An efficient and lightweight cross-domain authentication method for Internet of Vehicles

Abstract

The present invention relates to an efficient and lightweight cross-domain authentication method suitable for vehicle networking, including: initializing a trusted institution MTA, and authorizing a regional TA through MTA; vehicle users registering with the regional TA, creating a pseudonymous user list; registering a server with the regional TA; wherein the server includes: an authentication server and a computing server; the vehicle sends a cross-domain request for task offloading to the authentication server; the computing server verifies the cross-domain request, and after successful verification, sends a cross-domain confirmation message to the vehicle; after the vehicle receives the cross-domain confirmation message, the authentication server and the computing server negotiate a key. The present invention helps to enhance the reliability of cross-domain authentication of vehicles in the vehicle networking, the security of cross-domain task offloading, the privacy of vehicle identity and other security requirements, so as to achieve more efficient, safer and faster vehicle cross-domain task offloading, and is a beneficial supplement to cross-domain authentication privacy protection in the vehicle networking.

Description

Technical Field

[0001] The present invention relates to the technical field of cross-domain Internet of Vehicles and vehicle privacy protection, and in particular to an efficient and lightweight cross-domain authentication method suitable for Internet of Vehicles. Background Art

[0002] With the rapid development of the Internet of Vehicles, data interaction between vehicles and infrastructure has become more frequent and important. Internet of Vehicles technology has greatly improved driving safety and comfort by realizing real-time data exchange and information sharing between vehicles and infrastructure. However, the vehicle's own storage capacity and computing power are limited, resulting in deficiencies in data processing and computing. Therefore, vehicles need to offload tasks. Currently, task offloading is mainly concentrated in the same domain. However, in actual applications, cross-domain task offloading is also required when vehicles move between different areas. When cross-domain authentication is required for vehicle task offloading, complex authentication algorithms are not applicable to vehicle devices. In addition, the interactive information between the vehicle and the server is transmitted through a public channel, and the privacy information of the vehicle user itself is also an important factor in the reasonable and legal promotion of anonymous authentication in the Internet of Vehicles.

[0003] Mobile edge computing (MEC) is an innovative computing paradigm that can migrate computing and storage resources from the remote cloud to the edge of the network, close to the data source and end users. By processing and analyzing data at the edge of the network, MEC can significantly reduce the latency of data transmission, reduce bandwidth usage, and improve the real-time response capability of the system. MEC's ​​flexible and scalable architecture enables it to dynamically allocate and manage computing resources according to actual needs, optimize resource utilization, reduce operating costs, and improve the overall performance of the system. Mobile edge computing can process and store data by deploying computing resources close to end users, reduce data transmission latency, improve the real-time performance and response speed of applications, and effectively alleviate the computing pressure of vehicle-mounted devices, so it has received widespread attention. However, when vehicles move over long distances, they need to interact with servers in other regions across domains. When vehicles and servers authenticate and interact on public channels, information is easily stolen and vehicle identity privacy is easily leaked. Mobile edge computing cannot perfectly solve the information security, identity authentication, and vehicle privacy issues of vehicles during long-distance cross-domain transmission. Summary of the invention

[0004] The purpose of the present invention is to propose an efficient and lightweight cross-domain authentication method suitable for the Internet of Vehicles to solve the problems existing in the above-mentioned prior art. The method includes the following steps: the vehicle user and the server apply for registration with a trusted authority, and a distributed trusted authority is used to reduce the registration burden; the vehicle sends a cross-domain request to the regional authentication server required for the cross-domain, and establishes an association with the authentication server according to the vehicle's needs; the authentication server confirms the cross-domain request by querying the legitimacy of the vehicle; the server negotiates a key with the vehicle, and ensures the security of subsequent cross-domain task offloading by the vehicle by negotiating the service key. In the application scenario of the case, the present invention helps to enhance the reliability of cross-domain authentication of vehicles in the Internet of Vehicles, the security of cross-domain task offloading, the privacy of vehicle identity and other security requirements, so as to achieve more efficient, safer and faster cross-domain task offloading of vehicles.

[0005] To achieve the above object, the present invention provides the following solutions:

[0006] An efficient and lightweight cross-domain authentication method suitable for Internet of Vehicles, characterized by comprising:

[0007] S1. Initialize the trusted institution MTA and authorize the regional TA through the MTA, wherein the trusted institution MTA is composed of several regional TAs;

[0008] S2. The vehicle user registers with the corresponding initialized area TA and creates a pseudonymous user list;

[0009] S3, registering a preset server with the area TA; wherein the server includes: an authentication server AS and a computing server CS;

[0010] S4. The vehicle sends a cross-domain request for task offloading to the authentication server AS;

[0011] S5. The computing server CS verifies the cross-domain request, and after successful verification, sends a cross-domain confirmation message to the vehicle;

[0012] S6. After the vehicle receives the cross-domain confirmation message, the authentication server AS and the computing server CS perform key negotiation.

[0013] Optionally, creating the pseudonymous user list includes:

[0014] S21, the vehicle sends an identity to the area TA to which it belongs and the public key After receiving the information sent by the vehicle, the area TA selects a random value and calculate the vehicle's pseudonym Vehicle-based pseudonyms Create preset information and send it to the vehicle; wherein the preset information is: in, is the pseudonym of the vehicle, B i To pass the vehicle's public key and pseudonym The encrypted value generated by XOR operation, Z i is the value generated by the area TA for transmitting the secret value H(Q), X i Y is the value used for pairing between the vehicle and the authentication server AS during the cross-domain authentication process. i For secure transmission of X during the authentication process i The value of

[0015] S22. The area TA creates a pseudonym user list AIDL to store pseudonyms of vehicles, and secretly shares the AIDL with TAs in other areas.

[0016] Optionally, registering a preset server with the area TA includes:

[0017] S31, the authentication server AS in each area sends the identity information ID AS and public key PK AS Send to the area TA, the area TA calculates t1 = H (Q) and t2 = H (ID AS ||Q) and generate AS certificate CT AS =E(SK TA ,(ID AS ||PK AS ||T AS ||VER)); where SK TA represents the private key of area TA, T AS Indicates the validity period of an integer, VER indicates the version number of the certificate; the area TA will {t1, t2, CT AS}Return to the authentication server AS of the corresponding area;

[0018] S32, the computing server CS sends the identity information ID CS and public key PK CS Sent to regional TA; regional TA generates certificate CT CS =E(SK TA ,(ID CS ||PK CS ||T CS ||VER)); Area TA will certificate CT CS Return to the computing server CS.

[0019] Optionally, the vehicle sending a cross-domain request for task offloading to the authentication server AS includes:

[0020] Calculate the signature for cross-origin requests in, Indicates vehicle V i B The private key of is the vehicle V i B 's pseudonym, is the timestamp, It is a cross-domain request message;

[0021] The vehicle will Sent to the authentication server AS in the cross-domain zone.

[0022] Optionally, the computing server CS verifies the cross-domain request including:

[0023] S51. When the authentication server AS in another area receives the vehicle cross-domain request message, it verifies the timestamp of the cross-domain request message. is the vehicle V i B The time when message m is sent, It is AS A The time when the message is received, ΔT is the preset time range; after confirming the validity of the timestamp, the authentication server AS in other areas checks whether the vehicle's pseudonym is from the AIDL list of the area TA. If so, the authentication server AS verifies the vehicle's request message by calculating the bilinear mapping;

[0024] S52. If the verification is successful, the authentication server AS will send a cross-domain confirmation message to the vehicle; wherein the cross-domain confirmation message is: in It is AS A The private key of It is the identity information of the authentication server AS. is the timestamp, is a cross-domain confirmed message, H() is a hash function that converts input data of any length into a hash value of fixed length;

[0025] S53, after receiving the confirmation message from the authentication server AS, the vehicle first calculates ΔT check timestamp The effectiveness of It is AS A The timestamp of when the confirmation message was sent, is the vehicle V i BThe timestamp when the confirmation message is received, ΔT is the specified time range; then, the vehicle verifies the confirmation message of the authentication server AS by calculating the bilinear mapping; if the verification succeeds, it confirms that the authentication server AS has accepted the vehicle's cross-domain request.

[0026] Optionally, the computing server CS verifies the cross-domain request further comprising:

[0027] When n vehicles initiate a cross-domain request to the authentication server AS, the signatures of the n vehicles are is the private key of n cars, is the pseudonym of n cars, is the timestamp of n vehicles, It is a cross-domain request message from n vehicles; the authentication server AS calculates the signature sum Check whether the bilinear mapping holds; if the verification is successful, the authentication server AS has completed the batch verification of the vehicles.

[0028] Optionally, the authentication server AS and the computing server CS perform key negotiation including:

[0029] S61, authentication server AS calculation and is the pseudonym of the vehicle, X′ i is the intermediate value for protecting the real identity information of the vehicle during cross-domain authentication and key negotiation, t2 is the hash value for hiding the AS identity, and Z1 is the value used to hide the vehicle pseudonym information, AS identity, and X′ during the authentication process. i The hash value of is the identity of the AS in area A, X′ i Used to hide vehicle V i B Identity, Z1 is used to hide X′ i ; Then the authentication server AS performs the encryption calculation Z2 = E (SK AC ,(Z1||T1)); Z2 is the encrypted ciphertext of Z1 through hash operation, SK AC Indicates the temporary key negotiated between AC and CS. T1 is AS A Timestamp of the encryption operation; the authentication server AS sends Z2 to the computing server CS;

[0030] S62, after receiving Z2, the computing server CS first performs a decryption calculation Z′1||T1=D(SK AC ,(Z2)), get the timestamp T1; then verify whether the timestamp T′1-T1<ΔT is valid, T′1 is CS AThe timestamp when the message is received; if valid, the computing server CS generates a random number y, which is used to XOR with Z′1 to obtain Hide Z′1, and then calculate the server CS to calculate the service key Service Key SK CV is the key negotiated between the computing server and the vehicle, It is AS A identity information, It's CS A Identity information, T2 is CS A The timestamp when the key is generated; then the computing server CS calculates the signature Will Send to vehicle;

[0031] S63, the vehicle receives After that, first verify the timestamp T2 ′ -T2<ΔT is valid, T′2 is V i B The timestamp when the message is received. If valid, the vehicle calculates and A′ i To hide X′ i , X′ i Used to calculate Z′1; then the vehicle calculates and Get the service key For subsequent task offloading communication; where y′ is used to protect the service key from being leaked, and Z′1 is used to hide y′; finally, the vehicle calculates To verify the identity of the computing server CS.

[0032] The beneficial effects of the present invention are:

[0033] The cross-domain authentication of the Internet of Vehicles in the present invention uses MEC technology as the underlying support. The interaction process between the vehicle and other regional servers remains anonymous and traceable, which helps to solve the lightweight authentication, task offloading and load problems of a single registration center in a cross-domain environment.

[0034] The multi-distributed registration center design in the present invention can effectively share the load in the authentication and registration process through a distributed TA architecture, providing higher system reliability.

[0035] The authentication scheme is based on identity, and the server is divided into different tasks. Pseudonyms are used to prevent the server from directly contacting the real identity information of the vehicle, reducing the computational burden during the authentication process. Only XOR and hash operations are used during the authentication process, which is suitable for the computing power of the vehicle-mounted equipment, ensuring the lightweight and efficient authentication process.

[0036] The key negotiation mechanism ensures the secure transmission of information. Through key negotiation, a shared secret key is established between the communicating parties to ensure the confidentiality and integrity of the data transmission in subsequent encrypted communications, and to ensure information security even on insecure channels.

[0037] The batch verification mechanism improves the efficiency and reliability of the authentication process. By batch processing and verifying authentication requests of multiple vehicles, the system resource utilization is optimized and the authentication delay is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0039] Figure 1 A model diagram of an efficient and lightweight cross-domain authentication method applicable to Internet of Vehicles according to an embodiment of the present invention;

[0040] Figure 2 A diagram showing a process of a vehicle user registering with a TA according to an embodiment of the present invention;

[0041] Figure 3 A diagram showing the process of the authentication server AS registering with the TA according to an embodiment of the present invention;

[0042] Figure 4 This is a diagram of the process of the computing server CS registering with the TA according to an embodiment of the present invention;

[0043] Figure 5 A diagram of a cross-domain request and a cross-domain request confirmation process according to an embodiment of the present invention;

[0044] Figure 6 This is a diagram of the key negotiation process of an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0047] First, the important terms and constraints in this embodiment are described as follows:

[0048] Vehicle (V): A vehicle is equipped with electronic equipment used for communication and data exchange between vehicles, between vehicles and infrastructure, or between vehicles and cloud servers, to achieve vehicle intelligence, networking and automation.

[0049] Trusted Authority (TA): TA is a trusted authority or entity responsible for the registration and identity information management of vehicles and servers.

[0050] Authentication Server (AS): AS is a server responsible for verifying the user's identity in identity authentication and access control. It can quickly and effectively verify the identity of the vehicle to ensure the security of the Internet of Vehicles and the integrity of the data.

[0051] Computing Server (CS): CS is a server that is responsible for performing computing tasks during computing tasks or data processing. CS is usually responsible for handling tasks such as vehicle task offloading and data computing.

[0052] like Figure 1 As shown, this embodiment proposes an efficient and lightweight cross-domain authentication method suitable for the Internet of Vehicles; including:

[0053] S1. Initialize the trusted institution MTA and authorize the regional TA through MTA, wherein the trusted institution MTA is composed of several regional TAs;

[0054] S2. The vehicle user registers with the corresponding initialized area TA and creates a pseudonymous user list;

[0055] S3. Registering a preset server to the area TA; wherein the server includes: an authentication server AS and a computing server CS;

[0056] S4. The vehicle sends a cross-domain request for task offloading to the authentication server AS;

[0057] S5. The computing server CS verifies the cross-domain request and sends a cross-domain confirmation message to the vehicle after successful verification.

[0058] S6. After the vehicle receives the cross-domain confirmation message, the authentication server AS and the computing server CS perform key negotiation.

[0059] Specifically, in this embodiment, an efficient and lightweight cross-domain authentication method suitable for the Internet of Vehicles is proposed. It includes the vehicle user and the server applying for registration with a trusted authority, and adopting a distributed trusted authority to reduce the registration burden; the vehicle sends a cross-domain request to the regional authentication server that needs to cross the domain, and establishes an association with the authentication server according to the vehicle's needs; the authentication server confirms the cross-domain request by querying the legitimacy of the vehicle; the server and the vehicle negotiate a key, and ensure the security of subsequent cross-domain task offloading by the vehicle by negotiating the service key. The present invention helps to enhance the reliability of cross-domain authentication of vehicles in the Internet of Vehicles, the security of cross-domain task offloading, the privacy of vehicle identity and other security requirements, so as to achieve more efficient, safer and faster cross-domain task offloading of vehicles, and is a beneficial supplement to cross-domain authentication privacy protection in the Internet of Vehicles. The specific steps are as follows:

[0060] S1. System initialization, generating system parameters. The trusted institution MTA is a distributed registration center architecture. Entities in each region register with the trusted institution TA in their respective regions through a secure channel. Each regional TA is authorized by the MTA, and each TA has the same functions and permissions as the MTA.

[0061] S1-1 The trusted authority MTA is initialized and selects a long-term secret value P and a prime number Q. MTA selects G1 as a group with prime order Q, p as the generator of G1, and G1 represents a bilinear map. Then MTA selects a hash function H:{0,1} * →G1 and calculate the values ​​of H(Q) and H(P||Q). H(Q) is the result of mapping the prime number Q to the group G1 through the hash function H, and H(P||Q) is the result of concatenating P and Q and calculating it through the hash function H. Finally, the MTA secretly sends {P,Q,H(Q),H(P||Q)} to the distributed TA through a secure channel, and at the same time discloses the parameters {H,G1,G2,p}.

[0062] S2, vehicle user registration, each area of ​​the vehicle to register with the TA in the area. The vehicle user provides its identity information and public key to the regional TA. After receiving the registration request, the TA selects a random value and hides the real identity of the vehicle, and creates a pseudonym user list AIDL to store the vehicle pseudonyms, and shares the AIDL with other regional TAs through a secure channel. Figure 2 shown.

[0063] S2-1 Vehicle users provide their identities to the TA in their area and the public key After receiving the registration request, TA selects a random value and calculate the vehicle's pseudonym to conceal the true identity of the vehicle. Then, TA calculates And calculate X i = and Among them, A i To hide X i , B i For transmission A i , Z i Used to transmit secret values ​​H(Q), X i For pairing between the vehicle and the cross-domain server AS, and Y i For transmission of X i TA will Return to the vehicle.

[0064] S2-2 TA creates a pseudonym user list AIDL to store vehicle pseudonyms and secretly shares AIDL with TAs in other regions. The registration and revocation of vehicle pseudonyms are recorded in AIDL.

[0065] S3, the server registers with TA. The server SE is divided into the authentication server AS and the computing server CS, both of which register with TA separately, such as Figure 3 and Figure 4 As shown, by giving TA the server ID and public key, TA returns the server certificates to AS and CS respectively.

[0066] S3-1 Each region's AS will send the identity information ID AS and public key PK AS Sent to TA. TA first calculates t1 = H(Q) and t2 = H(ID AS ||Q) and generate AS certificate CT AS =E(SK TA ,(ID AS ||PK AS ||T AS ||VER)). Among them, SK TA Represents TA's private key, T AS Indicates the validity period of an integer, and VER indicates the version number of the certificate. TA will {t1, t2, CT AS}Return to the AS of this area.

[0067] S3-2 CS will send its identity information ID CS and public key PK CSSent to TA. The registration process of CS is the same as that of AS. TA generates certificate CT CS =E(SK TA ,(ID CS ||PK CS ||T CS ||VER)). Finally, TA returns the certificate to CS.

[0068] S4. The vehicle makes a cross-domain request. When the vehicle needs to offload tasks to the cross-domain server CS, it first sends a cross-domain request to the authentication server in another area. The vehicle calculates its own signature with the private key and sends the signature, pseudonym, cross-domain request message and timestamp to the authentication server AS.

[0069] S4-1 When a vehicle needs to offload a cross-domain task, it first sends a cross-domain request to the AS in the area where the cross-domain task is to be performed. i B If you want to offload the task to region A, you first calculate the signature for the cross-domain request. in, Indicates vehicle V i B The private key of is the vehicle V i B 's pseudonym, is the timestamp, is a cross-domain request message. Then, V i B Will Sent to the authentication server AS in area A A .

[0070] S5. Cross-domain request message confirmation. When the authentication server AS in other regions receives the vehicle's cross-domain request message, it first verifies the timestamp and looks up the pseudonym in TA, and then verifies the vehicle's cross-domain request message through the signature. If the verification is successful, the AS sends a cross-domain confirmation message to the vehicle, indicating that the regional server has accepted the vehicle's cross-domain request. Figure 5 shown.

[0071] S5-1 When AS in domain A A When receiving a request message, first verify the timestamp is the vehicle V i B The time when message m is sent, It is AS A The time when the message was received, ΔT is the limited time range. After confirming the validity of the timestamp, AS A Check V i B pseudonym Is it from TA? A If the search is successful, AS A By computing the bilinear map To verify the vehicle's request message.

[0072] S5-2 If the verification is successful, AS A A cross-domain confirmation message will be sent to vehicle V i B First, AS A Calculate the signature to confirm the cross-domain request in It is AS A The private key of It is AS A identity information, is the timestamp, This is a cross-domain confirmation message. Then, AS A Will Send to vehicle V i B .

[0073] S5-3 receives AS A After the confirmation message, the vehicle V i B First, by calculating Check timestamp The effectiveness of It is AS A The timestamp of when the confirmation message was sent, is the vehicle V i B The timestamp when the confirmation message is received, ΔT is the specified time range. Then, V i B By computing the bilinear map To verify AS A If the verification is successful, the AS A Accepted V i B Cross-domain request.

[0074] S5-4 When n vehicles are heading to AS A When a cross-domain request is initiated, the signature of these n vehicles is is the private key of n cars, is the pseudonym of n cars, is the timestamp of n vehicles, It is a cross-domain request message of n vehicles. A By calculating the signature sum Checking bilinear maps If the verification is successful, it means that AS A Completed batch verification of vehicles.

[0075] S6. The server and the vehicle negotiate a key. After cross-domain request verification and cross-domain request confirmation, the authentication server AS and the computing server CS perform identity authentication and key negotiation, confirm the identity and generate a key by transmitting a secret value. The CS generates a service key by generating a secret value and performing a hash operation and sends it to the vehicle. The vehicle obtains the service key after decryption for subsequent communication with the CS. Figure 6 shown.

[0076] S6-1 After cross-domain verification is confirmed, the authentication server AS A and computing server CS A Authentication and key negotiation are performed. First, AS A calculate and X′ i Used to hide vehicle V i B Identity, Z1 is used to hide X′ i Then AS A Execute the encryption calculation Z2=E(SK AC ,(Z1||T1)). Z2 is the encrypted ciphertext of Z1 through hash operation, SK AC Indicates the temporary key negotiated between AC and CS. T1 is AS A The timestamp of the encryption operation. A Send Z2 to CS A .

[0077] S6-2 CS A After receiving Z2, first perform decryption calculation Z′1||T1=D(SK AC ,(Z2)), get the timestamp T1. Then verify whether the timestamp T′1-T1<ΔT is valid. T′1 is CS A Timestamp when the message was received. If valid, CS A Generate a random number y, which is used to XOR with Z′1 to obtain Hide Z′1, then CS A Compute service key Service Key SK CV is the key negotiated between the computing server and the vehicle, It is AS A identity information, It's CS A Identity information, T2 is CSA The timestamp when the key was generated. Then CS A Calculate the signature Will Send to V i B .

[0078] S6-3V i B After receiving, first verify whether the timestamp T′2-T2<ΔT is valid, T′2 is V i B Timestamp when the message was received. If valid, V i B calculate and A′ i To hide X′ i , X′ i Used to calculate Z'1. Then V i B calculate and Get the service key It is used for subsequent task offloading communication. Among them, the service key is protected from being leaked by y′, and Z′1 is used to hide y′. Finally, B i B By calculation To verify CS A identity.

[0079] The cross-domain authentication of the Internet of Vehicles uses MEC technology as the underlying support. The interaction process between the vehicle and other regional servers remains anonymous and traceable, which helps with lightweight authentication, task offloading and load issues of a single registration center in a cross-domain environment.

[0080] The multi-distributed registry design provides higher system scalability and reliability through a distributed architecture, ensuring efficient management in dynamic cross-domain scenarios.

[0081] The authentication scheme is based on identity, and the server is divided into different tasks. Pseudonyms are used to prevent the server from directly contacting the real identity information of the vehicle, reducing the computational burden during the authentication process. Only XOR and hash operations are used during the authentication process, which is suitable for the computing power of the vehicle-mounted equipment, ensuring the lightweight and efficient authentication process.

[0082] The key negotiation mechanism ensures the secure transmission of information. Through key negotiation, a shared secret key is established between the communicating parties to ensure the confidentiality and integrity of the data transmission in subsequent encrypted communications, and to ensure information security even on insecure channels.

[0083] The batch verification mechanism improves the efficiency and reliability of the authentication process. By batch processing and verifying authentication requests of multiple vehicles, the system resource utilization is optimized and the authentication delay is reduced.

[0084] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. An efficient and lightweight cross-domain authentication method suitable for Internet of Vehicles, characterized in that: include: S1. Initialize the trusted institution MTA and authorize the regional TA through the MTA, wherein the trusted institution MTA is composed of several regional TAs; S2. The vehicle user registers with the corresponding authorized area TA and creates a pseudonymous user list; S3, registering a preset server with the area TA; wherein the server includes: an authentication server AS and a computing server CS; S4. The vehicle sends a cross-domain request for task offloading to the authentication server AS; The vehicle sends a cross-domain request for task offloading to the authentication server AS, including: Calculate the signature for cross-origin requests in, Indicates vehicle The private key of It is a vehicle alias, is the timestamp, It is a cross-domain request message; The vehicle will Sent to the authentication server AS in the cross-domain area; S5. The authentication server AS verifies the cross-domain request, and after successful verification, sends a cross-domain confirmation message to the vehicle; The authentication server AS verifies the cross-domain request including: S51. When the authentication server AS in another area receives the vehicle cross-domain request message, it verifies the timestamp of the cross-domain request message. It is a vehicle The time when message m is sent, It is AS A The time when the message is received, ΔT is the preset time range; after confirming the validity of the timestamp, the authentication server AS in other areas checks whether the vehicle's pseudonym is from the AIDL list of the area TA. If the search is successful, the authentication server AS verifies the vehicle's request message by calculating the bilinear mapping; S52. If the verification is successful, the authentication server AS will send a cross-domain confirmation message to the vehicle; wherein the cross-domain confirmation message is: in It is AS A The private key of It is the identity information of the authentication server AS. is the timestamp, It is a cross-domain confirmed message. H() is a hash function that converts input data of any length into a hash value of fixed length. S53, after receiving the confirmation message from the authentication server AS, the vehicle first calculates Check timestamp The effectiveness of It is AS A The timestamp of when the confirmation message was sent, It is a vehicle The timestamp when the confirmation message is received, ΔT is the specified time range; then, the vehicle verifies the confirmation message of the authentication server AS by calculating the bilinear mapping; if the verification succeeds, it confirms that the authentication server AS has accepted the cross-domain request of the vehicle; The authentication server AS verifies the cross-domain request further comprising: When n vehicles initiate a cross-domain request to the authentication server AS, the signatures of the n vehicles are is the private key of n cars, is the pseudonym of n cars, is the timestamp of n vehicles, It is a cross-domain request message from n vehicles; the authentication server AS calculates the signature sum Check whether the bilinear mapping is established; if the verification is successful, the authentication server AS has completed the batch verification of the vehicle; S6. After the vehicle receives the cross-domain confirmation message, the authentication server AS and the computing server CS perform key negotiation.

2. According to claim 1, the efficient and lightweight cross-domain authentication method suitable for Internet of Vehicles is characterized in that: Creating the pseudonymous user list includes: S21, the vehicle sends an identity to the area TA to which it belongs and the public key After receiving the information sent by the vehicle, the area TA selects a random value and calculate the vehicle's pseudonym Vehicle-based pseudonyms Create preset information and send it to the vehicle; wherein the preset information is: in, is the pseudonym of the vehicle, B i To pass the vehicle's public key and pseudonym The encrypted value generated by XOR operation, Z i is the value generated by the area TA for transmitting the secret value H(Q), X i Y is the value used for pairing between the vehicle and the authentication server AS during the cross-domain authentication process. i For secure transmission of X during the authentication process i The value of S22. The area TA creates a pseudonym user list AIDL to store pseudonyms of vehicles, and secretly shares the AIDL with TAs in other areas.

3. According to claim 1, the efficient and lightweight cross-domain authentication method suitable for Internet of Vehicles is characterized in that: Registering the preset server with the area TA includes: S31, the authentication server AS in each area sends the identity information ID AS and public key PK AS Send to the area TA, the area TA calculates t1 = H (Q) and t2 = H (ID AS ||Q) and generate AS certificate CT AS =E(SK TA ,(ID AS ||PK AS ||T AS ||VER)); where SK TA represents the private key of area TA, T AS Indicates the validity period of an integer, VER indicates the version number of the certificate; the area TA will {t1, t2, CT AS }Return to the authentication server AS of the corresponding area; S32, the computing server CS sends the identity information ID CS and public key PK CS Sent to regional TA; regional TA generates certificate CT CS =E(SK TA ,(ID CS ||PK CS ||T CS ||VER)); Area TA will certificate CT CS Return to the computing server CS.

4. The efficient and lightweight cross-domain authentication method applicable to the Internet of Vehicles according to claim 1 is characterized in that: The key negotiation between the authentication server AS and the computing server CS includes: S61, authentication server AS calculation and is the pseudonym of the vehicle, X i ′ is the intermediate value for protecting the real identity information of the vehicle during the cross-domain authentication and key negotiation process, t2 is the hash value for hiding the AS identity, and Z1 is the value used to hide the vehicle pseudonym information, AS identity, and X in the authentication process. i ′ The hash value of is the identity of the AS in area A, X i ′ To hide the vehicle Identity, Z1 is used to hide X i ′ ; Then the authentication server AS performs the encryption calculation Z2 = E (SK AC ,(Z1||T1)); Z2 is the encrypted ciphertext of Z1 through hash operation, SK AC Indicates the temporary key negotiated between AC and CS. T1 is AS A Timestamp of the encryption operation; the authentication server AS sends Z2 to the computing server CS; S62, after receiving Z2, the computing server CS first performs decryption calculation Z1 ′ ||T1=D(SK AC ,(Z2)), get timestamp T1; then verify timestamp T1 ′ -T1<ΔT is valid, T1 ′ It's CS A The timestamp when the message is received; if valid, the computing server CS generates a random number y, which is used to compare with Z1 ′ XOR operation shows that Z3=y⊕Z1 ′ Hide Z1 ′ , then calculate the server CS to calculate the service key Service Key SK CV is the key negotiated between the computing server and the vehicle, It is AS A identity information, It's CS A Identity information, T2 is CS A The timestamp when the key is generated; then the computing server CS calculates the signature Will Send to vehicle; S63, the vehicle receives After that, first verify the timestamp T2 ′ -T2<ΔT is effective, T2 ′ yes The timestamp when the message is received. If valid, the vehicle calculates and X i ′ =Y i ⊕A ′ i ; A ′ i To hide X i ′ , X i ′ To calculate Z1 ′ ; Then the vehicle calculates and ′ =Z3⊕Z1 ′ Get the service key Used for subsequent task offloading communication; among them, through y ′ Protect the service key from being leaked, Z1 ′ To hide y ′ ; Finally, the vehicle calculates To verify the identity of the computing server CS.

Images