Safe, efficient and lightweight certificateless signature scheme for ADS-B (Automatic Dependent Surveillance-Broadcast) system

Abstract

The invention discloses a safe, efficient and light certificateless signature scheme for an ADS-B (Automatic Dependent Surveillance-Broadcast) system. The scheme comprises the following steps: generating system parameters through a KGC (Key Generation Center) and issuing the system parameters to the ADS-B system; the key generation center KGC obtains the real identity information of the signer and generates and returns a part of private keys; the signer calculates a complete private key of the signer based on the partial private key and the selected secret value, derives a public key based on the complete private key and publishes the public key to the ADS-B system for publication; and the signer signs the message information and then broadcasts the message information outwards. Specific signature position design is given according to message field conditions, complex certificate management is not needed, the KGC is only responsible for generating a part of private keys to avoid the key escrow problem, flexibility and expandability are achieved in the aspect of large-scale deployment, and compared with a common bilinear scheme, the scheme is low in calculation complexity and supports batch verification, and the method is suitable for popularization and application. The system authentication efficiency is improved, and the method is suitable for an aeronautical communication environment with limited resources.

Description

Technical Field

[0001] The present invention belongs to the technical field of aviation electronic communication security, and in particular relates to a safe, efficient and lightweight certificateless signature scheme for an ADS-B system. Background Art

[0002] The ADS-B (Automatic Dependent Surveillance-Broadcast) system is a secure transmission authentication technology. This technology is mainly used in the fields of civil and military aviation to improve the real-time monitoring of aircraft and air traffic management, to achieve the integrity and authenticity of ADS-B message data, and to ensure flight safety.

[0003] Although the ADS-B system has significant advantages in improving air traffic management efficiency and flight safety, it faces serious problems in terms of security. The ADS-B system broadcasts plain text information through open channels and lacks any authentication measures, which makes the messages vulnerable to a variety of attacks, including signal spoofing, message modification and replay attacks. Due to the lack of authentication of ADS-B messages, attackers can mislead air traffic controllers and pilots by forging or tampering with messages, leading to potential safety hazards. In order to protect the integrity and authenticity of ADS-B messages, security authentication is required. By introducing an authentication mechanism, the credibility of the source and content of the broadcast message can be ensured, and the message can be prevented from being tampered with or replayed during transmission, thereby improving the security and reliability of the entire air traffic management system.

[0004] Traditional authentication methods are generally based on public key infrastructure (PKI) and symmetric keys. PKI verifies the source and content of messages through digital certificates and relies on complex certificate management and key infrastructure. PKI requires a centralized certificate authority (CA) to manage and issue certificates, and needs to maintain a complex system of public and private key pairs. These processes increase the complexity of the system and management costs. In addition, the life cycle management of certificates (including issuance, renewal and revocation) also requires additional communication and computing resources to maintain the security and reliability of the system, further increasing the burden and operating costs of the system. In the ADS-B system with limited computing and storage resources, these processes are difficult to run efficiently. Another authentication method is based on symmetric keys. MAC is one of the most commonly used technologies. It verifies the integrity and authenticity of messages by generating message digests using shared secret keys. Although the calculation is relatively simple and does not require certificate management, it is suitable for some resource-constrained environments. However, in situations where high-frequency message exchange and authentication are required, especially large-scale user deployment, key distribution and management is an important bottleneck and has poor scalability. Symmetric key methods also face the risk of key leakage and replay attacks, which limits their application in ADS-B systems.

[0005] In addition to these traditional methods, identity-based authentication (IBS) is also an option. IBS simplifies certificate management by using the user's unique identity to generate a public-private key pair. The distribution of private keys is performed by a centralized key generation center (KGC), which means that the system is at risk of single point failure. Once the KGC is compromised, the security of the entire system will be threatened. At the same time, constructing and processing identity-based authentication schemes requires a lot of complex calculations, which increases the burden on the system. Authentication methods based on certificateless signatures (CLS) have also received attention in recent years. These methods do not require complex certificate management and are suitable for resource-constrained environments. However, most of the current CLS schemes are based on bilinear mapping or hash-to-point construction, with high computational complexity, which limits their practical application in resource-constrained ADS-B systems. Summary of the invention

[0006] In view of this, the present invention proposes a secure and lightweight ECC-based certificateless signature scheme (ECB-CLS) for the ADS-B system, and provides a specific signature location design based on the actual message field situation. This scheme does not require complex certificate management, and KGC is only responsible for generating a part of the private key, thereby avoiding the key escrow problem and having better flexibility and scalability in large-scale deployment. Compared with the general bilinear scheme, this scheme has low computational complexity and supports batch verification, which greatly improves the system authentication efficiency and is particularly suitable for resource-constrained aviation communication environments.

[0007] In order to achieve the above object, the present invention provides the following technical solutions:

[0008] The present invention provides a secure, efficient and lightweight ADS-B system certificateless signature scheme, comprising:

[0009] Step S1, generate system parameters in advance through the key generation center KGC and publish them to the ADS-B system;

[0010] Step S2: The key generation center KGC obtains the real identity information of the signer and generates a partial private key and returns it;

[0011] Step S3: The signer calculates his / her complete private key based on the partial private key and the selected secret value, derives the public key based on the complete private key and publishes it to the ADS-B system for public disclosure;

[0012] Step S4: The signer signs the message using his or her complete private key and then broadcasts it to the outside.

[0013] Preferably, step S1 includes the following operations:

[0014] The key generation center KGC selects a security constant k and a preset prime number q so that 2 k <q<2 (k+1) ;

[0015] Configure elliptic curve group G q , whose order is q, select the generator P. Configure the finite field F p , select a large prime number p that meets the preset security standards as the modulus of the finite field;

[0016] The first random number a and the second random number b are selected by the key generation center KGC, where And calculate the public parameter P pub = {P pub1 ,P pub2}={aP,bP}, where represents the multiplication group modulo p, P pub1 Represents the first public parameter, P pub2 represents the second public parameter;

[0017] Define the first hash function Define the second hash function

[0018] The key generation center KGC generates complete system parameters params = {G q ,q,p,P,P pub ,H1,H2} and published to the ADS-B system.

[0019] Preferably, step S2 comprises:

[0020] The key generation center KGC obtains the real identity information ID transmitted by the signer through a secure channel S ∈{0, 1} * ;

[0021] The key generation center KGC selects the third random number And perform the following calculations:

[0022] R S =uP

[0023] v=H1(ID S ,P)

[0024] k=(b / u+av / u)modp

[0025] Among them, R S represents the first private key parameter, v represents the intermediate parameter, k represents the second private key parameter, H1() represents the calculation process of the first hash function, and mod represents the modulus operation;

[0026] The key generation center KGC sets the signer's partial private key to D S =(k,R S ) and sends this part of the private key to the signer aircraft.

[0027] Preferably, step S3 comprises:

[0028] After receiving the partial private key, the signer verifies the legitimacy of the partial private key through the following verification formula:

[0029]

[0030] When the verification formula is established, it is determined that some private keys are legitimate;

[0031] The signer chooses a secret value x S ,in

[0032] The signer calculates Q S =x S R S , where Q S The public key parameters are part of the signer's public key;

[0033] The signer generates the public key PK S =(R S ,Q S ) and published to the ADS-B system for public disclosure.

[0034] Preferably, step S4 comprises:

[0035] The signer broadcasts the message information m S ∈{0, 1} * Do the following:

[0036] For message information m S , the signer first generates the current timestamp T S ;

[0037] The signer calculates the signature parameter w = H2(m S ||ID S ||T S ,R S ,P);

[0038] The signer calculates the signature α = x S (wx S +k) ―1 mod p;

[0039] The signer signs the information {α,T S} is inserted into the ME and PI fields of the ADS-B message information, and then the message is broadcast.

[0040] Preferably, the end receiving the broadcast message is determined to be a verifier, and the verifier performs the following operations upon receiving the broadcast message:

[0041] The verifier first parses the broadcast message to obtain the signer's signature α and timestamp T S , identity information ID S And message information m S ;

[0042] Validators verify the following items:

[0043] Verify timestamp T S Is it valid and not reused?

[0044] Calculate v = H1 (ID S ,P),w=H2(m S ||ID S ||T S ,R S ,P);

[0045] Using public key Q S and the public parameters in the ADS-B system, calculate the verification parameters

[0046] Inspection and judgment Is it established:

[0047]

[0048] If the equation holds true, the signature verification passes and the verifier receives the message information. Otherwise, the signature verification fails and the verifier refuses to receive the message information.

[0049] Preferably, when the verifier receives multiple message information group sets at the same time, a batch verification operation is entered, including:

[0050] Determine the set of message information received by the verifier at the same time in, represents the i-th message information, and n represents the total number of message information in the message information set;

[0051] The verifier verifies the timestamp set of all message information in the message information set Is it valid? If all are valid, continue with batch verification, where: Indicates the signature timestamp of the i-th message information;

[0052] Verifier verification message information collection The validity of all signatures in the message information set is determined by judging the following batch verification formula:

[0053]

[0054] In the formula, α i Represents the signature of the i-th message information, Indicates the verification parameters of the i-th message information, represents the secret value of the i-th message information, w i Indicates the signature parameter of the i-th message information, k i Represents the second private key parameter of the i-th message information, Represents the public key of the i-th message information, v i Indicates the intermediate parameter of the i-th message information, u i The third random number representing the i-th message information, Indicates the first private key parameter of the i-th message information.

[0055] The present invention has achieved at least the following beneficial effects:

[0056] 1. No need for certificate management: Traditional security solutions rely on complex certificate management systems to implement authentication, which not only increases the burden on the system, but also brings management challenges, especially in terms of certificate renewal and revocation. The present invention completely eliminates the reliance on certificates through a certificateless signing mechanism, thereby simplifying the system architecture and reducing the maintenance burden.

[0057] 2. Optimize resource consumption: Compared with general signature schemes, the ECB-CLS algorithm proposed in this invention does not require complex bilinear mapping and hash-to-point operations, which greatly simplifies the signature algorithm implementation process, significantly reduces computational overhead, and saves computing resource requirements. This makes this scheme very suitable for running on resource-constrained ADS-B system equipment and improves system reliability.

[0058] 3. Efficient authentication: The proposed scheme supports batch verification. By verifying a batch of message signatures at a time, it can effectively reduce the computational complexity of verifying a message signature individually each time, thereby greatly improving the overall verification efficiency of the system.

[0059] 4. Security proof: The present invention has proved the security of adaptive chosen message attacks against type I and type II adversaries under the random oracle model (ROM), and given a specific cracking probability. The proposed scheme can resist a variety of attacks, including deception, tampering, replay attacks, etc., and achieves forward and backward security.

[0060] Other advantages, objectives and features of the present invention will be described in the following description and will be apparent to those skilled in the art to some extent, or those skilled in the art may be taught from the practice of the present invention. The objectives and other advantages of the present invention may be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to make the purpose, technical solution and beneficial effects of the present invention clearer, the present invention provides the following drawings for illustration:

[0062] Figure 1 This is the overall framework diagram of the ECB-CLS verification of the ADS-B system in the embodiment of the present invention;

[0063] Figure 2 1 is an authentication flow chart of the certificateless signature scheme of the ADS-B system in an embodiment of the present invention. DETAILED DESCRIPTION

[0064] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0065] The present invention provides a secure, efficient and lightweight ADS-B system certificateless signature scheme, referring to Figure 1 to Figure 2 ,include:

[0066] Step S1, generate system parameters in advance through the key generation center KGC and publish them to the ADS-B system;

[0067] Step S2: The key generation center KGC obtains the real identity information of the signer and generates a partial private key and returns it;

[0068] Step S3: The signer calculates his / her complete private key based on the partial private key and the selected secret value, derives the public key based on the complete private key and publishes it to the ADS-B system for public disclosure;

[0069] Step S4: The signer signs the message using his or her complete private key and then broadcasts it to the outside.

[0070] The working principle and beneficial effects of the above technical solution are as follows: According to the actual message field situation, a specific signature position design is given. This solution does not require complex certificate management, and KGC is only responsible for generating a part of the private key, thereby avoiding the key escrow problem and having better flexibility and scalability in large-scale deployment. Compared with the general bilinear solution, this solution has low computational complexity and is suitable for resource-constrained aviation communication environments.

[0071] In a specific embodiment, referring to Figure 1 to Figure 2 , ECB-CLS (certificateless signature) algorithm scheme includes:

[0072] (1) System parameter settings:

[0073] KGC plays a key role in establishing the ECB-CLS scheme by generating key system parameters and publishing them to the ADS-B system. This involves selecting appropriate security parameters, including prime numbers, and configuring the elliptic curve group Gq with prime order q and generator P. These parameters are critical to ensuring the security strength of the system. The detailed setup process is as follows:

[0074] 1. The key generation center KGC selects a security constant k and a sufficiently large prime number q so that 2 k <q<2 k+1 .

[0075] 2. Configure the elliptic curve group G q , whose order is q, select the generator P. Configure the finite field F p , select a large prime number p that meets the security criteria as the modulus of the finite field.

[0076] 3.KGC selects random numbers And calculate the public parameter P pub = {P pub1 ,P pub2}={aP,bP}.

[0077] 4. Define the hash function,

[0078] 5. KGC completes the system parameters params = {G q ,q,p,P,P pub ,H1,H2} are published to the ADS-B system.

[0079] (2) Partial private key settings:

[0080] In the ECB-CLS scheme of the ADS-B system, the aircraft, as the signer S, needs to provide its real identity information ID S ∈{0, 1} * Submit securely to KGC to ensure the uniqueness of the signer's identity.

[0081] The signatory aircraft S sends its real identity information ID through a secure channel S Transmit to KGC, when KGC receives the real ID of aircraft S S , KGC selects a random number calculate

[0082] R S =uP

[0083] v=H1(ID S ,P),k=(b / u+av / u)mod p.

[0084] KGC sets part of the private key to D S =(k,R S ) and securely sends this part of the private key to the signer aircraft S.

[0085] Signer Aircraft S receives partial private key D S After that, you can check kR S =P pub1v +P pub2 To verify the legitimacy of some private keys:

[0086] prove:

[0087]

[0088] (3) Public key settings:

[0089] The signer aircraft S needs to establish its own public key to facilitate the security of ADS-B message authentication. This process includes the selection of secret values ​​and the calculation of the corresponding public key components.

[0090] The signer S randomly selects a secret value x S ,

[0091] Signer Aircraft S Calculation Q S =x S R S , here Q S As part of the signer's S public key.

[0092] The public key of the signer aircraft S is PK S =(R S ,Q S ).

[0093] (4) Signature without certificate:

[0094] When aircraft S in the ADS-B system broadcasts message information to the outside, S ∈{0, 1} * , a signature needs to be generated for the message.

[0095] For message m S , the signer plane S first generates the current timestamp T S .

[0096] The signatory aircraft S calculates w = H2 (m S ||ID S ||T S ,R S ,P).

[0097] Signer aircraft S calculates signature α=x S (wx S+k) ―1 mod p.

[0098] The signer plane S will sign the information {α,T S} is embedded into the ME field and PI field of the ADS-B message, and then the message is broadcast.

[0099] (5) Signature verification process:

[0100] When other aircraft or ground stations receive the message m from aircraft S S When verifying the validity of the timestamp, you first need to determine the validity of the timestamp and then verify the legitimacy of the signature. The specific process is as follows.

[0101] Receive message m S The other aircraft or ground station is the verifier V. The verifier V first parses the message to obtain the signature α of the signer aircraft S and the timestamp T S , identity information ID S And the message m S .

[0102] Verifier V confirms timestamp T S Valid and not reused.

[0103] Verifier V calculates v = H1 (ID S ,P),w=H2(m S ||ID S ||T S ,R S ,P).

[0104] Verifier V uses public key Q S and other public parameters, calculate

[0105] Finally, the verifier V checks the judgment If they are equal, the signature verification passes and the verifier V receives the message. Otherwise, the signature verification fails and the verifier V refuses to receive the message.

[0106] prove:

[0107]

[0108] Furthermore, a batch verification solution is provided:

[0109] In the ECB-CLS scheme of the ADS-B system, the verifier V receives a set of message messages from different signatory aircraft S at the same time. By verifying a batch of message signatures at a time, the verifier V can effectively reduce the computational complexity of verifying a message signature individually each time, thereby improving the verification efficiency. The specific batch verification process is as follows:

[0110] 1. Verifier V first checks the timestamp set of a batch of messages Is it valid? Ensure that each message Generated or received within the expected time period, with special attention to the real-time and accuracy of aircraft position information, to prevent replay attacks or use of expired messages for verification. If the timestamp set T is within the validity period, batch signature verification is continued.

[0111] 2. Verifier V then verifies a batch of message signatures The validity of a batch of message signatures is determined by judging the following batch verification formula.

[0112]

[0113] prove:

[0114]

[0115] Through the above technical content, the beneficial effects achieved by the present invention are as follows: the present invention proposes a new and efficient certificateless signature scheme based on elliptic curves (ECB-CLS), which can ensure the secure transmission and authentication of message data between users of the ADS-B system and prevent illegal users from participating in malicious activities. The scheme of the present invention meets the needs of the actual system and is specially designed to solve the shortcomings of ADS-B message data being limited to existing formats and existing security frameworks, and has the following innovations and expected effects:

[0116] 1) No need for certificate management: Traditional security solutions rely on complex certificate management systems to implement authentication, which not only increases the burden on the system, but also brings management challenges, especially in terms of certificate renewal and revocation. The present invention completely eliminates the reliance on certificates through a certificateless signing mechanism, thereby simplifying the system architecture and reducing the maintenance burden.

[0117] 2) Optimize resource consumption: Compared with general signature schemes, the ECB-CLS algorithm proposed in this invention does not require complex bilinear mapping and hash-to-point operations, which greatly simplifies the signature algorithm implementation process, significantly reduces computational overhead, and saves computing resource requirements. This makes this scheme very suitable for running on resource-constrained ADS-B system equipment and improves system reliability.

[0118] 3) Efficient authentication: The proposed scheme supports batch verification. By verifying a batch of message signatures at a time, it can effectively reduce the computational complexity of verifying a single message signature each time, thereby greatly improving the overall verification efficiency of the system.

[0119] 4) Security proof: The present invention has proved the security of adaptive chosen message attacks against type I and type II adversaries under the random oracle model (ROM), and given the specific cracking probability. The proposed scheme can resist a variety of attacks, including deception, tampering, replay attacks, etc., and achieves forward and backward security.

[0120] To verify the effectiveness of the present invention, the following ECB-CLS algorithm security proof is provided:

[0121] Theorem 1: Under the elliptic curve discrete logarithm security assumption (ECDLP), the proposed ECB-CLS scheme is existential and unforgeable against type I attacker A1 to prevent adaptive chosen message attacks.

[0122] Lemma 1: If there is a type I adversary A1 in the random oracle model, he can perform at most n PPK Second part of the private key extraction query, n PK Public key extraction query, hash queries and n S If a valid signature is forged after the second signature query, then ECDLP is solvable.

[0123] Proof: Challenger C first interacts with adversary A1 to generate an instance of the ECDLP problem, given P, Q = sP, where P∈G q The goal of adversary A1 is to find s.

[0124] System parameter setting phase: Challenger C selects a, b and calculates P pub1 =aP,P pub2 = bP, and then the system parameters {G q ,q,p,P,P pub ,H1,H2} is sent to A1, and C randomly selects ID * As the challenger of the game, let s = x i u i , Calculate Q i =x i u i P=sP is the public key part of the challenger, which is used to demonstrate the ECDLP problem in the proof. Adversary A1 makes the following query.

[0125] Query phase: Adversary A1 adaptively performs the following polynomially bounded oracle queries.

[0126] H1 query: When A1 is (ID i,P) to query this oracle, C through the list L1 = (ID i ,P,d i ) records the questions and answers between A1 and C. If C finds the corresponding (ID i ,P,d i ), C will d i Return to A1, otherwise C randomly selects Send it to A1, and then (ID i ,P,d i ) is added to the list L1.

[0127] H2 asks: When A1 is (m i ,ID i ,T i ,R i ,P) to query this oracle, C through the list L2 = (m i ,ID i ,T i ,R i ,P,e i ) records the questions and answers between A1 and C. Here, it is assumed that A1 has performed a partial private key extraction query and obtained R i , so if C finds the corresponding (m i ,ID i ,T i ,R i ,P,e i ), C will e i Return to A1, otherwise C randomly selects Send it to A1, and then (m i ,ID i ,T i ,R i ,P,e i ) is added to list L2.

[0128] Partial private key extraction query: When A1 with ID i When asking this oracle, C uses the list L PPK =(ID i ,u i ,v i ,k i ,R i ,f i ) records the questions and answers between A1 and C. If C is in L PPK The corresponding (ID i ,u i ,v i ,k i ,R i ,fi ), C will f i Return to A1, otherwise, if ID i ≠ID * , C randomly selects u i , calculate v i =H1(ID i ,P),k i =(b / u i +ah / u i )mod p),R i =u i P, f i Send to A1 and (ID i ,u i ,v i ,k i ,R i ,f i ) is added to the list L PPK middle

[0129] Public key extraction query: When A1 uses ID i When asking this oracle, C uses the list L PK =(ID i ,x i ,R i ,Q i ,g i ) records the questions and answers between A1 and C. If C is in L PK The corresponding (ID i ,x i ,R i ,Q i ,g i ),C will g i Return to A1, otherwise, if ID i ≠ID * , C randomly selected Calculate Q i =x i R i , g i Send to A1 and (ID i ,x i ,R i ,Q i ,g i ) is added to the list L PK middle.

[0130] Secret value extraction query: When A1 with ID i When querying this oracle, if ID i =ID * , C gives up and terminates the operation, otherwise C searches the list LPK , if a record exists (ID i ,x i ,R i ,Q i ,g i ), C returns x i For A1, if it does not exist, C executes the public key extraction query to generate a tuple (ID i ,x i ,R i ,Q i ,g i ), returns x i to A1, and (ID i ,x i ,R i ,Q i ,g i ) is added to the list L PK middle.

[0131] Public key replacement query: When A1 (ID i ,g′ i ) to query this oracle, C first obtains PK Find the corresponding record (ID i ,x i ,R i ,Q i ,g i ), if it does not exist, then i Perform secret value extraction query and public key extraction query, and use g i Replace with g′ freely chosen from A1 i , and let x i =⊥,R i =⊥,Q i =⊥.

[0132] Signature inquiry: A1 (ID i ,m i ,T i ) to query this oracle, C selects from the lists L1, L2, L PPK ,L PK Restore H1(ID i ,P),H2(m i ||ID i ||T i ,R i ,P),k i ,R i ,x i If ID i ≠ID * , then C outputs message m i The corresponding signature α i , and αi Send to A1, otherwise ID i =ID * , C simulates the calculation message m i A signature of α i =x i (w i x i +k i ) ―1 mod q, here w i =H2(m i ||ID i ||T i ,R i ,P), C will α i Return to A1.

[0133] Signature forgery: Finally, A1 outputs a forged signature. i ≠ID * , C stops the simulation, otherwise ID i =ID * , C finds the corresponding signature information (m i ,ID i ,T i ,α i ). If the opponent A1 wins the game, then: x i (w i x i +k i ) ―1 mod q×(w i x i u i P+P pub2 +vP pub1 )=x i u i P. Use the fork lemma to get another valid signature in polynomial time And both signatures must satisfy Q i =sP, where s = x i u i , so there are two linearly independent equations:

[0134] Challenger C solves the two equations and outputs s as the solution to the ECDLP problem.

[0135] Cracking probability analysis:

[0136] If adversary A1 successfully forges signature α * , define the following events:

[0137] θ1: Challenger C allows adversary A1 to complete all types of queries without restricting or blocking any query type.

[0138] θ2: The adversary successfully forged a message m with ID * Signature α * ;

[0139] θ3: The forged signature satisfies ID=ID * ;

[0140] The probability that A1 successfully forges a signature is as follows:

[0141]

[0142] Pr(θ2|θ1)≥ε

[0143]

[0144] Theorem 2: Under the premise of elliptic curve discrete logarithm security assumption (ECDLP), the proposed scheme is existential and unforgeable against type II attacker A2 to prevent adaptive chosen message attack.

[0145] Lemma 2: If there is a type II adversary A2 in the random oracle model, he can perform at most n PPK Second part of the private key extraction query, n PK Public key query, hash queries and n S If a valid signature is forged after the second signature query, then ECDLP is solvable.

[0146] Proof: Challenger C first interacts with adversary A2 to generate an instance of the ECDLP problem, given P, Q = sP, where P∈G q The goal of adversary A2 is to find s.

[0147] System parameter setting phase: Challenger C selects a, b and calculates P pub1 =aP,P pub2 = bP, and then the system parameters {G q ,q,P,P pub ,H1,H2} is sent to A2, and C randomly selects ID * As the challenger of the game, let s = x i u i , x i ,u i is randomly selected, calculate Q i =x i u iP=sP is the public key part of the challenger, which is used to demonstrate the ECDLP problem in the proof. Adversary A2 makes the following query.

[0148] Query phase: Adversary A2 adaptively performs the following polynomially bounded oracle queries.

[0149] H1 query: When A2 is (ID i ,P) to query this oracle, C through the list L2 = (ID i ,P,d i ) records the questions and answers between A2 and C. If C finds the corresponding (ID i ,P,d i ), C will d i Return to A2, otherwise C randomly selects Send it to A2, and then (ID i ,P,d i ) is added to the list L1.

[0150] H2 asks: When A2 (m i ,ID i ,T i ,R i ,P) to query this oracle, C through the list L2 = (m i ,ID i ,T i ,R i ,P,e i ) records the questions and answers between A2 and C. Here, it is assumed that A2 has performed a partial private key extraction query and obtained R i , so if C finds the corresponding (m i ,ID i ,T i ,R i ,P,e i ), C will e i Return to A2, otherwise C randomly selects Send it to A2, and then (m i ,ID i ,T i ,R i ,P,e i ) is added to list L2.

[0151] Partial private key extraction query: When A2 with ID i When asking this oracle, C uses the list L PPK =(ID i ,v i ,k i ,R i ,fi ) records the questions and answers between A2 and C. If C is in L PPK The corresponding (ID i ,v i ,k i ,R i ,f i ), C will f i Return to A2, otherwise, if ID i ≠ID * , ensuring that challenger C controls and verifies the entire proof process. C randomly selects u i , calculate v i =H1(ID i ,P),k i =(b / u i +ah / u i )mod q,R i =u i P, f i Send to A2 and (ID i ,v i ,k i ,R i ,f i ) is added to the list L PPK middle.

[0152] Public key extraction query: When A2 uses ID i When asking this oracle, C uses the list L PK =(ID i ,x i ,R i ,Q i ,g i ) records the questions and answers between A2 and C. If C is in L PK The corresponding (ID i ,x i ,R i ,Q i ,g i ), C will g i Return to A2, otherwise, if ID i ≠ID * , C randomly selected Calculate Q i =x i R i , g i Send to A2 and (ID i ,x i ,R i ,Q i ,g i ) is added to the list L PK middle.

[0153] Secret value extraction query: When A2 with ID i When querying this oracle, if ID i =ID * , C gives up and terminates the operation, otherwise C searches the list L PK , if a record exists (ID i ,x i ,R i ,Q i ,g i ), C returns x i Give A2, if it does not exist, C executes the public key query to generate the tuple (ID i ,x i ,R i ,Q i ,g i ), returns x i to A2, and (ID i ,x i ,R i ,Q i ,g i ) is added to the list L PK middle.

[0154] Signature inquiry: A2 (ID i ,m i ,T i ) to query this oracle, C selects from the lists L1, L2, L PPK ,L PK Restore H1(ID i ,P),H2(m i ||ID i ||T i ,Q i ,P),k i ,R i ,x i , if ID i ≠ID * , then C outputs message m i The corresponding signature α i , and α i Send to A2, otherwise ID i =ID * , C simulates the calculation message m i A signature of i =x i (w i x i +k i ) ―1 mod q, here w i =H2(m i||ID i ||T i ||R i ||P). Finally, C will i Return to A2.

[0155] Forgery: Finally, A2 outputs a forged signature. i ≠ID * , C stops the simulation, otherwise ID i =ID * , C finds the corresponding signature information (m i ,ID i ,T i ,α i ). If the opponent A2 wins the game, then: x i (w i x i +k i ) ―1 mod q×(w i x i u i P+P pub2 +vP pub1 )=x i u i P. Use the fork lemma to get another valid signature in polynomial time And both signatures must satisfy Q i =sP, where s = x i u i , so there are two linearly independent equations:

[0156] Challenger C solves the two equations and outputs s as the solution to the ECDLP problem.

[0157] Cracking probability analysis:

[0158] If adversary A2 successfully forges signature α * , define the following events:

[0159] θ1: Challenger C allows adversary A2 to complete all types of queries without restricting or blocking any query type.

[0160] θ2: The adversary successfully forged a message m with ID * Signature α * ;

[0161] θ3: The forged signature satisfies ID=ID * ;

[0162] The probability that A2 successfully forges a signature is as follows:

[0163]

[0164] Pr(θ2|θ1)≥ε

[0165]

[0166] Through the above and verification content, it can be seen that the present invention has achieved at least the following expected effects:

[0167] 1) Improved system efficiency: Without complex calculations and reducing data transmission requirements, this solution can improve the overall efficiency of the ADS-B system, especially in high-speed aviation environments, ensuring the real-time and accuracy of data transmission.

[0168] 2) Enhanced system security: By strengthening message authentication and integrity protection, the present invention significantly improves the security protection capability of the ADS-B system and effectively prevents the risks of malicious tampering and identity impersonation.

[0169] 3) Reduced operation and maintenance costs: Eliminating the need for certificate management not only simplifies the system architecture, but also reduces the operation and maintenance costs caused by certificate updates and verifications, thereby achieving improved economic benefits.

[0170] In summary, the present invention provides a more secure, efficient and lightweight security transmission authentication solution for ADS-B system message data.

[0171] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes can be made in form and details without departing from the scope defined by the claims of the present invention.

Claims

1. A secure, efficient and lightweight certificateless signature scheme for ADS-B system, characterized in that: include: Step S1, generate system parameters in advance through the key generation center KGC and publish them to the ADS-B system; Step S2: The key generation center KGC obtains the real identity information of the signer and generates a partial private key and returns it; Step S3: The signer calculates his / her complete private key based on the partial private key and the selected secret value, derives the public key based on the complete private key and publishes it to the ADS-B system for public disclosure; Step S4: The signer signs the message using his or her complete private key and then broadcasts it to the outside.

2. A secure, efficient and lightweight certificateless signature scheme for ADS-B system according to claim 1, characterized in that: The step S1 includes the following operations: The key generation center KGC selects a security constant k and a preset prime number q so that 2 k <q<2( k+1 ); Configure elliptic curve group G q , whose order is q, select the generator P, configure the finite field F p , select a large prime number p that meets the preset security standards as the modulus of the finite field; The first random number a and the second random number b are selected by the key generation center KGC, where And calculate the public parameter P pub = {P pub1 ,P pub2 }={aP,bP}, where represents the multiplication group modulo p, P pub1 Represents the first public parameter, P pub2 represents the second public parameter; Define the first hash function Define the second hash function The key generation center KGC generates complete system parameters params = {G q ,q,p,P,P pub ,H1,H2} and published to the ADS-B system.

3. A secure, efficient and lightweight ADS-B system certificateless signature scheme according to claim 2, characterized in that: The step S2 comprises: The key generation center KGC obtains the real identity information ID transmitted by the signer through a secure channel S ∈{0, 1} * ; The key generation center KGC selects the third random number And perform the following calculations: R S =uP v=H1(ID S ,P) k=(b / u+av / u)mod p Among them, R S represents the first private key parameter, v represents the intermediate parameter, k represents the second private key parameter, H1() represents the calculation process of the first hash function, and mod represents the modulus operation; The key generation center KGC sets the signer's partial private key to D S =(k,R S ) and sends this part of the private key to the signer.

4. A secure, efficient and lightweight ADS-B system certificateless signature scheme according to claim 3, characterized in that: The step S3 comprises: After receiving the partial private key, the signer verifies the legitimacy of the partial private key through the following verification formula: When the verification formula is established, it is determined that some private keys are legitimate; The signer chooses a secret value x S ,in The signer calculates Q S =x S R S , where Q S The public key parameters are part of the signer's public key; The signer generates the public key PK S =(R S ,Q S ) and published to the ADS-B system for public disclosure.

5. A secure, efficient and lightweight certificateless signature scheme for ADS-B system according to claim 4, characterized in that: The step S4 comprises: The signer broadcasts the message information m S ∈{0, 1} * Do the following: For message information m S , the signer first generates the current timestamp T S ; The signer calculates the signature parameter w = H2(m S ||ID S ||T S ,R S ,P); The signer calculates the signature α = x S (wx S +k) ―1 mod p; The signer signs the information {α,T S } is inserted into the ME and PI fields of the ADS-B message information, and then the message is broadcast.

6. A secure, efficient and lightweight certificateless signature scheme for ADS-B system according to claim 5, characterized in that: The end receiving the broadcast message is determined to be the authenticator. When the authenticator receives the broadcast message, it performs the following operations: The verifier first parses the broadcast message to obtain the signer's signature α and timestamp T S , identity information ID S And message information m S ; Validators verify the following items: Verify timestamp T S Whether it is valid and has not been reused; Calculate v = H1 (ID S ,P),w=H2(m S ||ID S ||T S ,R S ,P); Using public key Q S and the public parameters in the ADS-B system, calculate the verification parameters Inspection and judgment Is it established: If the equation holds true, the signature verification passes and the verifier receives the message information. Otherwise, the signature verification fails and the verifier refuses to receive the message information.

7. A secure, efficient and lightweight certificateless signature scheme for ADS-B system according to claim 6, characterized in that: When the verifier receives multiple message information groups at the same time, it enters the batch verification operation, including: Determine the set of message information received by the verifier at the same time in, represents the i-th message information, and n represents the total number of message information in the message information set; The verifier verifies the timestamp set of all message information in the message information set Is it valid? If all are valid, continue with batch verification, where: Indicates the signature timestamp of the i-th message information; Verifier verification message information collection The validity of all signatures in the message information set is determined by judging the following batch verification formula: In the formula, α i Represents the signature of the i-th message information, Indicates the verification parameters of the i-th message information, represents the secret value of the i-th message information, w i Indicates the signature parameter of the i-th message information, k i Represents the second private key parameter of the i-th message information, Represents the public key of the i-th message information, v i Indicates the intermediate parameter of the i-th message information, u i The third random number representing the i-th message information, Indicates the first private key parameter of the i-th message information.

Images