Multicast authentication method based on Hash chain
Through the hash chain-based multicast authentication method, the problems of low efficiency and insufficient security in the prior art are solved, and efficient and secure multicast authentication is achieved, which is suitable for massive equipment and time-critical equipment.
Patent Information
- Application Number
- CN202411333919.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-24
- Publication Date
- 2024-12-17
AI Technical Summary
The existing multicast authentication method is inefficient under high-speed and low-latency requirements, has high computing costs, and the anonymous authentication method has problems of disclosure delay and excessive power, which cannot meet the needs of future development.
Adopt a multicast authentication method based on hash chain, and by building a message hash chain, it reduces the verification delay at the receiver, allocates the security delay of key disclosure, improves authentication efficiency, and passes the tamper-freeization of single key chain and hash chain Improve the security of the system.
It realizes more efficient multicast authentication efficiency than digital signatures and message verification codes, taking into account the characteristics, efficiency and security of multicast authentication, and is suitable for authentication scenarios of massive equipment and time-critical equipment.
Smart Images
Figure CN119155039A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to a multicast authentication method based on a hash chain. Background Art
[0002] As the number of connected devices increases, there is a growing need for efficient multicast authentication methods. Digital signatures are one of the most common technologies in multicast authentication. They are based on the public key infrastructure (PKI) to ensure the integrity and non-repudiation of messages. However, with the growing demand for low-latency, high-throughput transmission mechanisms in various fields, PKI cannot meet the needs of high speed and low latency. Direct use of message authentication codes is a solution based on symmetric keys, which can effectively meet the time and computation requirements in unicast communication, but when the number of receiving devices continues to increase, the computational cost and time increase exponentially. Therefore, this method will not be able to meet future development needs. Time-Effective Stream Loss Tolerant Authentication (μTESLA) is an effective solution for WSN authentication, which generates a MAC for each message to provide broadcast / multicast authentication. However, to ensure the security of transmitted messages, the disclosure delay of μTESLA will bring excessive overhead to the verification of each message. Obviously, for time-critical devices, a disclosure delay of several message delivery intervals (i.e., greater than the sum of the maximum network transmission delay and synchronization errors) is intolerable. Existing anonymous authentication methods are inefficient and have overpowered KGCs.
[0003] Therefore, it is an urgent problem for those skilled in the art to propose a multicast authentication method based on a hash chain to overcome the difficulties existing in the prior art. Summary of the invention
[0004] In view of this, the present invention provides a multicast authentication method based on hash chain, which uses disclosure delay to establish a message hash chain, can ensure a safe transmission interval, and at the same time reduce the verification delay of multiple receiving ends to one, and distribute it to multiple messages, thereby improving the authentication efficiency; the safety delay upper limit of key disclosure ensures the confidentiality and availability of the key in each round in each round, and the tamper-proof nature of the single key chain and hash chain greatly improves the security and privacy protection of the system.
[0005] In order to achieve the above object, the present invention adopts the following technical solution:
[0006] A multicast authentication method based on a hash chain comprises the following steps:
[0007] S1. The sender calculates key parameters and sets them;
[0008] S2, determine whether the key round number is greater than the key round number threshold, if yes, return to S1, otherwise enter S3;
[0009] S3: The receiver sets the security key value and the upper limit of the security delay T according to the parameters in S1;
[0010] S4, the sender uses the security time upper limit T to process batch messages and build a multicast hash chain;
[0011] S5, the receiver batch caches the messages in S4 and reconstructs the hash chain;
[0012] S6. The sender generates a multicast message authentication code every time a preset number of messages are sent;
[0013] S7, judging whether the time when the receiver receives the key is less than the safety interval or the key verification fails, if yes, the verification fails and the authentication ends, if no, proceeding to S8;
[0014] S8. Determine whether the recipient verifies that the hash chain value and the broadcast message authentication code are correct. If so, the verification is successful and the authentication ends. If not, the verification fails and the authentication ends.
[0015] The above method is optional, S1, parameters include: security key S0, number of key rounds N, and upper limit of security delay T.
[0016] In the above method, optionally, the key round number threshold in S2 is: L, where L is a positive integer.
[0017] In the above method, optionally, the parameter setting in S1 includes the following steps:
[0018] S101, determining the maximum transmission delay time of the network;
[0019] S102, setting a safety delay upper limit;
[0020] S103, calculating and setting the chain authentication interval;
[0021] S104: Send relevant parameters to a receiving node.
[0022] The above method is optional. The specific content of constructing the multicast hash chain in S4 is as follows:
[0023] Compute multicast hash chain (M i , HC i-1 )→{HC i}: If the message is the first message, the hash chain value is calculated directly from the hash value of the message. Otherwise, the input of the process is the current Mi and the hash chain value calculated from the previous message; and the hash value H(M i ), the output is HC i , which is the new hash chain value.
[0024] The above method is optional. The specific content of rebuilding the multicast hash chain in S5 is as follows:
[0025] The message sent by the sender carries the message hash chain node value. The receiver first builds the same message hash chain locally. After receiving the message, it calculates the hash value of the message to generate a new local message hash chain node value.
[0026] In the above method, optionally, in S6, the preset number of messages sent by the sender at each preset interval is: d, where d is a positive integer.
[0027] The above method is optional. In S8, for a message without a broadcast authentication code, the receiver needs to first determine whether the upper limit of the security delay T is legal, and then verify the hash chain node value of the message.
[0028] In the above method, optionally, the specific content of the receiving node verifying the broadcast message authentication code in S8 is as follows:
[0029] First, the receiver uses the previously disclosed security key S0 to verify the HMMA key S i , H(S i )=S i-1 If you do not receive S i-1 The receiver passes through S i Repeat H to verify S i , to obtain the last received HMMA key, i.e. H j (S i )=S i-j ;
[0030] If the verification is successful, use S i to verify the authenticity of the message and store to verify future values of the hash chain to be received;
[0031] Then, using the proof the recipient traverses the hash chain to retrieve the i ,t) The hash value of the chain node on the path starting from, thereby calculating the initial value;
[0032] Finally, verify whether S i =HMAC(H′(S i ),ts i ,root i ), if verified, the authenticity of the message is verified. In each time interval, the sent message forms a message hash chain, and the corresponding message is signed using the key in the time interval. Using the key disclosure time, the receiver first verifies the correctness of the message hash chain, and verifies the correctness of the message hash subchain at the disclosure time, realizing one signature verification of multiple messages.
[0033] It can be seen from the above technical solution that, compared with the prior art, the present invention provides a multicast authentication method based on a hash chain, which has the following beneficial effects:
[0034] 1) Designed a multicast authentication method based on hash chain
[0035] A message authentication scheme for time-sensitive multicast scenarios is proposed, which has a more efficient multicast authentication efficiency than digital signatures and message authentication codes. HMMA based on the hash chain structure is designed to solve the efficiency problem of massive device authentication with chained multicast authentication; and under strict transmission delay requirements, μTESLA is introduced into batch authentication for the first time, and the HMMA algorithm is proposed, which takes into account the characteristics, efficiency and security of multicast authentication.
[0036] 2) Designed a multicast authentication system based on hash chain
[0037] The innovative design of the hash chain-based multicast authentication system uses a delayed key disclosure mechanism to improve the security of the entire authentication process. First, this delayed disclosure mechanism prevents attackers from tampering with messages immediately even if they intercept messages, because they do not have the corresponding keys to generate valid security signatures. Secondly, this method ensures that even if a key is leaked, the leaked key is only valid within a limited time window. The security of the multicast message authentication code is guaranteed under the limitation of the security delay, and once the key expires, it can no longer be used to verify new messages. Hash chain, cannot be tampered with.
[0038] 3) Designed a broadcast message authentication code based on μTESLA
[0039] A lightweight multicast message verification code is designed. It integrates the μTESLA authentication concept and the authentication efficiency of the message hash chain to batch authenticate multicast information. It achieves high-security and high-efficiency multicast authentication, which can be applied to the authentication scenarios of massive information in the Internet of Vehicles and Industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.
[0041] Figure 1 This is a structural diagram of the multicast authentication based on the hash chain disclosed in the present invention;
[0042] Figure 2 A flow chart of a multicast authentication method based on a hash chain disclosed in the present invention;
[0043] Figure 3 A flow chart of system parameter settings disclosed in the present invention;
[0044] Figure 4 The figure is the overall flow chart of HMMA authentication disclosed in the present invention. DETAILED DESCRIPTION
[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0046] In this application, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, the elements defined by the sentence "comprise one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.
[0047] See also Figure 1 Shown is a diagram of the hash chain-based multicast authentication structure disclosed in the present invention.
[0048] Definition 1 describes the chained multicast authentication method as a four-tuple Acc = (Gen_KeyChain, Gen_HashChain, HMMA_Sign, HMMA_Verify)
[0049] Gen_KeyChain: The sender first generates a one-way key chain using a hash function. Using the irreversibility of the hash function, the sequence is generated in the reverse order and used as the key for each round of message authentication.
[0050] Gen_HashChain: If this is the first message, the value of the hash chain is calculated directly from the hash value of the message; if it is not the first message, the process will use the current message M i and the hash chain value of the previous message as input; then calculate the current message M i The hash value H(M i );
[0051] HMMA_Sign: multicast message signature, chain multicast signature of the message hash chain value, generate a signature value and attach it to the optional field of the message;
[0052] HMMA_Verify: The receiver first calculates the hash chain value, and after a security delay, it combines the disclosed key to perform hash verification on the chained multicast signature.
[0053] Definition 2 The receiver node is set to R, which contains {R1, R2, …, R n}node.
[0054] Definition 3 Key chain management: Generate a key chain, {S0, S1, ..., S N}.
[0055] Definition 4: Safety delay upper limit T: According to the maximum transmission delay of the selected network, the safety delay upper limit is set to T.
[0056] Definition 5 Multicast sending node: provides multicast messages and can form batch hash chains {M0,M1,……,M N}.
[0057] Definition 6: Verification node: The receiver verifies the hash chain value and the chained multicast authentication code.
[0058] After the communication nodes have negotiated the signature interval, they start to transmit data. The data packets transmitted by the communication nodes are divided into data packets without multicast authentication codes and only containing message hash chain nodes, and data packets containing multicast message codes and message hash chain nodes. Figure 2 The sender in the process shown in the figure transmits the data packet and constructs the calculation of the message hash chain node synchronously, that is, the calculation of each message segment m i The corresponding message hash chain node value HC i After that, m i With HC i As the data packet content, it is transmitted to the corresponding receiving end. For the security of the message hash chain, the data segments will be signed at intervals according to Sig, that is, HC α +Sig β Signature is performed, where α is the hash serial number of the first message to be signed, and β∈(1,2,……,n). Data packet p carrying the signature i The data structure is p i =(m i ,hc i ,Shc i ), data packet p without signature j The data structure is p j =(m j ,hc j ).
[0059] To this end, the present invention specifically discloses a multicast authentication method based on a hash chain. For a specific flow chart, see Figure 2 As shown, the following steps are included:
[0060] S1. The sender calculates key parameters and sets them;
[0061] S2, determine whether the key round number is greater than the key round number threshold, if yes, return to S1, otherwise enter S3;
[0062] S3: The receiver sets the security key value and the upper limit of the security delay T according to the parameters in S1;
[0063] S4, the sender uses the security time upper limit T to process batch messages and build a multicast hash chain;
[0064] S5, the receiver batch caches the messages in S4 and reconstructs the hash chain;
[0065] S6. The sender generates a multicast message authentication code every time a preset number of messages are sent;
[0066] S7, judging whether the time when the receiver receives the key is less than the safety interval or the key verification fails, if yes, the verification fails and the authentication ends, if no, proceeding to S8;
[0067] S8. Determine whether the recipient verifies that the hash chain value and the broadcast message authentication code are correct. If so, the verification is successful and the authentication ends. If not, the verification fails and the authentication ends.
[0068] Furthermore, the parameters in S1 include: security key S0, number of key rounds N, and upper limit of security delay T.
[0069] Furthermore, the key round number threshold in S2 is: L, where L is a positive integer.
[0070] For further information, see Figure 3 As shown, the parameter setting in S1 includes the following steps:
[0071] S101, determining the maximum transmission delay time of the network;
[0072] S102, setting a safety delay upper limit;
[0073] S103, calculating and setting the chain authentication interval;
[0074] S104: Send relevant parameters to a receiving node.
[0075] Furthermore, the specific contents of constructing the multicast hash chain in S4 are as follows:
[0076] Compute multicast hash chain (M i , HCi-1 )→{HC i}: If the message is the first message, the hash chain value is calculated directly from the hash value of the message. Otherwise, the input of the process is the current Mi and the hash chain value calculated from the previous message; and the hash value H(M i ), the output is HC i , which is the new hash chain value.
[0077] Furthermore, the specific contents of rebuilding the multicast hash chain in S5 are as follows:
[0078] The message sent by the sender carries the message hash chain node value. The receiver first builds the same message hash chain locally. After receiving the message, it calculates the hash value of the message to generate a new local message hash chain node value.
[0079] Furthermore, in S6, the preset number of messages sent by the sender at each preset interval is: d, where d is a positive integer.
[0080] Furthermore, for messages without a broadcast authentication code in S8, the receiver needs to first determine whether the upper limit of the security delay T is legal, and then verify the hash chain node value of the message.
[0081] Further, optionally, the specific content of the broadcast message authentication code verified by the receiving node in S8 is as follows:
[0082] First, the receiver uses the previously disclosed security key S0 to verify the HMMA key S i , H(S i )=S i-1 If you do not receive S i-1 The receiver passes through S i Repeat H to verify S i , to obtain the last received HMMA key, i.e. H j (S i )=S i-j ;
[0083] If the verification is successful, use S i to verify the authenticity of the message and store to verify future values of the hash chain to be received;
[0084] Then, using the proof the recipient traverses the hash chain to retrieve the i ,t) The hash value of the chain node on the path starting from, thereby calculating the initial value;
[0085] Finally, verify whether S i =HMAC(H′(S i ),ts i ,root i), if verified, the authenticity of the message is verified. In each time interval, the sent message forms a message hash chain, and the corresponding message is signed using the key in the time interval. Using the key disclosure time, the receiver first verifies the correctness of the message hash chain, and verifies the correctness of the message hash subchain at the disclosure time, realizing one signature verification of multiple messages.
[0086] See also Figure 4 As shown, the present invention also discloses an overall flow chart of HMMA authentication, including the following contents:
[0087] Step 1 Initialization parameters: In chained multicast authentication, in order to avoid calculating the MAC of each destination separately, the system needs to introduce an asymmetric source between the source and the destination. This asymmetry ensures that the destination can only verify the priority result but cannot initialize it (C' L )-→{S0,……,S L ,S N}: This process outputs a key chain of L+1 values and uses the commitment of the previous hash chain S'L to output a proof of the first value. The source selects a random number SL and commits it to it by repeatedly applying the one-way function H to generate a hash chain of length L+1 such that S i-1 =H(S i ), We will {S i} are called multicast keys and are used in the reverse order of their generation, i.e. from S1 to S L , to verify the root value of the message in the next L time interval.
[0088] The appropriate upper limit of the security delay is calculated based on the maximum round-trip delay and the proposed hash chain length, in order to obtain the optimal authentication efficiency while ensuring security.
[0089] Step 2 Calculate the multicast hash chain (M i , HC i-1 )→{HC i}: If the message is the first message, the hash chain value is calculated directly from the hash value of the message. Otherwise, the input of the process is the current Mi and the hash chain value calculated from the previous message; and the hash value H(M i ). The output is HC i , which is the new hash chain value. At this point, the hash chain is only known to the source and thus acts as private metadata.
[0090] Step 3 Generate chained multicast message authentication codes at intervals: MMAC{M i , HC i , K u}: The message sent by the sender needs to carry the message hash chain node value, which is used to verify the correctness of the message at the receiving end. For example, after the sender A sends a message to the receiving end B, the receiving end B must first build the same message hash chain locally, calculate the hash value of the message after receiving the message, generate a new local message hash chain node value, and then compare it with the message hash chain node value carried by the message to verify the message. i Next, we introduce the authentication steps of the receiving node.
[0091] Step 4: Verify the hash chain: Use the previous hash chain S' L , if there is a proof of generating the first HMMA key S0 and the key disclosure schedule, otherwise digitally sign S0 and the key disclosure schedule before sending them to the destination. As mentioned above, in HMMA, another hash function H' is applied to m i For messages without broadcast authentication codes, the receiver needs to first determine whether the upper limit of the security delay T is legal, and then verify the hash chain node value of the message.
[0092] Step 5 The receiving node verifies the broadcast authentication code (S i , S i-1 ,s i , m i ,t,proof i ) → {accept, reject}: Input is the HMMA key S i ,S i-1 ,proof i MAC value S i , real news i , t and proof of the true message i In this process, first, the destination uses the previously disclosed security key S0 to verify the HMMA key S i , for example H(S i )=S i-1 If S is not received due to packet loss, etc. i-1 , the destination can still be reached by i Repeat H to verify S i , to obtain the last received HMMA key, i.e. H j (S i )=S i-j If the verification is successful, use S i to verify the authenticity of the message and store it to verify the future value of the hash chain to be received. Then, use the proof destination to traverse the hash chain to retrieve the value from the saved (m i,t) to calculate the initial value. Finally, verify whether S i =HMAC(H′(S i ),ts i ,root i ). If verified, the authenticity of the message is verified. In each time interval, the sent message forms a message hash chain, and the corresponding message is signed using the key in the time interval. In this way, the receiver can first verify the correctness of the message hash chain at the key disclosure time, and then verify the correctness of the message hash subchain at the disclosure time. This enables one signature to verify multiple messages, thereby greatly reducing the signing and verification time.
[0093] The present invention applies the TESLA concept to the design of a chained multicast authentication protocol, and implements an efficient multicast authentication method through batch processing of messages by the sender and the receiver. In the implementation process, a suitable hash algorithm and encryption algorithm are selected, and parameter configuration and optimization are performed according to specific requirements. At the same time, factors such as the length of the message hash chain, the efficiency of hash calculation, and the upper limit of the security delay should also be considered to achieve the best balance between performance and security, and be applied to anonymous authentication and security authentication.
[0094] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.
[0095] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A multicast authentication method based on hash chain, characterized in that: The following steps are involved: S1. The sender calculates key parameters and sets them; S2, determine whether the key round number is greater than the key round number threshold, if yes, return to S1, otherwise enter S3; S3: The receiver sets the security key value and the upper limit of the security delay T according to the parameters in S1; S4, the sender uses the security time upper limit T to process batch messages and build a multicast hash chain; S5, the receiver batch caches the messages in S4 and reconstructs the hash chain; S6. The sender generates a multicast message authentication code every time a preset number of messages are sent; S7, judging whether the time when the receiver receives the key is less than the safety interval or the key verification fails, if yes, the verification fails and the authentication ends, if no, proceeding to S8; S8. Determine whether the recipient verifies that the hash chain value and the broadcast message authentication code are correct. If so, the verification is successful and the authentication ends. If not, the verification fails and the authentication ends.
2. A multicast authentication method based on hash chain according to claim 1, characterized in that: S1. Parameters include: security key S0, number of key rounds N, and upper limit of security delay T.
3. A multicast authentication method based on hash chain according to claim 2, characterized in that: The key round number threshold in S2 is: L, where L is a positive integer.
4. A multicast authentication method based on hash chain according to claim 3, characterized in that: The parameter setting in S1 includes the following steps: S101, determining the maximum transmission delay time of the network; S102, setting a safety delay upper limit; S103, calculating and setting the chain authentication interval; S104: Send relevant parameters to a receiving node.
5. A multicast authentication method based on hash chain according to claim 4, characterized in that: The specific contents of constructing the multicast hash chain in S4 are as follows: Compute multicast hash chain (M i , HC i-1 )→{HC i }: If the message is the first message, the hash chain value is calculated directly from the hash value of the message. Otherwise, the input of the process is the current Mi and the hash chain value calculated from the previous message; and the hash value H(M i ), the output is HC i , which is the new hash chain value.
6. A multicast authentication method based on hash chain according to claim 5, characterized in that: The specific contents of rebuilding the multicast hash chain in S5 are as follows: The message sent by the sender carries the message hash chain node value. The receiver first builds the same message hash chain locally. After receiving the message, it calculates the hash value of the message to generate a new local message hash chain node value.
7. A multicast authentication method based on hash chain according to claim 6, characterized in that: In S6, the preset number of messages sent by the sender at each preset number interval is: d, where d is a positive integer.
8. A multicast authentication method based on hash chain according to claim 7, characterized in that: In S8, for messages without a broadcast authentication code, the receiver needs to first determine whether the security delay upper limit T is legal, and then verify the hash chain node value of the message.
9. A multicast authentication method based on hash chain according to claim 8, characterized in that: The specific content of the receiving node verifying the broadcast message authentication code in S8 is as follows: First, the receiver uses the previously disclosed security key S0 to verify the HMMA key S i , H(S i )=S i-1 If you do not receive S i-1 The receiver passes through S i Repeat H to verify S i , to obtain the last received HMMA key, i.e. H j (S i )=S i-j ; If the verification is successful, use S i to verify the authenticity of the message and store to verify future values of the hash chain to be received; Then, using the proof the recipient traverses the hash chain to retrieve the i ,t) The hash value of the chain node on the path starting from, thereby calculating the initial value; Finally, verify whether S i =HMAC(H′(S i ),ts i ,root i ), if verified, the authenticity of the message is verified. In each time interval, the sent message forms a message hash chain, and the corresponding message is signed using the key in the time interval. Using the key disclosure time, the receiver first verifies the correctness of the message hash chain, and verifies the correctness of the message hash subchain at the disclosure time, realizing one signature verification of multiple messages.