A vehicle-to-infrastructure (v2i) authentication key exchange protocol and a fast handover authentication method thereof

Abstract

A vehicle-to-everything (V2I) authentication key exchange protocol and a fast switching authentication method thereof include the following steps: step one, the system selects and sets elliptic curve parameters for authentication and encryption, and configures the hardware security module of each node and the trusted platform module of the vehicle; step two, the vehicle and the driver's information are securely registered in the system, the vehicle registers its real identity by generating a unique public-private key pair and registering with the trusted authority center (TA), the TA generates a pseudo identity of the vehicle after verification and sends it back to the vehicle through a secure channel; step three, the RSU generates and registers its unique identity with the TA, the TA generates the relevant authentication information of the RSU after verification and stores it in the block chain; step four, the initial authentication and key exchange between the vehicle and the RSU are completed; and step five, the switching authentication with the new RSU is completed. The application has the characteristics of high efficiency, low calculation cost and communication overhead, strong security and privacy protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of authentication and key exchange, in particular to a V2I authentication and key exchange protocol for vehicle-to-everything and a fast switching authentication method thereof. BACKGROUND

[0002] With the rapid increase in global transportation demand and the acceleration of urbanization, traditional transportation systems are facing challenges such as traffic congestion, frequent traffic accidents and environmental pollution. In order to solve these problems, intelligent transportation systems (ITS) have emerged. ITS uses information and communication technology to enhance road safety, optimize traffic flow and alleviate congestion. As an important part of ITS, vehicle ad hoc networks (VANETs) perform well in acquiring and processing large amounts of real-time data. Through vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communication, these networks establish an efficient and reliable data sharing platform, thus supporting various ITS applications.

[0003] VANETs through V2V and V2I communication, not only improve road safety, optimize traffic flow, but also effectively deal with the increasing traffic demand and the complex problems brought by urbanization. With the rapid development of autonomous driving technology, ITS faces new opportunities and challenges. Autonomous vehicles rely on a large amount of sensor data to perceive the surrounding environment and make driving decisions. However, the data collected by on-board sensors may not be comprehensive enough in complex traffic scenarios. VANETs make up for this deficiency through real-time V2V and V2I communication, providing autonomous vehicles with a more comprehensive and accurate understanding of the environment.

[0004] Through V2I communication, autonomous vehicles can obtain information such as traffic signal status, road construction information and current traffic flow, thereby optimizing travel routes, improving safety and operational efficiency. These communication mechanisms not only enhance the safety and efficiency of autonomous driving, but also support the overall effectiveness of intelligent transportation systems. VANETs play an indispensable role in contemporary ITS, promoting more smooth and safe traffic management.

[0005] Son et al. proposed a lightweight vehicle-to-everything (VANET) vehicle-to-infrastructure (V2I) handover authentication protocol based on blockchain, which cannot resist internal authorization attacks, impersonation attacks, cannot resist RSU capture attacks, may lead to privacy leakage and identity impersonation attacks. And high computational cost, large communication overhead.

[0006] Wang et al. proposed a lightweight authentication protocol, which uses fixed parameters for vehicle authentication, which may lead to tracking attacks, cannot resist internal authorization attacks, impersonation attacks and RSU capture attacks, and may be maliciously tracked.

[0007] Wang et al. proposed a blockchain-based trust scalable computing system for V2I authentication, which uses bilinear pairing, although it achieves fast authentication but results in high computational overhead, cannot resist internal authorization attacks, impersonation attacks, middleman attacks, RSU capture attacks, and may be maliciously tracked.

[0008] In summary, the defects of the prior art are: in terms of security, many protocols have deficiencies in preventing internal authorization attacks. When an internal node is controlled by an attacker, the attacker can use a legitimate identity to perform malicious operations, threatening system security. In addition, the protocol fails to effectively resist impersonation attacks, and attackers can impersonate legitimate nodes to obtain system resources or manipulate network communication, affecting the normal operation of the network. For Road Side Unit (RSU) capture attacks, existing protocols are vulnerable, and once the RSU is controlled by an attacker, the attacker can use its resources to spread false information or tamper with data, endangering the security of the Internet of Vehicles. At the same time, privacy protection is also a weak link, and some protocols fail to effectively prevent identity leakage during the identity verification process, leading to the possibility of vehicle identity being tracked and user privacy being at risk. In terms of overhead, the computational cost and communication overhead of the protocol are high, limiting their efficiency and scalability in practical applications. In particular, protocols that use fixed parameters for authentication are vulnerable to exposing vehicle identity or location, increasing the likelihood of being maliciously tracked. SUMMARY

[0009] To overcome the above technical problems, the purpose of the present application is to provide a V2I authentication key exchange protocol for the Internet of Vehicles and a fast switching authentication method, which has the characteristics of high efficiency, low computational cost and communication overhead, strong security and privacy protection.

[0010] By using blockchain technology to ensure data transparency and tamper resistance, combining with the unique hardware security features provided by Physical Unclonable Function (PUF), and introducing a fast switching authentication mechanism, various security threats such as internal authorization attacks, impersonation attacks, middleman attacks, and tracking attacks are effectively resisted, thereby improving the overall security and communication efficiency in the Internet of Vehicles environment.

[0011] The technical solution adopted by the present application is:

[0012] A V2I authentication key exchange protocol for the Internet of Vehicles and a fast switching authentication method, comprising the following steps:

[0013] Step 1: System initialization phase, used to lay the foundation for the normal operation of the entire Internet of Vehicles system, the system selects and sets the elliptic curve parameters used for authentication and encryption, and configures the hardware security module (HSM) of each node and the trusted platform module (TPM) of the vehicle;

[0014] This stage provides the necessary encryption and security support for the subsequent registration and authentication process, and lays the foundation for the registration and authentication of vehicles and RSUs.

[0015] Step two: Vehicle registration stage, used to securely register vehicle and driver information into the system, vehicle generates a unique pair of public and private keys and registers its true identity to the trusted authority center (TA), TA generates a pseudo identity for the vehicle after verification and sends it back to the vehicle through a secure channel;

[0016] This step ensures the legitimacy of the vehicle's identity and privacy protection, and lays the foundation for secure communication between the vehicle and RSU.

[0017] Step three: RSU registration stage, used to register and authenticate roadside units (RSUs), RSU generates and registers its unique identity to TA, TA generates relevant authentication information for RSU after verification and stores it in the blockchain;

[0018] This step not only ensures the legitimacy of the RSU's identity, but also prepares for subsequent secure communication with the vehicle.

[0019] Step four: V2I initial authentication stage, used to complete the initial authentication and key exchange between the vehicle and RSU after the vehicle starts or loses RSU connection for more than a certain time;

[0020] The vehicle and RSU authenticate according to their respective pseudo identities and generate a shared session key through negotiation, updating the vehicle's pseudo identity;

[0021] Through this stage, the vehicle can securely establish a communication connection with the RSU, ensuring the confidentiality and integrity of the communication.

[0022] Step five: fast switching authentication stage, used to quickly complete the switching authentication with the new RSU when the vehicle moves out of the communication range of the current RSU and enters the range of the next RSU.

[0023] Through this stage, the vehicle can quickly verify the identity of the new RSU and establish a new session key, ensuring the continuity and security of communication during the switching process.

[0024] The first step is specifically:

[0025] In the system initialization stage, TA selects an elliptic curve E defined in finite field F p , its equation expression form is:

[0026] y 2 =x 3 +ax+b(modp)

[0027] Where p is a prime number, and a and b are in the finite field F. p The constants on, and a, b satisfy 4a 3 +27b 2 ≠0 (mod p); Choose a base point G, G = (G x G y ), where G x G y It is a finite field F p The elements of the generator G satisfy the elliptic curve equation:

[0028]

[0029] The TA selects SHA2 as the one-way hash function h(·) used by the system, and the TA publishes the parameters {E, h(·), p, G}.

[0030] Step two specifically involves:

[0031] Step 1: Vehicle i Select your real identity ID_Vehicle i A random number ri is generated using a random number generator, and the public key Pub_Vehicle is calculated using the private key. i ID_Vehicle i ,ri,Pub_Vehicle i Send it to TA via a secure channel;

[0032] Step 2: After receiving the message, the TA first verifies the ID_Vehicle. i If the validity of the condition is satisfied, then TA generates a random number rj and calculates R. i =ri·G,R j =rj·G, generates a pseudo-identity for the vehicle. Calculate verification message and temporary keys Finally, PID i ,rj,Vt is sent to Vehicle via a secure channel i ;

[0033] Step 3:

[0034] In Vehicle i Calculate after receiving a message from TA Verify that the received Vt is equal to the calculated Vt'. If they are equal, the user enters their biometric information (BIO) on the vehicle. i-x and generation Where vx is the total number of challenges generated, based on the vehicle's PUF. i(·) function generates corresponding vx using the fuzzy extractor, respectively, on the vx and P i vx ;

[0035] using the fuzzy extractor to process the biological information input by the user, obtaining (F i-x , P BIOi-x ) = Gen(BIO i-x ), generating a secret and calculating the temporary encryption key using symmetric encryption, the key being RSec', to encrypt the data BIO i-x , P i vx , Sec, obtaining MTi, and storing ID_Vehicle i , PID i , P i vx , Sec into the TPM of the vehicle, and sending PID i , Vv, MTi to the TA through a secure channel.

[0036] Step 4: After receiving the message, the TA calculates and verifies whether Vv is equal to Vv'. If they are equal, the TA decrypts the message MTi using the key RSec. Then, the TA stores ID_Vehicle i , PID i , P i vx , Sec, BIO i-x , into the HSM of the TA.

[0037] Said step three is specifically:

[0038] Step 1: The RSU j sends its identity ID_RSU j and a random number r r to the TA through a secure channel.

[0039] Step 2: After receiving the message, the TA first verifies the uniqueness and legality of ID_RSU j , generates a random number r t and a challenge Cha j , and then calculates the verification message ​​and temporary key for symmetric encryption and using temporary key TSec to encrypt Cha j , obtaining MTj1, ID_RSU j , MTj1, r t , Vtr are sent to RSU j through secure channel;

[0040] Step 3: RSU j , after receiving the message, first checks whether ID_RSU j from TA is consistent with its own, if consistent, calculates checks whether Vtr is equal to Vtr', if equal, calculates temporary key then uses the temporary key to decrypt the message MTj1, uses its own PUF(·) function to process Cha j obtained by decryption, obtaining Res j and uses the fuzzy extractor to obtain K j and P RSUj , uses temporary key TSec' to symmetrically encrypt data P RSUj , Res j , K j , and sends ID_RSU j , MTj2 back to TA;

[0041] Step 4: TA, after receiving the message, uses temporary key TSec to decrypt MTj2, then TA reads Vehicle i data PID i , P i vx , Sec, BIO i-x in HSM, and symmetrically encrypts these data using key TSec, obtaining MTj3, TA sends ID_RSU j , MTj3 to RSU j through secure channel, and saves parameters ID_RSU j , P RSUj , (Cha j , Res j ), K j in HSM;

[0042] Step 5: RSU j , after receiving the message, uses temporary key TSec' to decrypt MTj3, then saves data PID i , Sec, P i vx , BIOi-x Uploaded to the blockchain.

[0043] Step four specifically involves:

[0044] Step 1: The user enters their biometric information (BIO). i-x ', Vehicle i Generate timestamp T1, select sequence number Seq, and select the corresponding [item name] based on that sequence number. and P i Seq ,calculate

[0045] Calculate verification message PID i ,S i No i ,V,T1 sent to RSU j .

[0046] Step 2: RSU j Received Vehicle i After receiving the message, first generate a timestamp T2, check if ||T2-T1||≤ΔT is true, and then use the PID. i Query its relevant information on the blockchain;

[0047] calculate Check if Seq' is valid; if valid, find the corresponding Seq'. P i Seq' ,calculate (F i-x ”,P BIOi-x " ) =Gen(BIO) i-x ") and verification message Verify whether V' = V is true; if true, calculate the verification message Val. ij =h(PID) i ||P i Seq' PF i-x "PSec||T2), and session key" Calculate new identity Send message ID_RSU j ,T2,Val ij To Vehicle i And update the fake identity, and transfer the data. PID i Val ij ,SKi j BIO i-x , Pi Seq' S i ,F i-x ',V,T1,T2 into the blockchain, using replace the original PID i ;

[0048] Step 3: Vehicle i receives the message, generates a timestamp T3 and verifies whether it meets the freshness, if it meets, calculates Val ij ' = h(PID i || P i Seq PF i-x 'Psec||T2), checks whether Val ij ' is equal to Val ij , if equal, calculates the session key and uses replace the original PID i .

[0049] The step five is specifically:

[0050] Step 1: Vehicle i generates a current timestamp T4 and a random number R1 i , calculates and sends PID i , R1 i , Vv i , T4 to RSU j ;

[0051] Step 2: RSU j receives the message, generates a timestamp T5 and verifies ||T5-T4||≤ΔT, if it is true, calculates checks whether Vv i ' is equal to Vv i , if equal, generates a new random number R2 i , calculates the verification message sends the message ID_RSU j , Vr i , R2 i , T5 to Vehicle i , and then saves the data PID i , SID, Vr i , T4, T5 to the blockchain;

[0052] Step 3: Vehicle iUpon receiving the message, a timestamp T6 is generated and ||T6-T5||≤ΔT is checked, and if the condition is met, the verification message is calculated Vr is checked i ' and Vr i are equal, and if so, the verification is completed.

[0053] Advantages of the present application:

[0054] Through the improved authentication and key exchange protocol, the security of the VANETs system is significantly improved, especially in resisting common network attacks (such as man-in-the-middle attacks, replay attacks), which guarantees the security of user privacy and communication data.

[0055] The authentication protocol is optimized, which can still run efficiently in the case of limited computing resources and bandwidth. This is particularly important for vehicle-mounted devices, which usually have limited computing power and energy consumption. Compared with the prior art, the present application greatly reduces the computing cost and communication overhead while maintaining high security.

[0056] Through the improved message integrity verification mechanism, the present application ensures the integrity and accuracy of all communication messages during vehicle switching, thereby improving the reliability of the system and avoiding potential security risks caused by incomplete or tampered messages.

[0057] The lightweight security protocol designed by the present application performs excellently in resource utilization. Through effective resource allocation and optimization, the present application can still provide efficient authentication and communication functions in an environment with limited bandwidth and computing resources, improving the overall performance of the system.

[0058] The present application is particularly suitable for large-scale vehicle network environment, and through the use of blockchain technology and optimized protocol design, the system resource occupation is effectively reduced, ensuring that the system can still run stably under high load, supporting the expansion requirements of future intelligent transportation systems.

[0059] With the continuous development of intelligent transportation systems, the requirements for VANETs systems are also increasing. Through technical improvement, the present application provides higher scalability, which can adapt to the requirements of future complex traffic environment and autonomous driving technology. BRIEF DESCRIPTION OF DRAWINGS

[0060] Figure 1 is a schematic diagram of the vehicle registration phase.

[0061] Figure 2 is a schematic diagram of the RSU registration phase.

[0062] Figure 3 is a schematic diagram of the V2I initial authentication phase.

[0063] Figure 4 Schematic diagram for fast switching authentication phase.

[0064] Figure 5 Schematic diagram for vehicle registration phase flow.

[0065] Figure 6 Schematic diagram for RSU registration phase flow.

[0066] Figure 7 Schematic diagram for V2I initial authentication phase flow.

[0067] Figure 8 Schematic diagram for fast switching authentication phase flow. DETAILED DESCRIPTION

[0068] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0069] SYMBOL TABLE

[0070]

[0071]

[0072] A vehicle-to-everything (V2I) authentication key exchange protocol and a fast switching authentication method thereof, comprising the following steps:

[0073] Step one: system initialization phase;

[0074] In this phase, the system will select and configure the elliptic curve parameters for encryption and authentication, and at the same time, configure the hardware security module (HSM) and trusted platform module (TPM) for each vehicle and roadside unit (RSU). In addition, the hash function and encryption algorithm used by the system will also be selected to ensure that the communication between each node has a consistent security standard. Through the configuration of the system initialization phase, the entire system can run in a unified and secure environment, and the registration, authentication of vehicles and RSUs, and subsequent communication can all be carried out under strong security guarantee. The settings in this phase effectively reduce the security risks of the system in actual application, ensure the security and consistency of communication between nodes, and lay a solid foundation for efficient and secure operation of the vehicle-to-everything system.

[0075] In the system initialization phase, a TA selects an elliptic curve E defined on a finite field F p , and its equation expression form is: 2 y3 +ax+b(mod p) where p is a prime number, and a and b are in the finite field F. p The constants on, and a, b satisfy 4a 3 +27b 2 ≠0 (mod p). Choose a base point G, G = (G x G y ), where G x G y It is a finite field F p The elements of the generator G satisfy the elliptic curve equation: The TA selects SHA2 as the one-way hash function h(·) used by the system, and the TA publishes the parameters {E, h(·), p, G}.

[0076] In this system, the TA and each RSU are equipped with a hardware security module (HSM). An HSM is a dedicated hardware device used to protect and manage digital keys, perform encryption and decryption operations, and ensure data security. Each vehicle is also equipped with a trusted platform module (TPM). The TPM chip, either integrated into the motherboard or attached as a standalone module, provides hardware-based security features for the system.

[0077] Step Two: Vehicle Registration Stage

[0078] Vehicle and driver information is securely registered into the system to ensure the legitimacy of vehicle identity and privacy protection. During this stage, the vehicle generates a public-private key pair and registers its real identity with a Trusted Authorization Center (TA). After verification by the TA, a pseudo-identity is generated and securely transmitted to the vehicle. Through this registration process, the vehicle obtains a system-recognized identity and pseudo-identity, ensuring effective privacy protection in subsequent V2I authentication and communication, preventing identity leakage and tracking, and laying the foundation for secure communication with the RSU.

[0079] The flowchart for the vehicle registration process is attached. Figure 1 As shown.

[0080] During the vehicle registration phase, if it is the first time purchasing a vehicle, a registration application needs to be submitted to the car manufacturer. The salesperson will assist the buyer in completing the vehicle registration. When the ownership of the vehicle changes, the new owner needs to apply to the traffic management department for re-registration of the vehicle. When it is necessary to add or remove a driver, an application must also be submitted to the traffic management department. After the traffic management department sends a request to the TA and obtains approval, the staff will assist in completing the operation.

[0081] like Figure 5 As shown, Step 1: Vehiclei Select own real identity ID_Vehicle i , using random number generator to generate a random number ri, and through the private key to calculate the public key Pub_Vehicle i , ID_Vehicle i , ri, Pub_Vehicle i Send to TA through a secure channel.

[0082] Step 2: After receiving the message, TA first verifies the legitimacy of ID_Vehicle i , if satisfied, TA generates a random number rj, calculates R i = ri·G, R j = rj·G, generates the pseudo identity of the vehicle Calculate the verification message and the temporary key Finally, PID i , rj, Vt is sent to Vehicle i

[0083] Step 3:

[0084] After receiving the message from TA, Vehicle i calculates whether the received Vt is equal to the calculated Vt', if equal, the user inputs his own biological information BIO i-x on the vehicle, and generates where vx is the total number of challenges generated, at least 100 challenges can be generated according to the difference of the vehicle's own computing power, and then according to the vehicle's own PUF i (·) function to generate the corresponding vx Use the fuzzy extractor to process the vx respectively, get and P i vx . Use the fuzzy extractor to process the user's input biological information, get (F i-x , P BIOi-x ) = Gen(BIO i-x ), generate secret Calculate the verification message and calculate the temporary encryption key Use symmetric encryption, the key is RSec' to encrypt the data BIO i-x , P i vx , Sec, Encrypt to obtain MTi, then use ID_Vehicle i ,PID i ,P i vx , The Sec is stored in the vehicle's TPM. The PID is sent to the TA via a secure channel. i ,Vv,MTi.

[0085] Step 4: After receiving the message, TA calculates... Next, verify whether Vv and Vv' are equal. If they are equal, decrypt the message MTi using the key RSec. Then, use ID_Vehicle. i ,PID i ,P i vx , Sec, BIO i-x , Stored in TA's HSM.

[0086] Step 3: RSU Registration Phase

[0087] Securely registering Roadside Units (RSUs) into the system ensures their legitimacy and prepares them for secure communication with vehicles. In this phase, the RSU generates a unique identifier and registers with a Trusted Authorization Center (TA). After verification by the TA, relevant authentication information is generated and stored on the blockchain. Through this registration process, the RSU obtains a system-recognized identity, ensuring legitimacy and trustworthiness when communicating with vehicles. This provides security for subsequent V2I communication, prevents malicious RSU access, and enhances the overall security and reliability of the system. A flowchart of the RSU registration phase is attached. Figure 2 As shown.

[0088] During the RSU registration phase, the RSU manufacturer should submit an application to the transportation authority, and staff will assist with the RSU registration.

[0089] like Figure 6 As shown, Step 1: RSU j My identity ID_RSU j and random number r r Send it to TA via a secure channel.

[0090] Step 2: After receiving the message, the TA first checks the ID_RSU. j The uniqueness and validity of the result are verified, and a random number r is generated. t Challenge Cha j Then calculate the verification message. and temporary keys for symmetric encryption And use the temporary key TSec to check Cha j Encrypt to obtain MTj1. Then, use ID_RSU. j ,MTj1,r t Vtr is sent to RSU via a secure channel. j .

[0091] Step 3: RSU j Upon receiving the message, first check the ID_RSU sent by TA. j If it matches its own, calculate. Check if Vtr and Vtr' are equal; if they are equal, calculate the temporary key. Then, the message MTj1 is decrypted using the temporary key. The decrypted message Cha is then processed using its own PUF() function. j Processing yields Res j And use a fuzz extractor to obtain K. j and P RSUj Use the temporary key TSec' to access data P. RSUj Res j ,K j Perform symmetric encryption. Then, use ID_RSU. j MTj2 sends back to TA.

[0092] Step 4: After receiving the message, the TA decrypts MTj2 using the temporary key TSec. Then, the TA reads the Vehicle stored in the HSM. i Data PID i ,P i vx ,Sec, BIO i-x This data is then symmetrically encrypted using the key TSec to obtain MTj3. TA sends ID_RSU via a secure channel. j ,MTj3 to RSU j and the parameter ID_RSU j ,P RSUj ,(Cha j Res j ),K j Save it to HSM.

[0093] Step 5: RSU j Upon receiving the message, decrypt MTj3 using the temporary key TSec', and then retrieve the data PID. i ,Sec,P i vx , BIO i-xUploaded to the blockchain.

[0094] Step 4: V2I Initial Authentication Phase

[0095] After the vehicle starts up or has been inactive with the RSU for an extended period, the initial authentication and key exchange between the vehicle and the RSU are completed to ensure the security and validity of communication. In this phase, the vehicle and RSU authenticate each other using their respective pseudo-identities, negotiate and generate a shared session key, and update the vehicle's pseudo-identity. Through this authentication process, the vehicle and RSU establish a secure communication channel, ensuring the confidentiality and integrity of subsequent communications, preventing unauthorized devices from accessing the network, and laying a secure foundation for subsequent V2I communication. A flowchart of the V2I initial authentication phase is attached. Figure 3 As shown.

[0096] Whenever the vehicle starts up or has not maintained a connection with the RSU for more than 20 minutes, the InitialV2I authentication key exchange phase needs to be performed to complete the authentication between the vehicle and the RSU.

[0097] like Figure 7 As shown, Step 1: The user enters their biometric information (BIO). i-x ', Vehicle i Generate timestamp T1, select sequence number Seq, and select the corresponding [item name] based on that sequence number. and P i Seq .calculate Calculate verification message PID i ,S i No i ,V,T1 sent to RSU j .

[0098] Step 2: RSU j Received Vehicle i After receiving the message, first generate a timestamp T2, check if ||T2-T1||≤ΔT is true, and then use the PID. i Query its relevant information on the blockchain. Calculate. Check if Seq' is valid; if valid, find the corresponding Seq'. P i Seq' ,calculate (F i-x ”,P BIOi-x " ) =Gen(BIO) i-x ") and verification message Verify if V' = V is true, if true, calculate the verification message Val ij = h(PID i || P i Seq' PF i-x ' PSec || T2), and the session key Calculate a new identity Send the message ID_RSU j , T2, Val ij to Vehicle i . Update the pseudo-identity, and store the data PID i , Val ij , SKi j , BIO i-x , P i Seq' , S i , F i-x ', V, T1, T2 into the blockchain, and use replace the original PID i .

[0099] Step 3: After receiving the message, Vehicle i generates a timestamp T3 and verifies whether the freshness is met, if met, calculate Val ij ' = h(PID i || P i Seq PF i-x ' PSec || T2), check if Val ij ' is equal to Val ij , if equal, calculate the session key and use replace the original PID i .

[0100] Step 5: Fast switching authentication phase:

[0101] When the vehicle moves out of the current RSU's communication range and enters the range of the next RSU, quickly complete the authentication and key exchange with the new RSU to ensure the continuity and security of communication. In this phase, the vehicle and the new RSU verify each other's identity through the fast authentication mechanism and generate a new session key to ensure uninterrupted communication. Through this process, the vehicle can seamlessly switch to the new RSU during movement, maintain stable communication connection, avoid communication interruption or security vulnerabilities caused by switching, and thus improve the overall communication stability and security of the Internet of Vehicles system in dynamic environments. The flowchart of the fast switching authentication phase is as follows Figure 4as shown.

[0102] When Vehicle drives out of the communication range of the previous RSU and communicates with the current RSU, it is necessary to perform the fast handover authentication phase, which is to quickly complete the switching authentication with the target RSU when the vehicle is driving, and confirm the identity of each other.

[0103] As shown in Figure 8 Step 1: Vehicle i generates the current timestamp T4 and a random number R1 i , calculates and sends the PID i , R1 i , Vv i , T4 to RSU j .

[0104] Step 2: RSU j receives the message, generates a timestamp T5 and checks ||T5-T4||≤ΔT, and if it is true, calculates checks whether Vv i ' is equal to Vv i , if equal, generates a new random number R2 i , calculates the verification message sends the message ID_RSU j , Vr i , R2 i , T5 to Vehicle i , and saves the data PID i , SID, Vr i , T4, T5 to the blockchain.

[0105] Step 3: Vehicle i receives the message, generates a timestamp T6 and checks ||T6-T5||≤ΔT, and if it is true, calculates the verification message checks whether Vr i ' is equal to Vr i , if equal, completes the verification.

[0106] Lightweight authentication and key exchange protocol: the present application proposes a lightweight authentication and key exchange protocol for VANETs (vehicle ad hoc networks), which can still be efficiently run in a limited computing resource environment, and is particularly suitable for vehicle equipment and bandwidth limited communication environment. By optimizing the protocol design, the present application significantly reduces the computing and communication overhead.

[0107] Improved message integrity verification mechanism: In order to enhance the security of the system, the invention improves the switching authentication mechanism in V2I (vehicle-to-infrastructure) communication, ensuring that the integrity of all messages is fully verified during the communication process between the vehicle and the infrastructure, thereby improving the overall reliability and security of the system.

[0108] Resource optimization and utilization: The invention designs a lightweight security protocol based on blockchain, which optimizes the utilization of bandwidth and computing resources to ensure efficient and secure communication in resource-constrained environments. Especially in large-scale vehicle network environments, the design of the invention can effectively reduce the occupation of system resources and improve overall performance.

[0109] Enhanced security protection measures: In view of the security risks in the prior art, the invention designs a more secure protocol structure to enhance the system's ability to resist various network attacks (such as man-in-the-middle attacks, replay attacks, etc.), further protecting user privacy and the security of communication data.

Claims

1. A vehicle-to-everything (V2I) authentication key exchange protocol and its fast authentication switching method, characterized in that, Includes the following steps; Step 1: During the system initialization phase, the system selects and sets the elliptic curve parameters for authentication and encryption, and configures the Hardware Security Module (HSM) for each node and the Trusted Platform Module (TPM) for the vehicle. Step 2: Vehicle registration stage, used to securely register vehicle and driver information into the system. The vehicle registers its real identity with the Trusted Authorization Center (TA) by generating a unique public-private key pair. After verification, the TA generates a pseudo identity for the vehicle and sends it back to the vehicle through a secure channel. Step 3: RSU registration phase, used for registering and authenticating roadside units (RSUs). The RSU generates and registers its unique identity with the TA. After the TA verifies the identity, it generates the relevant authentication information of the RSU and stores it in the blockchain. Step 4: V2I Initial Authentication Phase, used to complete the initial authentication and key exchange between the vehicle and the RSU after the vehicle is started or the RSU connection is lost for a certain period of time; The vehicle and RSU authenticate each other based on their respective pseudo-identities and generate a shared session key through negotiation to update the vehicle's pseudo-identity; Step 5: The rapid handover authentication phase is used to quickly complete the handover authentication with the new RSU when the vehicle moves out of the communication range of the current RSU and into the range of the next RSU. Step one specifically involves: During the system initialization phase, TA selects an elliptic curve E defined over the finite field F. p The equation above is expressed in the following form: and 2 =x 3 +ax+b(modp) Where p is a prime number, and a and b are in the finite field F. p The constants on, and a, b satisfy 4a 3 +27b 2 ≠0 (mod p); Choose a base point G, G = (G x G y ), where G x G y It is a finite field F p The elements of the generator G satisfy the elliptic curve equation: The TA selects SHA2 as the one-way hash function h(·) used by the system, and the TA publishes the parameters {E, h(·), p, G}. Step two specifically involves: Step 1: Vehicle i Select your real identity ID_Vehicle i Use a random number generator to generate a random number ri, and use the private key Pri_Vehicle i To calculate the public key Pub_Vehicle i ID_Vehicle i ,ri,Pub_Vehicle i Send it to TA via a secure channel; Step 2: After receiving the message, the TA first verifies the ID_Vehicle. i If the validity of the condition is satisfied, then TA generates a random number rj and calculates R. i =ri·G,R j =rj·G, generates a pseudo-identity for the vehicle. Calculate verification message and temporary keys Finally, PID i ,rj,Vt is sent to Vehicle via a secure channel i ; Step 3: In Vehicle i Calculate after receiving a message from TA Verify that the received Vt is equal to the calculated Vt'. If they are equal, the user enters their biometric information (BIO) on the vehicle. i-x and generating challenges Where vx is the total number of challenges generated, based on the vehicle's PUF. i The (·) function generates vx corresponding responses. Use a fuzz extractor to process these vx items separately. Processing is performed to obtain and Use a fuzz extractor to process the user-input biometric information (BIO). i-x After processing, we obtain (F) i-x ,P BIOi-x = Gen(BIO) i-x Generate secret Calculate verification message And calculate the temporary encryption key Use symmetric encryption, with the key RSec' for the data. Encrypt to obtain MTi, then use ID_Vehicle i ,PID i , The Sec is stored in the vehicle's TPM and the PID is sent to the TA via a secure channel. i ,Vv,MTi; Step 4: After receiving the message, TA calculates... Then verify whether Vv and Vv' are equal. If they are equal, use the key RSec to decrypt the message MTi, and then... Sec, Stored in the TA's HSM; Step four specifically involves: Step 1: The user enters their biometric information (BIO). i-x ', Vehicle i Generate timestamp T1, select sequence number Seq, and select the corresponding [item name] based on that sequence number. and P i Seq Calculate (F) i-x' ,P BIOi-x') =Gen(BIO) i-x' ), Calculate verification message PID i ,S i No i ,V,T1 sent to RSU j ; Step 2: RSU j Received Vehicle i After receiving the message, first generate a timestamp T2, check if ||T2-T1||≤ΔT is true, and then use the PID. i Search for its relevant information on the blockchain; Among them ID_RSU j For RSU j His identity. calculate Check if Seq' is valid; if valid, find the corresponding Seq'. calculate (F i-x” ,P BIOi-x”) =Gen(BIO) i-x” and verification messages Verify whether V' = V is true; if true, calculate the verification message Val. ij =h(PID) i ||P i Seq' ||F i-x "||Sec||T2), and session key" Calculate new identity Send message ID_RSU j ,T2,Val ij To Vehicle i And update the fake identity, and transfer the data. PID i Val ij SK ij , S i ,F i-x ',V,T1,T2 are stored in the blockchain and used. Replace the original PID i ID_RSU j For RSU j identity; Step 3: Vehicle i Upon receiving the message, generate a timestamp T3 and verify if the freshness requirement is met. If it is met, calculate Val. ij =h(PID) i ||P i Seq ||F i-x '||Sec||T2), check Val ij 'Whether with Val ij If they are equal, then calculate the session key. as well as use Replace the original PID i .

2. The vehicle-to-everything (V2I) authentication key exchange protocol and its fast authentication switching method according to claim 1, characterized in that, Step three specifically involves: Step 1: RSU j My identity ID_RSU j and random number r r Send it to TA via a secure channel; Step 2: After receiving the message, the TA first checks the ID_RSU. j The uniqueness and validity of the result are verified, and a random number r is generated. t Challenge Cha j Then calculate the verification message. and temporary keys for symmetric encryption And use the temporary key TSec to check Cha j Encrypt to obtain MTj1, then set ID_RSU j ,MTj1,r t Vtr is sent to RSU via a secure channel. j ; Step 3; RSU j Upon receiving the message, first check the ID_RSU sent by TA. j If it matches its own, calculate. Check if Vtr and Vtr' are equal; if they are equal, calculate the temporary key. Then, the message MTj1 is decrypted using the temporary key, and the decrypted Cha is processed using its own PUF() function. j Processing yields Res j And use a fuzz extractor to obtain K. j and P RSUj Use temporary key TSec' to access data P RSUj Res j ,K j Perform symmetric encryption to obtain MTj2, then use ID_RSU j MTj2 sends back to TA; Step 4: After receiving the message, the TA decrypts MTj2 using the temporary key TSec, and then the TA reads the Vehicle stored in the HSM. i Data PID i ,P i vx ,Sec,K i vx BIO i-x The data is then symmetrically encrypted using the key TSec to obtain MTj3, and TA sends ID_RSU through a secure channel. j ,MTj3 to RSU j and the parameter ID_RSU j ,P RSUj ,(Cha j Res j ),K j Save it to HSM; Step 5: RSU j Upon receiving the message, decrypt MTj3 using the temporary key TSec', and then retrieve the data PID. i ,Sec, BIO i-x Uploaded to the blockchain.

3. The vehicle-to-everything (V2I) authentication key exchange protocol and its fast authentication switching method according to claim 2, characterized in that, Step five specifically involves: Step 1: Vehicle i Generate the current timestamp T4 and a random number R1. i ,calculate and PID i R1 i ,Vv i T4 sent to RSU j ; Step 2: RSU j Upon receiving the message, generate a timestamp T5 and check if ||T5-T4||≤ΔT. If true, calculate... Check Vv i 'with Vv i If they are equal, generate a new random number R2. i Calculate the verification message Send message ID_RSU j Vr i R2 i T5 to Vehicle i Then the data PID i ,SID,Vr i T4 and T5 are saved to the blockchain; Step 3: Vehicle i Upon receiving the message, generate a timestamp T6 and check if ||T6-T5||≤ΔT. If the condition is met, calculate the verification message. Test Vr i 'with Vr i Check if they are equal; if they are equal, the verification is complete.

Images