VANET anonymous roaming authentication method and system based on blockchain

Abstract

The present invention provides a blockchain-based anonymous roaming authentication method and system for VANETs. In the proposed roaming authentication scheme, the system model primarily consists of three entities: mobile users, access points, and a network control center. The system is divided into multiple regions, each with a network control center and at least one access point. Each network control center publishes a set of smart contracts. When a mobile user roams from their registered region to an area outside their registered region (i.e., an external region) and requires roaming services in the external region, the application of smart contracts satisfies the anonymous identity authentication and revocation verification between the mobile user and the access point in this scenario, thereby implementing a secure roaming authentication protocol.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technologies, and in particular to a VANET anonymous roaming authentication method and system based on blockchain. Background Art

[0002] With the rapid development of wireless technology, vehicular ad-hoc networks (VANETs) have shown great potential in assisted driving and traffic monitoring, and secure vehicular communications have become a growing focus. VANETs facilitate in-vehicle communications and connect vehicles to their surroundings, enabling full network connectivity and information exchange. Furthermore, as a new type of mobile self-organizing network, VANETs are a crucial component of intelligent transportation systems. In addition to inheriting the dynamic topology and multi-hop communication characteristics of VANETs, ​​they also possess unique features such as high-density node distribution and high-speed node mobility. These characteristics directly impact the network's information transmission capacity, increasing packet loss and latency. Therefore, secure, real-time communication between vehicles and infrastructure requires secure authentication and seamless access to roaming services.

[0003] According to different authentication methods, existing roaming authentication protocols can be divided into two types: three-party roaming authentication and two-party roaming authentication. The earliest three-party roaming authentication protocol was proposed by Zhu et al. (J. Zhu, J. Ma, A new authentication scheme with anonymity for wireless environments, IEEE Transactions on Consumer Electronics 50 (1) (2004) 231–235.) in 2004. Since then, researchers have further developed and studied three-party roaming authentication. However, since the three-party roaming authentication protocol requires the real-time participation of the home server, it leads to high communication delay, weak security and low authentication efficiency. To solve these problems, Yang et al. (G. Yang, Q. Huang, D. S. Wong, X. Deng, Universal authentication protocols for anonymous wireless communications, IEEE Transactions on Wireless Communications 9 (1) (2010) 168–174.) proposed a two-party roaming authentication protocol in 2010, which enables mobile users to directly interact with external servers and verify their identities without involving local servers.

[0004] However, traditional two-party roaming authentication protocols still face several pressing challenges. From an anonymity perspective, traditional two-party roaming authentication protocols may need to pay more attention to the anonymity of mobile users or continue to use temporary identities instead of real identities, resulting in inefficient storage and computing and poor real-time performance. In terms of security, traditional two-party roaming authentication protocols cannot withstand strong security attacks such as temporary key leakage. In terms of storage efficiency, establishing and revoking roaming partnerships between service providers requires a large amount of storage space, affecting convenient access for mobile users. As the number of roaming partners continues to increase, reducing storage space consumption and enabling mobile users to perform fast queries becomes crucial.

[0005] In recent years, there has been an increasing trend towards utilizing blockchain and distributed ledger technologies to enhance the security and credibility of roaming authentication schemes while achieving decentralized authentication methods. Smart contracts are programs stored on a blockchain that are executed when specific predefined conditions are met. They are often used to automatically execute agreements, allowing all participants to determine the outcome immediately without an intermediary. By automating workflows and triggering subsequent actions when conditions are met, smart contracts eliminate the need for intermediaries to process transactions. This, in turn, eliminates the associated time delays and costs. In response to the problems of traditional roaming authentication schemes, Xue et al. (Reference 1: K.Xue, X.Luo, Y.Ma, J.Li, J.Liu, D.S.Wei, A distributed authentication scheme based on smart contract for roaming service in mobile vehicular networks, IEEE Transactions on Vehicular Technology 71(5)(2022)5284–5297.) proposed a distributed authentication scheme for roaming services in mobile vehicular networks based on smart contracts. Xue et al. applied blockchain technology to vehicle roaming authentication, avoiding the single point of failure problem in a centralized storage architecture. However, it should be noted that Xue et al.’s scheme does not consider the anonymity of mobile users in mobile vehicular networks. In addition, their scheme cannot resist temporary key leakage attacks, which poses a significant security risk to mobile users. Summary of the Invention

[0006] Aiming at the problem that the existing smart contract-based mobile vehicle network roaming authentication scheme does not consider the anonymity of mobile users and there is a risk of temporary key leakage, the present invention provides a blockchain-based VANET anonymous roaming authentication method and system.

[0007] In one aspect, the present invention provides a blockchain-based VANET anonymous roaming authentication method, wherein the nodes on the blockchain include a network control center set up in each area and at least one access point connected to the network control center in each area, and the method includes:

[0008] Initialization phase: The network control center in each area publishes system parameters;

[0009] Registration phase: The mobile user and access point each send their real identity information to the network control center in their area for registration and receive a public and private key pair returned by the network control center;

[0010] Verification phase: When a mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number and generates a false identity of the mobile user based on the first random number, the system parameters, the mobile user's real identity information, and the public key of the access point in the external area. The mobile user then sends an access request to the access point in the external area based on the false identity.

[0011] When the access point in the external area receives the access request, it uses its own private key and the information carried in the access request to authenticate the mobile user. After the identity authentication is successful, it calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform a revocation check on the mobile user. After the revocation check is successful, the access point in the external area randomly selects a second random number, generates a false identity of the access point in the external area based on the second random number, the system parameters, its own real identity information, and the public key of the mobile user, and generates a temporary session key between the access point and the mobile user based on the second random number, the information carried in the access request sent by the mobile user, its own private key, and its own real identity information. The access point in the external area returns a response message to the mobile user based on its own false identity.

[0012] After receiving the response message, the mobile user uses its own private key and the information carried in the response message to authenticate the access point in the external area. After the authentication is successful, the mobile user invokes the smart contract pre-deployed by the network control center in the area where the access point in the external area is registered to perform a revocation check on the access point in the external area. After the revocation check is successful, the mobile user generates a temporary session key with the access point in the external area based on the first random number, the response message returned by the access point in the external area, and its own private key.

[0013] The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area has been revoked.

[0014] Furthermore, the initial stage specifically includes:

[0015] Network Control Center Selects Additive Group and multiplicative cyclic groups in, The generator of is denoted as P and has an order of q;

[0016] The network control center selects three hash functions h i ,i∈{1,2,3}; and select As the master private key, calculate P pub =λ·P as the master public key;

[0017] Network Control Center publishes system parameters Where H represents the set of selected hash functions.

[0018] Furthermore, the registration phase specifically includes:

[0019] The mobile user and the access point respectively transmit the real identity information RID through the secure channel j Sent to the network control center in the area; j∈{MU,AP}, MU represents the mobile user, AP represents the access point;

[0020] The network control center receives the real identity information RID of the mobile user and access point j Then, choose a random number And calculate the intermediate parameter X j =x j ·P;

[0021] The network control center calculates the private key sk for the mobile user and the access point j =x j +λh1(RID j ||X j ), public key pk j =sk j ·P;

[0022] The network control center will generate the public and private key pair {sk j ,pk j}Sent to mobile users and access points.

[0023] Furthermore, during the verification phase, when the mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number, and generates a false identity of the mobile user based on the first random number, the system parameters, the mobile user's real identity information, and a public key of an access point in the external area; and the mobile user sends an access request to the access point in the external area based on the false identity, specifically including:

[0024] The mobile user selects a first random number Calculate the intermediate parameter R U =r U P; where P is obtained from the published system parameters;

[0025] Mobile users use real identity information RID U , calculate false identities and identity verification information T U =h3(RID U ||R U ||ts U ), and generate a signature σ U =S.sign(T U ); where h2 and h3 are hash functions obtained from the published system parameters, pk AP Indicates the public key of the access point in the external area, tsU indicates the timestamp;

[0026] The mobile user sends an access request to the access point in the external area in, Indicates the identification information of the network control center in the mobile user registration area.

[0027] Furthermore, during the verification phase, when the access point in the external area receives the access request, it uses its own private key and the information carried in the access request to authenticate the mobile user. After the authentication is successful, it calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform a revocation check on the mobile user, which specifically includes:

[0028] The access point in the external area receives the access request A U After that, first verify the timestamp ts U Is it within the allowed range? If so, then according to the received false identity PID of the mobile user U , calculate the real identity of the mobile user and identity verification information T′ U =h3(RID′ U ||R U ||ts U ), then generate the signature σ′U =S.sign(T′ U ), if signature σ′ U and signature σ U If they are consistent, the identity authentication is passed;

[0029] When the mobile user passes the identity authentication, the access point in the external area generates transaction information

[0030] The access point call identification information of the external area is The smart contract pre-deployed by the network control center of the mobile phone network uses the cuckoo filter to query whether the mobile user is already in the network control center. If yes, then continue to query whether the mobile user has been revoked. If not, it means that the mobile user has passed the revocation test.

[0031] Furthermore, during the verification phase, when the revocation check passes, the external access point randomly selects a second random number, generates a false identity for the external access point based on the second random number, the system parameters, its own real identity information, and the public key of the mobile user, and generates a temporary session key with the mobile user based on the second random number, information carried in the access request sent by the mobile user, its own private key, and its own real identity information. The external access point returns a response message to the mobile user based on its own false identity, specifically including:

[0032] The access point in the external area randomly selects a second random number r AP , calculate the intermediate parameter R AP =r AP ·P;

[0033] The access point in the external area is based on the real identity information RID AP , calculate false identities and identity verification information T AP =h3(RID AP ||R AP ||ts AP ), and generate a signature σ AP =S.sign(T AP ); where pk U Indicates the public key of the mobile user in the access request, ts AP Indicates a timestamp;

[0034] The access point in the external area generates a temporary session key SK = h2(r AP pk U ||RU sk AP ||RID AP ||T′ U ); where sk AP The private key of the access point in the external area, R U Represents the intermediate parameter in the access request, T′ U It indicates the intermediate information obtained during the authentication process of the mobile user by the access point in the external area;

[0035] The access point in the external area returns a response message to the mobile user in, Indicates the identification information of the network control center of the registration area of ​​the access point in the external area.

[0036] Furthermore, in the verification phase, after receiving the response message, the mobile user uses its own private key and the information carried in the response message to authenticate the access point in the external area. After the authentication is successful, the mobile user invokes the smart contract pre-deployed by the network control center in the registration area of ​​the access point in the external area to perform a revocation check on the access point in the external area, which specifically includes:

[0037] The mobile user receives the response message A AP After that, first verify the timestamp ts AP Is it within the allowed range? If so, then according to the false identity PID of the access point in the external area received AP , calculate the real identity of the access point in the external area and identity verification information T′ AP =h3(RID′ AP ||R AP ||ts AP ), then generate the signature σ′ AP =S.sign(T′ AP ), if signature σ′ AP and signature σ AP If they are consistent, the identity authentication is passed;

[0038] When the access point in the external area passes the identity authentication, the mobile user generates transaction information

[0039] Mobile user calling identification information is The smart contract pre-deployed by the network control center uses the cuckoo filter to query whether the access point of the external area is already in the network control center. If yes, then continue to query whether the access point in the external area has been revoked. If no, it means that the access point in the external area has passed the revocation test.

[0040] Furthermore, in the verification phase, when the revocation check passes, the mobile user generates a temporary session key with the access point in the external area based on the first random number, the response information returned by the access point in the external area, and the mobile user's own private key, specifically including:

[0041] The mobile user generates a temporary session key SK=h2(r U pk AP ||R AP sk U ||RID′ AP ||T U ); where sk U Represents the private key of the mobile user, pk AP Indicates the public key of the external zone access point in the response message.

[0042] Furthermore, the method also includes: a dynamic registration and revocation stage; the dynamic registration refers to the network control center in each area receiving the real identity information sent by the new mobile user in real time and registering it; the revocation refers to stopping the roaming service for the registered mobile user or access point, and storing the real identity information of the revoked mobile user or access point.

[0043] Furthermore, the method further comprises: a batch verification phase; the batch verification means that when an access point in one area simultaneously receives access requests from multiple mobile users in other areas, identity authentication and revocation checks are performed on the multiple mobile users at the same time.

[0044] On the other hand, the present invention also provides a blockchain-based VANET anonymous roaming authentication system, wherein the nodes on the blockchain include a network control center set up in each area and at least one access point connected to the network control center in each area;

[0045] The network control center is used to publish system parameters during the initialization phase; during the registration phase, it is used to receive real identity information sent by mobile users and access points, register the two, and return their respective public and private key pairs to them;

[0046] The mobile user is configured to, during the authentication phase, select a first random number when roaming to an external area and needing to obtain roaming services, generate a false identity of the mobile user based on the first random number, the system parameters, the mobile user's real identity information, and a public key of an access point in the external area, and send an access request to the access point in the external area based on the false identity of the mobile user;

[0047] The access point is configured to, during the verification phase, upon receiving an access request from a mobile user, authenticate the mobile user using its own private key and information carried in the access request. If the authentication succeeds, the access point then invokes a smart contract pre-deployed by a network control center in the mobile user's registered area to perform a revocation check on the mobile user. If the revocation check succeeds, the access point randomly selects a second random number, generates a false identity based on the second random number, the system parameters, its own real identity information, and the mobile user's public key, and generates a temporary session key with the mobile user based on the second random number, information carried in the access request sent by the mobile user, its own private key, and its own real identity information. The access point then returns a response to the mobile user based on its own false identity.

[0048] The mobile user is further configured, during the verification phase, to authenticate the external access point using its own private key and information carried in the response message after receiving the response message from the external access point. After the identity authentication is successful, the mobile user invokes a smart contract pre-deployed by a network control center in the area where the external access point is registered to perform a revocation check on the external access point. After the revocation check is successful, the mobile user generates a temporary session key with the external access point based on the first random number, the response message returned by the external access point, and the mobile user's own private key.

[0049] The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area has been revoked.

[0050] Beneficial effects of the present invention:

[0051] (1) The BARA scheme proposed in this paper redesigns the roaming authentication process and session key generation method. It utilizes a private chain to simultaneously store and retrieve the secret credentials of system entities and participate in roaming service registration and authentication. The use of probabilistic data structure technology significantly reduces on-chain storage overhead. Formal and informal security analyses demonstrate that the proposed scheme, in addition to maintaining anonymity and resistance to ephemeral key leakage attacks, also meets the requirements of privacy protection, forward / backward security, and traceability.

[0052] (2) Scyther and BAN logic are used to prove the security of BARA, and it is compared with other similar protocols in terms of computation, communication, and revocation verification. The analysis results show that BARA can better balance security performance and execution efficiency.

[0053] (3) A prototype system of the BARA scheme was built on a private blockchain, and the scheme was compared with four other related schemes in terms of security characteristics, communication cost, computation cost, and revocation cost. The signature scheme was measured using the MIRACL database, and performance analysis showed that the proposed scheme can better balance security and efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of a blockchain-based VANET anonymous roaming authentication system model provided by an embodiment of the present invention;

[0055] Figure 2 A flowchart of the verification phase of the blockchain-based VANET anonymous roaming authentication method provided by an embodiment of the present invention;

[0056] Figure 3 A schematic diagram of the composition of the smart contract in the blockchain-based VANET anonymous roaming authentication method provided by an embodiment of the present invention;

[0057] Figure 4 The communication delays for mobile users provided in the embodiments of the present invention include: (a) the communication delay from the mobile user to the cloud server (on which the network control center is located), and (b) the communication delay from the mobile user to the blockchain node;

[0058] Figure 5 Experimental results of batch verification provided by the embodiments of the present invention: (a) comparison results of signing time, (b) comparison results of batch verification time;

[0059] Figure 6 Experimental results of revocation checking provided for embodiments of the present invention: (a) comparison results of revocation spaces, (b) comparison results of hash functions. DETAILED DESCRIPTION

[0060] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0061] In the roaming authentication solution proposed in the present invention, the system model mainly consists of three entities: mobile users (MUs, also called mobile vehicles in this invention), access points (APs), and network control centers (NCCs). Figure 1As shown, the system is divided into multiple regions, each with a network control center and at least one access point. When a mobile user roams from their registered region to an area outside their registered region (i.e., an external region) and requires roaming services in the external region, they must first authenticate with the access point in the external region and then obtain services through a roaming authentication protocol. The following briefly describes the main functions of these three entities, with detailed functional details provided in subsequent specific embodiments.

[0062] Network Control Center: The NCC provides roaming services for mobile users and registration services for mobile users and access points. The HNCC is the network control center responsible for mobile user registration (also known as the registration area network control center), while the FNCC is the network control center in an external region that has a roaming partnership with the HNCC. As a node in a private blockchain, the NCC stores all blockchain transaction data and is responsible for deploying and maintaining smart contracts for access points.

[0063] Access Point: When a mobile user enters the coverage area of ​​an access point, they must first authenticate with the access point. If the vehicle passes authentication, the access point provides roaming services. Each access point is deployed with a corresponding smart contract (referring to an authentication contract and / or a revocation contract). When the access point authenticates the mobile user, the contract is triggered and a transaction is formed. Once consensus is reached, the transaction is successfully executed.

[0064] Mobile users: When roaming to an external area, mobile users need to perform mutual authentication with the access point in the area to obtain roaming services.

[0065] Blockchain: A blockchain's full nodes, comprised of a network control center and access points, are responsible for storing the identities and public and private keys of registered entities. Smart contracts deployed on access points are used to authenticate and revoke roaming between access points and mobile users. Registered entities refer to registered mobile users and access points.

[0066] In one embodiment, in order to solve the problem that the existing smart contract-based mobile vehicle network roaming authentication scheme does not consider the anonymity of mobile users and there is a risk of temporary key leakage, the blockchain-based VANET anonymous roaming authentication method (abbreviated as BARA) provided in an embodiment of the present invention includes an initialization phase, a registration phase and a verification phase.

[0067] Initialization phase: The network control center in each area publishes system parameters;

[0068] Registration phase: The mobile user and access point each send their real identity information to the network control center in their area for registration and receive a public and private key pair returned by the network control center;

[0069] Verification phase: When a mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number and generates a false identity of the mobile user based on the first random number, the system parameters, the mobile user's real identity information, and the public key of the access point in the external area. The mobile user then sends an access request to the access point in the external area based on the false identity.

[0070] When the access point in the external area receives the access request, it uses its own private key and the information carried in the access request to authenticate the mobile user. After the identity authentication is successful, it calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform a revocation check on the mobile user. After the revocation check is successful, the access point in the external area randomly selects a second random number, generates a false identity of the access point in the external area based on the second random number, the system parameters, its own real identity information, and the public key of the mobile user, and generates a temporary session key between the access point and the mobile user based on the second random number, the information carried in the access request sent by the mobile user, its own private key, and its own real identity information. The access point in the external area returns a response message to the mobile user based on its own false identity.

[0071] After receiving the response message, the mobile user uses its own private key and the information carried in the response message to authenticate the access point in the external area. After the authentication is successful, the mobile user invokes the smart contract pre-deployed by the network control center in the area where the access point in the external area is registered to perform a revocation check on the access point in the external area. After the revocation check is successful, the mobile user generates a temporary session key with the access point in the external area based on the first random number, the response message returned by the access point in the external area, and its own private key.

[0072] The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area has been revoked.

[0073] In the anonymous roaming authentication method provided by an embodiment of the present invention, during the registration phase, mobile users and access points register with the domain's HNCC and obtain, via a secure channel, the public-private key pair assigned to each registered entity by the HNCC. When a mobile user attempts to access an external regional network for roaming services, mutual anonymous authentication with the access point within that external region is required. Unlike existing traditional roaming authentication, the roaming authentication in this embodiment of the present invention not only authenticates the true identities of the mobile user and access point but also performs revocation verification on both. Each NCC issues a set of smart contracts for revocation verification. Therefore, the anonymous roaming authentication method of the present invention maintains anonymity and is resistant to temporary key leakage attacks.

[0074] In one embodiment, during the initialization phase of the system, the NCC first selects the additive group and multiplicative cyclic groups also, The generator of is denoted as P and has an order of q. Then, NCC selects three suitable hash functions h i ,i∈{1,2,3}, and select As the master private key, calculate P pub =λ·P as the master public key. After completing these operations, NCC releases the system parameters See Table 1 for detailed description.

[0075] Table 1: Symbols and explanations

[0076]

[0077] In one embodiment, during the registration phase, each mobile user and access point sends its real identity to the HNCC in the area for registration. After the HNCC receives the real identity RID of the entity, it generates a public and private key pair {sk j ,pk j},j∈{MU,AP}, the specific process is as follows:

[0078] The mobile user and AP send their real identity RID to HNCC through a secure channel; after receiving the real identity from the registered user, HNCC selects a random number And calculate X j =x j ·P; Then, HNCC calculates the private key sk for the registered entity j =x j +λh1(RID j ||X j ), public key pk j =sk j ·P; Finally, HNCC will generate the public-private key pair {sk j ,pkj}Sent to mobile users and APs.

[0079] In one embodiment, during the verification phase, when a mobile user roams to an external area and needs to access the network in the external area to obtain roaming services, it is necessary to perform mutual authentication with the AP in the external area. If the authentication is successful, a secure session channel is established. In this embodiment, BARA generates pseudonyms for both the mobile user and the access point and changes the method of generating the temporary session key between the two. Specifically, Figure 2 It is worth mentioning that although the present invention mainly studies the roaming authentication scheme, the BARA scheme is still applicable to mobile users accessing the home network. The specific steps of mutual authentication between the mobile user and the access point are as follows:

[0080] Step A1: Mobile users Select a first random number r from U , calculate R U =r U P; where P can be obtained from the system parameters published by the system;

[0081] Mobile users use real identity information RID U , calculate false identities and identity verification information T U =h3(RID U ||R U ||ts U ), and generate a signature σ U =S.sign(T U ); where h2 and h3 are hash functions obtained from the published system parameters, pk AP Indicates the public key of the access point in the external area, ts U Indicates a timestamp;

[0082] The mobile user sends an access request to the AP in, Indicates the identification information of the network control center of the mobile user registration area;

[0083] AP receives access request A U After that, first verify the timestamp ts U Is it within the allowed range? If so, then according to the received false identity PID of the mobile user U , calculate the real identity of the mobile user and identity verification information T′ U =h3(RID′ U ||R U ||ts U ), then generate the signature σ′U =S.sign(T′ U ), if signature σ′ U and signature σ U If the authentication fails, the access request is directly denied.

[0084] When the mobile user passes the identity authentication, the AP generates transaction information

[0085] AP call identification information is The smart contract pre-deployed by the network control center of the mobile phone network uses the cuckoo filter to query whether the mobile user is already in the network control center. If yes, then continue to query whether the mobile user has been revoked. If not, it means that the mobile user has passed the revocation test.

[0086] Specifically, each NCC maintains a cuckoo filter, which uses the probabilistic data structure of the cuckoo filter to store the registration and revocation information of the registered entity and uses smart contracts to update it, which can greatly reduce the on-chain storage overhead.

[0087] It can be understood that the basic unit of the Cuckoo filter is an entry, and each entry stores a fingerprint. Specifically, the registration information of the registered entity is stored in the table RL, and the revocation information of the registered entity is stored in the array CKF. That is, first, the Cuckoo filter is used to query the table RL to check whether the mobile user has been registered in the network control center. If a matching fingerprint exists, the CKF is queried to see if the mobile user has been revoked. If so, the mobile user is considered revoked and False is returned. If not, the mobile user has passed the revocation check and True is returned. The smart contract returns a message of "True" or "False" to indicate the validity of the verification.

[0088] Step A2: When the mobile user passes the revocation check, the AP randomly selects a second random number r AP , calculate the intermediate parameter R AP =r AP ·P;

[0089] AP based on real identity information RID AP , calculate false identities and identity verification information T AP =h3(RID AP ||R AP ||ts AP ), and generate a signature σ AP=S.sign(T AP ); where pk U Indicates the public key of the mobile user in the access request, ts AP Indicates a timestamp;

[0090] AP generates a temporary session key SK between itself and the mobile user = h2(r AP pk U ||R U sk AP ||RID AP ||T′ U ) and returns the response information to the mobile user Among them, sk AP The private key of the access point in the external area, R U Represents the intermediate parameter in the access request, T′ U It indicates the intermediate information obtained during the authentication process of the mobile user by the access point in the external area; Indicates the identification information of the network control center of the registration area of ​​the access point in the external area.

[0091] Step A3: The mobile user receives the response message A AP After that, first verify the timestamp ts AP Is it within the allowed range? If so, then according to the received false identity PID of the AP AP , calculate the real identity of AP and identity verification information T′ AP =h3(RID′ AP ||R AP ||ts AP ), then generate the signature σ′ AP =S.sign(T′ AP ), if signature σ′ AP and signature σ AP If they are consistent, the identity authentication is passed;

[0092] When the AP passes the identity authentication, the mobile user generates transaction information

[0093] Mobile user calling identification information is The smart contract pre-deployed by the network control center uses the cuckoo filter to query whether the AP is in the network control center. If it is registered, then continue to query whether the AP has been revoked. If not, it means that the AP has passed the revocation test.

[0094] Step A4: When the AP passes the revocation check, the mobile user UGenerate a temporary session key SK between the AP and the server. U pk AP ||R AP sk U ||RID′ AP ||T U ); where sk U Represents the private key of the mobile user, pk AP Indicates the public key of the external zone access point in the response message.

[0095] It is understandable that Figure 3 As shown, the smart contract mainly includes the NCC ID, contract address, cuckoo filter, the registered user table jointly maintained by the NCC, and other mapping tables from NCC to smart contract addresses.

[0096] In practical applications, the algorithm code of the smart contract can be designed as follows:

[0097]

[0098]

[0099] In one embodiment, the BARA scheme also includes dynamic registration and revocation stages; the dynamic registration refers to the network control center in each area receiving the real identity information sent by new mobile users in real time and registering them; the revocation refers to stopping roaming services for registered mobile users or access points, and storing the real identity information of revoked mobile users or access points.

[0100] It is understood that when a new mobile user wants to join the system, they only need to register with the NCC in their area. At the same time, the system supports the revocation of mobile users and access points. Once revoked, the mobile user or access point is no longer a legal entity in the system and cannot access valid services. The NCC uses CKF to store the identity of the revoked user RID U / AP , the NCC updates the CKF array by calling a smart contract. In addition, the Cuckoo filter supports a delete operation. When a deleted mobile user registers with the system again, the HNCC can delete the user entry from the array, allowing them to regain roaming service.

[0101] In one embodiment, to further improve the AP verification efficiency, the BARA solution also includes a batch verification stage; the batch verification means that when an access point in one area simultaneously receives access requests from multiple mobile users in other areas, the access point simultaneously performs identity authentication and revocation checks on the multiple mobile users.

[0102] It is understandable that when the AP receives roaming authentication requests from multiple vehicles in other domains at the same time, a single authentication method may not be able to meet the high mobility of the vehicles. Therefore, this embodiment proposes a more efficient batch authentication solution. The specific steps are as follows:

[0103] Step B1: AP collects vehicle request messages from different areas and organizes them into a batch verification request

[0104] Step B2: AP checks whether the mobile user's timestamp is within the allowed range and calculates the pseudonym and

[0105] Step B3: Signature Perform batch validation where Given n public keys, messages and signature tuples (pk i ,T i ,(R i ,s i ), AP generates n random numbers {a1, a2, ..., a n}, calculate n challenge hashes e i =H(pk i ||R i ||T i ), and then verify that the following formula is true:

[0106] a1R1+a2R2+…+a n R n +(a1e1)pk1+(a2e2)pk2+…+(a n e n )pk n -(a1s1

[0107] +a2s2+…+a n s n )P=0

[0108] Here, the "Bos-Coster algorithm" is used, with random numbers {a1, a2, ..., a n}, where coefficient a1 is the largest, followed by a2, and so on. Write the first term and a1R1+a2R2 as (a1-a2)R1+a2(R1+R2). If the coefficient of the first term is 0, discard the first term. Repeat this process until only the last term remains, eliminating most point multiplications.

[0109] Corresponding to the above-mentioned anonymous roaming authentication method, an embodiment of the present invention also provides a blockchain-based VANET anonymous roaming authentication system, wherein the nodes on the blockchain include a network control center set up in each area and at least one access point connected to the network control center in each area.

[0110] The network control center is used to publish system parameters during the initialization phase; during the registration phase, it is used to receive real identity information sent by mobile users and access points, register the two, and return their respective public and private key pairs to them.

[0111] During the verification phase, when a mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number, generates a false identity of the mobile user based on the first random number, the system parameters, the mobile user's real identity information, and the public key of the access point in the external area, and sends an access request to the access point in the external area based on the false identity of the mobile user.

[0112] During the verification phase, upon receiving an access request from a mobile user, the access point uses its own private key and the information carried in the access request to authenticate the mobile user. After the identity authentication is successful, the access point invokes a smart contract pre-deployed by a network control center in the mobile user's registration area to perform a revocation check on the mobile user. After the revocation check is successful, the access point randomly selects a second random number, generates a false identity based on the second random number, the system parameters, its own real identity information, and the public key of the mobile user, generates a temporary session key with the mobile user based on the second random number, the information carried in the access request sent by the mobile user, its own private key, and its own real identity information, and returns a response message to the mobile user based on its own false identity.

[0113] During the verification phase, the mobile user is further configured to, after receiving a response message from the access point in the external area, use its own private key and information carried in the response message to authenticate the access point in the external area. After the identity authentication is successful, the mobile user calls a smart contract pre-deployed by a network control center in the area where the access point in the external area is registered to perform a revocation check on the access point in the external area. After the revocation check is successful, a temporary session key is generated between the mobile user and the access point in the external area based on the first random number, the response message returned by the access point in the external area, and the mobile user's own private key.

[0114] The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area has been revoked.

[0115] It should be noted that the system provided in the embodiment of the present invention is for implementing the above method. Its specific functions can be referred to the above method embodiment and will not be described in detail here.

[0116] The BARA solution proposed in this paper redesigns the roaming authentication process and session key generation. It utilizes a private chain to simultaneously store and retrieve the secret credentials of system entities and participate in roaming service registration and authentication. The use of probabilistic data structure technology significantly reduces on-chain storage overhead. Formal and informal security analyses demonstrate that the proposed solution, in addition to maintaining anonymity and resistance to ephemeral key leakage attacks, also meets privacy protection, forward / backward security, and traceability requirements.

[0117] To verify the effectiveness of the proposed solution, the following comprehensive analysis of BARA performance will be conducted from both theoretical and experimental perspectives. Theoretically, the comparison focuses on security, communication consumption, and time consumption for roaming authentication schemes. Experimentally, the comparison focuses on batch verification and revocation checking. All experiments were conducted using an Intel(R) Core(TM) i5-9400 CPU at 2.90GHz, 8GB of RAM, and Windows 10 Education.

[0118] To ensure the security of the solution presented in this invention, the eCK strong security model is used. In this security model, the attacker's capabilities are described as follows: The attacker has complete control over the communication network and can arbitrarily monitor, delay, replay, and modify information. The attacker can obtain the long-term private keys of both authenticated parties. The attacker can obtain the temporary private keys of both authenticated parties. The attacker can obtain the session keys of completed sessions. Furthermore, it is assumed that the NCC is honest to users in one domain but semi-honest to users in other domains. This means that the NCC will provide services to mobile users according to roaming agreements, but may provide incorrect information to users in other domains. However, no attacker can compromise the NCC.

[0119] Here, we briefly introduce several basic security properties of the BARA solution:

[0120] Mutual authentication: In a roaming authentication solution, when a mobile user enters the coverage area of ​​an access point, mutual authentication is performed with the access point to ensure that the mobile user is a legitimate registered user and has not been revoked. Furthermore, the NCC within the access point's domain must ensure a roaming partnership with the NCC where the mobile user is registered.

[0121] Anonymity: During the roaming authentication process, the real identity of the mobile user cannot be obtained by attackers.

[0122] Traceability: Mobile users can complete authentication with their legal identities, but when a legal vehicle violates the law, the real ID of the anonymous user needs to be tracked.

[0123] Revocation authentication: A mobile user's revocation authentication ensures that the mobile user is still a legitimate user and has not been revoked before the access point provides roaming services to the mobile user. This prevents a malicious user who has been revoked from illegally obtaining roaming services through mutual authentication with the access point.

[0124] Forward security: If the long-term private keys of the protocol participants are compromised, and the attacker cannot obtain the old session keys, the protocol is said to provide partial forward secrecy. If the compromise of the long-term private keys of the parties does not lead to the compromise of the old session keys, the protocol is said to provide perfect forward security.

[0125] Replay attack: An attacker cannot use a signed message that has already been received and pass verification when the message is invalid.

[0126] Man-in-the-middle attack: An attacker cannot reach a valid temporary session key with the communicating parties by intercepting, tampering with, and sniffing the interactive information without the knowledge of the communicating parties.

[0127] Impersonation attack: An attacker cannot impersonate a legitimate party in the communication protocol to complete roaming authentication.

[0128] Key leakage impersonation attack: After an attacker obtains a user's private key, he can impersonate another user to perform key agreement with that user, but still cannot obtain the temporary session key.

[0129] Temporary key leakage attack: After obtaining the temporary keys of both parties, the attacker still cannot calculate the session key.

[0130] (1) Theoretical analysis

[0131] 1) Security Properties. Table 2 summarizes the security properties of the BARA scheme compared to four other roaming authentication schemes, using a √ to indicate that the scheme satisfies this property and an × to indicate that the scheme does not. Table 2 shows that, compared with other related work, the BARA scheme provides the necessary security properties.

[0132] Table 2: Comparison of security properties of the schemes

[0133]

[0134] The scheme of Xue et al. (Reference 1) is almost unable to resist the temporary key leakage attack. In addition, since the real identity of the mobile user is directly transmitted in the public channel, the scheme does not provide anonymity for the mobile user. In the scheme of Tao et al. (Reference 2: Y.Tao, H.Du, J.Xu, L.Su, B.Cui, On-demand anonymous access and roaming authentication protocols for 6g satellite–ground integrated networks, Sensors 23 (11) (2023) 5075.), the temporary session key is composed of the temporary private keys of both parties to the protocol, so the scheme cannot resist the temporary key leakage attack. In addition, in the case of long-term private key leakage of low-Earth orbit satellites, attackers can impersonate legitimate users and conduct conversations with them. Similarly, the scheme of Yadav et al. (Reference 3: AKYadav, A. Braeken, M. Misra, M. Liyange, Aprovably secure and efficient 5g-aka authentication protocol using blockchain, in: 2023IEEE 20th Consumer Communications & Networking Conference (CCNC), IEEE, 2023, pp. 1110–1115.) is also not resistant to temporary key leakage attacks and key leakage impersonation attacks. The scheme of Cao et al. (Reference 4: Z. Cao, Z. Chen, W. Shang, Y. Zhu, Efficient revocable anonymous authentication mechanism for edge intelligent controllers, IEEE Internet of Things Journal 10(12)(2023) 10357–10367.) involves the server verifying the signature, so the scheme does not provide a mutual authentication scheme, and this also leads to malicious edge server impersonation attacks.

[0135] 2) Communication consumption. The communication consumption of the proposed scheme and the other four schemes is compared and analyzed, as shown in Table 3. The identity |ID| is 160 bits, the timestamp |ts| is 32 bits, and the elliptic curve point multiplication is 160 bits. is 321 bits, It is 320 bits. The scheme of Xue et al. (Reference 1) reaches a common temporary session key after two rounds of communication, and a total of 3266 bits need to be transmitted. In the scheme of Tao et al. (Reference 2), the terminal needs to send a 1636-bit message to the LEO, and the LEO returns 1313 bits. The scheme of Yadav et al. (Reference 3) performs 5 rounds of information exchange, so the communication consumption generated is the highest, which is 5604 bits. The scheme of Cao et al. (Reference 4) mainly communicates the group public key and the signature message, with a length of 1926 bits and 2563 bits respectively. BARA is similar to the scheme of Xue et al. (Reference 1). The mobile user and the AP reach a common temporary session key after two interactions, and a total of 2628 bits of message need to be transmitted.

[0136] Table 3: Communication consumption of the scheme

[0137]

[0138] 3) Time Consumption. This section evaluates the time consumption of the proposed scheme, including both computational and communication time. Regarding computational time consumption, this experiment consists of two main parts: the first part is the time consumption of encryption operations, and the second part is the time consumption of user revocation checks. Furthermore, based on a real-world VANET deployment, the actual communication time between mobile users, access points, cloud servers, and blockchain nodes was measured.

[0139] The computational time of the basic cryptographic algorithm based on the MIRACL library was measured. The cryptographic primitives were run 100 times, and the average runtime was calculated based on the highest and lowest runtimes. The symbolic representation, specific interpretation, and corresponding runtime of each operation are shown in Table 4. Next, the computational time consumption of the BARA scheme and the other four schemes was compared, as shown in Table 5. The computational time consumption of the BARA scheme was 8.412ms, which is slightly higher than the time consumption of the scheme in Yadav et al. (Reference 3) by 1ms. However, as shown in Table 2, the BARA scheme has higher security than the scheme in Yadav et al. (Reference 3), so this computational consumption is still within an acceptable range.

[0140] Table 4: Computational cost of operations

[0141]

[0142]

[0143] Table 5: Computational cost of the solution

[0144]

[0145] In addition to the relevant cryptographic calculations, the BARA scheme also performs revocation checks for each authenticated user, including the time required to query the revocation list and invoke the smart contract. Because the present invention uses a cuckoo filter, only two hash values ​​are required to obtain the required hash value and perform the revocation list query, so this portion of the latency can be considered zero. In a Bloom filter with the same false positive rate, a user's query would require 13 hash operations. It is worth noting that the lower false positive rate in a Bloom filter requires more hash functions to achieve, while the false positive rate in a cuckoo filter is independent of the number of hash functions used.

[0146] The process of invoking a smart contract is similar to a normal blockchain transaction. Once the trigger conditions of a smart contract are met, validating nodes will first verify the signature to ensure the validity of the transaction. Transactions that pass verification enter the pending consensus set. Once a majority of validating nodes reach consensus, the transaction is successfully executed and the user is notified. In this experiment, a local private chain built using Ganache was used to test the deployment and invocation of smart contracts. It is worth noting that this private chain uses the Proof of Authority (PoA) consensus mechanism, in which validating nodes in the network are granted permissions through pre-authorization. These validating nodes, known as authority nodes, are responsible for verifying and packaging transactions and adding them to the blockchain. Due to the rapid verification and packaging speed of authority nodes, transaction confirmation times are shortened. We will not consider modifications to the consensus mechanism here.

[0147] As shown in Table 6, the time consumed by mobile users and APs for calling smart contracts is 12.367ms and 0.009ms, respectively. The reason why the AP only takes 0.009ms to call the smart contract is that the AP is a node in the blockchain and the smart contract is stored locally. Therefore, it only needs to be executed in a "Call" manner, avoiding the consensus time.

[0148] Table 6: Communication time consumption of the scheme

[0149]

[0150] For the communication delay time setting, the time from user to FNCCT is calculated. U-F , from user to blockchain node T U-B , From AP to FNCC T A-F , from AP to blockchain node T A-B , From FNCC to HNCC T F-H According to the actual VANET environment, the general NCC is deployed on the cloud server. The delay time between the user and the cloud server is measured, such as Figure 4(a) shows that 30 cloud server nodes were selected at home and abroad and 10 measurements were conducted, with an average value of 101.3ms. Therefore, T U-F 、T A-F and T F-H The delay time is set to 50.65ms. However, for the time delay from the user to the digital currency node, this experiment also crawled the IP addresses of 25,366 digital currency nodes around the world and measured the ping delay, with an average value of 217.04ms. Figure 4 As shown in (b), T U-B and T A-B The value of is set to 108.52ms.

[0151] (2) Experimental analysis

[0152] This section focuses on the experimental performance of the BARA scheme, focusing on batch authentication and revocation verification. The proposed scheme is primarily used in VANETs. Therefore, when multiple mobile users are performing roaming authentication services within a short period of time, it is crucial to avoid AP failures, which necessitates batch authentication. Furthermore, mobile user revocation verification is a crucial function that prevents the NCC from providing roaming services to other unauthorized users.

[0153] 1) Batch Verification: This paper measures the execution time of message signing and batch verification. The number of mobile users in the experiments is set to 1, 10, 20, 40, 60, 80, and 100, with the minimum number of batch verifications being 10. Since the schemes by Xue et al. and Yadav et al. (Reference 3) do not provide batch verification schemes, we only conduct experiments on the schemes by BARA, Tao et al. (Reference 2), and Cao et al. (Reference 4).

[0154] like Figure 5 As shown, the solution of the present invention minimizes both signature and batch verification time. During the batch verification phase, the "Bos-Coster" algorithm eliminates most point multiplications, requiring only addition operations. In summary, the solution of the present invention is particularly suitable for high-mobility environments such as VANETs.

[0155] 2) Revocation Verification. In this section, a user invokes a smart contract to perform a revocation check. Ethereum smart contracts are limited to 24 KB. For ease of comparison, the filter size is fixed at 20 KB. Due to the filter size limitation, we consider maximizing the number of users stored within the limited storage space while improving user query efficiency.

[0156] The false positive rate of the cuckoo filter is determined by the bucket size and the number of bits in the fingerprint. To meet false positive rates of 1%, 0.1%, 0.01%, and 0.001%, respectively, the bucket size b is set to 4, and the corresponding fingerprint sizes f are 9, 13, 16, and 19 bits, respectively. The bucket size is chosen to save space using a "semi-sorted bucket" optimization. The required number of buckets is also calculated to meet the number of users stored for a fixed smart contract size. When setting four false positive rates, only when the false positive rate is 1% does the required number of buckets reach 9; when the other false positive rates meet the number of stored users, the required number of buckets is 1.

[0157] The revocation space per 5000 users added to the Bloom filter and the Cuckoo filter at different false positive rates is compared. Figure 6 As shown in (a), with a fixed storage capacity of 20KB and a false positive rate of 1%, the Bloom filter can store 17,093 users, while the Cuckoo filter can store 18,204 users. At false positive rates of 0.1%, 0.01%, and 0.001%, the Bloom filter can store 11, 395, 8,546, and 6,837 users, respectively, while the Cuckoo filter can store 12, 603, 10, 240, and 8,623 users, respectively. It can be seen that the lower the false positive rate of the Cuckoo filter, the better the storage efficiency of revoked users.

[0158] The number of hash functions used in the Bloom filter is also different to achieve different false positive rates. In this experiment, the number of hash functions corresponding to the four false positive rates is 7, 10, 13, and 17 respectively. The Cuckoo filter only needs to perform two hash operations at any false positive rate to query data, such as Figure 6 (b) shown.

[0159] This paper presents a novel smart contract-based anonymous roaming authentication scheme for VANETs. In this scheme, the use of smart contracts facilitates authentication between mobile users and access points in this scenario, implementing a secure roaming authentication protocol. Furthermore, to reduce on-chain storage overhead, this paper employs a cuckoo filter, achieving faster revocation verification and higher space utilization. Performance and security analysis demonstrate that, compared to four other similar roaming authentication schemes, the BARA scheme achieves a better balance between security and efficiency, making it more suitable for VANET environments.

[0160] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A VANET anonymous roaming authentication method based on blockchain, characterized in that: The nodes on the blockchain include a network control center set up in each area and at least one access point connected to the network control center in each area, and the method includes: Initialization phase: The network control center in each area publishes system parameters; Registration phase: The mobile user and access point each send their real identity information to the network control center in their area for registration and receive a public and private key pair returned by the network control center; Verification phase: When a mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number and generates a false identity of the mobile user based on the first random number, the system parameters, the mobile user's real identity information, and the public key of the access point in the external area. The mobile user then sends an access request to the access point in the external area based on the false identity. When the access point in the external area receives the access request, it uses its own private key and the information carried in the access request to authenticate the mobile user. After the identity authentication is successful, it calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform a revocation check on the mobile user. After the revocation check is successful, the access point in the external area randomly selects a second random number, generates a false identity of the access point in the external area based on the second random number, the system parameters, its own real identity information, and the public key of the mobile user, and generates a temporary session key between the access point and the mobile user based on the second random number, the information carried in the access request sent by the mobile user, its own private key, and its own real identity information. The access point in the external area returns a response message to the mobile user based on its own false identity. After receiving the response message, the mobile user uses its own private key and the information carried in the response message to authenticate the access point in the external area. After the authentication is successful, the mobile user invokes the smart contract pre-deployed by the network control center in the area where the access point in the external area is registered to perform a revocation check on the access point in the external area. After the revocation check is successful, the mobile user generates a temporary session key with the access point in the external area based on the first random number, the response message returned by the access point in the external area, and its own private key. The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area has been revoked.

2. The VANET anonymous roaming authentication method based on blockchain according to claim 1, characterized in that: The initialization phase specifically includes: Network Control Center Selects Additive Group and multiplicative cyclic groups in, The generator of is denoted as P and has an order of q; The network control center selects three hash functions h i ,i∈{1,2,3}; and select As the master private key, calculate P pub =λ·P as the master public key; Network Control Center publishes system parameters Here, H represents the hash function involved in the smart contract.

3. The VANET anonymous roaming authentication method based on blockchain according to claim 2, characterized in that: The registration stage specifically includes: The mobile user and the access point respectively transmit the real identity information RID through the secure channel j Sent to the network control center in the area; j∈{MU,AP}, MU represents the mobile user, AP represents the access point; The network control center receives the real identity information RID of the mobile user and access point j Then, choose a random number And calculate the intermediate parameter X j =x j ·P; The network control center calculates the private key sk for the mobile user and the access point j =x j +λh1(RID j ||X j ), public key pk j =sk j ·P; The network control center will generate the public and private key pair {sk j ,pk j }Sent to mobile users and access points.

4. The VANET anonymous roaming authentication method based on blockchain according to claim 1, characterized in that: During the verification phase, when the mobile user roams to an external area and needs to obtain roaming services, the mobile user selects a first random number, and a false identity of the mobile user is generated based on the first random number, the system parameters, the mobile user's real identity information, and the public key of the access point in the external area; The mobile user sends an access request to the access point in the external area based on the false identity of the mobile user, specifically including: The mobile user selects a first random number Calculate the intermediate parameter R U =r U P; where P is obtained from the published system parameters; P is the additive group The generator of , order is q; Mobile users use real identity information RID U , calculate false identities and identity verification information T U =h3(RID U ||R U ||ts U ), and generate a signature σ U =S.sign(T U ); where h2 and h3 are hash functions obtained from the published system parameters, pk AP Indicates the public key of the access point in the external area, ts U Indicates a timestamp; The mobile user sends an access request to the access point in the external area in, Indicates the identification information of the network control center in the mobile user registration area, pk U Represents the public key of the mobile user.

5. The VANET anonymous roaming authentication method based on blockchain according to claim 4 is characterized in that: During the verification phase, when the access point in the external area receives the access request, it uses its own private key and the information carried in the access request to authenticate the mobile user. Once the authentication is successful, it calls the smart contract pre-deployed by the network control center in the mobile user registration area to perform a revocation check on the mobile user. Specifically, the steps include: The access point in the external area receives the access request A U After that, first verify the timestamp ts U Is it within the allowed range? If so, then according to the received false identity PID of the mobile user U , calculate the real identity of the mobile user and identity verification information T′ U =h3(RID′ U ||R U ||ts U ), then generate the signature σ′ U =S.sign(T′ U ), if signature σ′ U and signature σ U If they are consistent, the identity authentication is passed; among them, sk AP The private key of the access point representing the external zone; When the mobile user passes the identity authentication, the access point in the external area generates transaction information The access point call identification information of the external area is The smart contract pre-deployed by the network control center of the mobile phone network uses the cuckoo filter to query whether the mobile user is already in the network control center. If yes, then continue to query whether the mobile user has been revoked. If not, it means that the mobile user has passed the revocation test.

6. The VANET anonymous roaming authentication method based on blockchain according to claim 4, characterized in that: During the verification phase, when the revocation check passes, the access point in the external area randomly selects a second random number, generates a false identity of the access point in the external area based on the second random number, the system parameters, its own real identity information, and the public key of the mobile user, and generates a temporary session key between the access point and the mobile user based on the second random number, information carried in the access request sent by the mobile user, its own private key, and its own real identity information; The access point in the external area returns response information to the mobile user based on the false identity thereof, specifically comprising: The access point in the external area randomly selects a second random number r AP , calculate the intermediate parameter R AP =r AP ·P; The access point in the external area is based on the real identity information RID AP , calculate false identities and identity verification information T AP =h3(RID AP ||R AP ||ts AP ), and generate a signature σ AP =S.sign(T AP ); where pk U Indicates the public key of the mobile user in the access request, ts AP Indicates a timestamp; The access point in the external area generates a temporary session key SK = h2(r AP pk U ||R U sk AP ||RID AP ||T′ U ); where sk AP The private key of the access point in the external area, R U Represents the intermediate parameter in the access request, T′ U It indicates the intermediate information obtained during the authentication process of the mobile user by the access point in the external area; The access point in the external area returns a response message to the mobile user in, Indicates the identification information of the network control center of the registration area of ​​the access point in the external area.

7. The VANET anonymous roaming authentication method based on blockchain according to claim 6, characterized in that: In the verification phase, after receiving the response message, the mobile user uses its own private key and the information carried in the response message to authenticate the access point in the external area. After the authentication is successful, the mobile user calls the smart contract pre-deployed by the network control center in the registration area of ​​the access point in the external area to perform a revocation check on the access point in the external area, which specifically includes: The mobile user receives the response message A AP After that, first verify the timestamp ts AP Is it within the allowed range? If so, then according to the false identity PID of the access point in the external area received AP , calculate the real identity of the access point in the external area and identity verification information T′ AP =h3(RID′ AP ||R AP ||ts AP ), then generate the signature σ′ AP =S.sign(T′ AP ), if signature σ′ AP and signature σ AP If they are consistent, the identity authentication is passed; among them, sk U Represents the private key of the mobile user; When the access point in the external area passes the identity authentication, the mobile user generates transaction information Mobile user calling identification information is The smart contract pre-deployed by the network control center uses the cuckoo filter to query whether the access point of the external area is already in the network control center. If yes, then continue to query whether the access point in the external area has been revoked. If no, it means that the access point in the external area has passed the revocation test.

8. The VANET anonymous roaming authentication method based on blockchain according to claim 7, characterized in that: In the verification phase, when the revocation check passes, the mobile user generates a temporary session key with the access point in the external area based on the first random number, the response information returned by the access point in the external area, and the mobile user's own private key, specifically including: The mobile user generates a temporary session key SK=h2(r U pk AP ||R AP sk U ||RID′ AP ||T U ); where sk U Represents the private key of the mobile user, pk AP Indicates the public key of the external zone access point in the response message.

9. The VANET anonymous roaming authentication method based on blockchain according to any one of claims 1 to 8, characterized in that: Also includes: Batch verification stage; the batch verification means that when an access point in one area receives access requests from multiple mobile users in other areas at the same time, it performs identity authentication and revocation checks on the multiple mobile users at the same time.

10. The VANET anonymous roaming authentication system based on blockchain is characterized by: The nodes on the blockchain include a network control center set up in each area and at least one access point connected to the network control center in each area; The network control center is used to publish system parameters during the initialization phase; during the registration phase, it is used to receive real identity information sent by mobile users and access points, register the two, and return their respective public and private key pairs to them; The mobile user is configured to, during the authentication phase, select a first random number when roaming to an external area and needing to obtain roaming services, generate a false identity of the mobile user based on the first random number, the system parameters, the mobile user's real identity information, and a public key of an access point in the external area, and send an access request to the access point in the external area based on the false identity of the mobile user; The access point is configured to, during the verification phase, upon receiving an access request from a mobile user, authenticate the mobile user using its own private key and information carried in the access request; after successful authentication, invoke a smart contract pre-deployed by a network control center in the mobile user's registered area to perform a revocation check on the mobile user; after successful revocation check, randomly select a second random number, generate a false identity based on the second random number, the system parameters, its own real identity information, and the mobile user's public key; and generate a temporary session key with the mobile user based on the second random number, information carried in the access request sent by the mobile user, its own private key, and its own real identity information; and returning response information to the mobile user based on the false identity of the mobile user; The mobile user is further configured, during the verification phase, to authenticate the external access point using its own private key and information carried in the response message after receiving the response message from the external access point. After the identity authentication is successful, the mobile user invokes a smart contract pre-deployed by a network control center in the area where the external access point is registered to perform a revocation check on the external access point. After the revocation check is successful, the mobile user generates a temporary session key with the external access point based on the first random number, the response message returned by the external access point, and the mobile user's own private key. The identity authentication refers to the access point and the mobile user authenticating each other's real identity information based on each other's false identity, and the revocation check refers to checking whether the registration information of the mobile user and the access point in the network control center of the registration area has been revoked.

Images