 1≤k≤d, d is a polynomially bounded constant; t = ω(logn).

[0030] (3) and H2:{0,1} *→{0,1} l , These are three collision-stable hash functions;

[0031] (4) The message space is

[0032] (5) The key generation center KGC runs TrapGen(q,n) and outputs Hog ∧ ⊥ (A) base T, master public key A, secret master private key T

[0033] (6) Key generation algorithm run by KGC: For identity ID i ∈{0,1} * , run SampleMat(A,T,s,H4(ID i ))get

[0034] In a preferred embodiment, the authorized third-party user AU obtains the encrypted ciphertext ψ from the vehicle computing server VEC according to the location information pos in the edge computing server; uses the random key α obtained by decryption to calculate and judge Ensure data integrity, if established receive message Otherwise, don’t answer.

[0035] In a preferred embodiment, the vehicle unit OBU generates a random key α for encrypting data and calculates the data collected by the vehicle Security Index

[0036] Use the random key α to convert the data Encryption, i.e. ciphertext The ciphertext ψ is stored in the vehicle computing server VEC, and the vehicle computing server VEC returns the storage location pos.

[0037] In a preferred embodiment, the step of sharing after POS position signcryption includes:

[0038] Select n third-party users R = {ID1, ID2...ID k}, the storage location pos and the random key α are signed, the process is as follows:

[0039] 1.

[0040] 2Signature

[0041] (1) Randomly select ζ∈{0,1} t,

[0042] (2) Calculation

[0043] (3) Sampling make

[0044] (4) Order

[0045] The output C = (ζ, c1, c2) is transmitted to the core cloud server CS as ciphertext.

[0046] In a preferred embodiment, when the authorized third-party user AU obtains the data about vehicle sharing in the core cloud server CS, it downloads the signcrypted ciphertext C from the core cloud server CS and uses the corresponding public and private keys to decrypt the signcryption; the specific steps are as follows:

[0047] Unsigncrypt(C,skri,pks)

[0048] (1) Known sk ri =T ri , calling the algorithm SampleBasis(A r ,T ri ), get the grid (Ar) high quality base Tr

[0049] (2) Using T r from Restore v and e

[0050] (3) Order

[0051] (4) Verification and ∥e∥≤σ; if both are true, receive the message Otherwise, reject;

[0052] (5) Extract α according to the negotiated symmetric key length and obtain the storage position pos.

[0053] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0054] 1. In the present invention, encryption and authentication of multiple receivers can be realized simultaneously in one logical step through a multi-recipient signcryption scheme, which has lower communication cost and computational complexity, and therefore has higher practical value. Due to the diversity of public key cryptographic systems, the security technologies used by communication systems are also different. The heterogeneous signcryption scheme solves the communication problem between communication systems using different security technologies, and enables people in two different cryptographic systems to communicate securely.

[0055] 2. In the present invention, lattice cryptography is adopted to realize resistance to quantum attacks; at the same time, a one-to-many multi-recipient signcryption scheme is realized, which can transform a message sent to multiple recipients into one ciphertext instead of multiple ciphertexts, while ensuring the confidentiality and authentication of the transmitted message, and effectively reducing the computational cost and transmission cost of message processing; a heterogeneous signcryption scheme is constructed to realize the transition from certificateless public key cryptography system CLC to public key cryptography system PKC scheme based on public key infrastructure, thereby improving the security and reliability of the overall system. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 is a system block diagram of the present invention;

[0057] Figure 2 This is an explanation diagram of the corresponding symbols in the present invention;

[0058] Figure 3 It is a block diagram of the communication system in the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0060] Reference Figure 1-3 ,

[0061] Example:

[0062] A data security transmission system for vehicle networking, the system includes: a trusted authority TA, a key production center KGC, a vehicle unit OBU, a vehicle computing server VEC, an authorized third-party user AU and a core cloud server CS;

[0063] The trusted institution TA is equipped with a registration module. Before each vehicle shares data, the vehicle station and third-party users register with the trusted institution TA.

[0064] The KGC key production center generates a public and private key pair;

[0065] The vehicle computing server VEC is internally provided with an information storage module, and the vehicle generates a random key to encrypt the collected data information and save it to the vehicle computing server VEC;

[0066] The core cloud server CS stores the signed information and the security index of the vehicle data;

[0067] When the key generation center KGC generates a key, the trusted institution TA generates a partial private key T0=sk for the vehicle through a secure and trusted key generation center KGC. ID0 , and generate corresponding public and private keys for third-party users. The public key pair of d recipients is (A r1 , T r1 ),…,(A rd , T rd ); After the vehicle sender receives T0, it randomly selects T1 and calculates

[0068] The sender's public and private key pair is (A s ,T s );

[0069] The key generation algorithm of the key generation center KGC includes:

[0070] After OUB (referred to as the sender) and the authorized third-party user AU (referred to as the receiver) complete registration with the trusted institution TA, they generate their own public and private keys;

[0071] 1. Vehicle key generation:

[0072] (1) For the vehicle sender whose identity is IDs, KGC runs the key generation algorithm and obtains the sender's partial key T0=sk ID0 , KGC sends T0 to the sender

[0073] (2) After receiving T0, the sender randomly selects T1∈{-d,…,0,…,d} m*k， and And calculate From the generation process of T0 and T1, we know that:

[0074]

[0075] The sender's public and private key pair is (A s ,T s );

[0076] 2. Authorized third-party user AU third-party user key generation:

[0077] (1) For the authorized third-party user AU whose identity is IDr, KGC calls the trap generation algorithm TrapGen(q,n,m) to obtain the matrix pair As the public-private key pair of the authorized third-party user AU, here Less than or equal to L

[0078] (2). The public key pair of d recipients is (A r1 , T r1 ),…,(A rd , T rd ).

[0079] The vehicle computing server VEC encrypts the data before sending it to the edge computing server. The vehicle generates a random symmetric session key α, which is used to encrypt the data collected by the vehicle in real time. encryption The encrypted ciphertext ψ is stored in the vehicle computing server VEC, and the vehicle computing server VEC returns The storage position pos.

[0080] The vehicle unit OBU uses the signcryption key T s , the random symmetric session key α is used to perform multi-recipient signcryption operation at storage location pos, and the signcrypted ciphertext C corresponding to the random key α and storage location pos is returned, and the signcrypted ciphertext C is placed in the core cloud server CS.

[0081] The present invention designs a safe and efficient data transmission protocol in a vehicle-mounted ad hoc network and realizes resistance to quantum information attacks, meeting the following characteristics:

[0082] (1) To be accepted as secure and reliable data, it must satisfy the requirements of authentication, integrity, and confidentiality.

[0083] Authentication and integrity: ensuring that the vehicle sending the data is the legitimate vehicle in the system and that the data cannot be tampered with during transmission.

[0084] Confidentiality: Sensitive data should be encrypted before transmission to ensure that it is transmitted in ciphertext form over public channels.

[0085] (2) Once a vehicle or third-party user exhibits malicious behavior, the system needs to track and revoke the malicious vehicle and user in a timely manner.

[0086] Traceability: Once a dispute occurs, the trusted authority TA can track the true identity of any vehicle and user.

[0087] Revocability: After tracking down malicious vehicles and third-party users, the trusted authority TA must be able to delete the malicious vehicles and users from the system.

[0088] (3) Quantum resistance: Given the advancement of quantum information and computing, the overall system solution must be able to resist quantum attacks.

[0089] (4) Finally, the overall system solution needs to be able to resist modification attacks, ESL attacks, and man-in-the-middle attacks.

[0090] The authorized third-party user AU obtains the signed ciphertext C from the core cloud server CS, and uses its own private key to perform the decryption algorithm to obtain the decrypted data The random key α and the storage location pos of the ciphertext C.

[0091] The authorized third-party user AU obtains the ciphertext ψ in the vehicle computing server VEC according to the storage location pos, and uses the random key ɑ to perform decryption operation to obtain the data

[0092] The initialization algorithm Setup of the data security transmission system includes:

[0093] The trusted authority TA inputs the security parameter n

[0094] (1) Order δ1∈(0,1) is a constant, is the Gaussian parameter;

[0095] (2) k is the number of authorized third-party users (AUs), 1≤k≤d, d is a polynomially bounded constant; t = ω(logn).

[0096] (3) and H2:{0,1} * →{0,1} l , These are three collision-stable hash functions;

[0097] (4) The message space is

[0098] (5) The key generation center KGC runs TrapGen(q,n) and outputs Hog ∧ ⊥ (A) base T, master public key A, secret master private key T

[0099] (6) Key generation algorithm run by KGC: For identity ID i ∈{0,1} * , run SampleMat(A,T,s,H4(ID i ))get

[0100] The authorized third-party user AU obtains the encrypted ciphertext ψ from the vehicle computing server VEC according to the location information pos in the edge computing server; uses the random key α obtained by decryption to calculate and judge Ensure data integrity, if established receive message Otherwise, it will not be accepted.

[0101] The vehicle unit OBU generates a random key α for encrypting data and calculates the data collected by the vehicle Security Index

[0102] Use the random key α to convert the data Encryption, i.e. ciphertext The ciphertext ψ is stored in the vehicle computing server VEC, and the vehicle computing server VEC returns the storage location pos.

[0103] The steps of sharing after POS location signcryption include:

[0104] Select n third-party users R = {ID1, ID2...ID k}, the storage location pos and the random key α are signed, the process is as follows:

[0105] 1.

[0106] 2Signature

[0107] (1) Randomly select ζ∈{0,1} t ,

[0108] (2) Calculation

[0109] (3) Sampling make

[0110] (4) Order The output C = (ζ, c1, c2) is transmitted to the core cloud server CS as ciphertext.

[0111] When the authorized third-party user AU obtains the data about vehicle sharing in the core cloud server CS, it downloads the signcrypted ciphertext C from the core cloud server CS and uses the corresponding public and private keys to decrypt the signcryption. The specific steps are as follows:

[0112] Unsigncrypt(C,skri,pks)

[0113] (1) Known sk ri =Tri , calling the algorithm SampleBasis(A r ,T ri ), get the grid High quality base Tr

[0114] (2) Using T r from Restore v and e

[0115] (3) Order

[0116] (4) Verification and ∥e∥≤σ; if both are true, receive the message Otherwise, reject;

[0117] (5) Extract α according to the negotiated symmetric key length and obtain the storage position pos.

[0118] In the present invention, encryption and authentication of multiple receivers can be achieved simultaneously in one logical step through a multi-recipient signcryption scheme, which has lower communication costs and computational complexity, and therefore has higher practical value. Due to the diversity of public key cryptographic systems, the security technologies used in communication systems are also different. The heterogeneous signcryption scheme solves the communication problems between communication systems using different security technologies, and enables people in two different cryptographic systems to communicate securely.

[0119] In the present invention, lattice cryptography is adopted to realize resistance to quantum attacks; at the same time, a one-to-many multi-recipient signcryption scheme is realized, which can transform a message sent to multiple recipients into one ciphertext instead of multiple ciphertexts, while ensuring the confidentiality and authentication of the transmitted message, and effectively reducing the computational cost and transmission cost of message processing; a heterogeneous signcryption scheme is constructed to realize the transition from certificateless public key cryptography system CLC to public key cryptography system PKC scheme based on public key infrastructure, thereby improving the security and reliability of the overall system.

[0120] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0121] The above description enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data security transmission system for vehicle networking, characterized in that: The system includes: a trusted authority TA, a key production center KGC, a vehicle unit OBU, a vehicle computing server VEC, an authorized third-party user AU and a core cloud server CS; The trusted institution TA is provided with a registration module. Before each vehicle shares data, the vehicle station and the third-party user register with the trusted institution TA; The key generation center KGC generates a public-private key pair; The vehicle computing server VEC is internally provided with an information storage module, and the vehicle generates a random key to encrypt the collected data information and save it to the vehicle computing server VEC; The core cloud server CS stores the signed information and the security index of the vehicle data; The key production center KGC generates a private key for the vehicle through a secure and trusted key production center KGC. T 0 =sk ID0 , and generate corresponding public and private keys for third-party users. The public key pair of d recipients is ( A r1， T r1 ),…,( A rd， T rd ); The vehicle sender receives T 0 Then, randomly select T 1 And calculate AT 1 = A s mod q∈ , T s = T 0 + T 1 ∈ ; The sender's public-private key pair is ( A s , T s ); The key generation algorithm of the key generation center KGC includes: After OUB and the authorized third-party user AU complete registration with the trusted authority TA, they generate their own public and private keys, where OUB is recorded as the sender and the third-party user AU is recorded as the receiver; The vehicle key generation steps include: (1) For the vehicle sender whose identity is IDs, KGC runs the key generation algorithm to obtain the sender’s partial key T 0 =sk ID0 ,KGC will T 0 sent to the sender; (2) The sender receives T 0 Then, randomly select T 1 ∈{-d,…,0,…,d} m*k， And∥ T 0 ∥≤d , and calculate AT 1 = A s mod q∈ , T s = T 0 + T 1 ∈ ;Depend on T 0 and T 1 The generation process of is known: ∥ T s ∥≤ ; The sender's public and private key pair is ( A s , T s ); The steps for generating the third-party user key of the authorized third-party user AU include: (1) For the authorized third-party user AU whose identity is IDr, KGC calls the trap generation algorithm TrapGen ( q, n,m ) to obtain the matrix pair As the public-private key pair of the authorized third-party user AU, here , Less than or equal to L; (2) The public key pairs of d recipients are , …, .

2. A data security transmission system for vehicle networking as claimed in claim 1, characterized in that: The vehicle computing server VEC encrypts the data before sending it to the edge computing server, and the vehicle generates a random symmetric session key , using the key to decrypt the data collected by the vehicle in real time encryption , and the encrypted ciphertext Stored in the vehicle computing server VEC, the vehicle computing server VEC returns The storage position pos.

3. A data security transmission system for vehicle networking as claimed in claim 1, characterized in that: The vehicle unit OBU uses a signcryption key T s , random symmetric session key , perform multi-receiver signcryption operation at storage location pos and return a random symmetric session key The signed ciphertext C corresponding to the storage location pos is placed in the core cloud server CS.

4. A data security transmission system for vehicle networking as claimed in claim 1, characterized in that: The authorized third-party user AU obtains the signed ciphertext C from the core cloud server CS, and uses its own private key to perform the decryption algorithm to obtain the decrypted data A random symmetric session key And the storage position pos of ciphertext C.

5. A data security transmission system for Internet of Vehicles according to claim 1, characterized in that: The authorized third-party user AU obtains the ciphertext in the vehicle computing server VEC according to the storage location pos , using a random symmetric session key Perform decryption operation to obtain decrypted data .

6. A data security transmission system for vehicle networking as claimed in claim 1, characterized in that: The authorized third-party user AU obtains the encrypted ciphertext from the vehicle computing server VEC according to the location information pos in the edge computing server ; Using the random symmetric session key obtained by decryption ,calculate and ;judge Ensure the integrity of the data. If the data is received, the decrypted data will be received. , otherwise it will not be accepted.

7. A data security transmission system for vehicle networking as claimed in claim 1, characterized in that: The vehicle unit OBU generates a random symmetric session key for encrypting data , and calculate the decrypted data collected by the vehicle Security Index ; Using random symmetric session keys Decrypt the data Encryption, i.e. ciphertext ; and the ciphertext Stored in the vehicle computing server VEC, the vehicle computing server VEC returns the storage location pos.

Images