VANET anonymous roaming authentication method and system based on block chain

Abstract

The invention provides a VANET anonymous roaming authentication method and system based on a block chain. In the roaming authentication scheme provided by the invention, a system model mainly consists of three entities, namely a mobile user, an access point and a network control center. The system is divided into a plurality of areas, and a network control center and at least one access point are arranged in each area. Each network control center issues a group of smart contracts, and when a mobile user roams from a registration area of the mobile user to an area outside the registration area, namely an external area, and needs to obtain a roaming service in the external area, the mobile user can obtain the roaming service in the external area. The application of the smart contract satisfies anonymous identity authentication and revocation check between the mobile user and the access point in the scene, and a secure roaming authentication protocol is realized.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technology, and in particular to a VANET anonymous roaming authentication method and system based on blockchain. Background Art

[0002] With the rapid development of wireless technology, vehicular ad-hoc network (VANET) has shown great potential in assisted driving and traffic monitoring, and secure mobile vehicle communication has become a focus of attention. Mobile vehicle networks facilitate in-vehicle communication and connect vehicles with the surrounding environment, realizing full network connection and information exchange. In addition, as a new type of mobile self-organizing network, mobile vehicle network is an important part of intelligent transportation system. In addition to inheriting the dynamic change of network topology and multi-hop communication characteristics of mobile self-organizing network, it also has unique characteristics such as high-density node distribution and high-speed node mobility. These characteristics directly affect the information transmission capacity of the network and increase packet loss and latency. Therefore, in the communication between vehicles and infrastructure, secure and real-time communication requires secure authentication and seamless access to roaming services.

[0003] According to different authentication methods, the existing roaming authentication protocols can be divided into two types: three-party roaming authentication and two-party roaming authentication. The earliest three-party roaming authentication protocol was proposed by Zhu et al. (J. Zhu, J. Ma, A new authentication scheme with anonymity for wireless environments, IEEE Transactions on Consumer Electronics 50 (1) (2004) 231–235.) in 2004. Since then, researchers have further developed and studied the three-party roaming authentication. However, since the three-party roaming authentication protocol requires the real-time participation of the home server, it leads to high communication delay, weak security and low authentication efficiency. In order to solve these problems, Yang et al. (G. Yang, Q. Huang, D. S. Wong, X. Deng, Universal authentication protocols for anonymous wireless communications, IEEE Transactions on Wireless Communications 9 (1) (2010) 168–174.) proposed a two-party roaming authentication protocol in 2010, which enables mobile users to interact directly with external servers and verify their identities without involving local servers.

[0004] However, the traditional two-party roaming authentication protocol still faces some pressing challenges. From the perspective of anonymity, the traditional two-party roaming authentication protocol may need to pay more attention to the anonymity of mobile users, or continue to use temporary identities instead of real identities, resulting in low storage and computing efficiency and poor real-time performance. In terms of security, the traditional two-party roaming authentication protocol cannot resist strong security attacks such as temporary key leakage. In terms of storage efficiency, the establishment and revocation of roaming partnerships between service operators requires a large amount of storage space, affecting the convenient access of mobile users. With the increasing number of roaming partners, it is crucial to reduce storage space consumption and enable mobile users to perform fast queries.

[0005] In recent years, there has been an increasing trend to leverage blockchain and distributed ledger technologies to enhance the security and trustworthiness of roaming authentication schemes while achieving decentralized authentication methods. Smart contracts are programs stored on a blockchain that are executed when specific predefined conditions are met. They are often used to automatically execute agreements, allowing all participants to determine the outcome immediately without an intermediary. By automating workflows and triggering subsequent actions when conditions are met, smart contracts eliminate the need for intermediaries to process transactions. As a result, this eliminates the associated time delays and costs. In response to the problems of traditional roaming authentication schemes, Xue et al. (Reference 1: K. Xue, X. Luo, Y. Ma, J. Li, J. Liu, D. S. Wei, A distributed authentication scheme based on smart contract for roaming service in mobile vehicular networks, IEEE Transactions on Vehicular Technology 71(5)(2022)5284–5297.) proposed a distributed authentication scheme for roaming services in mobile vehicular networks based on smart contracts. Xue et al. applied blockchain technology to vehicle roaming authentication, avoiding the single point of failure problem in centralized storage architectures. However, it should be noted that Xue et al.’s scheme does not consider the anonymity of mobile users in mobile vehicular networks. In addition, their scheme is not resistant to temporary key leakage attacks, which poses a significant security risk to mobile users. Summary of the invention

[0006] Aiming at the problem that the existing VANET roaming authentication scheme based on smart contract does not consider the anonymity of mobile users and has the risk of temporary key leakage, the present invention provides a VANET anonymous roaming authentication method and system based on blockchain.

[0007] On the one hand, the present invention provides a VANET anonymous roaming authentication method based on blockchain, wherein the nodes on the blockchain include a network control center set in each area and at least one access point connected to the network control center in each area, and the method includes:

[0008] Initialization phase: the network control center in each area publishes system parameters;

[0009] Registration phase: The mobile user and access point send their real identity information to the network control center in their area for registration and receive the public and private key pairs returned by the network control center;

[0010] Verification stage: when a mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number, and generates a false identity of the mobile user according to the first random number, the system parameters, the real identity information of the mobile user, and the public key of the access point in the external area; the mobile user sends an access request to the access point in the external area based on the false identity of the mobile user;

[0011] When the access point in the external area receives the access request, it uses its own private key and the information carried in the access request to authenticate the mobile user. When the identity authentication is passed, it calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform a revocation check on the mobile user. When the revocation check is passed, the access point in the external area randomly selects a second random number, generates a false identity of the access point in the external area according to the second random number, the system parameters, its own real identity information and the public key of the mobile user, and generates a temporary session key between the access point and the mobile user according to the second random number, the information carried in the access request sent by the mobile user, its own private key and its own real identity information; the access point in the external area returns a response message to the mobile user based on its own false identity;

[0012] After receiving the response information, the mobile user uses its own private key and the information carried in the response information to authenticate the access point in the external area. After the identity authentication is passed, the mobile user calls the smart contract pre-deployed by the network control center in the registration area of ​​the access point in the external area to perform a revocation check on the access point in the external area. After the revocation check is passed, the mobile user generates a temporary session key with the access point in the external area according to the first random number, the response information returned by the access point in the external area and its own private key.

[0013] The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area is revoked.

[0014] Furthermore, the initial stage specifically includes:

[0015] Network Control Center Selects Additive Group and multiplicative cyclic groups in, The generator of is denoted as P, and its order is q;

[0016] The network control center selects three hash functions h i ,i∈{1,2,3}; and select As the master private key, calculate P pub =λ·P as the master public key;

[0017] Network Control Center publishes system parameters Where H represents the set of selected hash functions.

[0018] Furthermore, the registration phase specifically includes:

[0019] The mobile user and the access point send their real identity information RID to the j Sent to the network control center in the area; j∈{MU,AP}, MU represents a mobile user, and AP represents an access point;

[0020] The network control center receives the real identity information RID of the mobile user and access point j Then, choose a random number And calculate the intermediate parameter X j =x j ·P;

[0021] The network control center calculates the private key sk for the mobile user and the access point j =x j +λh 1 (RID j ||X j ), public key pk j =sk j ·P;

[0022] The network control center will generate a public-private key pair {sk j ,pk j}Sent to mobile users and access points.

[0023] Furthermore, in the verification phase, when the mobile user roams to an external area and needs to obtain a roaming service, the mobile user selects a first random number, and generates a false identity of the mobile user according to the first random number, the system parameter, the real identity information of the mobile user, and the public key of the access point in the external area; the mobile user sends an access request to the access point in the external area based on the false identity of the mobile user, specifically including:

[0024] The mobile user selects a first random number Calculate the intermediate parameter R U =r U P; where P is obtained from the published system parameters;

[0025] Mobile users use real identity information RID U , calculate false identities and identity verification information T U =h 3 (RID U ||R U ||ts U ), and generate a signature σ U =S.sign(T U ), where h 2 and h 3 is the hash function obtained from the published system parameters, pk AP represents the public key of the access point in the external area, and tsU represents the timestamp;

[0026] The mobile user sends an access request to the access point in the external area in, Indicates the identification information of the network control center of the mobile user registration area.

[0027] Furthermore, in the verification phase, when the access point in the external area receives the access request, it uses its own private key and the information carried in the access request to authenticate the mobile user. When the identity authentication is passed, it calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform a revocation check on the mobile user, which specifically includes:

[0028] The access point in the external area receives the access request A U After that, first verify the timestamp ts U Is it within the allowed range? If so, then according to the received false identity PID of the mobile user U , calculate the real identity of the mobile user and identity verification information T′ U =h 3 (RID′ U||R U ||ts U ), and then generate the signature σ′ U =S.sign(T′ U ), if the signature σ′ U and signature σ U If they are consistent, the identity authentication is successful;

[0029] When the mobile user passes the identity authentication, the access point in the external area generates transaction information

[0030] The access point call identification information of the external area is A smart contract pre-deployed by a network control center of the mobile user, wherein a cuckoo filter is used in the smart contract to query whether the mobile user is already in the network control center. If yes, then continue to query whether the mobile user has been revoked. If not, it means that the mobile user has passed the revocation test.

[0031] Furthermore, in the verification phase, when the revocation check passes, the access point in the external area randomly selects a second random number, generates a false identity of the access point in the external area according to the second random number, the system parameter, its own real identity information and the public key of the mobile user, and generates a temporary session key between the access point and the mobile user according to the second random number, information carried in the access request sent by the mobile user, its own private key and its own real identity information; the access point in the external area returns response information to the mobile user based on its own false identity, which specifically includes:

[0032] The access point in the external area randomly selects a second random number r AP , calculate the intermediate parameter R AP =r AP ·P;

[0033] The access point in the external area is based on the real identity information RID AP , calculate false identities and identity verification information T AP =h 3 (RID AP ||R AP ||ts AP ), and generate a signature σ AP =S.sign(T AP ), where pk U Indicates the public key of the mobile user in the access request, ts AP Indicates a timestamp;

[0034] The access point in the external area generates a temporary session key SK=h between it and the mobile user 2 (r AP pk U ||R U sk AP ||RID AP ||T′ U );where sk AP The private key of the access point in the external area, R U Represents the intermediate parameter in the access request, T′ U It indicates the intermediate information obtained during the identity authentication of the mobile user by the access point in the external area;

[0035] The access point in the external area returns a response message to the mobile user in, Indicates the identification information of the network control center of the access point registration area in the external area.

[0036] Furthermore, in the verification phase, after receiving the response information, the mobile user uses its own private key and the information carried in the response information to authenticate the access point of the external area. After the authentication is passed, the smart contract pre-deployed by the network control center of the access point registration area of ​​the external area is called to perform a revocation check on the access point of the external area, which specifically includes:

[0037] The mobile user receives the response message A AP After that, first verify the timestamp ts AP Is it within the allowed range? If so, then according to the received false identity PID of the access point in the external area AP , calculate the real identity of the access point in the external area and identity verification information T′ AP =h 3 (RID′ AP ||R AP ||ts AP ), and then generate the signature σ′ AP =S.sign(T′ AP ), if the signature σ′ AP and signature σ AP If they are consistent, the identity authentication is successful;

[0038] When the access point in the external area passes the identity authentication, the mobile user generates transaction information

[0039] The mobile user calling identification information is A smart contract pre-deployed by a network control center of the network control center, in which a cuckoo filter is used to query whether the access point of the external area is already in the network control center If yes, then continue to query whether the access point in the external area has been revoked. If not, it means that the access point in the external area has passed the revocation test.

[0040] Furthermore, in the verification phase, when the revocation check is passed, the mobile user generates a temporary session key with the access point in the external area according to the first random number, the response information returned by the access point in the external area and its own private key, specifically including:

[0041] The mobile user generates a temporary session key SK=h between the mobile user and the access point in the external area. 2 (r U pk AP ||R AP sk U ||RID′ AP ||T U );where sk U Represents the private key of the mobile user, pk AP Indicates the public key of the external zone access point in the response message.

[0042] Furthermore, the method also includes: a dynamic registration and revocation stage; the dynamic registration refers to the network control center in each area receiving the real identity information sent by the new mobile user in real time and registering it; the revocation refers to stopping the roaming service for the registered mobile user or access point, and storing the real identity information of the revoked mobile user or access point.

[0043] Furthermore, the method also includes: a batch verification stage; the batch verification means that when an access point in one area simultaneously receives access requests from multiple mobile users in other areas, identity authentication and revocation checks are performed on the multiple mobile users at the same time.

[0044] On the other hand, the present invention also provides a VANET anonymous roaming authentication system based on blockchain, wherein the nodes on the blockchain include a network control center set up in each area and at least one access point connected to the network control center in each area;

[0045] The network control center is used to publish system parameters during the initialization phase; during the registration phase, it is used to receive real identity information sent by mobile users and access points, register the two, and return their respective public and private key pairs to the two;

[0046] The mobile user is used, during the verification phase, to select a first random number when roaming to an external area and needing to obtain a roaming service, generate a false identity of the mobile user according to the first random number, the system parameter, its own real identity information and a public key of an access point in the external area, and send an access request to the access point in the external area based on its own false identity;

[0047] The access point is used, in the verification phase, to authenticate the mobile user using its own private key and the information carried in the access request after receiving the access request of the mobile user, and to call the smart contract pre-deployed by the network control center in the mobile user registration area to perform revocation check on the mobile user after the identity authentication is passed, and to randomly select a second random number after the revocation check is passed, and to generate a false identity according to the second random number, the system parameters, its own real identity information and the public key of the mobile user, and to generate a temporary session key between the mobile user and the access point according to the second random number, the information carried in the access request sent by the mobile user, its own private key and its own real identity information; and to return response information to the mobile user based on its own false identity;

[0048] The mobile user is further configured to, in the verification stage, after receiving the response information of the access point in the external area, use its own private key and the information carried in the response information to authenticate the access point in the external area, and when the identity authentication is passed, call the smart contract pre-deployed by the network control center of the registration area of ​​the access point in the external area to perform a revocation check on the access point in the external area, and when the revocation check is passed, generate a temporary session key between the access point in the external area and the access point in the external area according to the first random number, the response information returned by the access point in the external area and its own private key;

[0049] The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area is revoked.

[0050] Beneficial effects of the present invention:

[0051] (1) The BARA scheme provided by the present invention redesigns the roaming authentication scheme process and the session key generation method, uses a private chain to simultaneously store and retrieve the secret credentials of the system entity and participate in the registration and identity authentication of the roaming service, and uses probabilistic data structure technology to greatly reduce the on-chain storage overhead. Formal and informal security analysis shows that in addition to anonymity and resistance to temporary key leakage attacks, the scheme proposed by the present invention also meets the requirements of privacy protection, forward / backward security, and traceability.

[0052] (2) Scyther and BAN logic are used to prove the security of BARA, and it is compared with other similar protocols in terms of computation, communication, and revocation verification. The analysis results show that BARA can better balance security performance and execution efficiency.

[0053] (3) A prototype system of the BARA scheme was built on a private chain, and the scheme was compared with four other related schemes in terms of security characteristics, communication cost, computational cost, and revocation cost. The MIRACL database was used to measure the signature scheme, and performance analysis showed that the proposed scheme can better balance security and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of a VANET anonymous roaming authentication system model based on blockchain provided by an embodiment of the present invention;

[0055] Figure 2 A flowchart of the verification phase in the blockchain-based VANET anonymous roaming authentication method provided by an embodiment of the present invention;

[0056] Figure 3 A schematic diagram of the composition of a smart contract in a blockchain-based VANET anonymous roaming authentication method provided by an embodiment of the present invention;

[0057] Figure 4 The communication delay of the mobile user provided in the embodiment of the present invention: (a) the communication delay from the mobile user to the cloud server (on which the network control center is arranged), (b) the communication delay from the mobile user to the blockchain node;

[0058] Figure 5 Experimental results of batch verification provided for embodiments of the present invention: (a) comparison results of signature time, (b) comparison results of batch verification time;

[0059] Figure 6 Experimental results of revocation checking provided for the embodiments of the present invention: (a) comparison results of revocation spaces, (b) comparison results of hash functions. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0061] In the roaming authentication scheme proposed in the present invention, the system model mainly consists of three entities: mobile user (MU, also called mobile vehicle in the present invention), access point (AP) and network control center (NCC). Figure 1 As shown, the system is divided into multiple areas, and a network control center and at least one access point are set in each area. When a mobile user roams from its own registered area to an area outside the registered area (i.e., an external area) and needs to obtain roaming services in the external area, it is first necessary to perform mutual authentication with the access point in the external area, and then obtain services through a roaming authentication agreement. The main functions of the above three entities are briefly introduced below, and the specific functional details are further introduced in detail in the subsequent specific embodiments.

[0062] Network Control Center: NCC provides roaming services for mobile users and registration services for mobile users and access points. HNCC refers to the network control center responsible for mobile user registration (also known as the network control center of the registration area), while FNCC refers to the network control center of the external area that has a roaming partnership with HNCC. As a node of the private blockchain, NCC stores all transaction data of the blockchain and is responsible for deploying and maintaining the smart contracts of the access points.

[0063] Access point: When a mobile user enters the coverage area of ​​an access point, it first needs to authenticate with the access point. If the vehicle passes the authentication, the access point provides it with corresponding roaming services. Each access point is deployed with a corresponding smart contract (referring to the authentication contract and / or revocation contract). When the access point authenticates with the mobile user, the contract is triggered and a transaction is formed. After reaching a consensus, the transaction will be successfully executed.

[0064] Mobile users: When mobile users roam to a foreign area, they need to perform mutual authentication with the access point in that area to obtain roaming services.

[0065] Blockchain: The full node of the blockchain consists of a network control center and access points, which are responsible for storing the real identity and public and private keys of the registered entity. Among them, the smart contract deployed on the access point is used to complete the roaming authentication and revocation of the access point and the mobile user. The so-called registered entity refers to the registered mobile user and access point.

[0066] In one embodiment, in order to solve the problem that the existing smart contract-based mobile vehicle network roaming authentication scheme does not consider the anonymity of mobile users and there is a risk of temporary key leakage, the blockchain-based VANET anonymous roaming authentication method (BARA for short) provided in an embodiment of the present invention includes an initialization phase, a registration phase and a verification phase.

[0067] Initialization phase: the network control center in each area publishes system parameters;

[0068] Registration phase: The mobile user and access point send their real identity information to the network control center in their area for registration and receive the public and private key pairs returned by the network control center;

[0069] Verification stage: when a mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number, and generates a false identity of the mobile user according to the first random number, the system parameters, the real identity information of the mobile user, and the public key of the access point in the external area; the mobile user sends an access request to the access point in the external area based on the false identity of the mobile user;

[0070] When the access point in the external area receives the access request, it uses its own private key and the information carried in the access request to authenticate the mobile user. When the identity authentication is passed, it calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform a revocation check on the mobile user. When the revocation check is passed, the access point in the external area randomly selects a second random number, generates a false identity of the access point in the external area according to the second random number, the system parameters, its own real identity information and the public key of the mobile user, and generates a temporary session key between the access point and the mobile user according to the second random number, the information carried in the access request sent by the mobile user, its own private key and its own real identity information; the access point in the external area returns a response message to the mobile user based on its own false identity;

[0071] After receiving the response information, the mobile user uses its own private key and the information carried in the response information to authenticate the access point in the external area. After the identity authentication is passed, the mobile user calls the smart contract pre-deployed by the network control center in the registration area of ​​the access point in the external area to perform a revocation check on the access point in the external area. After the revocation check is passed, the mobile user generates a temporary session key with the access point in the external area according to the first random number, the response information returned by the access point in the external area and its own private key.

[0072] The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area is revoked.

[0073] In the anonymous roaming authentication method provided by the embodiment of the present invention, during the registration phase, the mobile user and the access point register with the HNCC in the domain, and obtain the public-private key pair assigned by the HNCC to each registered entity through a secure channel. When the mobile user attempts to access an external area network for roaming service, it is necessary to perform mutual anonymous authentication with the access point in the external area. Different from the existing traditional roaming authentication, the roaming authentication in the embodiment of the present invention not only needs to authenticate the real identity of the mobile user and the access point, but also needs to perform revocation verification on the mobile user and the access point, and each NCC will issue a set of smart contracts for revocation verification. Therefore, the anonymous roaming authentication method of the present invention has anonymity and can resist temporary key leakage attacks.

[0074] In one embodiment, during the initialization phase of the system, the NCC first selects an additive group and multiplicative cyclic groups also, The generator of is denoted as P, with order q. Then, NCC selects 3 suitable hash functions h i ,i∈{1,2,3}, and select As the master private key, calculate P pub =λ·P as the master public key. After completing these operations, NCC publishes system parameters See Table 1 for detailed description.

[0075] Table 1: Symbols and explanations

[0076]

[0077] In one embodiment, during the registration phase, each mobile user and access point sends its real identity to the HNCC in the area for registration. After the HNCC receives the real identity RID of the entity, it generates a public-private key pair {sk j ,pk j},j∈{MU,AP}, the specific process is as follows:

[0078] The mobile user and AP send their real identity RID to HNCC through a secure channel; after receiving the real identity from the registered user, HNCC selects a random number And calculate X j =x j ·P; Then, HNCC calculates the private key sk for the registered entity j =x j +λh 1 (RID j ||X j ), public key pk j =sk j ·P; Finally, HNCC generates the public-private key pair {skj ,pk j}Sent to mobile users and APs.

[0079] In one embodiment, during the verification phase, when a mobile user roams to an external area and needs to access the network in the external area to obtain roaming services, mutual authentication is required with the AP in the external area. If the authentication is successful, a secure session channel is established. In this embodiment, BARA generates pseudonyms for both the mobile user and the access point and changes the way the temporary session key between the two is generated. Figure 2 It is worth mentioning that although the present invention mainly studies the roaming authentication scheme, the BARA scheme is still applicable to mobile users accessing the home network. The specific steps of mutual authentication between the mobile user and the access point are as follows:

[0080] Step A1: Mobile users Select a first random number r from U , calculate R U =r U P; where P can be obtained from the system parameters published by the system;

[0081] Mobile users use real identity information RID U , calculate false identities and identity verification information T U =h 3 (RID U ||R U ||ts U ), and generate a signature σ U =S.sign(T U ), where h 2 and h 3 is the hash function obtained from the published system parameters, pk AP Indicates the public key of the access point in the external area, ts U Indicates a timestamp;

[0082] The mobile user sends an access request to the AP in, The identification information of the network control center representing the mobile user registration area;

[0083] AP receives access request A U After that, first verify the timestamp ts U Is it within the allowed range? If so, then according to the received false identity PID of the mobile user U , calculate the real identity of the mobile user and identity verification information T′ U =h 3(RID′ U ||R U ||ts U ), and then generate the signature σ′ U =S.sign(T′ U ), if the signature σ′ U and signature σ U If the authentication fails, the access request is directly denied.

[0084] When the mobile user passes the identity authentication, the AP generates transaction information

[0085] The AP call identification information is A smart contract pre-deployed by a network control center of the mobile user, wherein a cuckoo filter is used in the smart contract to query whether the mobile user is already in the network control center. If yes, then continue to query whether the mobile user has been revoked. If not, it means that the mobile user has passed the revocation test.

[0086] Specifically, each NCC maintains a cuckoo filter, which uses the probabilistic data structure of the cuckoo filter to store the registration and revocation information of registered entities, and uses smart contracts to update it, which can greatly reduce on-chain storage overhead.

[0087] It can be understood that the basic unit of the cuckoo filter is an entry, and each entry stores a fingerprint. Specifically, the registration information of the registered entity is stored in the table RL, and the revocation information of the registered entity is stored in the array CKF. That is, first, the cuckoo filter is used to query the table RL to query whether the mobile user has been registered in the network control center. If there is a matching fingerprint, the CKF is queried to see if the mobile user has been revoked. If there is a matching fingerprint, the mobile user is considered to have been revoked and False is returned; if not, it means that the mobile user has passed the revocation check and True is returned. The smart contract returns a message "True" or "False" to indicate the validity of the verification.

[0088] Step A2: When the mobile user passes the revocation check, the AP randomly selects a second random number r AP , calculate the intermediate parameter R AP =r AP ·P;

[0089] AP based on real identity information RID AP , calculate false identities and identity verification information T AP =h 3(RID AP ||R AP ||ts AP ), and generate a signature σ AP =S.sign(T AP ), where pk U Indicates the public key of the mobile user in the access request, ts AP Indicates a timestamp;

[0090] AP generates a temporary session key SK=h between itself and the mobile user 2 (r AP pk U ||R U sk AP ||RID AP ||T′ U ) and returns the response information to the mobile user Among them, sk AP The private key of the access point in the external area, R U Represents the intermediate parameter in the access request, T′ U It indicates the intermediate information obtained during the identity authentication of the mobile user by the access point in the external area; Indicates the identification information of the network control center of the access point registration area in the external area.

[0091] Step A3: The mobile user receives the response message A AP After that, first verify the timestamp ts AP Is it within the allowed range? If so, then according to the received AP's false identity PID AP , calculate the real identity of AP and identity verification information T′ AP =h 3 (RID′ AP ||R AP ||ts AP ), and then generate the signature σ′ AP =S.sign(T′ AP ), if the signature σ′ AP and signature σ AP If they are consistent, the identity authentication is successful;

[0092] When the AP passes the identity authentication, the mobile user generates transaction information

[0093] The mobile user calling identification information is The smart contract pre-deployed by the network control center of the network control center uses the cuckoo filter to query whether the AP is already in the network control center. If yes, then continue to query whether the AP has been revoked. If not, it means that the AP has passed the revocation test.

[0094] Step A4: When the AP passes the revocation check, the mobile user U Generate a temporary session key SK=h between AP and the client 2 (r U pk AP ||R AP sk U ||RID′ AP ||T U );where sk U Represents the private key of the mobile user, pk AP Indicates the public key of the external zone access point in the response message.

[0095] It is understandable that Figure 3 As shown, the smart contract mainly includes the NCC ID, contract address, cuckoo filter, registered user table jointly maintained by the NCC, and other mapping tables from NCC to smart contract addresses.

[0096] In practical applications, the algorithm code of the smart contract can be designed as follows:

[0097]

[0098]

[0099] In one embodiment, the BARA scheme also includes dynamic registration and revocation stages; the dynamic registration means that the network control center in each area receives the real identity information sent by new mobile users in real time and registers it; the revocation means stopping roaming services for registered mobile users or access points, and storing the real identity information of the revoked mobile users or access points.

[0100] It is understood that when a new mobile user wants to join the system, they only need to register with the NCC in their area. At the same time, the system supports the revocation of mobile users and access points. Once revoked, the mobile user or access point is no longer a legal entity in the system and cannot access valid services. The NCC uses CKF to store the identity RID of the revoked user U / AP , the NCC updates the CKF array by calling a smart contract. In addition, the Cuckoo filter supports a delete operation. When the deleted mobile user registers with the system again, the HNCC can delete the user entry from the array, allowing them to regain roaming services.

[0101] In one embodiment, in order to further improve the verification efficiency of the AP, the BARA scheme also includes a batch verification stage; the batch verification means that when an access point in one area simultaneously receives access requests from multiple mobile users in other areas, identity authentication and revocation checks are performed on the multiple mobile users at the same time.

[0102] It is understandable that when the AP receives roaming authentication requests from multiple vehicles in other domains at the same time, a single authentication sometimes cannot meet the high mobility of the vehicle. Therefore, this embodiment proposes a more efficient batch authentication solution. The specific steps are as follows:

[0103] Step B1: AP collects vehicle request messages from different areas and organizes them into a batch verification request

[0104] Step B2: AP checks whether the mobile user's timestamp is within the allowed range and calculates the pseudonym and

[0105] Step B3: Signature Perform batch validation where Given n public keys, messages, and signature tuples (pk i ,T i ,(R i ,s i )), AP generates n random numbers {a 1 ,a 2 ,…,a n}, calculate n challenge hashes e i =H(pk i ||R i ||T i ), and then verify that the following formula is true:

[0106] a 1 R 1 +a 2 R 2 +…+a n R n +(a 1 e 1 )pk 1 +(a 2 e 2 )pk 2 +…+(a n e n )pk n -(a 1 s 1

[0107] +a 2 s 2+…+a n s n )P=0

[0108] Here, the "Bos-Coster algorithm" is used, with random numbers {a 1 ,a 2 ,…,a n}, where coefficient a 1 The value of is the largest, followed by a 2 , and so on. 1 R 1 +a 2 R 2 Written as (a 1 -a 2 )R 1 +a 2 (R 1 +R 2 ). If the coefficient of the first term is 0, discard the first term. Repeat the above steps until only the last term remains, eliminating most of the point multiplications.

[0109] Corresponding to the above-mentioned anonymous roaming authentication method, an embodiment of the present invention also provides a VANET anonymous roaming authentication system based on blockchain, and the nodes on the blockchain include a network control center set up in each area and at least one access point connected to the network control center in each area.

[0110] The network control center is used to publish system parameters during the initialization phase; during the registration phase, it is used to receive real identity information sent by mobile users and access points, register the two, and return their respective public and private key pairs to them.

[0111] During the verification phase, when a mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number, generates a false identity of the mobile user based on the first random number, the system parameters, its own real identity information and the public key of the access point in the external area, and sends an access request to the access point in the external area based on its own false identity.

[0112] During the verification phase, the access point is used to perform identity authentication on the mobile user using its own private key and the information carried in the access request after receiving the access request of the mobile user. When the identity authentication is passed, the access point calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform revocation verification on the mobile user. When the revocation verification is passed, a second random number is randomly selected, and a false identity is generated according to the second random number, the system parameters, its own real identity information and the public key of the mobile user, and a temporary session key between the access point and the mobile user is generated according to the second random number, the information carried in the access request sent by the mobile user, its own private key and its own real identity information; and a response information is returned to the mobile user based on its own false identity.

[0113] During the verification phase, the mobile user is also used to, after receiving the response information from the access point in the external area, use its own private key and the information carried in the response information to authenticate the access point in the external area. When the identity authentication is passed, the smart contract pre-deployed by the network control center of the registration area of ​​the access point in the external area is called to perform a revocation check on the access point in the external area. When the revocation check is passed, a temporary session key between the access point in the external area and the access point in the external area is generated according to the first random number, the response information returned by the access point in the external area and the private key.

[0114] The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area is revoked.

[0115] It should be noted that the system provided in the embodiment of the present invention is for implementing the above method, and its specific functions can be referred to the above method embodiment, which will not be described in detail here.

[0116] The BARA scheme provided by the present invention redesigns the roaming authentication scheme process and the session key generation method, uses a private chain to simultaneously store and retrieve the secret credentials of the system entity and participate in the registration and identity authentication of the roaming service, and uses probabilistic data structure technology to greatly reduce the on-chain storage overhead. Formal and informal security analysis shows that in addition to anonymity and resistance to temporary key leakage attacks, the scheme proposed by the present invention also meets privacy protection, forward / backward security, and traceability.

[0117] In order to verify the effectiveness of the scheme of the present invention, the comparison of BARA performance will be comprehensively analyzed from both theoretical and experimental aspects. In theory, the security characteristics, communication consumption and time consumption of the roaming authentication scheme are mainly compared. In the experiment, the comparison will be made from the aspects of batch verification and revocation check. All experiments use Inter(R)Core(TM)CPU i5-9400@2.90GHz, 8GB RAM, and Windows10Education.

[0118] Considering the security of the solution of the present invention, the eCK strong security model is used. In this security model, the attacker's capabilities are described as follows: The attacker has full control over the communication network and can arbitrarily monitor, delay, replay and modify information. The attacker can obtain the long-term private keys of both authenticated parties. The attacker can obtain the temporary private keys of both authenticated parties. The attacker can obtain the session key of a completed session. In addition, it is assumed that the NCC is honest to users in this domain, but semi-honest to users in other domains. That is, the NCC will provide services to mobile users according to the roaming agreement, but there may be problems with providing wrong information to users in other domains. However, no attacker can destroy the NCC.

[0119] Here, we briefly introduce several basic security properties of the BARA solution:

[0120] Mutual authentication: In the roaming authentication scheme, when a mobile user enters the coverage area of ​​an access point, it must first perform mutual authentication with the access point to ensure that the mobile user is a legitimate registered user and has not been revoked. In addition, it is also necessary to ensure that the NCC in the access point domain has a roaming partnership with the NCC registered by the mobile user.

[0121] Anonymity: During the roaming authentication process, the real identity of the mobile user cannot be obtained by the attacker.

[0122] Traceability: Mobile users can complete authentication with their legal identities, but when a legal vehicle violates the law, the real ID of the anonymous user needs to be tracked.

[0123] Revocation authentication: The purpose of revocation authentication for mobile users is to ensure that the mobile user is still a legitimate user and has not been revoked before the access point provides roaming services to the mobile user. This prevents malicious users who have been revoked from illegally obtaining roaming services through mutual authentication with the access point.

[0124] Forward security: If the long-term private keys of the protocol participants are compromised, and the attacker cannot obtain the old session keys, the protocol is said to provide partial forward secrecy. If the compromise of the long-term private keys of the parties does not lead to the compromise of the old session keys, the protocol is said to provide perfect forward security.

[0125] Replay attack: An attacker cannot use a signed message that has already been received and pass verification when the message is invalid.

[0126] Man-in-the-middle attack: An attacker cannot reach a valid temporary session key with the communicating parties by intercepting, tampering with, and sniffing the interactive information without the knowledge of the communicating parties.

[0127] Impersonation attack: An attacker cannot impersonate a legitimate party in the communication protocol to complete roaming authentication.

[0128] Key leakage impersonation attack: After an attacker obtains a user's private key, he can impersonate another user to perform key agreement with that user, but still cannot obtain the temporary session key.

[0129] Temporary key leakage attack: After the attacker obtains the temporary keys of both parties, he still cannot calculate the session key.

[0130] 1. Theoretical Analysis

[0131] 1) Security attributes. Table 2 lists the comparison of the security attributes of the BARA scheme and the other four roaming authentication schemes, and uses √ to indicate that the scheme meets this attribute, and × to indicate that the scheme does not meet this attribute. According to Table 2, it can be seen that compared with other related works, the BARA scheme can provide the necessary security attributes.

[0132] Table 2: Comparison of security properties of the schemes

[0133]

[0134] The scheme of Xue et al. (Reference 1) is almost immune to temporary key leakage attacks. In addition, since the real identity of the mobile user is directly transmitted in the public channel, the scheme does not provide anonymity for the mobile user. In the scheme of Tao et al. (Reference 2: Y. Tao, H. Du, J. Xu, L. Su, B. Cui, On-demand anonymous access and roaming authentication protocols for 6g satellite–ground integrated networks, Sensors 23 (11) (2023) 5075.), the temporary session key is composed of the temporary private keys of both parties to the protocol, so the scheme cannot resist temporary key leakage attacks. In addition, in the case of long-term private key leakage of low-Earth orbit satellites, attackers can impersonate legitimate users and have conversations with them. Similarly, the scheme of Yadav et al. (Reference 3: AKYadav, A. Braeken, M. Misra, M. Liyange, Aprovably secure and efficient 5g-aka authentication protocol using blockchain, in: 2023 IEEE 20th Consumer Communications & Networking Conference (CCNC), IEEE, 2023, pp. 1110–1115.) is also not resistant to temporary key leakage attacks and key leakage impersonation attacks. The scheme of Cao et al. (Reference 4: Z. Cao, Z. Chen, W. Shang, Y. Zhu, Efficient revocable anonymous authentication mechanism for edge intelligent controllers, IEEE Internet of Things Journal 10 (12) (2023) 10357–10367.) involves the server verifying the signature, so the scheme does not provide a mutual authentication scheme, and this also leads to malicious edge server impersonation attacks.

[0135] 2) Communication consumption. The communication consumption of the proposed scheme and other four schemes is compared and analyzed, as shown in Table 3. The identity |ID| is 160 bits, the timestamp |ts| is 32 bits, and the elliptic curve point multiplication is 160 bits. is 321 bits, It is 320 bits. The scheme of Xue et al. (Reference 1) reaches a consensus on the temporary session key after two rounds of communication, and a total of 3266 bits need to be transmitted. In the scheme of Tao et al. (Reference 2), the terminal needs to send a 1636-bit message to LEO, and LEO returns 1313 bits. The scheme of Yadav et al. (Reference 3) performs 5 rounds of information interaction, so the communication consumption generated is the highest, which is 5604 bits. The scheme of Cao et al. (Reference 4) mainly communicates the group public key and the signature message, with a length of 1926 bits and 2563 bits respectively. BARA is similar to the scheme of Xue et al. (Reference 1). The mobile user and the AP interact twice to reach a common temporary session key, and a total of 2628 bits of messages need to be transmitted.

[0136] Table 3: Communication consumption of the scheme

[0137]

[0138] 3) Time consumption. In this section, the time consumption of the proposed scheme is evaluated, including computing time consumption and communication time consumption. In terms of computing time consumption, this experiment mainly consists of two parts. The first part is the time consumption of encryption operations, and the second part is the time consumption of user revocation check. In addition, based on the actual environment deployment of VANET, the actual communication time between mobile users and APs and cloud servers and blockchain nodes is measured.

[0139] The computation time of the basic cryptographic algorithm based on the MIRACL library was measured. The cryptographic primitives were run 100 times, and the average running time was calculated based on the highest and lowest running times. The symbolic representation, specific interpretation, and corresponding running time of each operation are shown in Table 4. Next, the computation time consumption of the BARA scheme and the other four schemes are compared, as shown in Table 5. The computation time consumption of the BARA scheme is 8.412ms, which is slightly higher than the scheme time consumption of the scheme in Yadav et al. (Reference 3) by 1ms. However, as can be seen from Table 2, the BARA scheme has higher security than the scheme in Yadav et al. (Reference 3), so such computational consumption is still within an acceptable range.

[0140] Table 4: Computational cost of operations

[0141]

[0142]

[0143] Table 5: Computational cost of the solutions

[0144]

[0145] In addition to the relevant cryptographic calculations, the BARA scheme also performs revocation checks on each authenticated user, including the query time of the revocation list and the call time of the smart contract. Since the present invention uses a cuckoo filter, only two hash values ​​are needed to obtain the required hash value and perform a revocation list query, so the delay in this part can be considered to be 0. In a Bloom filter with the same false alarm rate, the user's query needs to go through 13 hash operations. It is worth noting that the lower false alarm rate in the Bloom filter requires more hash functions to achieve, while the false alarm rate in the cuckoo filter is independent of the number of its hash functions.

[0146] The process of calling a smart contract is similar to a normal blockchain transaction. Once the triggering conditions of the smart contract are met, the verification node will first perform signature verification to ensure the validity of the transaction; the verified transaction will enter the pending consensus set. After most verification nodes reach a consensus, the transaction will be successfully executed and the user will be notified. In this experiment, Ganache was used to build a local private chain to test the deployment and calling of smart contracts. It is worth noting that the built private chain uses the Proof of Authority (PoA) consensus mechanism, and the verification nodes in the network obtain permissions through pre-authorization. These verification nodes are called authoritative nodes, which are responsible for verifying and packaging transactions and adding them to the blockchain. Since the verification and packaging speed of the authoritative nodes is faster, the transaction confirmation time is shorter. Here, we do not consider modifying the consensus mechanism.

[0147] As shown in Table 6, the time consumption for mobile users and APs to call smart contracts is 12.367ms and 0.009ms respectively. The reason why AP only takes 0.009ms to call the smart contract is that AP is a node of the blockchain and the smart contract is stored locally, so it only needs to be executed in the "Call" mode, avoiding the consensus time.

[0148] Table 6: Communication time consumption of the scheme

[0149]

[0150] For the communication delay time setting, the time from user to FNCCT is calculated. U-F , from user to blockchain node T U-B , From AP to FNCC T A-F , from AP to blockchain node T A-B , From FNCC to HNCC T F-H According to the actual VANET environment, the general NCC is deployed on the cloud server. The delay time between the user and the cloud server is measured, such as Figure 4(a) shows. We selected 30 cloud server nodes at home and abroad and conducted 10 measurements, with an average value of 101.3ms. Therefore, T U-F , T A-F and T F-H The delay time is set to 50.65ms. However, for the time delay from the user to the digital currency node, this experiment also crawled the IP addresses of 25,366 digital currency nodes around the world and measured the ping delay, with an average value of 217.04ms. Figure 4 As shown in (b), T U-B and T A-B The value of is set to 108.52ms.

[0151] (II) Experimental analysis

[0152] In this section, the experimental performance of the BARA scheme will be discussed from two aspects: batch verification and revocation verification. The proposed scheme is mainly used in VANET. Therefore, when multiple mobile users perform roaming authentication services in a short period of time, it is very important to avoid AP failure, which requires batch verification. In addition, the revocation verification of mobile users is also an important function to prevent NCC from providing roaming services to other illegal users.

[0153] 1) Batch Verification: We measure the execution time of message signing and batch verification respectively. During the experiment, the number of mobile users is set to 1, 10, 20, 40, 60, 80 and 100 respectively, where the minimum number of batch verification is 10. Since Xue et al.'s scheme and Yadav et al.'s scheme (Reference 3) do not provide batch verification schemes, here we only conduct experiments on BARA, Tao et al.'s scheme (Reference 2) and Cao et al.'s scheme (Reference 4).

[0154] like Figure 5 As shown, the time required for both the signature time and the batch verification time is the shortest for the scheme of the present invention. In the batch verification stage, since the "Bos-Coster" algorithm is used to save most of the point multiplications, only addition operations are required. In summary, the scheme of the present invention is more suitable for application in a high-mobility environment such as VANET.

[0155] 2) Revocation check. In this section, the user calls the smart contract to perform revocation check. The size limit of Ethereum smart contract is 24kb. For the sake of comparison, the filter size is fixed to 20KB. Due to the limitation of filter size, while improving the efficiency of user query, we consider maximizing the number of users stored in the limited storage space.

[0156] The false positive rate of the cuckoo filter is determined by the bucket size and the number of bits of the fingerprint. In order to meet the false positive rates of 1%, 0.1%, 0.01% and 0.001%, the bucket size b=4 is set, and the corresponding fingerprint sizes f are 9, 13, 16 and 19 bits respectively. Here, the bucket size is chosen to save space using the "semi-sorted bucket" optimization. The storage buckets required to meet the number of users stored in a fixed smart contract size are also calculated. In the case of setting 4 false positive rates, the number of buckets required is 9 only when the false positive rate is 1%, and the number of buckets required is 1 when other false positive rates meet the number of stored users.

[0157] The revocation space per 5000 users added to the Bloom filter and the Cuckoo filter at different false positive rates is compared. Figure 6 As shown in (a), when the fixed storage capacity is 20KB and the false positive rate is 1%, the Bloom filter can store 17093 users and the Cuckoo filter can store 18204 users. When the false positive rates are 0.1%, 0.01% and 0.001%, the Bloom filter can store 11, 395, 8546 and 6837 users respectively, and the Cuckoo filter can store 12, 603, 10, 240 and 8623 users respectively. It can be seen that the lower the false positive rate of the Cuckoo filter, the better the storage efficiency of the revoked users.

[0158] The number of hash functions used in the Bloom filter is also different to achieve different false positive rates. In this experiment, the number of hash functions corresponding to the four false positive rates is 7, 10, 13, and 17 respectively. The Cuckoo filter only needs to perform two hash operations at any false positive rate to query data, such as Figure 6 (b) as shown.

[0159] The present invention provides a new VANET anonymous roaming authentication scheme based on smart contracts. In this scheme, the application of smart contracts satisfies the authentication between mobile users and APs in this scenario, and implements a secure roaming authentication protocol. In addition, in order to reduce the storage overhead on the chain, this paper adopts a cuckoo filter to achieve faster revocation verification and higher space utilization. Performance and security analysis show that compared with the other four similar roaming authentication schemes, the BARA scheme can achieve a better balance between security performance and execution efficiency, and is more suitable for application in VANET environments.

[0160] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. VANET anonymous roaming authentication method based on blockchain, It is characterized in that The nodes on the blockchain include a network control center set in each area and at least one access point connected to the network control center in each area, and the method includes: Initialization phase: the network control center in each area publishes system parameters; Registration phase: The mobile user and access point send their real identity information to the network control center in their area for registration and receive the public and private key pairs returned by the network control center; Verification stage: when a mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number, and generates a false identity of the mobile user according to the first random number, the system parameters, the real identity information of the mobile user, and the public key of the access point in the external area; the mobile user sends an access request to the access point in the external area based on the false identity of the mobile user; When the access point in the external area receives the access request, it uses its own private key and the information carried in the access request to authenticate the mobile user. When the identity authentication is passed, it calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform a revocation check on the mobile user. When the revocation check is passed, the access point in the external area randomly selects a second random number, generates a false identity of the access point in the external area according to the second random number, the system parameters, its own real identity information and the public key of the mobile user, and generates a temporary session key between the access point and the mobile user according to the second random number, the information carried in the access request sent by the mobile user, its own private key and its own real identity information; the access point in the external area returns a response message to the mobile user based on its own false identity; After receiving the response information, the mobile user uses its own private key and the information carried in the response information to authenticate the access point in the external area. After the identity authentication is passed, the mobile user calls the smart contract pre-deployed by the network control center in the registration area of ​​the access point in the external area to perform a revocation check on the access point in the external area. After the revocation check is passed, the mobile user generates a temporary session key with the access point in the external area according to the first random number, the response information returned by the access point in the external area and its own private key. The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area is revoked.

2. According to the blockchain-based VANET anonymous roaming authentication method of claim 1, It is characterized in that The initial stage specifically includes: Network Control Center Selects Additive Group and multiplicative cyclic groups in, The generator of is denoted as P, and its order is q; The network control center selects three hash functions h i , i∈{1,2,3}; and select As the master private key, calculate P pub =λ·P as the master public key; Network Control Center publishes system parameters Among them, H represents the hash function involved in the smart contract.

3. According to the blockchain-based VANET anonymous roaming authentication method of claim 2, It is characterized in that The registration phase specifically includes: The mobile user and the access point send their real identity information RID to the j Sent to the network control center in the area; j∈{MU,AP}, MU represents a mobile user, and AP represents an access point; The network control center receives the real identity information RID of the mobile user and access point j Then, choose a random number And calculate the intermediate parameter X j =x j ·P; The network control center calculates the private key sk for the mobile user and the access point j =x j +λh 1 (RID j ||X j ), public key pk j =sk j ·P; The network control center will generate a public-private key pair {sk j , pk j }Sent to mobile users and access points.

4. The VANET anonymous roaming authentication method based on blockchain according to claim 1, It is characterized in that In the verification phase, when the mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number, and generates a false identity of the mobile user according to the first random number, the system parameters, the real identity information of the mobile user, and the public key of the access point in the external area; The mobile user sends an access request to the access point of the external area based on the false identity of the mobile user, which specifically includes: The mobile user selects a first random number Calculate the intermediate parameter R U =r U P; where P is obtained from the published system parameters; Mobile users use real identity information RID U , calculate false identities and identity verification information T U =h 3 (RID U ||R U ||ts U ), and generate a signature σ U =S.sign(T U ), where h 2 and h 3 is the hash function obtained from the published system parameters, pk AP Indicates the public key of the access point in the external area, ts U Indicates a timestamp; The mobile user sends an access request to the access point in the external area in, Indicates the identification information of the network control center of the mobile user registration area.

5. According to the blockchain-based VANET anonymous roaming authentication method of claim 4, It is characterized in that In the verification phase, when the access point in the external area receives the access request, it uses its own private key and the information carried in the access request to authenticate the mobile user. When the identity authentication is passed, it calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform a revocation check on the mobile user, which specifically includes: The access point in the external area receives the access request A U After that, first verify the timestamp ts U Is it within the allowed range? If so, then according to the received false identity PID of the mobile user U , calculate the real identity of the mobile user and identity verification information T′ U =h 3 (RID′ U ||R U ||ts U ), and then generate the signature σ′ U =S.sign(T′ U ), if the signature σ′ U and signature σ U If they are consistent, the identity authentication is successful; When the mobile user passes the identity authentication, the access point in the external area generates transaction information The access point in the external area calls the identification information as A smart contract pre-deployed by a network control center of the mobile user, wherein a cuckoo filter is used in the smart contract to query whether the mobile user is already in the network control center. If yes, then continue to query whether the mobile user has been revoked. If not, it means that the mobile user has passed the revocation test.

6. According to the blockchain-based VANET anonymous roaming authentication method of claim 4, It is characterized in that In the verification phase, when the revocation check passes, the access point in the external area randomly selects a second random number, generates a false identity of the access point in the external area according to the second random number, the system parameter, its own real identity information and the public key of the mobile user, and generates a temporary session key between the access point and the mobile user according to the second random number, information carried in the access request sent by the mobile user, its own private key and its own real identity information; The access point in the external area returns response information to the mobile user based on the false identity thereof, specifically including: The access point in the external area randomly selects a second random number r AP , calculate the intermediate parameter R AP =r AP ·P; The access point in the external area is based on the real identity information RID AP , calculate false identities and identity verification information T AP =h 3 (RID AP ||R AP ||ts AP ), and generate a signature σ AP =S.sign(T AP ), where pk U Indicates the public key of the mobile user in the access request, ts AP Indicates a timestamp; The access point in the external area generates a temporary session key SK=h between itself and the mobile user. 2 (r AP pk U ||R U sk AP ||RID AP ||T′ U );where sk AP Represents the private key of the access point in the external area, R U Represents the intermediate parameter in the access request, T′ U It indicates the intermediate information obtained during the identity authentication of the mobile user by the access point in the external area; The access point in the external area returns a response message to the mobile user in, Indicates the identification information of the network control center of the access point registration area in the external area.

7. The VANET anonymous roaming authentication method based on blockchain according to claim 6, It is characterized in that In the verification phase, after receiving the response information, the mobile user uses its own private key and the information carried in the response information to authenticate the access point of the external area. After the authentication is passed, the smart contract pre-deployed by the network control center of the access point registration area of ​​the external area is called to perform a revocation check on the access point of the external area, which specifically includes: The mobile user receives the response message A AP After that, first verify the timestamp ts AP Is it within the allowed range? If so, then according to the received false identity PID of the access point in the external area AP , calculate the real identity of the access point in the external area and identity verification information T′ AP =h 3 (RID′ AP ||R AP ||ts AP ), and then generate the signature σ′ AP =S.sign(T′ AP ), if the signature σ′ AP and signature σ AP If they are consistent, the identity authentication is successful; When the access point in the external area passes the identity authentication, the mobile user generates transaction information The mobile user calling identification information is A smart contract pre-deployed by a network control center of the network control center, in which a cuckoo filter is used to query whether the access point of the external area is already in the network control center If yes, then continue to query whether the access point in the external area has been revoked. If not, it means that the access point in the external area has passed the revocation test.

8. According to the blockchain-based VANET anonymous roaming authentication method of claim 7, It is characterized in that In the verification phase, when the revocation check is passed, the mobile user generates a temporary session key between the mobile user and the access point in the external area according to the first random number, the response information returned by the access point in the external area, and the mobile user's own private key, specifically including: The mobile user generates a temporary session key SK=h between the mobile user and the access point in the external area. 2 (r U pk AP ||R AP sk U ||RID′ AP ||T U );where sk U Represents the private key of the mobile user, pk AP Indicates the public key of the external zone access point in the response message.

9. The VANET anonymous roaming authentication method based on blockchain according to any one of claims 1 to 8, It is characterized in that Also includes: Batch verification stage: Batch verification means that when an access point in one area receives access requests from multiple mobile users in other areas at the same time, identity authentication and revocation checks are performed on the multiple mobile users at the same time.

10. VANET anonymous roaming authentication system based on blockchain, It is characterized in that The nodes on the blockchain include a network control center set up in each area and at least one access point connected to the network control center in each area; The network control center is used to publish system parameters during the initialization phase; during the registration phase, it is used to receive real identity information sent by mobile users and access points, register the two, and return their respective public and private key pairs to the two; The mobile user is used, during the verification phase, to select a first random number when roaming to an external area and needing to obtain a roaming service, generate a false identity of the mobile user according to the first random number, the system parameter, its own real identity information and a public key of an access point in the external area, and send an access request to the access point in the external area based on its own false identity; The access point is used, in the verification phase, to authenticate the mobile user using its own private key and the information carried in the access request after receiving the access request of the mobile user, and then call the smart contract pre-deployed by the network control center in the mobile user registration area to perform revocation check on the mobile user after the identity authentication is passed, and when the revocation check is passed, randomly select a second random number, generate a false identity according to the second random number, the system parameters, its own real identity information and the public key of the mobile user, and generate a temporary session key between the mobile user and the mobile user according to the second random number, the information carried in the access request sent by the mobile user, its own private key and its own real identity information; and returning response information to the mobile user based on the false identity of the mobile user; The mobile user is further configured to, in the verification stage, after receiving the response information of the access point in the external area, use its own private key and the information carried in the response information to authenticate the access point in the external area, and when the identity authentication is passed, call the smart contract pre-deployed by the network control center of the registration area of ​​the access point in the external area to perform a revocation check on the access point in the external area, and when the revocation check is passed, generate a temporary session key between the access point in the external area and the access point in the external area according to the first random number, the response information returned by the access point in the external area and its own private key; The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area is revoked.

Images