Blockchain-assisted multi-server authentication method and system based on quantum key

Abstract

The present invention relates to the field of vehicle networking communications, and discloses a blockchain-assisted multi-server authentication method and system based on quantum keys. The method includes: a vehicle completes mutual authentication with a cloud server in a quantum key distribution network through a blockchain, so that the vehicle obtains a quick authentication credential pre-negotiated by the quantum key distribution network; when the vehicle needs to authenticate with other cloud servers in the quantum key distribution network, the authentication is completed by verifying the consistency of the quick authentication credential. The vehicle and the cloud server of the present invention can obtain an anti-eavesdropping authentication credential for the first authentication, and the vehicle can quickly complete the authentication with other cloud server nodes through the credential. In the authentication stage, the vehicle and the cloud server directly perform information interaction for identity authentication based on the quantum key distribution network and blockchain assistance, avoiding the problem of failure of the vehicle networking system due to a single point failure. Not only does it make identity authentication more secure and reliable, but it also makes authentication faster and more efficient.

Description

Technical Field

[0001] The present invention relates to the field of vehicle networking communications, and specifically to a blockchain-assisted multi-server authentication method and system based on quantum keys. Background Art

[0002] The Internet of Vehicles (IoV) is a fusion of mobile networks and traditional IoT models. Through the IoV system, vehicles obtain a wide range of delay-sensitive and location-aware services through wireless communications, such as road traffic monitoring, emergency alerts, and cloud-assisted autonomous driving. The IoV wireless communication environment is open and vulnerable to attacks by adversaries. Malicious vehicles and attackers can eavesdrop on and track data broadcast by other vehicles, and obtain the driver's identity information, geographic location, etc. of the vehicle. Generally, conditional identity authentication mechanisms are considered to be effective measures to ensure the security of IoV data and anonymous vehicle identities. However, with the rapid expansion of vehicle services and applications, vehicles and servers will interact with a large amount of information, which poses challenges to the reliability and efficiency of authentication schemes.

[0003] The efficiency of current multi-server authentication schemes cannot meet the needs of computationally intensive and delay-sensitive cloud services. When vehicles travel at high speeds on intelligent traffic roads, the network connection between the vehicle and the cloud server will frequently connect and disconnect at different service providers. In this case, repeated identity authentication will also be performed between the vehicle and the cloud server. However, the existing Internet of Vehicles authentication schemes for multi-server scenarios are usually one-to-many independent authentications when dealing with the authentication of multiple vehicles and multiple servers. These schemes cannot meet the needs of vehicles requesting multiple urgent cloud services at the same time. Therefore, the problem of fast identity authentication between vehicles and multiple servers needs to be taken seriously, and the reliability and efficiency of authentication need to be improved. Summary of the invention

[0004] The technical problem to be solved by the present invention is to improve the reliability and efficiency of identity authentication between vehicles and multiple servers in the existing Internet of Vehicles.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] The present invention discloses a blockchain-assisted multi-server authentication method based on quantum key, comprising:

[0007] The vehicle completes mutual authentication through blockchain and a cloud server in the quantum key distribution network, so that the vehicle obtains the quick authentication credentials pre-negotiated by the quantum key distribution network.

[0008] When the vehicle needs to be authenticated with other cloud servers in the quantum key distribution network, the authentication is completed by verifying the consistency of the fast authentication credential.

[0009] As a further improvement of the above scheme, before the vehicle completes mutual authentication with a cloud server in the quantum key distribution network through the blockchain, the method also includes an initialization phase:

[0010] Quantum cryptography service platform initialization: Quantum cryptography service platform selects elliptic curve , generate your own public and private key pair , and choose three one-way hash functions , and , and then disclose the system parameters ; Among them, the elliptic curve satisfies , express right Take the remainder, is a prime number greater than 3, , represents a finite field; is the base point of the elliptic curve; .

[0011] Multiple cloud servers join the blockchain and initialize the defined smart contracts, thereby obtaining the authority to call the functions of the smart contracts; among them, the functions of the smart contracts include: quantum key information registration function, vehicle information registration and key activation function, public key acquisition function, quantum key information acquisition function, hardware unchangeable query function and malicious identity revocation function.

[0012] As a further improvement of the above solution, before the vehicle completes mutual authentication with a cloud server in the quantum key distribution network through the blockchain, the method also includes a quantum key pre-filling stage:

[0013] The vehicle selects its own unique hardware serial number for the quantum secure encryption chip As a physically unclonable function Input to generate the challenge information hardware status code and sent to the quantum key injection system; the quantum key injection system receives each vehicle’s After that, Corresponds to the quantum security encryption chip and injects key information After encryption, it is forwarded to the quantum cryptography service platform; To pre-fill quantum key files, multiple quantum keys composition, For each quantum key 1. .

[0014] The quantum cryptography service platform calls the quantum key information registration function of the smart contract. Write to the blockchain, and then send a confirmation result to the quantum key injection system to indicate that the injection key is written to the blockchain;

[0015] After receiving the confirmation result, the quantum key filling system will Written into the quantum secure encryption chip; among them, , The key block identifier.

[0016] As a further improvement of the above scheme, before the vehicle completes mutual authentication with a cloud server in the quantum key distribution network through the blockchain, the method also includes a registration phase:

[0017] The cloud server selects its own unique identity , and sent via a secure channel Go to the Quantum Cryptography Service Platform to request registration.

[0018] After receiving the registration request from the cloud server, the quantum cryptography service platform calculates the pseudonym of the cloud server , generate the private key of the cloud server And calculate the public key of the cloud server , then Write to the blockchain and calculate after writing ,Will It is sent to the cloud server through a secure channel to complete the registration of the cloud server; Indicates a connection symbol.

[0019] As a further improvement of the above solution, the registration stage further includes:

[0020] vehicle Extract its own unique identifier and challenge information hardware status code , and send a registration request To the quantum cryptography service platform;

[0021] The quantum cryptography service platform receives the vehicle After the registration request is received, the quantum key information registration function of the smart contract is called. As input to the function, query the blockchain to determine the vehicle Whether the quantum key has been charged, after the query is successful, the quantum cryptography service platform generates a vehicle The public and private key pair and Kana , and call the vehicle information registration and key activation functions of the smart contract to pseudonym , public key Write to the blockchain, thereby filling the corresponding key information stored in the blockchain Bind and then calculate ,Will Send to vehicle , thus completing the vehicle of which, Represents the public key set of all cloud servers.

[0022] As a further improvement of the above solution, the vehicle completes mutual authentication with a cloud server in the quantum key distribution network through the blockchain, so that the vehicle obtains the quick authentication credentials pre-negotiated by the quantum key distribution network, including:

[0023] vehicle Selecting quantum random numbers , and extract key information from its own quantum secure encryption chip , then select your own hardware security parameters and quantum random numbers Generates hardware security response parameters as input to a physical unclonable function , and call the hardware immutable query function of the smart contract Upload to the blockchain for storage, then calculate the message verification code , through the public channel to the cloud server Send Message ;

[0024] in, , , , , , , , For calculation The timestamp generated when

[0025] Cloud Server On receiving the message After verifying the message freshness, calculate the message verification code , and judge and Are they equal? ​​If they are equal, it means that the message integrity is qualified. Then the public key acquisition function and quantum key acquisition function of the smart contract are called to obtain the vehicle The public key and key information , then calculate and , and according to Calculate , call the hardware unchangeable query function according to Query hardware security response parameters from the blockchain , then calculate And judge and Are they equal? ​​If they are equal, it means that the vehicle's hardware identity is legal and the current hardware status is normal and has not been attacked by hardware forgery; then calculate the signature parameters and .

[0026] Cloud Server Judgement equation Is it true? If yes, then the cloud server Confirm vehicle The identity is legal, otherwise the current session is terminated; For cloud servers Calculate and , .

[0027] Cloud Server Generating quantum random numbers , query the blockchain to obtain new injection key information , then select the new key block ID , and from the pre-filled quantum key file Select quantum key information , calculate the temporary session key , and generate encrypted credentials ;in, Indicates the encryption algorithm using · as the key; A fast authentication credential pre-negotiated for the quantum key distribution network.

[0028] Cloud Server Generate message signature , generate a session key , then calculate the ciphertext and parameters , and calculate the message verification code , through public access to vehicles Send Message ;

[0029] in, , ; For calculation The timestamp generated when

[0030] vehicle On receiving the message After verifying the message freshness, calculate the message verification code , and judge and Are they equal? ​​If they are equal, calculate the preset quantum key information , and according to Extract the corresponding quantum key from the quantum secure encryption chip .

[0031] vehicle Judgement equation Is it true? If yes, then the vehicle Confirm the cloud server The identity is legal; among them, , , and Vehicles Calculated , , and .

[0032] vehicle Calculate temporary session key ,pass Encrypted Credentials Execute the symmetric decryption algorithm to obtain a fast authentication credential , and calculate the session key ; Then the vehicle Calculate the session key verification code , and send it to the cloud server Send Message ; For calculation The timestamp generated when

[0033] Cloud Server On receiving the message After verifying the message freshness, calculate the session key verification code , and judge and Are they equal? ​​If they are equal, then the vehicle and cloud servers The authentication and key agreement phases are completed.

[0034] As a further improvement of the above solution, when the vehicle needs to authenticate with other cloud servers in the quantum key distribution network, completing the authentication by verifying the consistency of the fast authentication credential includes:

[0035] When the vehicle Requires cloud server During certification, the vehicle Extract registration stage , calculate the authentication and key agreement code , and then send it to the cloud server Send Message ;in, For vehicles calculate The timestamp generated when

[0036] Cloud Server On receiving the message After verifying the message freshness, calculate the authentication and key agreement code , and judge and Are they equal? ​​If they are equal, query the vehicle hardware status code by calling the hardware immutable query function of the smart contract , then judge and Are they equal? ​​If they are equal, it means that the vehicle The identity is legal and the hardware status is normal, then generate the vehicle Session key for communication , then calculate the parameters , to the vehicle Send Message .

[0037] vehicle On receiving the message After verifying the message freshness, calculate the session key , then calculate the parameters ,judge and Are they equal? ​​If they are equal, then the vehicle and cloud servers The authentication and key agreement phases are completed.

[0038] As a further improvement of the above solution, the fast authentication credential is obtained by negotiation through the BB84 protocol by a quantum key distribution device, and the quantum key distribution device is provided with multiple quantum key distribution nodes corresponding to multiple cloud servers one by one.

[0039] As a further improvement to the above solution, both the vehicle and the cloud server generate timestamps when receiving messages sent by each other. , and calculate the timestamp The timestamp in the corresponding message The time difference between the two messages is less than the preset time length, indicating that the message freshness is qualified. The present invention also discloses a blockchain-assisted multi-server authentication system based on quantum key, which applies the blockchain-assisted multi-server authentication method based on quantum key as described above. The authentication system includes: blockchain, quantum cryptography service platform, cloud server and vehicle; wherein, there are several cloud servers, and all cloud servers together constitute a quantum key distribution network.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] 1. The blockchain-assisted multi-server authentication method based on quantum key disclosed in the present invention can obtain anti-eavesdropping authentication credentials through the blockchain and the cloud server in the quantum key distribution network for the first authentication. The vehicle can quickly complete the authentication with other cloud server nodes through the credentials. During the authentication stage, the vehicle and the cloud server directly exchange information for identity authentication based on the quantum key distribution network and blockchain assistance, avoiding the problem of failure of the Internet of Vehicles system due to single point failure. Not only does it make identity authentication more secure and reliable, but it also makes authentication faster and more efficient.

[0042] 2. The fast credential in the present invention is generated by all cloud server nodes through quantum key distribution equipment based on the BB84 protocol negotiation. This process has the characteristic of quantum unobservability. Therefore, the generation process of the credential cannot be eavesdropped and is unique. In addition, during the authentication process of the vehicle and the cloud server, not only the identity information is verified based on the lightweight signature algorithm, but also the hardware information needs to be verified based on the pre-filled quantum key, thereby achieving enhanced mutual authentication. Moreover, the authentication between the vehicle and the cloud server does not rely on a trusted third-party center. In the proposed architecture, the vehicle and the cloud server only need to register once with the quantum cryptography service platform. The quantum cryptography service platform only provides a trusted source of trust to ensure the registration phase of the vehicle and the cloud server.

[0043] 3. The present invention also designs a security-enhanced signature / verification algorithm based on elliptic curves and pre-set quantum keys. The algorithm generates a message signature by introducing the discrete logarithm problem of the elliptic curve and the identity information of the communication entity (vehicle or cloud server) to achieve the legitimacy of the identity. At the same time, the algorithm also introduces a pre-set quantum key as a hardware security parameter to ensure the hardware authentication security of the communication entity. This is because the pre-made quantum key is stored in a unique quantum security chip and cannot be forged by an illegal communication entity. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is an architecture diagram of a blockchain-assisted multi-server authentication system based on quantum keys in an embodiment of the present invention.

[0045] Figure 2 This is a flowchart of a blockchain-assisted multi-server authentication method based on quantum key in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] See also Figure 1 , this embodiment provides a blockchain-assisted multi-server authentication system based on quantum key, and the authentication system includes: blockchain, quantum cryptography service platform, cloud server and vehicle.

[0048] Among them, smart contracts are stored on the blockchain. Smart contracts are computer protocols stored on the blockchain. They are written in programming languages ​​(such as Solidity) and can automatically execute related operations when preset conditions are met without human intervention. Principle: The operation of smart contracts is based on the distributed ledger technology of blockchain, which realizes decentralized information verification and dissemination through point-to-point links. This kind of link is distributed and there is no centralization, which ensures the immutability and transparency of the contract content. Smart contracts write the contract content into the blockchain in a digital form. Each contract will be copied and stored in the distributed ledger, and all transaction information will not be destroyed or tampered with.

[0049] The quantum cryptography service platform is responsible for providing registration and quantum key negotiation for vehicles and cloud service providers in the system. It does not store any identity and key-related information. It is also responsible for managing the pre-set quantum keys and forming an extended QKD network between the vehicle and the cloud to achieve wireless quantum key distribution.

[0050] There are n cloud servers (CSP1, CSP2, ..., CSPn), and all cloud servers together form a quantum key distribution network (QKD network). The quantum key distribution device (QKD device) is equipped with n QKD nodes (i.e., QKD1, QKD2, ..., QKDn) corresponding to the n cloud servers. Among them, quantum key distribution is a technology that uses the principles of quantum mechanics to securely generate and share keys between communicating parties. This technology can ensure that the transmission process of the key is not stolen or tampered with by a third party, thereby providing unconditional security. QKD uses the uncertainty principle and measurement collapse in quantum mechanics to generate keys through the transmission and measurement of quantum states. The communicating parties send and receive quantum states (such as photons) and use the results of quantum measurements to negotiate a common key. If a third party attempts to eavesdrop or interfere with the communication process, it will cause disturbances to the quantum state, which will be detected by the communicating parties.

[0051] The TBOX on each vehicle is equipped with a quantum secure encryption chip (QSE). The quantum key injection system (QKC) is an independent hardware system, usually deployed in the vehicle production line. Among them, QSE is mainly used to store pre-injected quantum keys, and QKC is mainly used to inject quantum keys into the QSE chip integrated in the vehicle.

[0052] See also Figure 2 This embodiment also provides a blockchain-assisted multi-server authentication method based on quantum key, which can be applied to the above authentication system. The method can include five stages S1 to S5.

[0053] S1, initialization phase, which includes two sub-phases, namely S11~S12.

[0054] S11. Quantum cryptography service platform initialization: Quantum cryptography service platform selects elliptic curve , generate your own public and private key pair , and choose three one-way hash functions , and , and then disclose the system parameters ; Among them, the elliptic curve satisfies , express right Take the remainder, is a prime number greater than 3, , represents a finite field; is the base point of the elliptic curve; .

[0055] S12, blockchain initialization: multiple cloud servers join the blockchain and initialize the defined smart contracts, thereby obtaining the authority to call the smart contract functions. In the present invention, the cloud server and the quantum cryptography service platform are nodes on the blockchain and have the authority to call the smart contract. The functions of the smart contract designed by the present invention include: quantum key information registration function ( QKZC ), vehicle information registration and key activation function ( VKZC )、Public key acquisition function( PKHQ )、Quantum key information acquisition function( QKHQ ), hardware cannot be changed query function ( YJCX ) and malicious identity revocation capabilities ( SFCX ).

[0056] S2: Quantum key pre-filling phase, which includes S21~S23.

[0057] S21. The vehicle selects its own unique hardware serial number for the quantum security encryption chip As a physically unclonable function Input to generate the challenge information hardware status code , and sent to the quantum key filling system; the quantum key filling system receives each vehicle’s After that, Corresponds to the quantum security encryption chip and injects key information After encryption, it is forwarded to the quantum cryptography service platform; To pre-fill quantum key files, multiple quantum keys composition, For each quantum key 1. .

[0058] It should be noted that physical unclonable functions PUF It is an integrated circuit that relies on the inherent random physical factors introduced in the chip manufacturing process to generate a unique digital signature of the device. It has the characteristics of low power consumption, fast response, robustness, unpredictability, and tamper-proofing. It has become a new type of lightweight security primitive.

[0059] Challenge Information , corresponding information , PUF The challenge-response mechanism can be realized by using cryptographic technology. The formula is .

[0060] Physical unclonable functions have the following characteristics: ① Each PUF are unique and cannot be cloned. PUF Inputting two different stimuli will produce different responses. PUF Will get different responses. ③Any tampering PUF The behavior will lead to PUF invalid.

[0061] S22. The quantum cryptography service platform calls the quantum key information registration function of the smart contract. Write to the blockchain, and then send a confirmation result to the quantum key injection system to indicate that the injection key is written to the blockchain.

[0062] S23. After receiving the confirmation result, the quantum key filling system sends the quantum key information Written into the quantum secure encryption chip; among them, , The key block identifier.

[0063] S3: Registration phase, which includes the cloud server registration phase and the vehicle registration phase.

[0064] Among them, the registration stage of the cloud server includes S3A1~S3A2.

[0065] S3A1. The cloud server selects its own unique identity , and sent via a secure channel Go to the Quantum Cryptography Service Platform to request registration.

[0066] S2A2, after receiving the registration request from the cloud server, the quantum cryptography service platform calculates the pseudonym of the cloud server , generate the private key of the cloud server And calculate the public key of the cloud server , then Write to the blockchain and calculate after writing ,Will It is sent to the cloud server through a secure channel to complete the registration of the cloud server; Indicates a connection symbol.

[0067] Any vehicle For example, the vehicle registration stages include S3B1~S3B2.

[0068] S3B1, Vehicle Extract its own unique identifier and challenge information hardware status code , and send a registration request Go to the quantum cryptography service platform.

[0069] S3B2, quantum cryptography service platform receives the vehicle After the registration request is made, the smart contract quantum key information registration function ( QKZC ),Will As input to the function, query the blockchain to determine the vehicle Whether the quantum key has been charged, after the query is successful, the quantum cryptography service platform generates a vehicle The public and private key pair and Kana , and call the vehicle information registration and key activation functions of the smart contract to pseudonym , public key Write to the blockchain, thereby filling the corresponding key information stored in the blockchain Bind and then calculate ,Will Send to vehicle , thus completing the vehicle of which, Represents the public key set of all cloud servers.

[0070] S4, the first certification stage, which includes:

[0071] The vehicle completes mutual authentication through blockchain and a cloud server in the quantum key distribution network, so that the vehicle obtains the quick authentication credentials pre-negotiated by the quantum key distribution network.

[0072] Specifically, S4 may include S41~S49.

[0073] S41. To defend against replay attacks and hardware forgery attacks, the vehicle Selecting quantum random numbers , and extract key information from its own quantum secure encryption chip , then select your own hardware security parameters and quantum random numbers Generates hardware security response parameters as input to a physical unclonable function , and call the hardware unchangeable query function ( YJCX )Will Upload to the blockchain for storage, then calculate the message verification code , through the public channel to the cloud server Send Message ;

[0074] in, , , , , , , , For calculation The timestamp generated when

[0075] S42, Cloud Server On receiving the message Generate timestamp ,judge Is it less than the preset time? If so, it means the message is fresh enough, and then the message verification code is calculated. , and judge and Are they equal? ​​If they are equal, it means that the message integrity is qualified (the same applies to the message freshness and integrity test in the following text). Then call the public key acquisition function and quantum key acquisition function of the smart contract to obtain the vehicle The public key and key information , then calculate and , and according to Calculate , (the principle is Kid =(Ktag || KSN ),Depend on Kid i and KSN i Can be launched Ktag i , and then according to Ktag i from PQK Found QK i ), and then call the hardware unchangeable query function ( YJCX )according to Query hardware security response parameters from the blockchain , then calculate And judge and Are they equal? ​​If they are equal, it means that the vehicle's hardware identity is legal and the current hardware status is normal and has not been attacked by hardware forgery; then calculate the signature parameters and .

[0076] S43, Cloud Server Judgement equation Is it true? If yes, then the cloud server Confirm vehicle The identity is valid; otherwise, the current session is terminated. For cloud servers Calculate and , .

[0077] Specifically, Eq. The reasoning process is as follows:

[0078] If formula (1) satisfies:

[0079] ;

[0080] And formula (2) satisfies:

[0081] ;

[0082] When equation (1) is equal to equation (2), equation Established.

[0083] In order to realize the vehicle and cloud servers Mutual authentication, cloud server Need to send authentication request to the vehicle .

[0084] S44, Cloud Server Generating quantum random numbers , query the blockchain to obtain new injection key information , then select the new key block ID , and from the pre-filled quantum key file Select quantum key information , calculate the temporary session key , and generate encrypted credentials ;in, Indicates the encryption algorithm using · as the key; A fast authentication credential pre-negotiated for the quantum key distribution network.

[0085] In this embodiment, the fast authentication credentials can be obtained through the BB84 protocol negotiation of the quantum key distribution network composed of all cloud servers, and the negotiation process cannot be eavesdropped. In addition, It is based on enhanced authentication and encrypted transmission, and only vehicles with both legitimate identities and hardware can obtain it. Therefore, when the vehicle completes the first authentication and requests authentication of other cloud servers, the vehicle-cloud authentication can be completed by verifying the consistency of the session key parameters.

[0086] The BB84 protocol is a quantum key distribution protocol, and its workflow (a~f) is as follows:

[0087] a. The sender (Alice) randomly selects one of two polarization bases (such as horizontal / vertical or diagonal / anti-diagonal) to prepare the photon, and randomly selects 0 or 1 as the quantum state of the photon (such as horizontal polarization represents 0 and vertical polarization represents 1; or diagonal polarization represents 0 and anti-diagonal polarization represents 1).

[0088] b. Alice sends the prepared photons to the receiver (Bob).

[0089] c. Bob randomly chooses one of the two polarization bases to measure the received photon and records the measurement result.

[0090] d. Alice and Bob announce their respective polarization bases (but not their measurement results) through the classical channel, and then discard the measurement results whose polarization bases do not match.

[0091] e. Alice and Bob retain the measurement results of polarization basis matching as part of the key.

[0092] f. Finally, Alice and Bob can detect the presence of an eavesdropper by sacrificing a portion of the key (e.g., by comparing the parity of a portion of the key), and if an eavesdropper is detected, discard the entire key and start over.

[0093] S45, Cloud Server Generate message signature , generate a session key , then calculate the ciphertext and parameters , and calculate the message verification code , through public access to vehicles Send Message ;

[0094] in, , ; For calculation The timestamp generated when

[0095] S46, Vehicle On receiving the message Generate timestamp ,judge Is it less than the preset time? If so, calculate the message verification code. , and judge and Are they equal? ​​If they are equal, calculate the preset quantum key information , and according to Extract the corresponding quantum key from the quantum secure encryption chip .

[0096] S47, Vehicle Judgement equation The reasoning process of this equation is the same as that of equation (1) and equation (2). If it is true, then the vehicle Confirm the cloud server The identity is legal; among them, , , and Vehicles Calculated , , and .

[0097] S48, Vehicle Calculate temporary session key ,pass Encrypted Credentials Execute the symmetric decryption algorithm to obtain a fast authentication credential , and calculate the session key ; Then the vehicle Calculate the session key verification code , and send it to the cloud server Send Message ; For calculation The timestamp generated when

[0098] S49, Cloud Server On receiving the message Generate timestamp ,judge Is it less than the preset time? If so, calculate the session key verification code. , and judge and Are they equal? ​​If they are equal, then the vehicle and cloud servers The authentication and key agreement phases are completed.

[0099] S5, re-authentication phase, which includes:

[0100] When the vehicle needs to authenticate with other cloud servers in the quantum key distribution network, identity authentication is completed by verifying the consistency of the quick authentication credentials. At the same time, in order to ensure the legitimacy of the vehicle's hardware status, the corresponding parameters of the hardware's physical unclonability also need to be verified.

[0101] Specifically, S5 may include S51~S53.

[0102] S51, when the vehicle S52, Requires cloud server During certification, the vehicle Extract registration stage , calculate the authentication and key agreement code , and then send it to the cloud server Send Message ;in, For vehicles calculate The timestamp generated when

[0103] S52, Cloud Server On receiving the message Generate timestamp ,judge Is it less than the preset time? If so, calculate the authentication and key agreement code. , and judge and Are they equal? ​​If they are equal, the hardware immutable query function of the smart contract is called ( YJCX ) Query the vehicle hardware status code , then judge and Are they equal? ​​If they are equal, it means that the vehicle The identity is legal and the hardware status is normal, then generate the vehicle Session key for communication , then calculate the parameters , to the vehicle Send Message .

[0104] S53, Vehicle On receiving the message Generate timestamp , and judge Is it less than the preset duration? If so, calculate the session key. , then calculate the parameters ,judge and Are they equal? ​​If they are equal, then the vehicle and cloud servers The authentication and key agreement phases are completed.

[0105] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A blockchain-assisted multi-server authentication method based on quantum key, characterized in that: include: The vehicle completes mutual authentication with a cloud server in the quantum key distribution network through the blockchain, so that the vehicle obtains the fast authentication credentials pre-negotiated by the quantum key distribution network; When the vehicle needs to authenticate with other cloud servers in the quantum key distribution network, the authentication is completed by verifying the consistency of the fast authentication credential; Before the mutual authentication, the method further includes a quantum key pre-injection stage: The vehicle selects the unique hardware serial number HSN of its own quantum security encryption chip as the input of the physical unclonable function PUF(·), thereby generating the challenge information hardware status code RSN=PUF(HSN) and sending it to the quantum key injection system; after receiving the RSN of each vehicle, the quantum key injection system matches {PQK, Ktag} with the quantum security encryption chip, and encrypts the injection key information {RSN, QKInfo, Ktag} and forwards it to the quantum cryptography service platform; wherein PQK is a pre-injected quantum key file, which consists of multiple quantum keys QK, and Ktag is the identifier of each quantum key QK; h1 is a one-way hash function; The quantum cryptography service platform writes {RSN, QKInfo, Ktag} into the blockchain by calling the quantum key information registration function of the smart contract, and then sends a confirmation result indicating that the injected key is written into the blockchain to the quantum key injection system; After receiving the confirmation result, the quantum key filling system writes the quantum key information {PQK, Kid} into the quantum security encryption chip; wherein, KSN is the key block identifier.

2. The blockchain-assisted multi-server authentication method based on quantum key according to claim 1 is characterized in that: Before the vehicle completes mutual authentication through the blockchain and a cloud server in the quantum key distribution network, the method also includes an initialization phase: Quantum cryptography service platform initialization: Quantum cryptography service platform selects elliptic curve y 2 =x 3 +ax+bmodq, generate its own public and private key pair {PuK Q ,PrK Q }, and select three one-way hash functions h1, h2 and h3, and then disclose the system parameters Para = {P, q, h i',i'＝{1,2,3} ,PuK Q }; Among them, the elliptic curve satisfies 4a 3 +27b 2 ≠0, mod q represents y 2 =x 3 +ax+b modulo q, q is a prime number greater than 3, a,b∈F p , F p represents a finite field; P is the base point of the elliptic curve; PuK Q =P·PrK Q ; Multiple cloud servers join the blockchain and initialize the defined smart contracts, thereby obtaining the authority to call the functions of the smart contracts; among them, the functions of the smart contracts include: quantum key information registration function, vehicle information registration and key activation function, public key acquisition function, quantum key information acquisition function, hardware unchangeable query function and malicious identity revocation function.

3. The blockchain-assisted multi-server authentication method based on quantum key according to claim 2 is characterized in that: Before the vehicle completes mutual authentication through the blockchain and a cloud server in the quantum key distribution network, the method also includes a registration phase: The cloud server selects its own unique identity identifier CID and sends the CID to the quantum cryptography service platform through a secure channel to request registration; After receiving the registration request from the cloud server, the quantum cryptography service platform calculates the pseudonym of the cloud server Generate the private key PrK of the cloud server C And calculate the public key PuK of the cloud server C =PrK C ·P, then {TID,PuK C }Write to the blockchain and calculate SP after writing is completed C =[h1(PuK C ||TID)·PrK Q ]modq-PrK C , {Para,SP C ,TID,PrK C ,PuK C } is sent to the cloud server through a secure channel, thereby completing the registration of the cloud server; where || represents a connection symbol.

4. The blockchain-assisted multi-server authentication method based on quantum key according to claim 3 is characterized in that: The registration phase also includes: Vehicle V i Extract its own unique identity VID i and challenge information hardware status code RSN i =PUF(HSN i ) and send a registration request {VID i ,RSN i }To the quantum cryptography service platform; The quantum cryptography service platform receives the vehicle V i After the registration request is made, the RSN i As input to the function, query the blockchain to determine the vehicle V i Whether the quantum key has been charged, after the query is successful, the quantum cryptography service platform generates the public and private key pair {PuK Vi ,PrK Vi } and pseudonyms And call the vehicle information registration and key activation functions of the smart contract to i Pseudonymous PID i 、Public key PuK Vi Write to the blockchain, thereby binding with the corresponding injection key information {RSNi, QKInfoi, Ktagi} stored in the blockchain, and then calculate SP Vi =[h1(PuK Vi ||PID i )·PrK Q ]modq-PrK Vi ,Will Send to vehicle V i , thus completing the vehicle V i of which, Represents the public key set of all cloud servers.

5. The blockchain-assisted multi-server authentication method based on quantum key according to claim 4 is characterized in that: The vehicle completes mutual authentication through blockchain and a cloud server in the quantum key distribution network, so that the vehicle obtains the quick authentication credentials pre-negotiated by the quantum key distribution network, including: Vehicle V i Select the quantum random number QR Vi , and extract the key information {QK i ,Kid i }, then select your own hardware security parameter HS Vi and quantum random number QR Vi As input to the physical unclonable function, generate the hardware security response parameter RSH Vi =PUF(HS Vi ||QR Vi ) and call the hardware immutable query function of the smart contract to (PID i ,RSH Vi ) is uploaded to the blockchain for storage, and then the message verification code Mac1=h2(PID i ||QR Vi ||R Vi ||RH Vi ||λ Vi ||u Vi ||δ Vi ||t1), send message m to cloud server CSPj through the public channel A1 = {PIDi,QR V i,R V i,RH V i,λ V i,u V i,δ V i,Mac1,t1}; where R Vi =QK i ·P, RH Vi =RSH Vi ·P,δ V i=d V i+Mi·(QKi-RSH V i) modq, λ Vi =h2(QK i ||RSH Vi ), M i =h2(QK i ||PID i ||K i ), Ki=h1(PuK V i) PuK Q -PuK V i, t1 is the timestamp generated when Mac1 is calculated; Cloud Server CSP j Upon receiving the message A1 After verifying the message freshness, calculate the message verification code And judge Mac1 and Are they equal? ​​If they are equal, it means that the message integrity is qualified. Then the public key acquisition function and quantum key acquisition function of the smart contract are called to obtain the public key PuK of the vehicle Vi. V i and the key information {QKInfo i ,Ktag i }, then calculate and According to KSN i Calculate Call the hardware unchangeable query function according to PID i Query hardware security response parameters from the blockchain Then calculate And judge With λ Vi Are they equal? ​​If they are equal, it means that the vehicle's hardware identity is legal and the current hardware status is normal and has not been attacked by hardware forgery; then calculate the signature parameters and Cloud Server CSP j Judgement equation Is it true? If yes, then the cloud server CSP j Confirm vehicle V i The identity is legal, otherwise the current session is terminated; For cloud server CSP j Calculate and R Vi , Cloud Server CSP j Generate quantum random number QR Cj , query the blockchain to obtain the new injection key information {QKI j ,Ktag j }, then select the new key block identifier KSNj and select the quantum key information {QK j ,Kid j }, calculate the temporary session key And generate encrypted credentials Among them, E (·) Indicates the encryption algorithm using · as the key; SQK j a pre-negotiated rapid authentication credential for the quantum key distribution network; Cloud Server CSP j Generate message signature δ Cj =D Cj +N j ·QK j modq, generate session keys Then calculate the ciphertext and parameter R Cj =QK j P, and calculate the message verification code Mac2 = h2(QR Cj ||R Cj ||δ Cj ||u Cj ||t2), send message m to vehicle Vi through the public channel A2 = {QR Cj ,R Cj ,δ Cj ,u Cj ,Mac2,t2}; where N j =h2(QK j ||Kid j ||V j ), V j =h1(PuK Cj )·PuK Q -PuK Cj ; t2 is the timestamp generated when calculating Mac2; Vehicle V i Upon receiving the message A2 After verifying the message freshness, calculate the message verification code And judge Mac2 and Are they equal? ​​If they are equal, calculate the preset quantum key information And according to Extract the corresponding quantum key from the quantum secure encryption chip Vehicle V i Judgement equation Is it true? If yes, then vehicle V i Confirm the cloud server CSP j The identity is legal; among them, and Vehicle V i The calculated δ Cj 、V j 、N j and R Cj ; Vehicle V i Calculate temporary session key pass Encrypted certificate D Cj Execute the symmetric decryption algorithm to obtain a fast authentication credential And calculate the session key Then the vehicle V i Calculate the session key verification code And to the cloud server CSP j Send message A3 = {W i ,t3}; t3 is the calculation of W i The timestamp generated when Cloud Server CSP j Upon receiving the message A3 After verifying the message freshness, calculate the session key verification code W i * =h2(SK ij ||QR Cj ||QR Vi * ||t3), and judge W i and W i * Are they equal? ​​If they are equal, then the vehicle V i and cloud server CSP j The authentication and key agreement phases are completed.

6. The blockchain-assisted multi-server authentication method based on quantum key according to claim 5 is characterized in that: When the vehicle needs to authenticate with other cloud servers in the quantum key distribution network, completing the authentication by verifying the consistency of the fast authentication credential includes: When the vehicle V i Need to be compatible with cloud server CSP j+1 During authentication, the vehicle V i Extract the registration phase (HSN i ,RSN i ), calculate the authentication and key agreement code Then send the data to the cloud server CSP j+1 Send message A4 ={PID i ,HSN i ,X i ,t4}; where t4 is the vehicle V i Calculate X i The timestamp generated when Cloud Server CSP j+1 Upon receiving the message A4 After verifying the message freshness, calculate the authentication and key agreement code And judge X i and Are they equal? ​​If they are equal, query the vehicle hardware status code by calling the hardware immutable query function of the smart contract Then determine RSN i and Are they equal? ​​If they are equal, it means that the vehicle V i The identity is legitimate and the hardware status is normal, then generate the same as the vehicle V i Session key for communication Then calculate the parameters Towards vehicle V i Send message A5 = {Y j+1 ||t5}; Vehicle V i Upon receiving the message A5 After verifying the message freshness, calculate the session key Then calculate the parameters Judge Y j+1 and Are they equal? ​​If they are equal, then the vehicle V i and cloud server CSP j+1 The authentication and key agreement phases are completed.

7. The blockchain-assisted multi-server authentication method based on quantum key according to any one of claims 1 to 6, characterized in that: The fast authentication credential is obtained by negotiation through the BB84 protocol by a quantum key distribution device, and a plurality of quantum key distribution nodes corresponding to a plurality of cloud servers are provided in the quantum key distribution device.

8. The blockchain-assisted multi-server authentication method based on quantum key according to claim 7 is characterized in that: When the vehicle and the cloud server receive messages sent by each other, they both generate a timestamp t' and calculate the time difference between the timestamp t' and the timestamp t in the corresponding message. If the time difference is less than the preset duration, it indicates that the message freshness is qualified.

9. Blockchain-assisted multi-server authentication system based on quantum key, characterized in that: The blockchain-assisted multi-server authentication method based on quantum key as described in claim 8 is applied, and the authentication system includes: a blockchain, a quantum cryptography service platform, a cloud server and a vehicle; wherein, there are several cloud servers, and all cloud servers together constitute a quantum key distribution network.

Images