Lightweight encryption authentication method for wireless sensor network and related equipment

Abstract

The invention provides a lightweight encryption authentication method for a wireless sensor network, which comprises the following steps: a gateway node generates a sensing instantaneous key and a user instantaneous key respectively based on a one-way hash function and a preset physical unclonable function, the sensing instantaneous key, the user instantaneous key, a preset sensing long-term key and a user long-term key are respectively sent to the user side and the sensor node; after the user side and the sensor node are registered, the user side performs identity verification on identity information currently input by a user, and performs mutual authentication among the user side, the gateway node and the sensor node based on the identity information, so as to send a sensing hash message authentication code and a user hash message authentication code to the sensor node according to an authentication result; according to the method, the sensor node and the gateway node are subjected to key negotiation authentication to obtain the session key, so that wireless sensor network communication can be carried out based on the session key, and the security authentication problem of the wireless sensor network is effectively solved.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of communication network security, and in particular to a lightweight encryption authentication method, apparatus, device, and storage medium for a wireless sensor network. Background Art

[0002] Currently, with the development of Internet of Things (IoT) technology, wireless sensor networks (WSNs) have been widely used in environmental monitoring, industrial automation, smart home and other fields as an important means of data collection and monitoring. However, due to the resource-constrained characteristics and open communication environment of wireless sensor networks, they face challenges such as data security, privacy protection and identity authentication. Most of the existing wireless sensor network authentication methods rely on complex cryptographic mechanisms. Although these methods provide high security, they have high computational complexity and low operating efficiency on resource-constrained sensor nodes. They are not suitable for resource-constrained sensor nodes. Therefore, it is necessary to design an authentication method that can both ensure security and adapt to the resource constraints of wireless sensor networks. Summary of the invention

[0003] The embodiment of the present application provides a lightweight encryption authentication method for a wireless sensor network, which can utilize physically unclonable functions and one-way hash functions to reduce computational complexity, simplify the authentication process, and reduce communication overhead to improve the overall performance of the system. It is suitable for sensor nodes with limited resources, and can effectively solve the security authentication problem of wireless sensor networks.

[0004] To achieve the above-mentioned purpose, the first aspect of an embodiment of the present application provides a lightweight encryption authentication method for a wireless sensor network, wherein the wireless sensor network includes a user terminal, a gateway node and a sensor node that are communicatively connected, and the method includes: the gateway node generates a sensor transient key and a user transient key based on a one-way hash function and a preset physical unclonable function, respectively, and sends the sensor transient key, the user transient key, the preset sensor long-term key and the user long-term key to the user terminal and the sensor node, respectively; the user terminal obtains a user identity and user password data generated by the user, and sends the user identity to the gateway node to complete user registration; the sensor node obtains a sensor identifier and a sensor initial value, and sends the sensor identifier and the sensor initial value to the gateway node , to complete sensor registration; the user end authenticates the identity information currently input by the user based on the user identity identifier and the user password data, and performs mutual authentication between the user end, the gateway node and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result; the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code and the random number and timestamp generated by the gateway node, so as to obtain a session key according to the authentication result; the session key is shared among the user end, the gateway node and the sensor node, so as to exchange data among the user end, the gateway node and the sensor node based on the session key.

[0005] In some embodiments, the gateway node generates a sensor transient key and a user transient key based on a one-way hash function and a preset physical unclonable function, respectively, including: generating random one-time random numbers R1 and R2 based on a collision-resistant one-way hash function h(.); using a physical unclonable function PUF to generate challenge values ​​C1 and C2 and an initialization vector and Based on the random numbers R1 and R2, the challenge values ​​C1 and C2, and the initialization vector and Generate sensor instantaneous key T S and the user's instantaneous key T M ;in,

[0006] In some embodiments, the sensor node obtains a sensor identifier and a sensor initial value, and sends the sensor identifier and the sensor initial value to the gateway node to complete sensor registration, including: the sensor node obtains a sensor identifier SID j and the initial value of the sensor IV Sand share the sensor identification SID with the gateway node through a secure channel j and the sensing initial value IV S The gateway node sends the sensor initial value IV through a secure channel S , the parameter set formed by the sensor long-term key and the user long-term key is sent to the memory of the sensor node, so that the sensor node sets the cycle counter c to 1.

[0007] In some embodiments, the user terminal authenticates the identity information currently input by the user based on the user identity identifier and the user password data, including: the user terminal receives the identity identifier UID input by the user i * and password PW i * ; If the user terminal verifies the identity UID entered by the user i * and password PW i * The user ID cached by the client i and the user password data PWi match, the user is successfully authenticated; in the case of successful authentication of the user, the user terminal sends the identity identifier UID to the gateway node i * .

[0008] In some embodiments, mutual authentication is performed between the user terminal, the gateway node and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result, including: the gateway node authenticates the user based on the user identity identifier UID i Verify the identity UID i * If the verification is successful, a random number R3 is generated to obtain the user identity UID i Get authentication parameter A1 = (R3 || UID i ), and sends an authentication response corresponding to A1 to the sensor node; the sensor node retrieves the counter c and the sensor instantaneous key T S and the user instantaneous key T M , and determine the timestamp T1 to calculate the authentication parameters and sends an authentication message corresponding to A2 to the gateway node; the gateway node calculates a security token based on R3 and A2 and sends the security token A4 to the user terminal; the user terminal obtains the sensor instantaneous key T corresponding to the counter cS , based on T S Verify the security token A4, and if verification is successful, obtain a message containing the timestamp T1 and the random number R3 And send A5 to the gateway node; the gateway node calculates the user identity UID i , the sensor node's identity identifier SID j , the counter c, the random number R3 and the authentication message B1 of the timestamp T1, and sends the B1 to the user terminal; the user terminal obtains the user instantaneous key T corresponding to the counter c M , based on T M Verify the B1, and if the verification is successful, send a message containing the timestamp T1 and the user identity UID i , the sensor node's identity identifier SID j , the counter c and the authentication message B2 of the random number R3 to the gateway node; the gateway node sends the sensor hash message authentication code based on B2 and the user hashed message authentication code Sent to the sensor node.

[0009] In some embodiments, the method further comprises: the sensor node increasing the value of the counter c each time an authentication process is successfully completed.

[0010] In some embodiments, the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node to obtain a session key according to the authentication result, including: the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, the random number R3 and the timestamp T1, so that the sensor node calculates the session key δ(c), wherein the calculation formula of the session key δ(c) is:

[0011]

[0012] Where, B3 = h(T1||Φ(c)),

[0013] To achieve the above-mentioned purpose, the second aspect of the embodiment of the present application provides a lightweight encryption authentication device for a wireless sensor network, the device comprising: a system setting module, used to control the gateway node to generate a sensor transient key and a user transient key based on a one-way hash function and a preset physical unclonable function, respectively, and send the sensor transient key, the user transient key, the preset sensor long-term key and the user long-term key to the user terminal and the sensor node, respectively; a registration module, used to control the user terminal to obtain a user identity and user password data generated by the user, and send the user identity to the gateway node to complete user registration; and used to control the sensor node to obtain a sensor identifier and a sensor initial value, and send the sensor identifier and the sensor initial value to the gateway node to complete sensor registration; a login authentication module, Used to control the user end to authenticate the identity information currently input by the user based on the user identity identifier and the user password data, and to perform mutual authentication between the user end, the gateway node and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result; a key negotiation module is used to control the sensor node to perform key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code and the random number and timestamp generated by the gateway node, so as to obtain a session key according to the authentication result; so that the session key is shared among the user end, the gateway node and the sensor node, and the user end, the gateway node and the sensor node exchange data based on the session key.

[0014] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application provides an electronic device, comprising: at least one processor; at least one memory for storing at least one program; when at least one of the programs is executed by at least one of the processors, a lightweight encryption authentication method for a wireless sensor network as described in any one of the first aspects is implemented.

[0015] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the lightweight encryption authentication method for a wireless sensor network as described in any one of the fourth aspects.

[0016] The embodiment of the present application provides a lightweight encryption authentication method, device, equipment and storage medium for a wireless sensor network. The method is applied to a wireless sensor network, which is composed of a user terminal, a gateway node and a sensor node. These nodes are connected by wireless communication. The method includes: a key generation and distribution stage, in which the gateway node generates a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical unclonable function, respectively, and sends the sensor instantaneous key, the user instantaneous key, the preset sensor long-term key and the user long-term key to the user terminal and the sensor node, respectively; in a registration stage, the user terminal obtains a user identity and user password data generated by the user, and sends the user identity to the gateway node to complete user registration, and the sensor node obtains a sensor identification and a sensor initial value, and sends the sensor identification and the sensor initial value to the gateway node to complete sensor registration; in a login authentication stage, the user terminal authenticates the identity information currently input by the user based on the user identity and user password data, and performs mutual authentication between the user terminal, the gateway node and the sensor node based on the identity information , so that the sensor hash message authentication code and the user hash message authentication code are sent to the sensor node according to the authentication result; in the key negotiation stage, the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code and the random number and timestamp generated by the gateway node, so as to obtain the session key according to the authentication result, and then share the session key between the user end, the gateway node and the sensor node, so as to exchange data between the user end, the gateway node and the sensor node based on the session key; among them, it can be understood that the one-way hash function is used to encrypt and hash data to ensure the irreversibility of the data, and the physical unclonable function generates a unique key based on the characteristics of the hardware, which is difficult to copy. Therefore, this application can ensure the security of data transmission by combining instantaneous keys and long-term keys, and adopts multiple authentication mechanisms, including local verification of the user end, mutual authentication between the gateway node and the user end and the sensor node, to ensure that only legitimate users and sensors can access the network, and then through the session key negotiation based on timestamps and random numbers, it is ensured that each communication has a new key, thereby enhancing the security of the system. In summary, through the above-mentioned lightweight encryption authentication mechanism, the present application can effectively solve the security problem in wireless sensor networks and is suitable for sensor nodes with limited resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic diagram of the architecture of a wireless sensor network provided in one embodiment of the present application;

[0018] Figure 2 A flowchart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application;

[0019] Figure 3A flowchart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application;

[0020] Figure 4 A flowchart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application;

[0021] Figure 5 A flowchart of obtaining visually associated word units and image mask position information provided by an embodiment of the present application;

[0022] Figure 6 A flowchart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application;

[0023] Figure 7 A flowchart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application;

[0024] Figure 8 A timing flow chart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application;

[0025] Fig. 9 A timing flow chart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application;

[0026] Fig.10 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0028] In some embodiments, although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms first, second, etc. in the specification, claims and the above drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0029] In addition, unless otherwise clearly specified and limited, the term "connected" should be understood in a broad sense. For example, it can be a fixed connection or a movable connection, a detachable connection or a non-detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection, or the two can communicate with each other; it can be a direct connection or an indirect connection through an intermediate medium.

[0030] In the description of the embodiments of the present application, the description of reference terms "one embodiment / implementation", "another embodiment / implementation" or "certain embodiments / implementations", "in the above embodiments / implementations", etc. means that the specific features, structures, materials or characteristics described in combination with the implementation or example are included in at least two embodiments or implementations disclosed in the present application. In the disclosure of this application, the schematic representation of the above terms does not necessarily refer to the same embodiment or implementation. It should be noted that although the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in an order different from that in the flowchart.

[0031] Currently, with the development of Internet of Things (IoT) technology, wireless sensor networks (WSNs) have been widely used in environmental monitoring, industrial automation, smart home and other fields as an important means of data collection and monitoring. However, due to the resource-constrained characteristics and open communication environment of wireless sensor networks, they face challenges such as data security, privacy protection and identity authentication. Most of the existing wireless sensor network authentication methods rely on complex cryptographic mechanisms. Although these methods provide high security, they have high computational complexity and low operating efficiency on resource-constrained sensor nodes. They are not suitable for resource-constrained sensor nodes. Therefore, it is necessary to design an authentication method that can both ensure security and adapt to the resource constraints of wireless sensor networks.

[0032] Based on this, the present application provides a lightweight encryption authentication method for a wireless sensor network, including: a gateway node generates a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical unclonable function, respectively, and sends the sensor instantaneous key, the user instantaneous key, the preset sensor long-term key and the user long-term key to a user terminal and a sensor node, respectively; after the user terminal and the sensor node are registered, the user terminal authenticates the identity information currently input by the user, and performs mutual authentication between the user terminal, the gateway node and the sensor node based on the identity information, so as to send a sensor hash message authentication code and a user hash message authentication code to the sensor node according to the authentication result, so that the sensor node and the gateway node perform key negotiation authentication to obtain a session key, and then wireless sensor network communication can be performed based on the session key, effectively solving the security authentication problem of the wireless sensor network.

[0033] The embodiments of the present application are further described below in conjunction with the accompanying drawings.

[0034] refer to Figure 1 , Figure 1A schematic diagram of the architecture of a wireless sensor network provided in an embodiment of the present application. A first aspect of an embodiment of the present application provides a lightweight encryption authentication method for a wireless sensor network, wherein the wireless sensor network includes a user terminal, a gateway node, and a sensor node connected in communication; wherein it can be understood that a wireless sensor network (WSN) is a distributed network composed of multiple sensor nodes for monitoring and collecting data in an environment or a specific area, and a WSN includes the following three main entities: a sensor node (SensorNode, S j ): These nodes are distributed in the area of ​​interest and are used to collect data (such as environmental parameters such as temperature and humidity) and send it to the central node or other nodes; Gateway Node (GWN): As a bridge between sensor nodes and external networks, the gateway node is responsible for processing and forwarding data, as well as performing authentication and other security-related tasks; User End (MD i ): usually refers to the end user or application, which wants to access the data collected by the sensor node, user U i MD can be used via mobile devices i (such as a smartphone or tablet) to access the j data.

[0035] In some embodiments, Figure 1 The network model of WSN is shown. In this model, the user end communicates with the sensor node through the mobile device. There is no direct communication between the user end and the sensor node, but it is relayed through the gateway node. In addition, S j and MD i Both embed a physical unclonable function that acts as a hardware-based cryptographic primitive during authentication. The GWN is deployed as a cryptographic primitive based on some long-term master key Ψ S and U Generate a transient key pair that is unique to each session and is derived from the master key and a preset Trivium stream cipher initial value.

[0036] It is understood that a physical unclonable function (PUF) is a hardware-based cryptographic primitive that can use the physical characteristics of hardware (such as small differences in the manufacturing process) to generate a unique key or identifier. j and the client MD i Both are embedded with PUF for key generation during the authentication process, while the gateway node (GWN) is responsible for generating and managing transient key pairs, which are derived from the long-term master key Ψ S and Uand the initial value of the Trivium stream cipher; further, the protocol execution process corresponding to the present application may include the following stages: a system setup stage, in which the gateway node selects a collision-resistant one-way hash function and generates a random number (nonce) and an initialization vector (IV) for generating an instantaneous key pair; a user and sensor registration stage, in which users and sensor nodes need to register to participate in communication. The user generates an identity (UIDi) and a password (PW), and shares the identity with the gateway node through a secure channel. The sensor node selects its unique identifier (SIDj) and initial value (IVS) and sends them to the gateway node; in the login and authentication stage, the user enters identity information through a mobile device, the device verifies the user's identity, and mutually authenticates with the gateway node and the sensor node; in the key negotiation stage, once the user and the sensor node are authenticated, they will negotiate a session key for encrypted communication; in the data exchange stage, the session key is shared between the user end, the gateway node, and the sensor node to ensure the security of data transmission.

[0037] Through these steps, the present application can ensure data security and privacy protection while reducing computation, energy and communication costs to be suitable for resource-constrained wireless sensor network environments.

[0038] refer to Figure 2 , Figure 2 A flowchart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application, the method comprising:

[0039] Step S210, the gateway node generates a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical unclonable function, and sends the sensor instantaneous key, the user instantaneous key, the preset sensor long-term key and the user long-term key to the user terminal and the sensor node respectively;

[0040] Step S220, the user terminal obtains the user identity and user password data generated by the user, and sends the user identity to the gateway node to complete the user registration; the sensor node obtains the sensor identification and the sensor initial value, and sends the sensor identification and the sensor initial value to the gateway node to complete the sensor registration;

[0041] Step S230, the user terminal authenticates the identity information currently input by the user based on the user identity identifier and the user password data, and performs mutual authentication between the user terminal, the gateway node and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result;

[0042] Step S240: The sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node, so as to obtain a session key according to the authentication result; the session key is shared between the user end, the gateway node, and the sensor node, so as to exchange data between the user end, the gateway node, and the sensor node based on the session key.

[0043] Among them, a one-way hash function is a cryptographic function used to generate a fixed-length output (hash value), and it is difficult to infer the original input from the hash value, so that the gateway node uses a one-way hash function to generate an instantaneous key; a physical unclonable function (PUF) is a hardware-based cryptographic primitive that can use tiny differences in the device manufacturing process to generate a unique key or identifier for generating an instantaneous key; a sensor instantaneous key (T S ) and the user's transient key (T M ): The transient key is a one-time key used to protect the security of a specific session. The gateway node generates these two keys using PUF and a one-way hash function; the sensor long-term key (Ψ S ) and the user's long-term key (Ψ U ): Long-term keys are pre-configured keys that are used to generate transient keys and remain unchanged throughout their lifecycle.

[0044] Among them, the user identity (UID i ) and user password data (PW i ) generates data for the user so that the user can register and authenticate; sensor identification (SID j ) and the initial value of the sensor (IV S ): The sensor node generates these data for registration, the sensor identity is the unique identifier of the sensor node, and the sensor initial value is used to generate the transient key.

[0045] In some embodiments, identity authentication is the user end verifying whether the identity information input by the user is correct, mutual authentication is the authentication process between the user end, the gateway node and the sensor node to ensure that all parties are legitimate participants, and the sensor hash message authentication code and the user hashed message authentication code is an authentication code generated based on a hash function, which is used to ensure the integrity of the data and the authenticity of the source; the random number (R3) and timestamp (T1) are random values ​​generated by the gateway node, which are used to ensure the uniqueness of each session and prevent replay attacks; the session key (δ(c)) is a temporary key used to encrypt and decrypt data of a specific session. The session key is determined between the sensor node and the gateway node through a key negotiation process.

[0046] In some embodiments, through the key negotiation and authentication process, the sensor node and the gateway node negotiate a session key to ensure the secure transmission of data. The entire process uses lightweight encryption algorithms and hardware-based encryption primitives (such as PUF) to reduce computational complexity while ensuring the security of the wireless sensor network. Through these steps, the user end, gateway node, and sensor node can exchange data securely while protecting the privacy and integrity of the data.

[0047] It is understandable that the present application can ensure the security of data transmission by combining instantaneous keys and long-term keys, and adopt multiple authentication mechanisms, including local verification of the user end, mutual authentication between the gateway node and the user end and sensor nodes, to ensure that only legitimate users and sensors can access the network, and then through the session key negotiation based on timestamps and random numbers, ensure that each communication has a new key, thereby enhancing the security of the system. In summary, through the above-mentioned lightweight encryption authentication mechanism, the present application can effectively solve the security problems in wireless sensor networks and is suitable for resource-constrained sensor nodes.

[0048] refer to Figure 3 , Figure 3 A flowchart of a lightweight encryption authentication method for a wireless sensor network provided by an embodiment of the present application; in some embodiments, a gateway node generates a sensor transient key and a user transient key based on a one-way hash function and a preset physical unclonable function, respectively, including:

[0049] Step S310, generating random one-time random numbers R1 and R2 based on a collision-resistant one-way hash function h(.);

[0050] Step S320: Use the physical unclonable function PUF to generate challenge values ​​C1 and C2 and an initialization vector and Based on the random numbers R1 and R2, the challenge values ​​C1 and C2, and the initialization vector and Generate sensor instantaneous key T S and the user's instantaneous key T M ;in,

[0051] Among them, the collision-resistant one-way hash function h(.) has one-way and collision-resistant properties. One-way means that it is difficult to infer the input from a given output; collision-resistant means that it is difficult to find two different inputs that produce the same output. This ensures the security of the hash function; the one-time random numbers R1 and R2 are used to create instantaneous keys, which helps to ensure that each generated key is unique, thereby improving security.

[0052] Among them, the challenge values ​​C1 and C2 are random values ​​generated by PUF and used in the subsequent key generation process. They can be regarded as "questions" to PUF, and PUF will generate corresponding "answers" based on its internal physical properties; initialization vector and Used in encryption algorithms to ensure that even identical plaintext does not produce identical ciphertext. In this context, and Used to add extra randomness to make the generated key more secure; encryption function Enc k () can encrypt the input using a long-term key k, which can refer to the sensor long-term key or user long-term key mentioned previously.

[0053] In some embodiments, Among them, the symbol || represents the serial operation of data, that is, connecting multiple data segments together to form a continuous data stream. The above formula shows that the present application can combine the output of PUF, the initialization vector and the random number to generate an instantaneous key, and further process it using the encryption function and the hash function to obtain the final instantaneous key; through the above steps, the gateway node can generate a one-time sensor instantaneous key and a user instantaneous key, which will be used in subsequent secure communication processes. Since the output of PUF is based on hardware characteristics, each sensor or user device will generate a different key, which increases the overall security of the system.

[0054] refer to Figure 4 , Figure 4 A flowchart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application; in some embodiments, a sensor node obtains a sensor identifier and a sensor initial value, and sends the sensor identifier and the sensor initial value to a gateway node to complete sensor registration, including:

[0055] Step S410: The sensor node obtains a sensor identifier SID j and the initial value of the sensor IV S and share the sensor identification SID with the gateway node through a secure channel j and the initial value of the sensor IV S ;

[0056] Step S420: The gateway node sends the sensor initial value IV through a secure channel. S , the parameter set formed by the sensor long-term key and the user long-term key is sent to the memory of the sensor node so that the sensor node sets the cycle counter c to 1.

[0057] In some embodiments, the sensor identifier SID jIt is the unique identifier of the sensor node, which is used to uniquely identify the sensor node in the network. The initial value of the sensor IV S It is an initial value used by sensor nodes during the registration process to generate instantaneous keys; secure channels are used to ensure sensitive information (such as SID j and IV S ) security during transmission.

[0058] In some embodiments, the sensor long-term key is used to generate the transient key and remains unchanged throughout the life cycle. The user long-term key is used to generate the transient key of the user end and remains unchanged throughout the life cycle. Cycle counter c: This is a counter used to track the number of authentication processes between the sensor node and the gateway node. After each successful authentication, the value of the counter will increase.

[0059] refer to Figure 5 , Figure 5 A flowchart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application; in some embodiments, the user terminal authenticates the identity information currently input by the user based on the user identity identifier and the user password data, including:

[0060] Step S510: The user terminal receives the identity identifier UID input by the user i * and password PW i * ;

[0061] Step S520: If the user terminal verifies the identity UID input by the user i * and password PW i * The user ID cached by the client i And user password data PW i If they match, the user is authenticated successfully;

[0062] Step S530: If the user is successfully authenticated, the user sends the identity identifier UID to the gateway node. i * .

[0063] In some embodiments, the UID i * It is an identifier entered by the user, used to uniquely identify the user in the network. The password is PW i * It is the password data entered by the user, which is used to verify the user's identity. If the user end verifies the user's input identity UIDi and password PWi with the user identity UID cached by the user end i And user password data PWi If the user is successfully authenticated, the user sends the identity UID to the gateway node. i * ; It can be understood that the sensor registration process ensures that the sensor node can securely join the network and establishes the necessary trust relationship with the gateway node. The user authentication process ensures that only legitimate users can access network resources and services. By using secure channels and pre-configured long-term keys, these steps improve the security of the entire system. The use of loop counters helps prevent replay attacks and ensures the correctness of the authentication process.

[0064] refer to Figure 6 , Figure 6 A flowchart of a lightweight encryption authentication method for a wireless sensor network provided by an embodiment of the present application; in some embodiments, mutual authentication is performed between a user terminal, a gateway node, and a sensor node based on identity information, so that a sensor hash message authentication code and a user hash message authentication code are sent to the sensor node according to the authentication result, including:

[0065] Step S610: The gateway node uses the user identity UID i Verify identity UID i * If the verification is successful, a random number R3 is generated to identify the user according to the random number R3 and the user identity UID i Get authentication parameter A1 = (R3 || UID i ), and sends an authentication response corresponding to A1 to the sensor node;

[0066] Step S620: the sensor node retrieves the counter c and the sensor instantaneous key T S and the user's instantaneous key T M , and determine the timestamp T1 to calculate the authentication parameters And send the authentication message corresponding to A2 to the gateway node;

[0067] Step S630: The gateway node calculates the security token based on R3 and A2. And send security token A4 to the user end;

[0068] Step S640: The user terminal obtains the sensor instantaneous key T corresponding to the counter c S , based on T S Verify the security token A4. If verification is successful, a message containing the timestamp T1 and the random number R3 is obtained. And send A5 to the gateway node;

[0069] Step S650: The gateway node calculates the user identity UIDi , the sensor node's identity SID j , counter c, random number R3 and timestamp T1 authentication message B1, and send B1 to the user end;

[0070] Step S660: The user terminal obtains the user instantaneous key T corresponding to the counter c. M , based on T M Verify B1. If verification is successful, send a message containing timestamp T1 and user identity UID. i , the sensor node's identity SID j , counter c and random number R3 authentication message B2 to the gateway node;

[0071] Step S670: The gateway node converts the sensor hash message authentication code into and the user hashed message authentication code sent to the sensor nodes.

[0072] In some embodiments, corresponding to step S610, the gateway node checks the identity identifier UID sent by the user end. i * Is it the same as the known legal user identity UID? i Once the verification is successful, the gateway node generates a random number R3 and uses the random number R3 and the user identity UID i Combined into authentication parameters A1 = (R3 | | UID i ), so that the gateway node sends the authentication parameter A1 to the sensor node.

[0073] In some embodiments, corresponding to step S620, the sensor node reads the value of the current cycle counter c, and the sensor node generates a current timestamp T1 using the sensor node's identity identifier SID j , counter c, timestamp T1 and user identity UID i To construct the authentication parameter A2, so that the sensor node sends the authentication parameter A2 to the gateway node.

[0074] In some embodiments, corresponding to step S630 , the gateway node uses the previously generated random number R3 , the counter c and the timestamp T1 to create a security token A4 , so that the gateway node sends the security token A4 to the user end.

[0075] In some embodiments, corresponding to step S640, the user terminal uses the sensor instantaneous key T corresponding to the current counter c S To verify the security token A4, if the verification is successful, the user side constructs message A5 and sends it to the gateway node.

[0076] In some embodiments, corresponding to step S650, the gateway node calculates the user identity UID i , the sensor node's identity SID j , counter c, random number R3 and timestamp T1, and sends B1 to the user end, so that the gateway node uses the previous various parameters to construct the authentication message B1, and sends the authentication message B1 to the user end.

[0077] In some embodiments, corresponding to step S660, the user terminal uses the user instantaneous key T corresponding to the current counter c M To verify the authentication message B1, if the verification is successful, the user terminal constructs the authentication message B2 and sends it to the gateway node.

[0078] In some embodiments, corresponding to step S670, the gateway node constructs and sends a hash message authentication code to the sensor node based on the received authentication message B2.

[0079] It can be understood that the above mutual authentication process ensures that the user end, the gateway node and the sensor node can communicate securely by using the random number R3, the timestamp T1, the user identity UID i and the sensor node's identity SID j and other parameters, and by using various instantaneous keys T S and T M To verify these parameters, this process provides authentication and data integrity.

[0080] refer to Figure 7 , Figure 7 A flowchart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application; in some embodiments, the method further includes:

[0081] Step S710: The sensor node increases the value of the counter c each time the authentication process is successfully completed.

[0082] It can be understood that the sensor node increases the value of the counter c by 1 each time the authentication process is successfully completed. The use of the counter c helps to prevent replay attacks and ensure the timeliness of communication.

[0083] In some embodiments, the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node to obtain a session key according to the authentication result, including: the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, the random number R3 and the timestamp T1, so that the sensor node calculates the session key δ(c), wherein the calculation formula of the session key δ(c) is: Where B3 = h(T1||Φ(c)),

[0084] In some embodiments, the sensor node receives the sensor hash message authentication code, the user hash message authentication code, the random number and the timestamp from the gateway node to calculate the token δ(c), which is the timestamp T1 and the random number R3 XOR (⊕) timestamp T1, user identity UID i , the sensor node's identity SID j And a string consisting of random number R3.

[0085] Among them, the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, user hash message authentication code, random number and timestamp. The sensor node uses the timestamp, random number, user identity and sensor node identity to calculate the session key δ(c). The ⊕ operator here represents the bitwise XOR operation, which ensures that the key is still difficult to crack even if part of the information is leaked. In addition, the hash function h(.) ensures that even if there is a slight change in the original data, a completely different output will be produced, which enhances the security of the key.

[0086] It can be understood that the session key δ(c) is calculated based on the current timestamp and random number, which ensures that even if the future session key is leaked, the past session key cannot be inferred; similarly, even if the past session key is leaked, the future session key cannot be inferred, because each new session will generate a new timestamp and random number, and since each session contains a new timestamp, the old session data cannot be reused; in addition, the calculation of the hashed message authentication code depends on the timestamp and token, which ensures the integrity and source authentication of the message.

[0087] In summary, in this way, a secure session key δ(c) can be established between the sensor node and the gateway node through the key negotiation and authentication process. The key is calculated based on the current timestamp, random number, user identity and sensor node identity, which ensures efficient and secure communication even in resource-constrained environments.

[0088] refer to Figure 8 , Figure 8 A timing flow chart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application; in some embodiments, Figure 8 Corresponding to the system setup phase and registration phase in this application, corresponding to Figure 8, System Setup Phase, this application is executed by the GWN through a setup procedure, with the goal of generating secure values ​​that can be deployed during the registration and authentication phases. The GWN first selects h(.) as a collision-resistant one-way hash function. Next, it generates two random nonce numbers R1 and R2. Thereafter, it uses the PUF challenges C1 and C2 and the initialization vector and To derive S j and MD i The instant key: and Finally, it will T S and T M Release to MD i and S j ,like Figure 2 Finally, the master key is sent to S through a secure channel. j and U i .

[0089] During the registration phase, user U i Generate a unique identity UID i and password PW i These security parameters are then cached in the MD i 's memory. Thereafter, MD i Share UID with GWN through secure channel i Similarly, the sensor node S j The unique identifier SID will also be selected j and the initial value IV S , the unique identifier SID j and the initial value IV S It is also shared with the GWN through a secure channel. Figure 8 As shown, the parameter set {Ψ S ,Ψ U ,IV S} is loaded into S j In the memory of sensor node S j The loop counter c is set to 1.

[0090] refer to Fig. 9 , Fig. 9 A timing flow chart of a lightweight encryption authentication method for a wireless sensor network provided in an embodiment of the present application; in some embodiments, Fig. 9 Corresponding to the login and authentication phase and the key negotiation phase in this application, the purpose of these phases is to allow MD i For User U i To authenticate and promote MD i , GWN and S jThe following steps detail these login and authentication procedures:

[0091] Step 1: U i To MD i Provide UID i * and PW i * , then MD i Confirm whether In addition, it checks whether Causes the login session to be abandoned if authentication fails. Otherwise, U i Will be MD i Successfully authenticated. After that, MD i Send authentication message Auth1={UID i *},like Figure 3 shown.

[0092] Step 2: From MD i After receiving the message Auth1, GWN confirms whether Basically, if the authentication fails, the session is terminated. Otherwise, it generates a random one-time random number R3 and derives the parameter A1 = (R3||UID i Finally, it compiles the authentication response Auth2 = {A1} and forwards it to S through the public channel. j .

[0093] Step 3: After receiving the Auth2 sent by GWN, S j The counter c and the equivalent instantaneous key pair T will be retrieved S and T M It will then establish the current timestamp T1 and calculate the value Finally, it compiles the message Auth3={A2} and sends it to the GWN.

[0094] Step 4: When obtaining Auth3, GWN calculates the security token The security token is forwarded to the MD via the public channel in the message Auth4={A4} i .

[0095] Step 5: After obtaining Auth4 from GWN, MD i Retrieve the instantaneous key T corresponding to the received counter c S Use this T S , it verifies the HMAC of T1 received from GWN. If the verification fails, the session is terminated. Otherwise, it exports And sends it back to the GWN in the message Auth5={A5}. Finally, it increases the counter c by 1.

[0096] Step 6: After obtaining Auth5, GWN calculates Afterwards, it sends B1 to MD in the message Auth6={B1} i ,like Figure 3 shown.

[0097] Step 7: After obtaining Auth6 from GWN, MD i Retrieve the instantaneous key T corresponding to the received counter c M Next, it verifies T1, UID i and SID j If the HMAC verification succeeds, it verifies the time validity of T1. In addition, it also verifies the time validity of T1 through Ψ U Verify user U i Basically, if any of these verifications fail, the session stops. Otherwise, the procedure in the subsequent step 8 is executed.

[0098] Step 8: MD i calculate And sends it to the GWN in the message Auth7={B2}. After that, it increases the counter c by 1.

[0099] In addition, corresponding to the key negotiation phase, the GWN has received j and the user's mobile device MD i This phase is performed immediately after receiving the hashed message authentication code. The following steps detail these key agreement procedures:

[0100] Step 1: Use the received hashed message authentication code and GWN Export Token Then, GWN forwards the token Φ(c) in the message Auth8={Φ(c),B3} to S j .

[0101] Step 2: After obtaining Auth8, S j Establish the current timestamp T2 and check whether T2-T1≤ΔT. Here, ΔT represents the maximum allowed transmission delay. If the verification fails, it means that the response was received outside the set time window, so the request is marked as a replay. Otherwise, S j Independently generated token and parameter B3 * =h(T1||Φ *(c)). Next, by confirming whether Verify the re-exported B3 * Is it equal to B3 received in message Auth8? If the verification fails, the authentication procedure is terminated. Otherwise, S j The GWN has been effectively verified, and the MD i It provides access to the sensed data.

[0102] Step 3: S j Increase the loop counter c by 1 and derive the session key The session key δ(c) is in S j , GWN and MD i This session key is then used to protect data exchange over the public Internet.

[0103] Through the above steps, the present application can share the session key between the user end, the gateway node and the sensor node, so as to perform data exchange between the user end, the gateway node and the sensor node based on the session key.

[0104] Furthermore, the present application also provides the following examples to analyze and illustrate the effects of the present application.

[0105] In some embodiments, the security of the negotiated session key can be verified by adopting a real or random (ROR) model. Specifically, the difficulties faced by an adversary in trying to obtain the communication session key are analyzed. By simulating different attack strategies that the adversary may adopt, the effectiveness of the scheme in resisting various attacks can be demonstrated. In addition, an informal security analysis is performed, including the use of various formulated and verified theorems, which can prove that the scheme can resist typical WSN attacks.

[0106] In some embodiments, the scheme can be implemented on a Windows 11 operating system machine equipped with an Intel Core i5 processor, 6GB RAM and a 2.6GHz main frequency. For the Trivium stream cipher, Python's pytrivium library is used, and the result is: 11 hash message authentication codes (THMAC) and 3 one-way hash (Th) operations are performed. The experimental results show that the computational cost of the scheme is only 16.04ms, which is much lower than the computational cost of other related lightweight authentication schemes. Therefore, it can be concluded that since the sensor nodes in WSN are limited in computing resources, the scheme is most suitable in this environment.

[0107] In some embodiments, considering the information exchange in the login, identity authentication and key negotiation stages, in these processes, it is assumed that information Auth1 = {UIDi*}, Auth2 = {A1}, Auth3 = {A2}, Auth4 = {A4}, Auth5 = {A5}, Auth6 = {B1}, Auth7 = {B2} and Auth8 = {Φ(c), B3} are exchanged between Sj, GWN and MDi, and the result is: the cumulative computational overhead is 1824 bits, which is much lower than the communication overhead of other related lightweight authentication schemes; it can be understood that due to the limited communication capabilities of WSN sensor nodes, this scheme is most suitable for deployment in this application field.

[0108] In some embodiments, the energy consumption of sensor nodes and mobile devices is considered. In a WSN environment, energy is given by the product of computational overhead and maximum processing power, where the maximum processing power is 10.88 watts. In this embodiment, the energy consumption of sensor nodes and mobile devices is 142.27 mJ and 152.43 mJ, respectively, which is much lower than the energy consumption of other related lightweight authentication schemes. It can be understood that since most sensor nodes in WSN are powered by batteries, energy resources are limited, so this scheme performs well in terms of energy consumption and is very suitable for resource-constrained wireless sensor network environments.

[0109] In summary, through the above embodiments, the effect of the lightweight encryption authentication mechanism of the present application has been fully verified. This solution can not only provide significant security and privacy protection, but also achieve efficient computing, energy and communication costs in resource-constrained environments. It can effectively solve security problems in wireless sensor networks and is suitable for resource-constrained sensor nodes.

[0110] To achieve the above-mentioned purpose, the second aspect of the embodiment of the present application provides a lightweight encryption authentication device for a wireless sensor network, the device comprising: a system setting module, used to control the gateway node to generate a sensor transient key and a user transient key based on a one-way hash function and a preset physical unclonable function, respectively, and send the sensor transient key, the user transient key, the preset sensor long-term key and the user long-term key to the user end and the sensor node, respectively; a registration module, used to control the user end to obtain the user identity and user password data generated by the user, and send the user identity to the gateway node to complete the user registration; and a module for controlling the sensor node to obtain the sensor identification and the sensor initial value, and send the sensor identification and the sensor initial value to the gateway node to complete the sensor registration. a login authentication module, used to control the user end to authenticate the identity information currently input by the user based on the user identity identifier and the user password data, and to perform mutual authentication between the user end, the gateway node and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result; a key negotiation module, used to control the sensor node to perform key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code and the random number and timestamp generated by the gateway node, so as to obtain the session key according to the authentication result; so that the session key is shared among the user end, the gateway node and the sensor node, and the user end, the gateway node and the sensor node exchange data based on the session key.

[0111] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application provides an electronic device, comprising: at least one processor; at least one memory for storing at least one program; and when the at least one program is executed by the at least one processor, a lightweight encryption authentication method for a wireless sensor network as described in any one of the first aspects is implemented.

[0112] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, and the computer-executable instructions are used to execute a lightweight encryption authentication method for a wireless sensor network as described in any one of the fourth aspects.

[0113] Some embodiments of the present application provide an electronic device, Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, referring to Fig.10 The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the lightweight encryption authentication method for a wireless sensor network of any one of the above embodiments is implemented, for example, the above described Figure 2 Steps S210 to S240 of the method, Figure 3Steps S310 to S320 of the method, Figure 4 Steps S410 to S420 of the method, Figure 5 Steps S510 to S530 of the method, Figure 6 Steps S610 to S670 of the method, Figure 7 Method step S710 in .

[0114] The electronic device 1000 of the embodiment of the present application includes one or more processors 1010 and a memory 1020. Fig.10 In the figure, a processor 1010 and a memory 1020 are taken as an example.

[0115] The processor 1010 and the memory 1020 may be connected via a bus or other means. Fig.10 The example of connecting through bus is taken in the following.

[0116] The memory 1020, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory 1020 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1020 may optionally include a memory 1020 remotely disposed relative to the processor 1010, and these remote memories may be connected to the electronic device 1000 via a network. At the same time, examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0117] In some embodiments, when the processor executes the computer program, the processor executes the lightweight encryption authentication method for the wireless sensor network of any one of the above embodiments at a preset interval.

[0118] Those skilled in the art will understand that Fig.10 The device structure shown in the figure does not constitute a limitation on the electronic device 1000, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0119] exist Fig.10 In the electronic device 1000 shown, the processor 1010 can be used to call the lightweight encryption authentication method for the wireless sensor network stored in the memory 1020, so as to implement the lightweight encryption authentication method for the wireless sensor network.

[0120] Based on the hardware structure of the above-mentioned electronic device 1000, various embodiments of the lightweight encryption authentication device for the wireless sensor network of the present application are proposed. At the same time, the non-transient software programs and instructions required to implement the lightweight encryption authentication method for the wireless sensor network of the above-mentioned embodiments are stored in the memory. When executed by the processor, the lightweight encryption authentication method for the wireless sensor network of the above-mentioned embodiments is executed.

[0121] The embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions, which are used to execute the lightweight encryption authentication method for the wireless sensor network described above, and can enable the one or more processors to execute the lightweight encryption authentication method for the wireless sensor network of any of the above embodiments, for example, to execute the above described Figure 2 Steps S210 to S240 of the method, Figure 3 Steps S310 to S320 of the method, Figure 4 Steps S410 to S420 of the method, Figure 5 Steps S510 to S530 of the method, Figure 6 Steps S610 to S670 of the method, Figure 7 Method step S710 in .

[0122] The embodiment of the present application also provides a computer program product, which includes a computer program, which is stored in a computer-readable storage medium. The processor of the computer device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the lightweight encryption authentication method for the wireless sensor network implementing any one of the above embodiments, for example, executing the above described Figure 2 Steps S210 to S240 of the method, Figure 3 Steps S310 to S320 of the method, Figure 4 Steps S410 to S420 of the method, Figure 5 Steps S510 to S530 of the method, Figure 6 Steps S610 to S670 of the method, Figure 7 Method step S710 in .

[0123] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network nodes. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0124] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer-readable storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer-readable storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD to ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0125] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the above-mentioned implementation mode. Technical personnel familiar with the field can also make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A lightweight encryption authentication method for wireless sensor networks, characterized in that: The wireless sensor network includes a user terminal, a gateway node and a sensor node that are communicatively connected, and the method includes: The gateway node generates a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical unclonable function, and sends the sensor instantaneous key, the user instantaneous key, the preset sensor long-term key and the user long-term key to the user terminal and the sensor node respectively; The user terminal obtains the user identity and user password data generated by the user, and sends the user identity to the gateway node to complete the user registration; the sensor node obtains the sensor identification and the sensor initial value, and sends the sensor identification and the sensor initial value to the gateway node to complete the sensor registration; The user terminal authenticates the identity information currently input by the user based on the user identity identifier and the user password data, and performs mutual authentication between the user terminal, the gateway node and the sensor node based on the identity information, so as to send a sensor hash message authentication code and a user hash message authentication code to the sensor node according to the authentication result; The sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node, so as to obtain a session key according to the authentication result; The session key is shared among the user terminal, the gateway node and the sensor node, so that data exchange is performed among the user terminal, the gateway node and the sensor node based on the session key.

2. The lightweight encryption authentication method for wireless sensor networks according to claim 1, characterized in that: The gateway node generates a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical unclonable function, respectively, including: Generate random one-time random numbers R1 and R2 based on the collision-resistant one-way hash function h(.); Use the physical unclonable function PUF to generate challenge values ​​C1 and C2 and initialization vector and Based on the random numbers R1 and R2, the challenge values ​​C1 and C2, and the initialization vector and Generate sensor instantaneous key T S and the user's instantaneous key T M ; in, 3. The lightweight encryption authentication method for wireless sensor networks according to claim 2, characterized in that: The sensor node obtains a sensor identifier and a sensor initial value, and sends the sensor identifier and the sensor initial value to the gateway node to complete sensor registration, including: The sensor node obtains the sensor identification SID j and the initial value of the sensor IV S and share the sensor identification SID with the gateway node through a secure channel j and the sensing initial value IV S ; The gateway node transmits the sensor initial value IV through a secure channel S , the parameter set formed by the sensor long-term key and the user long-term key is sent to the memory of the sensor node, so that the sensor node sets the cycle counter c to 1.

4. The lightweight encryption authentication method for wireless sensor networks according to claim 3 is characterized in that: The user terminal authenticates the identity information currently input by the user based on the user identity identifier and the user password data, including: The user terminal receives the identity identifier UID input by the user i * and password PW i * ; If the user terminal verifies the identity identifier UID input by the user i * and password PW i * The user ID UID cached by the client i If it matches the user password data PWi, the user is successfully authenticated; When the user is successfully authenticated, the user terminal sends the identity identifier UID to the gateway node. i * .

5. The lightweight encryption authentication method for wireless sensor networks according to claim 4, characterized in that: The mutual authentication is performed between the user terminal, the gateway node and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result, including: The gateway node is based on the user identity identifier UID i Verify the identity UID i * If the verification is successful, a random number R3 is generated to obtain the user identity UID i Get authentication parameter A1 = (R3 || UID i ), and sends an authentication response corresponding to A1 to the sensor node; The sensor node retrieves the counter c and the sensor transient key T S and the user instantaneous key T M , and determine the timestamp T1 to calculate the authentication parameters and sending an authentication message corresponding to A2 to the gateway node; The gateway node calculates a security token based on R3 and A2 and sending the security token A4 to the user terminal; The user end obtains the sensor instantaneous key T corresponding to the counter c S , based on T S Verify the security token A4, and if verification is successful, obtain a message containing the timestamp T1 and the random number R3 And send A5 to the gateway node; The gateway node calculates the user identity UID i , the sensor node's identity identifier SID j , the counter c, the random number R3 and the authentication message B1 of the timestamp T1, and sending the B1 to the user terminal; The user terminal obtains the user instantaneous key T corresponding to the counter c M , based on T M Verify the B1, and if the verification is successful, send a message containing the timestamp T1 and the user identity UID i , the sensor node's identity identifier SID j , an authentication message B2 of the counter c and the random number R3 to the gateway node; The gateway node converts the sensor hash message authentication code into and the user hashed message authentication code Sent to the sensor node.

6. The lightweight encryption authentication method for wireless sensor networks according to claim 5, characterized in that: The method further comprises: The sensor node increases the value of the counter c each time the authentication process is successfully completed.

7. The lightweight encryption authentication method for wireless sensor networks according to claim 5, characterized in that: The sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node to obtain a session key according to the authentication result, including: The sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, the random number R3 and the timestamp T1, so that the sensor node calculates the session key δ(c), wherein the calculation formula of the session key δ(c) is: Where B3 = h(T1||Φ(c)), 8. A lightweight encryption authentication device for a wireless sensor network, characterized in that: The device comprises: A system setting module, used for controlling the gateway node to generate a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical unclonable function, and sending the sensor instantaneous key, the user instantaneous key, the preset sensor long-term key and the user long-term key to the user terminal and the sensor node respectively; A registration module, used to control the user terminal to obtain a user identity and user password data generated by the user, and send the user identity to the gateway node to complete user registration; and used to control the sensor node to obtain a sensor identifier and a sensor initial value, and send the sensor identifier and the sensor initial value to the gateway node to complete sensor registration; A login authentication module, used to control the user terminal to authenticate the identity information currently input by the user based on the user identity identifier and the user password data, and to perform mutual authentication between the user terminal, the gateway node and the sensor node based on the identity information, so as to send a sensor hash message authentication code and a user hash message authentication code to the sensor node according to the authentication result; A key negotiation module is used to control the sensor node to perform key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node, so as to obtain a session key according to the authentication result; so that the session key is shared among the user terminal, the gateway node and the sensor node, and the user terminal, the gateway node and the sensor node exchange data based on the session key.

9. An electronic device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When at least one of the programs is executed by at least one of the processors, the lightweight encryption authentication method for a wireless sensor network according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the lightweight encryption authentication method for a wireless sensor network according to any one of claims 1 to 7.

Images