Key distribution method in IoT cloud-edge collaboration scenario based on heterogeneous joint PUF

Abstract

The present invention discloses a key distribution method in a cloud-edge collaborative scenario of the Internet of Things based on heterogeneous joint PUF, including: the edge end receives a communication request sent by a terminal device and containing a target device identifier, and when the two devices are identified as belonging to the same group according to the request, the key for communication between the two devices is generated based on its own superlattice PUF, and the encryption information of the two devices is generated based on the key, its own superlattice PUF and the SRAM PUF fingerprints of the two devices, and each is sent to the two devices, so that the two devices decrypt the encrypted information according to the SRAM PUF fingerprint to obtain the key, and the SRAM PUF fingerprint is the information output after the SRAM PUF is powered on. The present invention changes the existing local and single PUF usage mode, and realizes the safe and efficient distribution of keys under the cloud-edge collaborative architecture of the Internet of Things by combining SRAM PUF and superlattice PUF.

Description

Technical Field

[0001] The present invention belongs to the field of communication security technology, and specifically relates to a key distribution method in an IoT cloud-edge collaboration scenario based on heterogeneous joint PUF. Background Art

[0002] At present, in the field of Internet of Things, a large number of new technologies, new products and new models are constantly emerging, which are profoundly changing the traditional industrial form and social lifestyle, and gradually developing into an indispensable part of people's social life. Most of the devices in the Internet of Things have limited storage capacity and computing efficiency, and cannot directly complete complex calculations and a large number of storage tasks. They need to interact with the central server to complete core computing and data storage. Due to the rapid increase in the number of IoT devices and the continuous expansion of application scenarios, the cloud computing model has bottlenecks such as reduced multi-task processing efficiency, increased data search delay and limited network bandwidth resources. Therefore, edge computing has emerged to decompose the tasks previously handled by the central server and put the tasks on the edge for calculation, which can effectively reduce data transmission time and delay. However, edge computing is limited by local edge computing capabilities and cloud-edge communication bandwidth. In order to solve the problems existing in cloud computing and edge computing, the cloud-edge collaborative architecture of the Internet of Things came into being. Cloud-edge collaboration closely combines cloud computing and edge computing. By reasonably allocating cloud computing and edge computing tasks, the computing tasks are decomposed and extended to the edge, realizing the sinking of cloud computing. At the same time, the edge computing results are sent back to the cloud for data analysis and processing, and finally realizing efficient computing and data transmission of IoT data.

[0003] With the continuous development of cloud-edge collaboration methods, data security issues have also become an important research topic. How to effectively ensure the security, integrity, confidentiality and availability of data transmission is a key and difficult problem faced by data security transmission under the cloud-edge collaboration architecture of the Internet of Things. In the process of data transmission in the Internet of Things, it is difficult to achieve secure key distribution and key storage. Relying on the public key cryptography system to achieve key distribution, on the one hand, due to the cumbersome working mechanism, the storage resources and computing power of the Internet of Things devices are limited, and it is difficult to achieve complex calculations; on the other hand, the public key cryptography system is difficult to effectively cope with the extremely strong cracking ability in the post-quantum era. In addition, through network attacks, attackers can use side channel attacks to obtain keys stored in non-volatile memory (NVM), or implant malicious code in the software to illegally read the keys, and key storage faces huge risks. Key distribution and storage based on the physical unclonable function (PUF) is an effective method to solve the problem of secure data transmission in the Internet of Things, which can effectively solve the above problems. PUF is a hardware security technology that mainly extracts the process parameter deviations that are inevitably introduced in the chip manufacturing process to achieve the physical one-way function function that uniquely corresponds to the excitation signal and the response signal. PUF can generate keys in real time based on the excitation signal, so there is no need to store them locally in advance. It can effectively prevent side-channel attacks and reduce key management risks.

[0004] Since different PUF types have different physical and security characteristics, although they can all be used for IoT data security protection, different types of PUFs have their own advantages for different application scenarios. Under the IoT cloud-edge collaborative architecture, due to the large number of terminal devices and diverse structural types, PUF can only be used in a local area. It is difficult to solve the problem of secure and efficient key distribution under the IoT cloud-edge collaborative architecture by using PUF. Summary of the invention

[0005] In order to solve the above problems existing in the prior art, the present invention provides a key distribution method in an IoT cloud-edge collaboration scenario based on heterogeneous joint PUF.

[0006] The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0007] The present invention provides a key distribution method in a cloud-edge collaboration scenario of the Internet of Things based on heterogeneous joint PUF, the method comprising:

[0008] The first edge terminal receives a communication request sent by a terminal device; wherein the communication request includes an identifier of the terminal device and an identifier of a target device;

[0009] The first edge end identifies the identifier of the target device, and when identifying that the target device belongs to a first group in which the first edge end and the terminal device are located, generates a communication encryption key for communication between the terminal device and the target device based on the superlattice PUF of the first edge end;

[0010] Based on the communication encryption key, the superlattice PUF of the first edge end, the SRAM PUF fingerprint of the terminal device and the SRAM PUF fingerprint of the target device, the first edge end generates key encryption information of the terminal device and key encryption information of the target device respectively by address rearrangement and hash transformation, and sends them to the terminal device and the target device respectively, so that the terminal device and the target device decrypt their respective key encryption information according to their own SRAM PUF fingerprints to obtain the communication encryption key; wherein the SRAM PUF fingerprint is information output after the SRAM PUF is powered on.

[0011] Compared with the prior art, the present invention has the following beneficial effects:

[0012] 1) The present invention can use PUF to generate encryption keys when encryption keys are needed, without storing keys in NVM, which can greatly reduce the risk of key theft and improve the security of key storage and the confidentiality of transmitted data. In addition, using PUF for key distribution can effectively reduce the computational complexity of key distribution, which is conducive to improving the efficiency of key distribution.

[0013] 2) This invention changes the original local and single PUF usage mode, designs a heterogeneous PUF joint working mode based on the security characteristics of SRAM PUF and superlattice PUF, realizes data fusion at the application level, and can achieve the security, integrity, confidentiality and availability of data transmission under the cloud-edge collaborative architecture, ensuring the efficiency and correctness of key distribution.

[0014] 3) The present invention adopts the method of "address reordering + hash transformation" to achieve the exponential expansion of the challenge-response pairs of SRAM PUF, thereby meeting the actual needs of key distribution.

[0015] The present invention will be further described in detail below with reference to the accompanying drawings and specific implementation methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flowchart of a key distribution method in a cloud-edge collaboration scenario of the Internet of Things based on heterogeneous joint PUF provided by an embodiment of the present invention;

[0017] Figure 2It is a schematic diagram of the generation principle of the communication encryption key provided by an embodiment of the present invention;

[0018] Figure 3 is a schematic diagram of a random address rearrangement provided by an embodiment of the present invention;

[0019] Figure 4 It is a flow chart of group key distribution under the IoT cloud-edge collaborative architecture based on heterogeneous joint PUF provided by an embodiment of the present invention;

[0020] Figure 5 It is a flow chart of cross-group key distribution under the IoT cloud-edge collaborative architecture based on heterogeneous joint PUF provided by an embodiment of the present invention;

[0021] Figure 6 It is an overall flow chart of key distribution under the IoT cloud-edge collaborative architecture based on heterogeneous joint PUF provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0023] The embodiment of the present invention provides a key distribution method in a cloud-edge collaborative scenario of the Internet of Things based on heterogeneous joint PUF, which can be applied in a communication network. The network may include a cloud and at least one group, each group including an edge terminal and at least two terminal devices. The cloud can communicate with the edge terminal in each group, and the terminal device in each group can communicate with the edge terminal in the group. When a terminal device in a group needs to communicate with a terminal device in the group or another group, the key distribution method in the cloud-edge collaborative scenario of the Internet of Things based on heterogeneous joint PUF provided by the embodiment of the present invention can be used to distribute communication encryption keys for the two devices, so that the two terminal devices can communicate with each other subsequently according to the distributed communication encryption keys. Exemplarily, the network may include a cloud, a smart home device group, and a smart medical device group. The smart home device group may include an edge terminal, a smart light, a sweeping robot, and a monitoring device. The smart medical device group may include an edge terminal, a smart health management device, a smart medical device detection system, and a smart body medical detection device. For example, when a smart light needs to communicate with a monitoring device or a smart health management device, the key distribution method in the IoT cloud-edge collaboration scenario based on heterogeneous joint PUF provided by an embodiment of the present invention can be used to distribute communication encryption keys for the two devices, so that the two terminal devices can subsequently communicate with each other based on the distributed communication encryption keys.

[0024] Figure 1: is a flowchart of a key distribution method in a cloud-edge collaboration scenario of the Internet of Things based on heterogeneous joint PUF provided by an embodiment of the present invention, such as Figure 1 As shown, the method includes:

[0025] S101. A first edge terminal receives a communication request sent by a terminal device; wherein the communication request includes an identifier of the terminal device and an identifier of a target device.

[0026] Here, the first edge terminal and the terminal device belong to the same group, and the target device can be a terminal device in the group where the first edge terminal and the terminal device are located together, or a terminal device in another group in the same network as the group where the first edge terminal and the terminal device are located together. The identifier of each terminal device and the identifier of each edge terminal are unique.

[0027] S102. The first edge end identifies the identifier of the target device, and when it is identified that the target device belongs to a first group in which the first edge end and the terminal device are located, generates a communication encryption key for communication between the terminal device and the target device based on the superlattice PUF of the first edge end.

[0028] Here, the first edge end can store the identifications of all terminal devices in the group to which it is located. By comparing the identification of the target device with the identifications of all terminal devices stored by itself one by one, the first edge end can identify whether the target device belongs to the first group to which the first edge end and the terminal device are located.

[0029] S103. The first edge end generates key encryption information of the terminal device and key encryption information of the target device respectively based on the communication encryption key, the superlattice PUF of the first edge end, the SRAM PUF fingerprint of the terminal device and the SRAM PUF fingerprint of the target device by means of address rearrangement and hash transformation, and sends them to the terminal device and the target device respectively, so that the terminal device and the target device decrypt their respective key encryption information according to their own SRAM PUF fingerprints to obtain the communication encryption key; wherein the SRAM PUF fingerprint is the information output after the SRAM PUF is powered on.

[0030] Here, SRAM PUF is a semiconductor chip, wherein SRAM is the abbreviation of Static Random Access Memory, called static random access memory.

[0031] Here, the SRAM PUF in different terminal devices may be different, so that the SRAM PUF fingerprints of different terminal devices are different.

[0032] In some embodiments, the “generating a communication encryption key for communication between the terminal device and the target device based on the superlattice PUF at the first edge end” in S102 above can be implemented by the following steps:

[0033] S1021. Obtain the current time, obtain the first time, and generate a first random number.

[0034] S1022. Generate first incentive data according to the first random number and the first time.

[0035] Specifically, the first random number and the first time are both binary sequences, and the two binary sequences can be concatenated to serve as the first excitation data.

[0036] S1023 , input the first stimulus data into the superlattice PUF at the first edge end to obtain first response data.

[0037] S1024: Sample and post-process the first response data to obtain a communication encryption key DataKey used for communication between the terminal device and the target device.

[0038] Here, in the communication encryption key generation stage, since the superlattice PUF is a strong PUF, it can generate a large number of true random numbers for data encryption, thus ensuring a high key generation rate and security, so the superlattice PUF generates the core key DataKey required for data security communication. Superlattice PUF is an analog device, and the key generation process requires the use of a digital to analog converter (DAC) and an analog to digital converter (ADC) for analog-to-digital conversion. The specific generation principle of the communication encryption key is as follows: Figure 2 As shown, first, the initial excitation signal is generated by using the bias voltage and the random signal generated by the random number generator ( Figure 2 The initial excitation signal is then converted into an analog signal using a DAC, and the resulting analog signal is used as the final excitation signal. After the final excitation signal is input into the superlattice PUF, self-oscillation occurs inside the superlattice PUF, and an initial response signal is generated. The initial response signal generated by the superlattice PUF is then digitally sampled into a random sequence using an ADC to obtain a final response signal. The sampled response signal is then post-processed, and the data obtained after the post-processing operation can be used as the communication encryption key DataKey required for secure device data communication.

[0039] In some embodiments, the above S103 is implemented by the following steps:

[0040] S1031. The first edge terminal obtains the current time, obtains the second time Time1, and generates a second random number Nonce1, and obtains the current time, obtains the third time Time2, and generates a third random number Nonce2.

[0041] S1032: The first edge end generates a first random sequence Seq1 based on the second random number Nonce1 and the second time Time1 using the superlattice PUF of the first edge end, and generates a second random sequence Seq2 based on the third random number Nonce2 and the third time Time2 using the superlattice PUF of the first edge end.

[0042] It should be noted that the second time Time1 and the third time Time2 may be the same or different. When the second time Time1 and the third time Time2 are the same, it means that the current time acquisition operation is performed only once. When the second time Time1 and the third time Time2 are different, it means that the current time acquisition operation is performed twice, thereby obtaining two different times accordingly.

[0043] Exemplarily, the generation principle of Seq1 and Seq2 is: according to the second random number Nonce1 and the second time Time1, generate the second excitation data c1; according to the third random number Nonce2 and the third time Time2, generate the third excitation data c2; input the second excitation data c1 into the superlattice PUF at the first edge end to obtain the second response data, and sample, post-process and normalize the second response data in sequence to obtain the first random sequence Seq1; input the third excitation data c2 into the superlattice PUF at the first edge end to obtain the third response data, and sample, post-process and normalize the third response data in sequence to obtain the second random sequence Seq2.

[0044] Specifically, the principle of generating the second excitation data and the third excitation data is the same as the principle of generating the first excitation data mentioned above. Similarly, the principle of generating the second response data and the third response data is also the same as the principle of generating the first response data mentioned above, which will not be repeated here.

[0045] Specifically, the second response data can be sampled and post-processed in sequence to obtain a first true random number TRandom1, and then the first true random number TRandom1 can be normalized to adjust the value space of the first true random number TRandom1 to 0 to 15, thereby obtaining a 64-bit first random sequence Seq1. Similarly, the third response data can be sampled and post-processed in sequence to obtain a second true random number TRandom2, and then the second true random number TRandom2 can be normalized to adjust the value space of the second true random number TRandom2 to 0 to 15, thereby obtaining a 64-bit second random sequence Seq2.

[0046] S1033. The first edge end uses the first random sequence Seq1 as the first value address, rearranges the random address of the SRAM PUF fingerprint of the terminal device according to the first value address, and then performs a hash operation on the SRAM PUF fingerprint after the random address rearrangement to obtain the first transfer key K1 of the terminal device.

[0047] S1034. The first edge end uses the second random sequence Seq2 as the second value address, rearranges the random address of the SRAM PUF fingerprint of the target device according to the second value address, and then performs a hash operation on the SRAM PUF fingerprint after the random address rearrangement to obtain the first transfer key K2 of the target device.

[0048] Specifically, the principle of random address rearrangement is as follows Figure 3 As shown, assuming that the original data to be randomly rearranged is 256 bits, the original data is represented in hexadecimal format with 8 bits as a group. At the same time, the value address (i.e. Figure 3 The address sequence in the address sequence is grouped into 4 bits each and expressed in decimal. After that, the original data and the address sequence are traversed in turn, and the original data is rearranged according to the new address sequence. In this way, the address randomization transformation result obtained is the original data after random address rearrangement.

[0049] S1035. The first edge end uses the first transfer key K1 of the terminal device to encrypt the communication encryption key DataKey to obtain the key ciphertext K1[DataKey] of the terminal device, and uses the key ciphertext K1[DataKey] of the terminal device and the first random sequence Seq1 as the key encryption information of the terminal device, and uses the first transfer key K2 of the target device to encrypt the communication encryption key to obtain the key ciphertext K2[DataKey] of the target device, and uses the key ciphertext K2[DataKey] of the target device and the second random sequence Seq2 as the key encryption information of the target device.

[0050] Here, when the first edge terminal identifies that the target device belongs to the first group in which the first edge terminal and the terminal device are located, the first edge terminal is responsible for distributing the communication encryption key to the terminal device and the target device, which belongs to the same group key distribution. Figure 4 It is a flow chart of group key distribution in the IoT cloud-edge collaborative architecture based on heterogeneous joint PUF, and Figure 4 This is a brief description of the steps in distributing the same group of keys. Figure 4 In the figure, E1 represents the first edge end, T1 represents the terminal device, and T2 represents the target device. PUF_Id1 represents the SRAM PUF fingerprint of T1, PUF_Id2 represents the SRAM PUF fingerprint of T2, Seq1+PUF_Id1 represents the PUF_Id1 after random address rearrangement obtained by taking Seq1 as the value address and performing random address rearrangement on PUF_Id1, Hash(Seq1+PUF_Id1) represents the hash operation on the PUF_Id1 after random address rearrangement, and the same is true for Seq2+PUF_Id2 and Hash(Seq2+PUF_Id2). Figure 4 Data1 in the data represents the key encryption information of T1, and Data2 represents the key encryption information of T2.

[0051] In some embodiments, the above method further comprises the following steps:

[0052] S104: When the first edge terminal recognizes that the target device does not belong to the first group, the communication request is forwarded to the cloud.

[0053] S105. The cloud identifies the identifier of the target device, and when it is identified that the target device belongs to the network in which the first edge terminal, the cloud terminal and the terminal device are located, a communication encryption key DataKey is generated based on the superlattice PUF of the cloud terminal, and key information KeyData is generated through a cryptographic fuzzy extractor generation algorithm and an encryption algorithm based on the superlattice PUF and the communication encryption key DataKey of the cloud terminal, and the key information KeyData is sent to the first edge terminal and the second edge terminal respectively; wherein the second edge terminal and the target device belong to the second group together, and the first group, the second group and the cloud terminal belong to the same network.

[0054] Here, when the cloud recognizes that the target device does not belong to the network in which the first edge, the cloud and the terminal device are located, an alarm prompt that the identifier of the target device does not exist can be sent to the first edge and the terminal device respectively.

[0055] S106. The first edge end recovers the communication encryption key DataKey according to the superlattice PUF of the first edge end and the key information KeyData, and generates the key encryption information of the terminal device through address rearrangement and hash transformation based on the communication encryption key DataKey, the superlattice PUF of the first edge end, and the SRAMPUF fingerprint of the terminal device, and sends it to the terminal device, so that the terminal device decrypts the key encryption information according to its own SRAM PUF fingerprint to obtain the communication encryption key DataKey.

[0056] S107. The second edge end recovers the communication encryption key DataKey according to the superlattice PUF of the second edge end and the key information KeyData, and generates the key encryption information of the target device through address rearrangement and hash transformation based on the communication encryption key DataKey, the superlattice PUF of the second edge end, and the SRAMPUF fingerprint of the target device, and sends it to the target device, so that the target device decrypts the key encryption information according to its own SRAM PUF fingerprint to obtain the communication encryption key DataKey; wherein the superlattice PUF of any two of the cloud, the first edge end, and the second edge end are twin superlattice PUFs.

[0057] In some embodiments, the above S105 of “generating key information KeyData through a cryptographic fuzzy extractor generation algorithm and an encryption algorithm based on the superlattice PUF and the communication encryption key DataKey in the cloud” can be implemented by the following steps:

[0058] S1051. Acquire the current time, obtain a fourth time Time, and generate a fourth random number Nonce.

[0059] S1052. Generate fourth excitation data c according to the fourth time Time and the fourth random number Nonce.

[0060] S1053. Input the fourth excitation data c into the superlattice PUF in the cloud to obtain fourth response data w.

[0061] Specifically, the generation principle of the fourth excitation data c is the same as the generation principle of the first excitation data mentioned above. Similarly, the generation principle of the fourth response data w is also the same as the generation principle of the first response data mentioned above, which will not be repeated here.

[0062] S1054: Use the cryptographic fuzzy extractor generation algorithm Gen(w)→(HelpData, Key) to operate on the fourth response data w to obtain the auxiliary data HelpData and the second transfer key K ES .

[0063] S1055: Use the second transfer key KES The communication encryption key DataKey is encrypted with the encryption algorithm to obtain the encrypted communication encryption key K ES [DataKey].

[0064] S1056, the fourth incentive data c, the auxiliary data HelpData and the encrypted communication encryption key K ES The information composed of [DataKey] is used as the key information KeyData.

[0065] In some embodiments, the “the first edge end recovers the communication encryption key DataKey according to the superlattice PUF of the first edge end and the key information KeyData” in the above S106 can be implemented by the following steps:

[0066] S1061. The first edge end inputs the fourth stimulus data c in the key information KeyData into the superlattice PUF of the first edge end to obtain fifth response data w'; wherein the similarity between the fifth response data w' and the fourth response data w is higher than a preset value.

[0067] Here, since the superlattice PUF at the first edge and the superlattice PUF at the cloud are twin superlattice PUFs, the fifth response data w′ and the fourth response data w have extremely high similarity.

[0068] S1062: The first edge terminal uses the fuzzy extractor recovery algorithm Rep(w', HelpData)→(Key) to calculate the fifth response data w' and the auxiliary data HelpData in the key information KeyData to obtain the second transfer key K ES .

[0069] S1063: The first edge end uses the second transfer key K ES The encrypted communication encryption key K in the key information KeyData ES [DataKey] is decrypted to obtain the communication encryption key DataKey.

[0070] In some embodiments, the above-mentioned “the second edge end recovers the communication encryption key DataKey according to the superlattice PUF of the second edge end and the key information KeyData” in S107 can be implemented by the following steps:

[0071] S1071. The second edge end inputs the fourth stimulus data c in the key information KeyData into the superlattice PUF of the second edge end to obtain sixth response data w″; wherein the similarity between the sixth response data w″ and the fourth response data w is higher than a preset value.

[0072] Here, since the superlattice PUF at the second edge and the superlattice PUF at the cloud are twin superlattice PUFs, the sixth response data w″ and the fourth response data w have extremely high similarity.

[0073] S1072. The second edge end uses the fuzzy extractor recovery algorithm Rep(w'', HelpData)→(Key) to operate the sixth response data w'' and the auxiliary data HelpData in the key information KeyData to obtain the second transfer key K ES .

[0074] S1073: The second edge end uses the second transfer key K ES The encrypted communication encryption key K in the key information KeyData ES [DataKey] is decrypted to obtain the communication encryption key DataKey.

[0075] Here, the specific implementation principle of "based on the communication encryption key DataKey, the superlattice PUF at the first edge end, and the SRAM PUF fingerprint of the terminal device, the key encryption information of the terminal device is generated and sent to the terminal device by means of address rearrangement and hash transformation" in the above S106, and the specific implementation principle of "based on the communication encryption key DataKey, the superlattice PUF at the second edge end, and the SRAM PUF fingerprint of the target device, the key encryption information of the target device is generated and sent to the target device by means of address rearrangement and hash transformation" in the above S107 are the corresponding steps in the above steps S1031~S1035, and will not be repeated here.

[0076] In some embodiments, after the above S103, or S106 and S107, the following steps are further included:

[0077] S201. After receiving the key encryption information, the terminal device powers on the SRAM PUF of the terminal device to obtain the SRAM PUF fingerprint of the terminal device.

[0078] S202. The terminal device uses the first random sequence Seq1 in the received key encryption information as a value address, performs random address rearrangement on the SRAM PUF fingerprint of the terminal device according to the value address, and then performs a hash operation on the SRAM PUF fingerprint after the random address rearrangement to obtain the first transfer key K1 of the terminal device.

[0079] S203. The terminal device uses the first transfer key K1 of the terminal device to decrypt the key ciphertext K1[DataKey] in the received key encryption information to obtain the communication encryption key DataKey.

[0080] S301. After receiving the key encryption information, the target device powers on the SRAM PUF of the target device to obtain the SRAM PUF fingerprint of the target device.

[0081] S302. The target device uses the second random sequence Seq2 in the received key encryption information as the value address, performs random address rearrangement on the SRAM PUF fingerprint of the target device according to the value address, and then performs a hash operation on the SRAM PUF fingerprint after the random address rearrangement to obtain the first transfer key K2 of the target device.

[0082] S303. The target device uses the first transfer key K2 of the target device to decrypt the key ciphertext K2[DataKey] in the received key encryption information to obtain the communication encryption key DataKey.

[0083] Here, when the first edge terminal identifies that the target device does not belong to the first group in which the first edge terminal and the terminal device are located, but the cloud terminal identifies that the target device belongs to the network in which the cloud terminal is located, the cloud terminal, the first edge terminal and the second edge terminal jointly distribute the communication encryption key to the terminal device and the target device, which belongs to cross-group key distribution. Figure 5 It is a flow chart of cross-group key distribution in the IoT cloud-edge collaborative architecture based on heterogeneous joint PUF, and Figure 5 is a brief description of the steps involved in cross-group key distribution. Figure 5 In the figure, S represents the cloud, E1 represents the first edge terminal, E2 represents the second edge terminal, T1 represents the terminal device, and T2 represents the target device. PUF_Id1 represents the SRAM PUF fingerprint of T1, PUF_Id2 represents the SRAM PUF fingerprint of T2, Seq1+PUF_Id1 represents the PUF_Id1 after random address rearrangement obtained by taking Seq1 as the value address and performing random address rearrangement on PUF_Id1, Hash(Seq1+PUF_Id1) represents the hash operation on the PUF_Id1 after random address rearrangement, and the same is true for Seq2+PUF_Id2 and Hash(Seq2+PUF_Id2). Figure 5 Data1 in the data represents the key encryption information of T1, and Data2 represents the key encryption information of T2.

[0084] According to the above steps, the present invention mainly uses the strong PUF properties of superlattice to generate a large number of true random numbers for key generation, uses the security characteristics of twin superlattice PUF for long-distance public channel key distribution, and uses the good physical and security characteristics of SRAM PUF to achieve rapid transformation of terminal equipment, thereby building a complete key distribution system to achieve the security of IoT data transmission. The key distribution process can be divided into three stages: request sending, key generation, and key distribution.

[0085] Phase 1: Request sending phase. The terminal device initiates a key distribution request to the edge end, which contains the target device ID of the communication request. The edge end device selects whether the key distribution is within the same group or across groups based on the ID, and determines the key distribution path.

[0086] Phase 2: Key generation phase. The cloud or edge uses the superlattice PUF it holds to generate the core key DataKey for data encryption required for secure communication of the terminal device.

[0087] Phase 3: Key distribution phase. The transfer protection key required for key distribution is generated by using the superlattice PUF and SRAM PUF characteristics, and the key DataKey obtained in phase 2 is encrypted and decrypted to ensure that the key can be securely distributed to the terminal device.

[0088] For example, Figure 6 The overall flow chart of key distribution in the IoT cloud-edge collaborative architecture based on heterogeneous joint PUF is shown, and Figure 6 is a brief description of the overall key distribution process. Figure 6 In the above, S represents the cloud, E1 represents the first edge terminal, E2 represents the second edge terminal, T1 represents the terminal device, T2 represents the target device, and the other parameters are the same as above. Figure 4 , 5 Also the same.

[0089] The present invention utilizes the characteristics of SRAM PUF and superlattice PUF to propose a key distribution method based on heterogeneous joint PUF in the IoT cloud-edge collaborative architecture, creatively combining the two PUFs and applying them to IoT key distribution. Since the feasibility of using superlattice PUF for key generation and distribution has been experimentally verified, and SRAM PUF as a typical PUF is also widely used, the heterogeneous joint use method has a good application foundation, and provides a feasible solution to the data transmission security and privacy protection issues under the cloud-edge collaborative architecture. In the future when related technologies continue to develop, the existing key distribution methods will face great challenges in key calculation and storage security. Gradually applying the key distribution method of heterogeneous joint SRAM PUF and superlattice to the field of physical network data transmission can effectively solve the core problem of data transmission security. The present invention has the following technical effects:

[0090] 1. Solved the data fusion problem under the joint working conditions of heterogeneous PUF. Since SRAM PUF and superlattice PUF belong to digital circuit PUF and analog circuit PUF respectively, the model structures of the two are quite different, and the driving modes are completely different. The joint work needs to shield the underlying structural differences and realize the shared fusion at the data level. The present invention designs the mode of heterogeneous PUF joint work according to the security characteristics of SRAM PUF and superlattice PUF, realizes the fusion of data at the application level, and ensures the efficiency and correctness of key distribution.

[0091] 2. Solve the key generation problem of heterogeneous joint PUF under the cloud-edge collaborative architecture of the Internet of Things. To distribute keys under the cloud-edge collaborative architecture of the Internet of Things, it is necessary to generate data encryption keys used for secure communication and protection keys for secure key transfer. The present invention uses the strong PUF characteristics of superlattice to realize the generation of core data keys, and uses the security characteristics of superlattice PUF and SRAM PUF to realize the generation of transfer keys. SRAM PUF is a physical component with a linear structure. Although it is portable and easy to install for key distribution in edge devices, it cannot store a large number of CRP pairs due to the effective address space of the device itself. In practical applications, in order to ensure the security of key distribution, the "one-time one-key" mode is often used for key distribution. It is necessary to realize the expansion of the number of SRAM PUF challenge-response pairs to meet the needs of each session update of data transmission between the terminal device and the edge device. The present invention adopts the method of "address rearrangement + hash transformation" to achieve the exponential expansion of SRAM PUF challenge-response pairs, so as to meet the actual needs of key distribution.

[0092] 3. Solved the key distribution problem of heterogeneous joint PUF under the cloud-edge collaborative architecture of the Internet of Things. The twin characteristics of superlattice PUF have been gradually applied to the key field in recent years. The research mainly focuses on using twin superlattices to achieve one-to-one communication. The present invention extends the one-to-one communication mode of superlattice PUF to key distribution between superlattice devices holding twins of each other. Combined with the security characteristics of SRAM PUF, a key distribution method under the cloud-edge collaborative architecture is designed to achieve secure and efficient key distribution.

[0093] It should be noted that the terms "first", "second" and the like are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, the features defined as "first" or "second" may explicitly or implicitly include one or more features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0094] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification.

[0095] In the specification, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality of components. Certain measures are recorded in different embodiments, but this does not mean that these measures cannot be combined to produce good effects.

[0096] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A key distribution method in the IoT cloud-edge collaboration scenario based on heterogeneous joint PUF, characterized in that: The method comprises: The first edge terminal receives a communication request sent by a terminal device; wherein the communication request includes an identifier of the terminal device and an identifier of a target device; The first edge end identifies the identifier of the target device, and when identifying that the target device belongs to a first group in which the first edge end and the terminal device are located, generates a communication encryption key for communication between the terminal device and the target device based on the superlattice PUF of the first edge end; The first edge terminal obtains the current time, obtains the second time, and generates a second random number, and obtains the current time, obtains the third time, and generates a third random number; The first edge generates a first random sequence Seq1 based on the second random number and the second time using the superlattice PUF of the first edge, and generates a second random sequence Seq2 based on the third random number and the third time using the superlattice PUF of the first edge; The first edge end uses the first random sequence Seq1 as a first value address, performs random address rearrangement on the SRAM PUF fingerprint of the terminal device according to the first value address, and then performs a hash operation on the SRAM PUF fingerprint after the random address rearrangement to obtain a first transfer key K1 of the terminal device; The first edge uses the second random sequence Seq2 as a second value address, performs random address rearrangement on the SRAM PUF fingerprint of the target device according to the second value address, and then performs a hash operation on the SRAM PUF fingerprint after the random address rearrangement to obtain a first transfer key K2 of the target device; The first edge end uses the first transfer key K1 of the terminal device to encrypt the communication encryption key to obtain the key ciphertext of the terminal device, and uses the key ciphertext of the terminal device and the first random sequence Seq1 as the key encryption information of the terminal device, and uses the first transfer key K2 of the target device to encrypt the communication encryption key to obtain the key ciphertext of the target device, and uses the key ciphertext of the target device and the second random sequence Seq2 as the key encryption information of the target device, and sends them to the terminal device and the target device respectively, so that the terminal device and the target device decrypt their respective key encryption information according to their own SRAM PUF fingerprints to obtain the communication encryption key; wherein the SRAM PUF fingerprint is the information output after the SRAM PUF is powered on.

2. According to claim 1, the key distribution method in the cloud-edge collaboration scenario of the Internet of Things based on heterogeneous joint PUF is characterized in that: The generating, based on the superlattice PUF at the first edge, a communication encryption key for communication between the terminal device and the target device, comprises: Get the current time, get the first time, and generate the first random number; Generate first incentive data according to the first random number and the first time; Inputting the first stimulus data into the superlattice PUF at the first edge end to obtain first response data; The first response data is sampled and post-processed to obtain a communication encryption key used for communication between the terminal device and the target device.

3. The key distribution method in the IoT cloud-edge collaboration scenario based on heterogeneous joint PUF according to claim 1 is characterized in that: The first edge end generates a first random sequence Seq1 based on the second random number and the second time using the superlattice PUF of the first edge end, and generates a second random sequence Seq2 based on the third random number and the third time using the superlattice PUF of the first edge end, including: The first edge terminal generates second excitation data according to the second random number and the second time; The first edge terminal generates third excitation data according to the third random number and the third time; The first edge end inputs the second excitation data into the superlattice PUF of the first edge end to obtain second response data, and sequentially samples, post-processes and normalizes the second response data to obtain a first random sequence Seq1; The first edge end inputs the third excitation data into the superlattice PUF of the first edge end to obtain third response data, and sequentially samples, post-processes and normalizes the third response data to obtain a second random sequence Seq2.

4. The key distribution method in the IoT cloud-edge collaboration scenario based on heterogeneous joint PUF according to claim 3 is characterized in that: The sampling, post-processing and normalization processing are performed on the second response data in sequence to obtain a first random sequence Seq1, including: The second response data is sampled and post-processed in sequence to obtain a first true random number; The first true random number is normalized to adjust the value space of the first true random number to 0 to 15, thereby obtaining a 64-bit first random sequence Seq1.

5. The key distribution method in the IoT cloud-edge collaboration scenario based on heterogeneous joint PUF according to claim 1 is characterized in that: The method further comprises: When the first edge terminal identifies that the target device does not belong to the first group, forwarding the communication request to the cloud; The cloud identifies the identifier of the target device, and when it is identified that the target device belongs to a network in which the first edge, the cloud and the terminal device are located, generates the communication encryption key based on the superlattice PUF of the cloud, and generates key information through a cryptographic fuzzy extractor generation algorithm and an encryption algorithm based on the superlattice PUF of the cloud and the communication encryption key, and sends the key information to the first edge and the second edge respectively; wherein the second edge and the target device belong to a second group together, and the first group, the second group and the cloud belong to the same network; The first edge end recovers the communication encryption key according to the superlattice PUF of the first edge end and the key information, and generates the key encryption information of the terminal device through address rearrangement and hash transformation based on the communication encryption key, the superlattice PUF of the first edge end, and the SRAMPUF fingerprint of the terminal device, and sends the key encryption information to the terminal device, so that the terminal device decrypts the key encryption information according to its own SRAM PUF fingerprint to obtain the communication encryption key; The second edge end recovers the communication encryption key according to the superlattice PUF of the second edge end and the key information, and generates the key encryption information of the target device through address rearrangement and hash transformation based on the communication encryption key, the superlattice PUF of the second edge end, and the SRAMPUF fingerprint of the target device, and sends the key encryption information to the target device, so that the target device decrypts the key encryption information according to its own SRAM PUF fingerprint to obtain the communication encryption key; Among them, the superlattice PUFs of any two of the cloud end, the first edge end and the second edge end are twin superlattice PUFs.

6. The key distribution method in the IoT cloud-edge collaboration scenario based on heterogeneous joint PUF according to claim 5 is characterized in that: The cloud-based superlattice PUF and the communication encryption key generate key information through a cryptographic fuzzy extractor generation algorithm and an encryption algorithm, including: Get the current time, obtain the fourth time, and generate a fourth random number; Generate fourth incentive data according to the fourth time and the fourth random number; Inputting the fourth stimulus data into the superlattice PUF in the cloud to obtain fourth response data; The fourth response data is operated by using a cryptographic fuzzy extractor generation algorithm to obtain auxiliary data and a second transfer key K ES ; Using the second delivery key K ES The communication encryption key is encrypted using an encryption algorithm to obtain an encrypted communication encryption key; Information consisting of the fourth excitation data, the auxiliary data and the encrypted communication encryption key is used as key information.

7. The key distribution method in the IoT cloud-edge collaboration scenario based on heterogeneous joint PUF according to claim 6 is characterized in that: The first edge end recovers the communication encryption key according to the superlattice PUF of the first edge end and the key information, including: The first edge end inputs the fourth excitation data in the key information into the superlattice PUF of the first edge end to obtain fifth response data; wherein the similarity between the fifth response data and the fourth response data is higher than a preset value; The first edge terminal uses a fuzzy extractor recovery algorithm to operate the fifth response data and the auxiliary data in the key information to obtain the second transfer key K ES ; The first edge uses the second transfer key K ES The encrypted communication encryption key in the key information is decrypted to obtain the communication encryption key.

8. The key distribution method in the IoT cloud-edge collaboration scenario based on heterogeneous joint PUF according to claim 6 is characterized in that: The second edge end recovers the communication encryption key according to the superlattice PUF of the second edge end and the key information, including: The second edge end inputs the fourth excitation data in the key information into the superlattice PUF of the second edge end to obtain sixth response data; wherein the similarity between the sixth response data and the fourth response data is higher than a preset value; The second edge end uses a fuzzy extractor recovery algorithm to operate the sixth response data and the auxiliary data in the key information to obtain the second transfer key K ES ; The second edge end uses the second transfer key K ES The encrypted communication encryption key in the key information is decrypted to obtain the communication encryption key.

9. The key distribution method in the IoT cloud-edge collaboration scenario based on heterogeneous joint PUF according to claim 1 is characterized in that: The method further comprises: After receiving the key encryption information, the terminal device powers on the SRAM PUF of the terminal device to obtain the SRAM PUF fingerprint of the terminal device; The terminal device uses the first random sequence Seq1 in the received key encryption information as a value address, performs random address rearrangement on the SRAM PUF fingerprint of the terminal device according to the value address, and then performs a hash operation on the SRAM PUF fingerprint after the random address rearrangement to obtain a first transfer key K1 of the terminal device; The terminal device uses the first transfer key K1 of the terminal device to decrypt the key ciphertext in the received key encryption information to obtain the communication encryption key.

Images