A secure and efficient and lightweight adsb system certificateless signature scheme

Abstract

The application discloses a safe, efficient and lightweight certificateless signature scheme of ADS-B system, which comprises the following steps: generating system parameters by a key generation center KGC and publishing the system parameters to the ADS-B system; acquiring real identity information of a signer by the key generation center KGC and returning a partial private key; calculating a complete private key of the signer based on the partial private key and a selected secret value, deriving a public key based on the complete private key and publishing the public key to the ADS-B system for public; and broadcasting the message information signed by the signer. The application gives a specific signature position design according to the message field, does not need complex certificate management, and only generates a partial private key by the KGC to avoid the key escrow problem, so that the application is more flexible and scalable in large-scale deployment. Compared with a general bilinear scheme, the application has low calculation complexity, supports batch verification, improves the authentication efficiency of the system and is suitable for the aviation communication environment with limited resources.

Description

Technical Field

[0001] This invention belongs to the field of avionics and communications security technology, specifically relating to a secure, efficient, and lightweight certificate-free signature scheme for ADS-B systems. Background Technology

[0002] ADS-B (Automatic Dependent Surveillance-Broadcast) is a secure transmission authentication technology. This technology is primarily used in civil and military aviation to improve real-time aircraft monitoring and air traffic management, ensuring the integrity and authenticity of ADS-B message data and guaranteeing flight safety.

[0003] While ADS-B systems offer significant advantages in improving air traffic management efficiency and flight safety, they also face serious security challenges. ADS-B broadcasts plaintext information through open channels without any authentication measures, making the messages highly vulnerable to various attacks, including signal spoofing, message modification, and replay attacks. Because ADS-B messages lack authentication, attackers can mislead air traffic controllers and pilots by forging or altering messages, leading to potential security risks. To protect the integrity and authenticity of ADS-B messages, security authentication is necessary. Introducing authentication mechanisms can ensure the credibility of the source and content of broadcast messages, preventing tampering or replay during transmission, thereby improving the security and reliability of the entire air traffic management system.

[0004] Traditional authentication methods are generally based on Public Key Infrastructure (PKI) and symmetric keys. PKI verifies the source and content of messages through digital certificates, relying on complex certificate management and key infrastructure. PKI requires a centralized Certificate Authority (CA) to manage and issue certificates, and maintains a complex public and private key pair system, increasing system complexity and management costs. Furthermore, certificate lifecycle management (including issuance, renewal, and revocation) requires additional communication and computing resources to maintain system security and reliability, further increasing the system's burden and operating costs. In ADS-B systems with limited computing and storage resources, these processes are difficult to operate efficiently. Another authentication method is based on symmetric keys; MAC is one of the most commonly used techniques, verifying message integrity and authenticity by generating message digests using a shared secret key. While computationally simple and requiring no certificate management, making it suitable for some resource-constrained environments, key distribution and management become a significant bottleneck in situations requiring high-frequency message exchange and authentication, especially in large-scale user deployments, resulting in poor scalability. Symmetric key methods also face the risks of key leakage and replay attacks, limiting their application in ADS-B systems.

[0005] Besides these traditional methods, Identity-Based Authentication (IBS) is another option. IBS simplifies certificate management by generating public-private key pairs using a user's unique identifier. However, the distribution of private keys is handled by a centralized Key Generation Center (KGC), which introduces a single point of failure; if the KGC is compromised, the entire system's security is compromised. Furthermore, constructing and processing identity-based authentication schemes requires significant computational complexity, increasing the system's burden. Certificate-less Signature (CLS) authentication methods have also gained attention in recent years. These methods do not require complex certificate management and are suitable for resource-constrained environments. However, most current CLS schemes are based on bilinear mappings or hash-to-point constructions, resulting in high computational complexity and limiting their practical application in resource-constrained ADS-B systems. Summary of the Invention

[0006] In view of this, this invention proposes a lightweight, ECC-based certificateless signature scheme (ECB-CLS) for secure ADS-B systems, providing specific signature location designs for actual message field configurations. This scheme eliminates the need for complex certificate management, and the KGC only generates a portion of the private keys, thus avoiding key escrow issues and offering greater flexibility and scalability for large-scale deployments. Compared to typical bilinear schemes, this scheme has lower computational complexity and supports batch verification, significantly improving system authentication efficiency, making it particularly suitable for resource-constrained aerospace communication environments.

[0007] To achieve the above objectives, the present invention provides the following technical solution:

[0008] This invention provides a secure, efficient, and lightweight certificate-free signature scheme for ADS-B systems, comprising:

[0009] Step S1: Generate system parameters in advance through the Key Generation Center (KGC) and publish them to the ADS-B system;

[0010] Step S2: The Key Generation Center (KGC) obtains the signer's real identity information and generates a partial private key, which is then returned.

[0011] Step S3: The signer calculates their complete private key based on a partial private key and the chosen secret value, derives a public key based on the complete private key, and publishes it to the ADS-B system for public access.

[0012] Step S4: The signer signs the message using their full private key and then broadcasts it.

[0013] Preferably, step S1 includes the following operations:

[0014] The key generation center (KGC) selects a security constant k and a preset prime number q such that 2 k <q<2 (k+1) ;

[0015] Configure elliptic curve group G q Let its order be q, and choose a generator P. Configure a finite field F. p Choose a large prime number p that meets the preset safety criteria as the modulus of the finite field;

[0016] The first random number 'a' and the second random number 'b' are selected by the key generation center KGC. And calculate the common parameter P pub ={P pub1 ,P pub2}={aP,bP}, where, Let P represent the modular multiplication group modulo p. pub1 P represents the first publicly disclosed parameter. pub2 Indicates the second publicly disclosed parameter;

[0017] Define the first hash function Define the second hash function

[0018] The complete system parameters params = {G are generated through the Key Generation Center (KGC). q ,q,p,P,P pub ,H1,H2} and publish to the ADS-B system.

[0019] Preferably, step S2 includes:

[0020] Key Generation Center (KGC) obtains the real identity information (ID) transmitted by the signer through a secure channel. S ∈{0,1} * ;

[0021] Key Generation Center (KGC) selects a third random number. And perform the following calculations:

[0022] R S =uP

[0023] v = H1(ID) S ,P)

[0024] k = (b / u + av / u) mod p

[0025] Among them, R S denoted as the first private key parameter, v as the intermediate parameter, k as the second private key parameter, H1() as the calculation process of the first hash function, and mod as the modulo operation;

[0026] The Key Generation Center (KGC) sets part of the signer's private key to D. S =(k,R) S ), and send that part of the private key to the signer's plane.

[0027] Preferably, step S3 includes:

[0028] After receiving a portion of the private key, the signer verifies its legitimacy using the following formula:

[0029]

[0030] When the verification formula is true, it is determined that part of the private key is legitimate;

[0031] The signer chooses a secret value x S ,in

[0032] Signer calculates Q S =x S R S Q S The public key parameter is used as part of the signer's public key;

[0033] The signer generates the public key PK. S =(R S Q S It was then published to the ADS-B system for public access.

[0034] Preferably, step S4 includes:

[0035] The signer broadcasts the message information m S ∈{0,1} * Perform the following operations:

[0036] Regarding message information m S The signer first generates the current timestamp T. S ;

[0037] The signer calculates the signature parameter w = H2(m) S ||ID S ||T S ,R S ,P);

[0038] The signer calculates the signature α = x S (wx S +k) ―1 mod p;

[0039] The signer will sign the information {α,T} S Insert the message into the ME and PI fields of the ADS-B message information, and then broadcast the message.

[0040] Preferably, the end receiving the broadcast message is designated as the verifier, and the verifier performs the following operations upon receiving the broadcast message:

[0041] The verifier first parses the broadcast message to obtain the signer's signature α and timestamp T. S Identity information ID S and message information m S ;

[0042] The verifier verifies the following items:

[0043] Verify timestamp T S Whether it is effective and has not been reused;

[0044] Calculate v = H1(ID) S ,P), w=H2(m S ||ID S ||T S ,R S ,P);

[0045] Using public key Q S Calculate verification parameters using publicly available parameters from the ADS-B system.

[0046] Check and judge Is it true or false?

[0047]

[0048] If the equation is true, the signature verification passes and the verifier receives the message; otherwise, the signature verification fails and the verifier refuses to receive the message.

[0049] Preferably, when the verifier receives multiple message sets at the same time, it enters a batch verification operation, including:

[0050] Determine the set of message information received by the verifier at the same time. in, This represents the i-th message, and n represents the total number of messages in the message set.

[0051] The verifier checks the timestamp set of all message information within the message information set. If all are valid, proceed with batch verification. This represents the signature timestamp of the i-th message.

[0052] Verifier verification message information set The validity of the signatures is determined by judging the legitimacy of all signatures within the message information set using the following batch verification formula:

[0053]

[0054] In the formula, α i This represents the signature of the i-th message. This represents the verification parameter for the i-th message. w represents the secret value of the i-th message. i k represents the signature parameter of the i-th message. i The second private key parameter represents the information in the i-th message. v represents the public key of the i-th message. i u represents the intermediate parameter of the i-th message. i This represents the third random number for the i-th message. This represents the first private key parameter of the i-th message.

[0055] The present invention has achieved at least the following beneficial effects:

[0056] 1. No Certificate Management Required: Traditional security solutions rely on complex certificate management systems for authentication, which not only increases the system's burden but also presents management challenges, especially in certificate renewal and revocation. This invention completely eliminates the dependence on certificates through a certificateless signing mechanism, thereby simplifying the system architecture and reducing the maintenance burden.

[0057] 2. Optimized Resource Consumption: Compared with general signature schemes, the ECB-CLS algorithm proposed in this invention eliminates the need for complex bilinear mapping and hash-to-point operations, greatly simplifying the signature algorithm implementation process, significantly reducing computational overhead, and saving computational resources. This makes this scheme very suitable for running on resource-constrained ADS-B system devices, improving system reliability.

[0058] 3. High-efficiency authentication: The proposed solution supports batch verification. By verifying a batch of message signatures at once, the computational complexity of verifying a single message signature each time can be effectively reduced, thereby greatly improving the overall verification efficiency of the system.

[0059] 4. Security Proof: This invention provides security proofs against Type I and Type II adversaries using a random oracle (ROM) model, demonstrating the effectiveness of adaptive selected message attacks and providing specific cracking probabilities. The proposed scheme resists various attacks, including spoofing, tampering, and replay attacks, and achieves both forward and backward security.

[0060] Other advantages, objectives, and features of the invention will be set forth in the following description and will be apparent to those skilled in the art in some respects, or may be learned by practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0061] To make the objectives, technical solutions, and beneficial effects of this invention clearer, the following figures are provided for illustration:

[0062] Figure 1 This is a diagram illustrating the overall framework for the ECB-CLS verification of the ADS-B system in this embodiment of the invention.

[0063] Figure 2 This is a flowchart illustrating the authentication process of the certificateless signature scheme in the ADS-B system according to an embodiment of the present invention. Detailed Implementation

[0064] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0065] This invention provides a secure, efficient, and lightweight certificate-free signature scheme for ADS-B systems, referring to... Figures 1 to 2 ,include:

[0066] Step S1: Generate system parameters in advance through the Key Generation Center (KGC) and publish them to the ADS-B system;

[0067] Step S2: The Key Generation Center (KGC) obtains the signer's real identity information and generates a partial private key, which is then returned.

[0068] Step S3: The signer calculates their complete private key based on a partial private key and the chosen secret value, derives a public key based on the complete private key, and publishes it to the ADS-B system for public access.

[0069] Step S4: The signer signs the message using their full private key and then broadcasts it.

[0070] The working principle and beneficial effects of the above technical solution are as follows: A specific signature location design is provided for the actual message field conditions. This solution does not require complex certificate management, and KGC is only responsible for generating a portion of the private keys, thus avoiding key escrow issues and providing better flexibility and scalability for large-scale deployments. Compared to general bilinear solutions, this solution has lower computational complexity and is suitable for resource-constrained aerospace communication environments.

[0071] In one specific embodiment, refer to Figures 1 to 2 The ECB-CLS (certificate-free signing) algorithm scheme includes:

[0072] (1) System parameter settings:

[0073] KGC played a crucial role in establishing the ECB-CLS scheme by generating key system parameters and publishing them to the ADS-B system. This involved selecting appropriate security parameters, including prime numbers, and configuring the elliptic curve group Gq with prime order q and generator P. These parameters are essential for ensuring the system's security strength. The detailed setup process is shown below:

[0074] 1. The key generation center (KGC) chooses a security constant k and a sufficiently large prime number q, such that 2 k <q<2 k+1 .

[0075] 2. Configure the elliptic curve group G q Let its order be q, and choose a generator P. Configure a finite field F. p Choose a large prime number p that meets the safety criteria as the modulus of the finite field.

[0076] 3. KGC selects random numbers And calculate the common parameter P pub ={P pub1 ,P pub2}={aP,bP}.

[0077] 4. Define the hash function.

[0078] 5. KGC will store the complete system parameters params = {G q ,q,p,P,P pub ,H1,H2} are published to the ADS-B system.

[0079] (2) Partial private key settings:

[0080] In the ECB-CLS scheme of the ADS-B system, the aircraft, as the signer S, needs to provide its true identity information ID. S ∈{0,1} * Securely submit to KGC to ensure the uniqueness of the signer's identity.

[0081] The signer, aircraft S, transmitted their true identity information (ID) through a secure channel. S Transmitted to KGC, when KGC receives the true identity ID of aircraft S S KGC selects random numbers calculate

[0082] R S =uP

[0083] v = H1(ID) S ,P),k=(b / u+av / u)mod p.

[0084] KGC sets part of the private key to D. S =(k,R) S ), and securely send that part of the private key to the signer, aircraft S.

[0085] The signer, aircraft S, received a portion of the private key D. S Afterwards, you can check kR S =P pub1v +P pub2 To verify the legitimacy of a portion of the private key:

[0086] prove:

[0087]

[0088] (3) Public key settings:

[0089] The signer aircraft S needs to establish its own public key to enhance the security of ADS-B message authentication. This process includes secret value selection and corresponding public key component computation.

[0090] The signer, aircraft S, randomly selects a secret value x. S ,

[0091] Signer aircraft S calculation Q S =x S R S Q here S As part of the signer's aircraft S public key.

[0092] The public key of the signer, aircraft S, is PK. S =(R S Q S ).

[0093] (4) No certificate signature:

[0094] When aircraft S broadcasts a message in the ADS-B system, m S ∈{0,1} * A signature needs to be generated for this message.

[0095] For message m S The signer, aircraft S, first generates the current timestamp T. S .

[0096] The signer's aircraft S calculates w = H2(m) S ||ID S ||T S ,R S ,P).

[0097] The signer, aircraft S, calculates the signature α = x. S (wx S+k) ―1 mod p.

[0098] The signer, aircraft S, will sign the information {α,T}. S The message is embedded into the ME and PI fields of the ADS-B message and then broadcast.

[0099] (5) Signature verification process:

[0100] When other aircraft or ground stations receive message m from aircraft S S First, the validity of the timestamp needs to be determined, and then the legality of the signature needs to be verified. The specific process is as follows.

[0101] Receive message m S Other aircraft or ground stations act as verifiers (V). Verifier V first parses the message to obtain the signature α and timestamp T of the signer aircraft S. S Identity information ID S and message m S .

[0102] Verifier V confirms timestamp T S It is effective and has not been reused.

[0103] Verifier V calculates v = H1(ID) S ,P), w=H2(m S ||ID S ||T S ,R S ,P).

[0104] Validator V uses public key Q S Calculate with other publicly available parameters

[0105] Finally, the verifier V checks and judges. If the signature is equal to the verifier's signature, the signature verification passes and the verifier V receives the message; otherwise, the signature verification fails and the verifier V refuses to receive the message.

[0106] prove:

[0107]

[0108] Furthermore, a batch verification solution is provided:

[0109] In the ECB-CLS scheme of the ADS-B system, the verifier V receives a set of message messages from different signer aircraft S at the same time. By verifying a batch of message signatures at once, verifier V can effectively reduce the computational complexity of verifying a single message signature each time, thereby improving verification efficiency. The specific batch verification process is as follows:

[0110] 1. Verifier V first checks a set of timestamps for a batch of messages. Whether it is effective, ensure that each message is valid. Generate or receive signatures within the expected timeframe, paying particular attention to the real-time nature and accuracy of aircraft location information to prevent replay attacks or the use of expired messages for verification. If the timestamp set T is within its validity period, proceed with batch signature verification.

[0111] 2. Verifier V then verifies a batch of message signatures. The validity of the signatures is determined by judging the legitimacy of a batch of message signatures using the following batch verification formula.

[0112]

[0113] prove:

[0114]

[0115] Through the above technical content, the beneficial effects achieved by this invention are as follows: This invention proposes a novel and efficient elliptic curve-based certificateless signature scheme (ECB-CLS), which can ensure the secure transmission and authentication of message data between users in an ADS-B system and prevent unauthorized users from engaging in malicious activities. This invention's scheme is tailored to the needs of practical systems, specifically designed to address the shortcomings of existing formats and security frameworks in ADS-B message data, and possesses the following innovative points and expected effects:

[0116] 1) No Certificate Management Required: Traditional security solutions rely on complex certificate management systems for authentication, which not only increases the system's burden but also brings management challenges, especially in terms of certificate renewal and revocation. This invention completely eliminates the dependence on certificates through a certificate-free signing mechanism, thereby simplifying the system architecture and reducing the maintenance burden.

[0117] 2) Optimized resource consumption: Compared with general signature schemes, the ECB-CLS algorithm proposed in this invention does not require complex bilinear mapping and hash-to-point operations, which greatly simplifies the signature algorithm implementation process, significantly reduces computational overhead, and saves computing resources. This makes this scheme very suitable for running on resource-constrained ADS-B system devices, improving system reliability.

[0118] 3) High-efficiency authentication: The proposed solution supports batch verification. By verifying a batch of message signatures at once, the computational complexity of verifying a single message signature each time can be effectively reduced, thereby greatly improving the overall verification efficiency of the system.

[0119] 4) Security Proof: This invention provides security proofs against Type I and Type II adversaries using a random oracle model (ROM) for adaptive selected message attacks, giving specific cracking probabilities. The proposed scheme can resist various attacks, including spoofing, tampering, and replay attacks, and achieves both forward and backward security.

[0120] To verify the effectiveness of this invention, the following security proof of the ECB-CLS algorithm is provided:

[0121] Theorem 1: Under the premise of Elliptic Curve Discrete Logarithm Security Assumption (ECDLP), the proposed ECB-CLS scheme is existent and unforgeable against type I attacker A1 to prevent adaptive choice message attacks.

[0122] Lemma 1: If in a random oracle model there exists an adversary A1 of type I, who can perform at most n... PPK The next part of the private key extraction query, n PK Secondary public key retrieval query hash queries and n S If a valid signature is forged after a signature query, then ECDLP is solvable.

[0123] Proof: Challenger C first interacts with adversary A1 to generate an instance of the ECDLP problem, given P, Q = sP, where P∈G q The goal of opponent A1 is to find s.

[0124] System parameter setting phase: Challenger C selects a, b and calculates P. pub1 =aP,P pub2 =bP, then the system parameter {G q ,q,p,P,P pub The values ​​H1 and H2 are sent to A1, and C randomly selects an ID. * As the challenger in the game, let s = x i u i , Calculate Q i =x i u i P = sP, as the challenger's public key portion, is used to demonstrate the ECDLP problem in the proof. The adversary A1 makes the following query.

[0125] Query Phase: The adversary A1 adaptively performs the following polynomial-bounded oracle queries.

[0126] H1 query: When A1 uses (ID) iWhen C queries this oracle (P), C uses list L1 = (ID) i ,P,d i Record the question and answer interactions between A1 and C. If C finds the corresponding (ID) in L1... i ,P,d i C will d i Return to A1, otherwise C selects randomly. Send to A1, then (ID) i ,P,d i Add it to list L1.

[0127] H2 query: When A1 uses (m i ID i ,T i ,R i When P queries this oracle, C uses list L2 = (m i ID i ,T i ,R i ,P,e i Record the question-and-answer exchanges between A1 and C. Here, it is assumed that A1 has already performed a partial private key extraction query to obtain R. i Therefore, if C finds the corresponding (m) in L2 i ID i ,T i ,R i ,P,e i ), C will e i Return to A1, otherwise C selects randomly. Send to A1, then (m i ID i ,T i ,R i ,P,e i Add it to list L2.

[0128] Partial private key extraction query: When A1 uses ID i When querying this oracle, C uses list L PPK =(ID) i ,u i ,v i ,k i ,R i ,f i Record the questions and answers between A1 and C. If C is in L PPK The corresponding (ID) can be found in the search. i ,u i ,v i ,k i ,R i ,fi C will f i Return to A1, otherwise, if ID i ≠ID * C randomly selects u i Calculate v i =H1(ID) i ,P),k i =(b / u i +ah / u i )mod p),R i =u i P, will f i Send to A1, and (ID) i ,u i ,v i ,k i ,R i ,f i Add to list L PPK middle

[0129] Public key retrieval query: When A1 uses ID i When querying this oracle, C uses list L PK =(ID) i ,x i ,R i Q i ,g i Record the questions and answers between A1 and C. If C is in L PK The corresponding (ID) can be found in the search. i ,x i ,R i Q i ,g i ), C will g i Return to A1, otherwise, if ID i ≠ID * C is randomly selected Calculate Q i =x i R i , will g i Send to A1, and (ID) i ,x i ,R i Q i ,g i Add to list L PK middle.

[0130] Secret value extraction query: When A1 uses ID i When querying this oracle, if ID i =ID * C abandons and aborts the operation; otherwise, C searches list L.PK If a record (ID) exists i ,x i ,R i Q i ,g i C returns x i Given A1, if it does not exist, C performs a public key extraction query to generate a tuple (ID). i ,x i ,R i Q i ,g i ), return x i Give A1, and (ID) i ,x i ,R i Q i ,g i Add to list L PK middle.

[0131] Public key replacement query: When A1 uses (ID) i ,g′ i When querying this oracle, C first obtains information from L. PK Find the corresponding record (ID) i ,x i ,R i Q i ,g i If it does not exist, then for ID i Perform secret value extraction queries and public key extraction queries, and then... i Replace with g′, which can be freely selected in A1 i And let x i =⊥,R i =⊥,Q i =⊥.

[0132] Signature Query: A1 with (ID) i ,m i ,T i ) Queries are made to this oracle, and C is selected from lists L1, L2, L... PPK ,L PK H1 (ID) recovery i ,P),H2(m i ||ID i ||T i ,R i ,P),k i ,R i ,x i If ID i ≠ID * Then C outputs message m i The corresponding signature α i and αi Send to A1, otherwise ID i =ID * C simulation calculation message m i A signature α i =x i (w i x i +k i ) ―1 mod q, here w i =H2(m i ||ID i ||T i ,R i ,P), C will α i Return to A1.

[0133] Signature forgery: Finally, A1 outputs a forged signature. If ID i ≠ID * C stops the simulation, otherwise ID i =ID * C retrieves the corresponding signature information (m) from the oracle query list. i ID i ,T i ,α i If opponent A1 wins the game, then: x i (w i x i +k i ) ―1 mod q×(w i x i u i P+P pub2 +vP pub1 )=x i u i P. Using the bifurcation lemma, another valid signature is obtained in polynomial time. And both signatures must satisfy Q i =sP, where s = x i u i Therefore, we have the following two linearly independent systems of equations:

[0134] Challenger C solves the two equations and outputs s as the solution to the ECDLP problem.

[0135] Probability analysis of cracking:

[0136] If the adversary A1 successfully forges signature α * Define the following events:

[0137] θ1: Challenger C allows adversary A1 to complete all types of inquiries without restricting or blocking any type of inquiry.

[0138] θ2: The adversary successfully forged a message with the identity ID m * Signature α * ;

[0139] θ3: The forged signature satisfies ID = ID * ;

[0140] The probability that A1 successfully forges a signature is as follows:

[0141]

[0142] Pr(θ2|θ1)≥ε

[0143]

[0144] Theorem 2: Under the premise of Elliptic Curve Discrete Logarithm Security Assumption (ECDLP), the proposed scheme is existent and unforgeable against type II attackers A2 to prevent adaptive choice message attacks.

[0145] Lemma 2: If in a random oracle model there exists an adversary A2 of type II, who can perform at most n... PPK The next part of the private key extraction query, n PK Second public key query hash queries and n S If a valid signature is forged after a signature query, then ECDLP is solvable.

[0146] Proof: Challenger C first interacts with adversary A2 to generate an instance of the ECDLP problem, given P, Q = sP, where P∈G q The goal of opponent A2 is to find s.

[0147] System parameter setting phase: Challenger C selects a, b and calculates P. pub1 =aP,P pub2 =bP, then the system parameter {G q ,q,P,P pub The values ​​H1 and H2 are sent to A2, and C randomly selects an ID. * As the challenger in the game, let s = x i u i x i ,u i It is randomly selected, calculate Q. i =x i u iP = sP, as the challenger's public key portion, is used to demonstrate the ECDLP problem in the proof. The adversary A2 makes the following query.

[0148] Query Phase: The adversary A2 adaptively performs the following polynomial-bounded oracle queries.

[0149] H1 query: When A2 uses (ID) i When C queries this oracle, P) uses list L2 = (ID) i ,P,d i Record the question and answer exchange between A2 and C. If C finds the corresponding (ID) in L1... i ,P,d i C will d i Return to A2, otherwise C selects randomly. Send to A2, then (ID) i ,P,d i Add it to list L1.

[0150] H2 query: When A2 uses (m i ID i ,T i ,R i When P queries this oracle, C uses list L2 = (m i ID i ,T i ,R i ,P,e i Record the question-and-answer exchanges between A2 and C. Here, it is assumed that A2 has already performed a partial private key extraction query to obtain R. i Therefore, if C finds the corresponding (m) in L2 i ID i ,T i ,R i ,P,e i ), C will e i Return to A2, otherwise C selects randomly. Send to A2, then (m i ID i ,T i ,R i ,P,e i Add it to list L2.

[0151] Partial private key retrieval query: When A2 uses ID i When querying this oracle, C uses list L PPK =(ID) i ,v i ,k i ,R i ,fi Record the questions and answers between A2 and C. If C is in L PPK The corresponding (ID) can be found in the search. i ,v i ,k i ,R i ,f i ), C will f i Return to A2, otherwise, if ID i ≠ID * To ensure challenger C's control and verification of the entire proof process, C randomly selects u. i Calculate v i =H1(ID) i ,P),k i =(b / u i +ah / u i )mod q,R i =u i P, will f i Send to A2, and (ID) i ,v i ,k i ,R i ,f i Add to list L PPK middle.

[0152] Public key retrieval query: When A2 uses ID i When querying this oracle, C uses list L PK =(ID) i ,x i ,R i Q i ,g i Record the questions and answers between A2 and C. If C is in L PK The corresponding (ID) can be found in the search. i ,x i ,R i Q i ,g i C will g i Return to A2, otherwise, if ID i ≠ID * C is randomly selected Calculate Q i =x i R i , will g i Send to A2, and (ID) i ,x i ,R i Q i ,g i Add to list L PK middle.

[0153] Secret value extraction query: When A2 uses ID i When querying this oracle, if ID i =ID * C abandons and aborts the operation; otherwise, C searches list L. PK If a record (ID) exists i ,x i ,R i Q i ,g i C returns x i Given A2, if it does not exist, C performs a public key query to generate a tuple (ID). i ,x i ,R i Q i ,g i ), return x i Give A2, and (ID) i ,x i ,R i Q i ,g i Add to list L PK middle.

[0154] Signature Request: A2 with (ID) i ,m i ,T i ) Queries are made to this oracle, and C is selected from lists L1, L2, L... PPK ,L PK H1 (ID) recovery i ,P),H2(m i ||ID i ||T i Q i ,P),k i ,R i ,x i If ID i ≠ID * Then C outputs message m i The corresponding signature α i and α i Send to A2, otherwise ID i =ID * C simulation calculation message m i A sign α i =x i (w i x i +k i ) ―1 mod q, here w i =H2(m i||ID i ||T i ||R i ||P). Finally, C will α i Return to A2.

[0155] Forgery: Finally, A2 outputs a forged signature. If ID i ≠ID * C stops the simulation, otherwise ID i =ID * C retrieves the corresponding signature information (m) from the oracle query list. i ID i ,T i ,α i If opponent A2 wins the game, then: x i (w i x i +k i ) ―1 mod q×(w i x i u i P+P pub2 +vP pub1 )=x i u i P. Using the bifurcation lemma, another valid signature is obtained in polynomial time. And both signatures must satisfy Q i =sP, where s = x i u i Therefore, we have the following two linearly independent systems of equations:

[0156] Challenger C solves the two equations and outputs s as the solution to the ECDLP problem.

[0157] Probability analysis of cracking:

[0158] If the adversary A2 successfully forges signature α * Define the following events:

[0159] θ1: Challenger C allows adversary A2 to complete all types of inquiries without restricting or blocking any type of inquiry.

[0160] θ2: The adversary successfully forged a message with the identity ID m * Signature α * ;

[0161] θ3: The forged signature satisfies ID = ID * ;

[0162] The probability that A2 successfully forges a signature is as follows:

[0163]

[0164] Pr(θ2|θ1)≥ε

[0165]

[0166] Based on the above and the verification results, it is clear that the present invention has achieved at least the following expected effects:

[0167] 1) Improved system efficiency: By eliminating the need for complex calculations and reducing data transmission requirements, this solution can improve the overall efficiency of the ADS-B system, especially in high-speed aviation environments, ensuring the real-time performance and accuracy of data transmission.

[0168] 2) Enhanced system security: By strengthening message authentication and integrity protection, this invention significantly improves the security protection capabilities of the ADS-B system and effectively prevents the risks of malicious tampering and identity fraud.

[0169] 3) Reduced operation and maintenance costs: Eliminating the need for certificate management not only simplifies the system architecture but also reduces the operation and maintenance costs caused by certificate updates and verification, thereby improving economic efficiency.

[0170] In summary, this invention provides a more secure, efficient, and lightweight secure transmission authentication scheme for ADS-B system message data.

[0171] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes can be made to it in form and detail without departing from the scope defined by the claims of the present invention.

Claims

1. A secure, efficient, and lightweight certificate-free signature scheme for an ADS-B system, characterized in that, include: Step S1: Generate system parameters in advance through the Key Generation Center (KGC) and publish them to the ADS-B system; Step S2: The Key Generation Center (KGC) obtains the signer's real identity information and generates a partial private key, which is then returned. Step S3: The signer calculates their complete private key based on a partial private key and the chosen secret value, derives a public key based on the complete private key, and publishes it to the ADS-B system for public access. Step S4: The signer signs the message using their complete private key and then broadcasts it. Step S1 includes the following operations: The key generation center (KGC) selects a security constant k and a preset prime number q, such that... ; Configure Elliptic Curve Group Its order is Select generator Configure a limited domain Choose a large prime number that meets the preset safety standards. The modulus of a finite field; The first random number is selected through the Key Generation Center (KGC). and the second random number ,in And calculate common parameters. ,in, Represents the multiplication group modulo p. Indicates the first publicly disclosed parameter. Indicates the second publicly disclosed parameter; Define the first hash function Define the second hash function ; Generate complete system parameters through the Key Generation Center (KGC). And publish it to the ADS-B system; Step S2 includes: Key Generation Center (KGC) obtains the real identity information transmitted by the signer through a secure channel. ; Key Generation Center (KGC) selects a third random number. And perform the following calculations: in, This is represented as the first private key parameter. Represented as intermediate parameters, This is represented as the second private key parameter. The calculation process of the first hash function, This represents the modulo operation; Key Generation Center (KGC) sets part of the signer's private key as... And send that part of the private key to the signer; Step S3 includes: After receiving a portion of the private key, the signer verifies its legitimacy using the following formula: When the verification formula is true, it is determined that part of the private key is legitimate; The signer selects a secret value ,in ; Signer Calculation ,in The public key parameter is used as part of the signer's public key; The signer generates the public key. And it was published to the ADS-B system for public access; Step S4 includes: The signer broadcasts the message. Perform the following operations: Regarding message information The signer first generates the current timestamp. ; The signer calculates the signature parameters. ; The signer calculates the signature. ; The signer will sign the information. Insert the message into the ME and PI fields of the ADS-B message information, and then broadcast the message.

2. The secure, efficient, and lightweight certificate-free signature scheme for an ADS-B system according to claim 1, characterized in that, The end receiving the broadcast message is identified as the authenticator. Upon receiving the broadcast message, the authenticator performs the following operations: The verifier first parses the broadcast message to obtain the signer's signature. timestamp Identity information and message information ; The verifier verifies the following items: Verify timestamp Whether it is effective and has not been reused; calculate , ; Use public key Calculate verification parameters using publicly available parameters from the ADS-B system. ; Check and judge Is it true or false? If the equation is true, the signature verification passes and the verifier receives the message; otherwise, the signature verification fails and the verifier refuses to receive the message.

3. The secure, efficient, and lightweight certificate-free signature scheme for an ADS-B system according to claim 2, characterized in that, When a verifier receives multiple message sets at the same time, it initiates a batch verification operation, including: Determine the set of message information received by the verifier at the same time. ,in, Indicates the first Individual message information, Indicates the total number of messages in the message information set; The verifier checks the timestamp set of all message information within the message information set. If all are valid, proceed with batch verification. Indicates the first The signature timestamp of each message information; Verifier verification message information set The validity of the signatures is determined by judging the legitimacy of all signatures within the message information set using the following batch verification formula: In the formula, Indicates the first The signature of each message information Indicates the first Verification parameters for each message message. Indicates the first The secret value of each message message. Indicates the first Signature parameters for each message message. Indicates the first The second private key parameter of the message information, Indicates the first The public key of the message information Indicates the first Intermediate parameters of a message message Indicates the first The third random number of the message information Indicates the first The first private key parameter of each message.

Images