UAV assistance-based Internet of Things equipment multi-cluster concurrent access and switching authentication method

Abstract

The invention discloses an Internet of Things equipment multi-cluster concurrent access and switching authentication method based on UAV assistance, and the method comprises the steps: achieving the offline registration of a UAV and each Internet of Things equipment cluster through a ground network, introducing a long-term shared key for the UAV in a registration stage, and introducing a PUF challenge value for each Internet of Things equipment cluster; in the unmanned aerial vehicle access verification stage, based on a shared key mechanism, the unmanned aerial vehicle safely and efficiently accesses the ground network; the Internet of Things equipment multi-cluster concurrent access authentication stage is based on a PUF mechanism, and the unmanned aerial vehicle assists the ground multi-cluster Internet of Things equipment to complete concurrent access authentication; when the new unmanned aerial vehicle is switched in the multi-cluster concurrent switching authentication stage of the Internet of Things equipment, the multi-cluster Internet of Things equipment can quickly and safely complete switching with the new unmanned aerial vehicle based on the shared key between the UAVs. According to the invention, safe and efficient multi-cluster concurrent access and switching authentication of the unmanned aerial vehicle assisted Internet of Things equipment are realized.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology, and in particular relates to a UAV-assisted multi-cluster concurrent access and switching authentication method for Internet of Things devices. Background Art

[0002] With the surge in the number of IoT (Internet of Things) devices, network infrastructure needs to rely on a large number of low-cost wireless sensors and energy-constrained nodes to meet the needs of applications such as smart cities, smart agriculture, and industrial smart manufacturing. As these applications become more popular, the requirements for communication systems are also increasing, including higher transmission rates and larger coverage. In this context, UAVs (Unmanned Aircraft Vehicles) can expand network coverage due to their flexibility and mobility, connect IoT devices beyond the coverage area to the network, and provide green communications with high reliability, high throughput, and low energy consumption. In particular, considering that the future sixth-generation mobile communication system (6G) network will support the access of hundreds of billions of IoT devices, it may cause problems such as signaling conflicts and congestion failures at key nodes.

[0003] To solve this problem, the academic community has proposed a number of group master aggregation schemes. For example, the request messages of a large number of devices are aggregated by a single group master and then forwarded to the access point uniformly. The group master can broadcast the response message to all members uniformly, thereby effectively reducing the signaling overhead. However, when the number of devices is too large, the scheme of aggregation by a single group master may still lead to problems such as signaling conflicts and group master congestion failures. In order to ensure that these super-massive devices can access the ground network through UAV, some scholars have proposed the principle of cluster division. There are multiple clusters, each cluster has a large number of cluster members and there is a cluster head that can aggregate and forward messages within the cluster. Different clusters can access orthogonal sub-channels through protocols such as orthogonal frequency division multiple access at the same time, so that UAV can simultaneously assist multiple IoT device clusters to access the ground network. However, the UAV-assisted multi-cluster IoT device communication model faces many security and performance challenges. First, since the IoT devices and UAVs, and the UAVs and the ground network are connected through insecure air interface channels, they are vulnerable to eavesdropping attacks, forgery attacks, man-in-the-middle attacks and other threats. Secondly, since IoT devices usually have weak computing and storage capabilities, they cannot deploy more complex cryptographic algorithms. At the same time, IoT devices are often deployed in unmanned areas, such as suburbs and remote areas, and are easily attacked by attackers. In addition, when a large number of devices in multiple IoT device clusters are connected to UAVs at the same time and each executes a separate authentication mechanism, it may generate a large signaling overhead and even lead to signaling conflicts, key node congestion failures and other problems. Finally, due to the characteristics of UAVs such as poor endurance and prone to failure, a single UAV cannot guarantee the continuity of network services. New UAVs can be used to replace old UAVs, so it is necessary to consider the switching mechanism between IoT devices and new and old UAVs.

[0004] In summary, it is crucial to study a secure and efficient UAV-assisted multi-cluster concurrent access and switching authentication scheme for IoT devices. Summary of the invention

[0005] In order to solve the above problems existing in the prior art, the present invention provides a UAV-assisted multi-cluster concurrent access and switching authentication method for IoT devices. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0006] The embodiment of the present invention provides a UAV-assisted concurrent access and switching authentication method for multiple clusters of IoT devices, which is applied to a communication system including a ground network, a UAV, and multiple IoT device clusters, each of which includes multiple IoT devices and a gateway; the corresponding method includes:

[0007] Registration process: The UAV and each IoT device cluster register offline through the ground network. When the UAV registers offline through the ground network, a long-term shared key is introduced for the UAV. When each IoT device cluster registers offline through the ground network, a PUF challenge value is introduced for each IoT device cluster.

[0008] UAV access authentication process: Based on the long-term shared key, the UAV sends an access request message to the ground network, the ground network verifies the access request message sent by the UAV and returns an access response message, and the UAV verifies the access response message sent by the ground network to complete the UAV access authentication; and the negotiation key between the UAV and the ground network is calculated in the process to establish a secure channel between the UAV and the ground network;

[0009] Concurrent access authentication process of multiple clusters of IoT devices: the ground network sends the PUF challenge value to each IoT device cluster, each IoT device cluster calculates the corresponding PUF response value according to the PUF challenge value, and sends it to the gateway in the corresponding IoT device cluster, the gateway aggregates all PUF response values ​​and sends them to the UAV, the UAV verifies and further aggregates the PUF response value and sends it to the ground network, the ground network verifies the PUF response value aggregated by the UAV to complete the concurrent access authentication of multiple clusters of IoT devices; and the negotiation key between the IoT device in each IoT device cluster and the UAV and the ground network is calculated in the process to establish a secure channel between the IoT device cluster and the UAV and the ground network;

[0010] Concurrent switching authentication process of multiple clusters of IoT devices: When the original UAV is replaced, before the new UAV replaces the original UAV, the original UAV first completes the switching preparation with each IoT device cluster. During the switching preparation process, a ciphertext including a shared key between UAVs and a negotiation key between the IoT devices in each IoT device cluster and the original UAV is generated; subsequently, when the IoT device cluster switches with the new UAV, the IoT device cluster uses the ciphertext generated during the switching preparation process to complete mutual authentication with the new UAV, and during the process, the negotiation key between the IoT devices in each IoT device cluster and the new UAV is calculated to establish a secure channel between the IoT device cluster and the new UAV.

[0011] Beneficial effects of the present invention:

[0012] The UAV-assisted multi-cluster concurrent access and switching authentication method for IoT devices proposed in the present invention is a feasible, safe and efficient UAV-assisted multi-cluster concurrent access and switching authentication scheme for IoT devices, which comprehensively considers the registration stage of the communication system, the UAV access authentication stage, the multi-cluster concurrent access authentication stage for IoT devices and the multi-cluster concurrent switching authentication stage for IoT devices, introduces a long-term shared key for UAV in the registration stage, and introduces a PUF challenge value for each IoT device cluster, and then in the UAV access verification stage, based on the shared key mechanism, the UAV can safely and efficiently access the ground network, and at the same time, the UAV and the ground network share a negotiated key to ensure the security of subsequent communication data between the UAV and the ground network, and in the multi-cluster concurrent access authentication stage for IoT devices, based on the PUF mechanism, it can effectively avoid the risk of massive devices being accessed in parallel. It can solve the problems of signaling conflicts and key node congestion failures caused by access and transmission, and prevent IoT devices from being subjected to threats such as physical attacks. It can ensure the security of IoT devices under the premise of low storage and computing overhead, making it suitable for resource-constrained IoT devices. At the same time, the IoT devices in each IoT device cluster share a negotiated key with the UAV and the ground network to ensure the security of the subsequent communication data between the IoT devices in each IoT device cluster and the UAV and the ground network. When switching to a new UAV in the concurrent switching authentication stage of multiple clusters of IoT devices, based on the shared key between UAVs, multiple clusters of IoT devices can quickly and safely complete the switch with the new UAV. At the same time, the IoT devices in each IoT device cluster share a negotiated key with the new UAV to ensure the security of the subsequent communication data between the IoT devices in each IoT device cluster and the new UAV.

[0013] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 Schematic diagram of the communication system architecture of UAV-assisted multi-cluster IoT devices provided by an embodiment of the present invention;

[0015] Figure 2 It is a flow chart of a method for concurrent access and switching authentication of multiple clusters of IoT devices based on UAV assistance provided by an embodiment of the present invention;

[0016] Figure 3 Schematic diagram of the drone access authentication process provided by an embodiment of the present invention;

[0017] Figure 4 This is a schematic diagram of a multi-cluster concurrent access authentication process for IoT devices provided by an embodiment of the present invention;

[0018] Figure 5 It is a schematic diagram of the concurrent switching authentication process of multiple clusters of Internet of Things devices provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0020] The embodiment of the present invention is based on Figure 1 The communication system framework of UAV-assisted multi-cluster IoT devices is implemented, and the communication system includes a ground network, UAV and multiple IoT device clusters. The IoT device cluster can communicate with the ground network through UAV. Each IoT device cluster mainly includes multiple IoT devices and a gateway. IoT devices are usually installed as sensors, actuators, etc. in various environments. They are responsible for collecting various types of data, such as ambient temperature, humidity, etc., and usually have weak computing and storage capabilities. The gateway is responsible for aggregating data from multiple IoT devices in the IoT device cluster and transmitting this data to the ground network through UAV. UAV acts as a communication device to assist the IoT device cluster to access the ground network. Due to the limited weight and battery capacity of UAV, a single UAV cannot provide continuous network services for the IoT device cluster. When a UAV can no longer provide services, the ground network calls a new UAV to continue to provide services. The ground network is responsible for verifying the legitimacy of the UAV and IoT devices. In the example Figure 2 In the communication system shown, each IoT device in the IoT device cluster and the gateway, the gateway and the UAV, and the UAV and the ground network are generally connected through an insecure air interface channel.

[0021] against Figure 1 For the communication system shown, see Figure 2 The embodiment of the present invention provides a method for concurrent access and switching authentication of multiple clusters of IoT devices based on UAV assistance, the method comprising:

[0022] S10, registration process: the UAV and each IoT device cluster implement offline registration through the ground network; wherein, when the UAV implements offline registration through the ground network, a long-term shared key is introduced for the UAV; when each IoT device cluster implements offline registration through the ground network, a PUF challenge value is introduced for each IoT device cluster;

[0023] S20, UAV access authentication process: Based on the long-term shared key, the UAV sends an access request message to the ground network, the ground network verifies the access request message sent by the UAV and returns an access response message, and the UAV verifies the access response message sent by the ground network to complete the UAV access authentication; and the negotiation key of the UAV and the ground network is calculated in the process to establish a secure channel between the UAV and the ground network;

[0024] S30, concurrent access authentication process of multiple clusters of IoT devices: the ground network sends the PUF challenge value to each IoT device cluster, each IoT device cluster calculates the corresponding PUF response value according to the PUF challenge value, and sends it to the gateway in the corresponding IoT device cluster, the gateway aggregates all PUF response values ​​and sends them to the UAV, the UAV verifies and further aggregates the PUF response value and sends it to the ground network, the ground network verifies the PUF response value aggregated by the UAV to complete the concurrent access authentication of multiple clusters of IoT devices; and the negotiation key between the IoT device in each IoT device cluster and the UAV and the ground network is calculated in the process to establish a secure channel between the IoT device cluster and the UAV and the ground network;

[0025] S40. Concurrent switching authentication process of multiple clusters of IoT devices: When the original UAV is replaced, before the new UAV replaces the original UAV, the original UAV first completes the switching preparation work with each IoT device cluster. During the switching preparation process, a ciphertext including a shared key between UAVs and a negotiation key between the IoT devices in each IoT device cluster and the original UAV is generated; subsequently, when the IoT device cluster switches with the new UAV, the IoT device cluster uses the ciphertext generated during the switching preparation process to complete mutual authentication with the new UAV, and during the process, the negotiation key between the IoT devices in each IoT device cluster and the new UAV is calculated to establish a secure channel between the IoT device cluster and the new UAV.

[0026] Next, the implementation of the four processes is introduced in detail.

[0027] For ease of explanation, the embodiment of the present invention assumes that there are m IoT device clusters in a UAV coverage area, and each IoT device cluster has n IoT devices. The ground network first completes the communication system configuration. Specifically: the ground network selects a 256-bit random number X as the system master key, and selects a random number GK as the shared key between UAVs in the coverage area, and selects a secure hash function H(): {0,1} * →{0,1} * , and the symmetric encryption algorithm ENC key (), symmetric decryption algorithm DEC key (), where key is a symmetric key; select a key derivation function KDF() and a physical unclonable function PUF(), where R = PUF(C), and C is the PUF challenge value and R is the PUF response value.

[0028] The specific process of the UAV implementing offline registration through the ground network in S10 of the embodiment of the present invention includes:

[0029] The UAV will identify its ID UAV Send to ground network;

[0030] The ground network generates a long-term shared key K for the UAV UAV 、Service validity period UAV , and according to ID UAV 、w UAV Calculate the temporary service ID sID UAV =H(w UAV ,X)⊕ID UAV , and (sID UAV ,w UAV ,K UAV ) is sent to the UAV offline; wherein X is the system master key pre-selected by the ground network, H() represents the hash function, and ⊕ represents the XOR operation.

[0031] In addition, the ground network also generates a random number GK in advance, uses GK as a shared key between UAVs, and sends (GK) to the UAV offline for switching between the new and old UAVs.

[0032] Furthermore, in the embodiment S10 of the present invention, the specific process of each IoT device cluster implementing offline registration through the ground network includes:

[0033] Each IoT device cluster selects an identity (ID GA ) A＝1,...,m , ID GA represents the identity of the Ath IoT device cluster, m represents the number of IoT device clusters in the communication system, and all IoT devices in each IoT device cluster are numbered SN Ai , S.N. Ai represents the ID of the ith IoT device in the Ath IoT device cluster, n represents the number of IoT devices in the Ath IoT device cluster, and GA and SN Ai Calculate the real identity of the corresponding IoT device as ID Ai =ID GA ||SN Ai , ID Ai Indicates the real identity of the ith IoT device in the Ath IoT device cluster; for example, the n IoT devices in the Ath IoT device cluster are numbered as {1,…,n}, that is, the first IoT device is numbered 1, the second IoT device is numbered 2, and so on, and the nth IoT device is numbered n;

[0034] The ground network selects a set of PUF challenge values ​​(C A1 ,…,C Al ,…,C AL ) A＝1,...,m；l＝1,...,L , C Alrepresents the lth PUF challenge value of the Ath IoT device cluster, L represents the number of PUF challenge values, and sends it to each IoT device in the IoT device cluster;

[0035] Each IoT device in the IoT device cluster calculates a PUF response value (R Ail ) i＝1,...,n；l＝1,...,L =PUF(C Al ), R Ail represents the PUF response value calculated by the i-th IoT device in the A-th IoT device cluster for the l-th PUF challenge value, PUF() represents a physical unclonable function, and ({C Al ,R Ail} A＝1,...,m；i＝1,...,n；l＝1,...,L ) is sent offline to the ground network.

[0036] The specific process of offline registration of each IoT device cluster through the ground network also includes:

[0037] The ground network stores (ID GA ,(C A1 ,…,C Al ,…,C AL ),(R Ail ) i＝1,...,n；l＝1,...,L ).

[0038] Further, the UAV access authentication process in S20 of the embodiment of the present invention is as follows Figure 3 As shown, specifically including:

[0039] The UAV obtains the Access number of the access to the ground network and calculates the serial number value SQN based on the Access number UAV =H(K UAV ||'Access number'), according to SQN UAV Calculate the message authentication code MAC UAV =H(K UAV ||sID UAV ||SQN UAV ||w UAV ) and sends an access request message (sID UAV ,SQN UAV ,MAC UAV ,w UAV ) to the ground network; if the drone is accessing for the first time, the Access number is 0;

[0040] After receiving the UAV access request message, the ground network first verifies w UAV Is it valid? If so, the ground network decrypts and obtains the UAV's identity. By ID UAV Find the long-term shared key K corresponding to the UAV UAV ; Then, the ground network checks SQN UAV Is the value valid? If valid, the ground network calculates the local message authentication code XMAC UAV =H(K UAV ||sID UAV ||SQN UAV ||w UAV ) and verify the received message authentication code MAC UAV Is it equal to the local message authentication code XMAC? UAV If they are equal, the ground network calculates the response value XRES for the UAV UAV =H(K UAV ||ID UAV ||SQN UAV ||w UAV ), and calculate the negotiation key K with the UAV UAV-N =KDF(K UAV ||ID UAV ||SQN UAV ); Finally, the ground network increases the access number Accessnumber of the UAV by 1 and sends an access response message (XRES UAV ) to the UAV;

[0041] UAV calculates the local response value RES UAV =H(K UAV ||ID UAV ||SQN UAV ||w UAV ) and verify the received response value XRES UAV Is it equal to the local response value RES? UAV If the verification is successful, the UAV calculates the negotiated key K between the UAV and the ground network. UAV-N =KDF(K UAV ||ID UAV ||SQN UAV ) and increase the access number Accessnumber by 1.

[0042] After the UAV access authentication process, the UAV and the ground network share the negotiation key K UAV-N , to ensure the security of communication data transmission in the communication system.

[0043] In addition, the ground network can update the temporary service identifier sID of the UAV regularly or irregularly. UAV And the service validity period UAV .

[0044] Further, in the embodiment S30 of the present invention, the concurrent access authentication process of multiple clusters of IoT devices is as follows: Figure 4 As shown, specifically including:

[0045] When the gateway in each IoT device cluster discovers the UAV and needs to interact with the ground network through the UAV, the gateway sends a cluster access request message (ID GA ) to the UAV;

[0046] UAV aggregates cluster access request messages from all gateways and forwards multi-cluster access request messages ({ID GA} A＝1,..,m ) to the ground network;

[0047] The ground network is based on each ID GA Find the corresponding IoT device cluster information and randomly select a PUF challenge value C Al And a random number RAND, find the ID GA The information of each IoT device in the IoT device cluster (ID Ai ,C Al ,R Ail ), and calculate the local message authentication code XMAC corresponding to each IoT device Ai =H(ID Ai ||C Al ||R Ail ||RAND), local response value XRES Ai =H(ID GA ||ID Ai ||C Al ||R Ail ||RAND) and the hashed response value XRES * Ai =H(XRES Ai ||sID UAV ); Then, the ground network sends a multi-cluster access response message (RAND, {ID GA ,C Al ,{XMAC Ai ,XRES Ai *} i＝1,..,n} A＝1,..,m ) to the UAV;

[0048] UAV broadcast cluster access response message (RAND, {ID GA ,C Al ,{XMAC Ai} i＝1,..,n} A＝1,..,m ) to all gateways and store locally ({ID GA ,{XRES Ai*} i＝1,..,n} A＝1,..,m );

[0049] Gateway broadcast access response message (RAND, C Al ,{XMAC Ai} i＝1,..,n ) to each IoT device in the corresponding IoT device cluster;

[0050] Each IoT device in the IoT device cluster calculates the corresponding PUF response value R Ail =PUF(C Al ) and the local message authentication code MAC Ai =H(ID Ai ||C Al ||R Ail ||RAND) and verify the received message authentication code XMAC Ai Is it equal to the local message authentication code MAC? Ai If the verification is successful, each IoT device in the IoT device cluster calculates the response value RES Ai =H(ID GA ||ID Ai ||C Al ||R Ail ||RAND), and sends an access confirmation message (RES Ai ) to the corresponding gateway; Finally, the negotiated key K between each IoT device in the IoT device cluster and the ground network i-N =KDF(ID Ai ||C Al ||R Ail ||RAND) and the negotiated key K between the UAV and i-UAV =KDF(sID UAV ||K i-N ), KDF() represents the key derivation function;

[0051] After the gateway receives the corresponding access confirmation message, it calculates the aggregate response value of the corresponding IoT cluster And the hashed aggregate response value At the same time, the flag corresponding to the IoT device cluster RESA Set to 1; then, the gateway sends a cluster access confirmation message Send to UAV;

[0052] After receiving access confirmation response messages from multiple gateways, the UAV responds to each gateway based on the received flag. RESA Select the corresponding response value in the local storage Calculate local aggregate response value Verify local aggregate response value Is it equal to the received aggregate response value RES? * A , if they are equal, then the UAV successfully authenticates each IoT device in the IoT device cluster corresponding to the gateway; at the same time, the UAV receives the aggregate response value RES from multiple gateways. A Calculate the aggregate response value RES UAV =RES A＝1 ⊕...⊕RES A＝m , and send a multi-cluster access confirmation message (RES UAV ,{flag RESA} A＝1,..,m ) to the ground network;

[0053] After receiving the multi-cluster access confirmation message, the ground network RESA Select the response value XRES of each IoT device in the corresponding IoT device cluster Ai , calculate the local aggregate response value XRES UAV =(XRES 11 ⊕...⊕XRES 1n )⊕...⊕(XRES m1 ⊕...⊕XRES mn ), verify the received aggregate response value RES UAV Is it equal to the local aggregate response value XRES? UAV If the verification is successful, the ground network calculates the negotiation key K with each IoT device in the corresponding IoT device cluster. i-N =KDF(ID Ai ||C Al ||R Ail ||RAND), and the negotiation key K between each IoT device and the UAV in the corresponding IoT device cluster i-UAV =KDF(sID UAV ||K i-N ); Then, the ground network will negotiate the key K i-UAV Transmitted to the UAV.

[0054] After the IoT device clusters access authentication process, the IoT devices in each IoT device cluster share the negotiation key K with the UAV. i-UAV , share the negotiated key K with the ground network i-N , to ensure the security of communication data transmission in the communication system.

[0055] Furthermore, the S40 networking device multi-cluster concurrent switching authentication process of the embodiment of the present invention is as follows Figure 5 As shown, specifically including:

[0056] Before the switch is triggered, each IoT device cluster must first complete the switch preparation work with the original UAV, including:

[0057] The original UAV calculates the symmetric key TK for each IoT device in the IoT device cluster corresponding to the gateway Ai =H(GK||ID GA ||sID UAV1 ||ID Ai ), GK represents a random number pre-generated by the ground network as a shared key between UAVs, sID UAV1 Indicates the temporary service identifier of the original UAV and uses the symmetric key TK Ai Calculate the ciphertext Ai =ENC TKAi (H(K i-UAV ||ID Ai ||sID UAV1 )), ENC TKAi () indicates the use of symmetric key TK Ai Then, the original UAV sends a cluster switching preparation notification message ({ID GA ,{Cipher Ai} i＝1,..,n} A＝1,..,m ) to the corresponding gateway;

[0058] The gateway will send a switch preparation notification message ({Cipher Ai} i＝1,..,n} A＝1,..,m ) broadcast to each IoT device in the corresponding IoT device cluster;

[0059] Each IoT device in the IoT device cluster saves the corresponding (Cipher Ai );

[0060] After the switch is triggered, the gateway completes the switch between the physical network device in the IoT device cluster and the new UAV. The switch authentication work includes:

[0061] The new UAV generates a random number RAND1 and broadcasts a cluster switching notification message (sID UAV2 ,RAND1) to all gateways, sID UAV2 A temporary service identifier representing a new UAV;

[0062] The gateway generates a random number RAND A And broadcast the switching notification message (sID UAV2 ,RAND1,RAND A ) to each IoT device in the corresponding IoT device cluster;

[0063] The gateway calculates the negotiation key K with the new UAV for each IoT device in the IoT device cluster. i-UAV * =KDF(H(K i-UAV ||ID Ai ||sID UAV1 )||RAND1||RAND A ), and the message authentication code MAC Ai * =H(ID Ai ||K i-UAV * ||RAND1||sID UAV1 ||sID UAV2 ||Cipher Ai ); Subsequently, the gateway sends a switching request message (ID Ai ,MAC Ai * ,Cipher Ai ) is sent to the corresponding gateway;

[0064] After receiving the handover request message, the gateway sends the ID Ai Corresponding flag MACA Set to 1 and calculate the aggregate message verification code of each IoT device in the IoT device cluster corresponding to the gateway Then, the gateway sends the cluster switching request message (ID GA ,MAC A * ,sID UAV1 ,RAND A ,flag MACA ,{Cipher Ai} i＝1,..,n ) is sent to the new UAV;

[0065] After the new UAV receives cluster switching request messages from multiple gateways, it uses flags to MACA Find the ID of each IoT device in the corresponding IoT device cluster Ai , and calculate the symmetric key TK Ai =H(GK||ID GA ||sID UAV1 ||ID Ai ), and the negotiated key with each IoT device in the corresponding IoT device cluster Indicates the use of symmetric key TK Ai Symmetric decryption algorithm to verify the received message authentication code MAC A *Is it equal to the locally calculated message verification code?

[0066] ||sID UAV1 ||sID UAV2 ||Cipher An ), if the verification is successful, the response value is calculated Finally, the new UAV sends a cluster switch response message ({{XRES Ai *} i＝1,..,n} A＝1,..,m ) broadcast to all gateways;

[0067] The gateway will switch the response message ({XRES Ai *} i＝1,..,n ,flag MACA ) broadcast to each IoT device in the corresponding IoT device cluster;

[0068] Each IoT device in each IoT device cluster calculates a local response value And verify the local response value RES Ai * Is it equal to the received response value XRES? Ai * , if they are equal, the switch is successful.

[0069] After the IoT device multi-cluster concurrent switching authentication process, the IoT devices in each IoT device cluster share the negotiation key K with the new UAV i-UAV * , to ensure the security of communication data transmission in the communication system.

[0070] In summary, the UAV-assisted multi-cluster concurrent access and switching authentication method for IoT devices proposed in the embodiment of the present invention is a feasible, safe and efficient UAV-assisted multi-cluster concurrent access and switching authentication scheme for IoT devices, which comprehensively considers the registration stage of the communication system, the UAV access authentication stage, the multi-cluster concurrent access authentication stage for IoT devices and the multi-cluster concurrent switching authentication stage for IoT devices. In the registration stage, a long-term shared key is introduced for the UAV, and a PUF challenge value is introduced for each IoT device cluster. Then, in the UAV access verification stage, based on the shared key mechanism, the UAV can access the ground network safely and efficiently. At the same time, the UAV and the ground network share a negotiated key to ensure the security of subsequent communication data between the UAV and the ground network. In the multi-cluster concurrent access authentication stage for IoT devices, based on the PUF mechanism, it can effectively avoid the risk of being overloaded due to ultra-high-speed Internet of Things. It can solve the problems of signaling conflicts and congestion failures of key nodes caused by the concurrent access of a large number of devices, and prevent the IoT devices from being subjected to threats such as physical attacks. It can ensure the security of IoT devices under the premise of low storage and computing overhead, making it suitable for resource-constrained IoT devices. At the same time, the IoT devices in each IoT device cluster share a negotiation key with the UAV and the ground network to ensure the security of the subsequent communication data between the IoT devices in each IoT device cluster and the UAV and the ground network. When switching to a new UAV in the concurrent switching authentication stage of multiple clusters of IoT devices, based on the shared key between UAVs, multiple clusters of IoT devices can quickly and safely complete the switch with the new UAV. At the same time, the IoT devices in each IoT device cluster share a negotiation key with the new UAV to ensure the security of the subsequent communication data between the IoT devices in each IoT device cluster and the new UAV.

[0071] In the description of the present invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0072] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art may understand and implement other variations of the disclosed embodiments by viewing the specification and its drawings. In the specification, the word "comprising" does not exclude other components or steps, and "a" or "one" does not exclude multiple situations. Certain measures are recorded in different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0073] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A UAV-assisted multi-cluster concurrent access and switching authentication method for IoT devices, characterized in that: Applied in a communication system including a ground network, a UAV and multiple IoT device clusters, each IoT device cluster including multiple IoT devices and a gateway; the corresponding method includes: Registration process: The UAV and each IoT device cluster register offline through the ground network. When the UAV registers offline through the ground network, a long-term shared key is introduced for the UAV. When each IoT device cluster registers offline through the ground network, a PUF challenge value is introduced for each IoT device cluster. UAV access authentication process: Based on the long-term shared key, the UAV sends an access request message to the ground network, the ground network verifies the access request message sent by the UAV and returns an access response message, and the UAV verifies the access response message sent by the ground network to complete the UAV access authentication; and the negotiation key of the UAV and the ground network is calculated in the process to establish a secure channel between the UAV and the ground network; Concurrent access authentication process of multiple clusters of IoT devices: the ground network sends the PUF challenge value to each IoT device cluster, each IoT device cluster calculates the corresponding PUF response value according to the PUF challenge value, and sends it to the gateway in the corresponding IoT device cluster, the gateway aggregates all PUF response values ​​and sends them to the UAV, the UAV verifies and further aggregates the PUF response value and sends it to the ground network, the ground network verifies the PUF response value aggregated by the UAV to complete the concurrent access authentication of multiple clusters of IoT devices; and the negotiation key between the IoT device in each IoT device cluster and the UAV and the ground network is calculated in the process to establish a secure channel between the IoT device cluster and the UAV and the ground network; Concurrent switching authentication process of multiple clusters of IoT devices: When the original UAV is replaced, before the new UAV replaces the original UAV, the original UAV first completes the switching preparation with each IoT device cluster. During the switching preparation process, a ciphertext including a shared key between UAVs and a negotiation key between the IoT devices in each IoT device cluster and the original UAV is generated; subsequently, when the IoT device cluster switches with the new UAV, the IoT device cluster uses the ciphertext generated during the switching preparation process to complete mutual authentication with the new UAV, and during the process, the negotiation key between the IoT devices in each IoT device cluster and the new UAV is calculated to establish a secure channel between the IoT device cluster and the new UAV.

2. According to the UAV-assisted multi-cluster concurrent access and switching authentication method for IoT devices according to claim 1, it is characterized in that: The specific process of UAV offline registration through the ground network includes: The UAV will identify its ID UAV Send to ground network; The ground network generates a long-term shared key K for the UAV UAV 、Service validity period UAV , and according to ID UAV 、w UAV Calculate the temporary service ID sID UAV =H(w UAV ,X)⊕ID UAV , and (sID UAV ,w UAV ,K UAV ) is sent to the UAV offline; where X is the system master key pre-selected by the ground network, H( ) represents the hash function, and ⊕ represents the XOR operation.

3. The method for concurrent access and switching authentication of multiple clusters of IoT devices based on UAV assistance according to claim 2 is characterized in that: The specific process of offline registration of each IoT device cluster through the ground network includes: Each IoT device cluster selects an identity (ID GA ) A＝1,...,m , ID GA represents the identity of the Ath IoT device cluster, m represents the number of IoT device clusters in the communication system, and all IoT devices in each IoT device cluster are numbered SN Ai , S.N. Ai represents the ID of the ith IoT device in the Ath IoT device cluster, n represents the number of IoT devices in the Ath IoT device cluster, and GA and SN Ai Calculate the real identity of the corresponding IoT device as ID Ai =ID GA ||SN Ai , ID Ai Represents the real identity of the i-th IoT device in the A-th IoT device cluster; The ground network selects a set of PUF challenge values ​​(C A1 ,…,C Al ,…,C AL ) A＝1,...,m；l＝1,...,L , C Al represents the lth PUF challenge value of the Ath IoT device cluster, L represents the number of PUF challenge values, and sends it to each IoT device in the IoT device cluster; Each IoT device in the IoT device cluster calculates a PUF response value (R Ail ) i＝1,...,n；l＝1,...,L =PUF(C Al ), R Ail represents the PUF response value calculated by the i-th IoT device in the A-th IoT device cluster for the l-th PUF challenge value, PUF() represents a physical unclonable function, and ({C Al ,R Ail } A＝1,...,m；i＝1,...,n；l＝1,...,L ) is sent offline to the ground network.

4. The method for concurrent access and switching authentication of multiple clusters of IoT devices based on UAV assistance according to claim 3 is characterized in that: The specific process of offline registration of each IoT device cluster through the ground network also includes: The ground network stores (ID GA ,(C A1 ,…,C Al ,…,C AL ),(R Ail ) i＝1,...,n；l＝1,...,L ).

5. The method for concurrent access and switching authentication of multiple clusters of IoT devices based on UAV assistance according to claim 2 is characterized in that: The UAV access authentication process specifically includes: The UAV obtains the number of times it accesses the ground network, Accessnumber, and calculates the sequence number value SQN based on Accessnumber. UAV =H(K UAV ||'Accessnumber'), according to SQN UAV Calculate the message authentication code MAC UAV =H(K UAV ||sID UAV ||SQN UAV ||w UAV ) and sends an access request message (sID UAV ,SQN UAV ,MAC UAV ,w UAV ) to the ground network; After receiving the UAV access request message, the ground network first verifies w UAV Is it valid? If it is valid, the ground network decrypts it to obtain the UAV's ID UAV =H(w UAV ,X)⊕sID UAV , according to ID UAV Find the long-term shared key K corresponding to the UAV UAV ; Then, the ground network checks SQN UAV Is the value valid? If valid, the ground network calculates the local message authentication code XMAC UAV =H(K UAV ||sID UAV ||SQN UAV ||w UAV ) and verify the received message authentication code MAC UAV Is it equal to the local message authentication code XMAC? UAV If they are equal, the ground network calculates the response value XRES for the UAV UAV =H(K UAV ||ID UAV ||SQN UAV ||w UAV ), and calculate the negotiation key K with the UAV UAV-N =KDF(K UAV ||ID UAV ||SQN UAV ), KDF() represents the key derivation function; finally, the ground network increases the access number Accessnumber of the UAV by 1 and sends an access response message (XRES UAV ) to the UAV; UAV calculates the local response value RES UAV =H(K UAV ||ID UAV ||SQN UAV ||w UAV ) and verify the received response value XRES UAV Is it equal to the local response value RES? UAV If the verification is successful, the UAV calculates the negotiated key K between the UAV and the ground network. UAV-N =KDF(K UAV ||ID UAV ||SQN UAV ) and increase the access number Accessnumber by 1.

6. The method for concurrent access and switching authentication of multiple clusters of IoT devices based on UAV assistance according to claim 5 is characterized in that: After the UAV access authentication process, the UAV and the ground network share the negotiation key K UAV-N , to ensure the security of communication data transmission in the communication system.

7. The method for concurrent access and switching authentication of multiple clusters of IoT devices based on UAV assistance according to claim 3 is characterized in that: The authentication process for concurrent access of multiple clusters of IoT devices specifically includes: When the gateway in each IoT device cluster discovers the UAV and needs to interact with the ground network through the UAV, the gateway sends a cluster access request message (ID GA ) to the UAV; UAV aggregates cluster access request messages from all gateways and forwards multi-cluster access request messages ({ID GA } A＝1,..,m ) to the ground network; The ground network is based on each ID GA Find the corresponding IoT device cluster information and randomly select a PUF challenge value C Al And a random number RAND, find the ID GA The information of each IoT device in the IoT device cluster (ID Ai ,C Al ,R Ail ), and calculate the local message authentication code XMAC corresponding to each IoT device Ai =H(ID Ai ||C Al ||R Ail ||RAND), local response value XRES Ai =H(ID GA ||ID Ai ||C Al ||R Ail ||RAND) and the hashed response value Then, the ground network sends a multi-cluster access response message (RAND, {ID GA ,C Al ,{XMAC Ai ,XRES Ai * } i＝1,..,n } A＝1,..,m ) to the UAV; UAV broadcast cluster access response message (RAND, {ID GA ,C Al ,{XMAC Ai } i＝1,..,n } A＝1,..,m ) to all gateways and store locally ({ID GA ,{XRES Ai * } i＝1,..,n } A＝1,..,m ); Gateway broadcast access response message (RAND, C Al ,{XMAC Ai } i＝1,..,n ) to each IoT device in the corresponding IoT device cluster; Each IoT device in the IoT device cluster calculates the corresponding PUF response value R Ail =PUF(C Al ) and the local message authentication code MAC Ai =H(ID Ai ||C Al ||R Ail ||RAND) and verify the received message authentication code XMAC Ai Is it equal to the local message authentication code MAC? Ai If the verification is successful, each IoT device in the IoT device cluster calculates the response value RES Ai =H(ID GA ||ID Ai ||C Al ||R Ail ||RAND), and sends an access confirmation message (RES Ai ) to the corresponding gateway; Finally, the negotiated key K between each IoT device in the IoT device cluster and the ground network i-N =KDF(ID Ai ||C Al ||R Ail ||RAND) and the negotiated key K between the UAV and i-UAV =KDF(sID UAV ||K i-N ), KDF() represents the key derivation function; After the gateway receives the corresponding access confirmation message, it calculates the aggregate response value RES of the corresponding IoT cluster A =RES A1 ⊕...⊕RES An And the hashed aggregate response value At the same time, the flag corresponding to the IoT device cluster RESA Set to 1; then, the gateway sends a cluster access confirmation message Send to UAV; After receiving access confirmation response messages from multiple gateways, the UAV responds to each gateway based on the received flag. RESA Select the corresponding response value in the local storage Calculate local aggregate response value Verify local aggregate response value Is it equal to the received aggregate response value? If they are equal, the UAV successfully authenticates each IoT device in the IoT device cluster corresponding to the gateway; at the same time, the UAV receives the aggregate response value RES from multiple gateways. A Calculate the aggregate response value RES UAV =RES A＝1 ⊕...⊕RES A＝m , and send a multi-cluster access confirmation message (RES UAV ,{flag RESA } A＝1,..,m ) to the ground network; After receiving the multi-cluster access confirmation message, the ground network RESA Select the response value XRES of each IoT device in the corresponding IoT device cluster Ai , calculate the local aggregate response value XRES UAV =(XRES 11 ⊕...⊕XRES 1n )⊕...⊕(XRES m1 ⊕...⊕XRES mn ), verify the received aggregate response value RES UAV Is it equal to the local aggregate response value XRES? UAV If the verification is successful, the ground network calculates the negotiation key K with each IoT device in the corresponding IoT device cluster. i-N =KDF(ID Ai ||C Al ||R Ail ||RAND), and the negotiation key K between each IoT device and the UAV in the corresponding IoT device cluster i-UAV =KDF(sID UAV ||K i-N ); Then, the ground network will negotiate the key K i-UAV Transmitted to the UAV.

8. The method for concurrent access and switching authentication of multiple clusters of IoT devices based on UAV assistance according to claim 7 is characterized in that: After the IoT device clusters access authentication process, the IoT devices in each IoT device cluster share the negotiation key K with the UAV. i-UAV , share the negotiated key K with the ground network i-N , to ensure the security of communication data transmission in the communication system.

9. The method for concurrent access and switching authentication of multiple clusters of IoT devices based on UAV assistance according to claim 7 is characterized in that: The IoT device multi-cluster concurrent switching authentication process specifically includes: Preparation for the switch includes: The original UAV calculates the symmetric key TK for each IoT device in the IoT device cluster corresponding to the gateway Ai =H(GK||ID GA ||sID UAV1 ||ID Ai ), GK represents a random number pre-generated by the ground network as a shared key between UAVs, sID UAV1 Indicates the temporary service identifier of the original UAV and uses the symmetric key TK Ai Calculate the ciphertext Ai =ENC TKAi (H(K i-UAV ||ID Ai ||sID UAV1 )), ENC TKAi () indicates the use of symmetric key TK Ai Then, the original UAV sends a cluster switching preparation notification message ({ID GA ,{Cipher Ai } i＝1,..,n } A＝1,..,m ) to the corresponding gateway; The gateway will send a switch preparation notification message ({Cipher Ai } i＝1,..,n } A＝1,..,m ) broadcast to each IoT device in the corresponding IoT device cluster; Each IoT device in the IoT device cluster saves the corresponding (Cipher Ai ); Switching certification work includes: The new UAV generates a random number RAND1 and broadcasts a cluster switching notification message (sID UAV2 ,RAND1) to all gateways, sID UAV2 A temporary service identifier representing a new UAV; The gateway generates a random number RAND A And broadcast the switching notification message (sID UAV2 ,RAND1,RAND A ) to each IoT device in the corresponding IoT device cluster; The gateway calculates the negotiation key K with the new UAV for each IoT device in the IoT device cluster. i-UAV * =KDF(H(K i-UAV ||ID Ai ||sID UAV1 )||RAND1||RAND A ), and the message authentication code MAC Ai * =H(ID Ai ||K i-UAV * ||RAND1||sID UAV1 ||sID UAV2 ||Cipher Ai ); Subsequently, the gateway sends a switching request message (ID Ai ,MAC Ai * ,Cipher Ai ) is sent to the corresponding gateway; After receiving the handover request message, the gateway sends the ID Ai Corresponding flag MACA Set to 1 and calculate the aggregate message authentication code MAC of each IoT device in the IoT device cluster corresponding to the gateway A * =MAC A1 * ⊕....⊕MAC An * ; Then, the gateway sends the cluster switching request message (ID GA ,MAC A * ,sID UAV1 ,RAND A ,flag MACA ,{Cipher Ai } i＝1,..,n ) is sent to the new UAV; After the new UAV receives cluster switching request messages from multiple gateways, it uses flags to MACA Find the ID of each IoT device in the corresponding IoT device cluster Ai , and calculate the symmetric key TK Ai =H(GK||ID GA ||sID UAV1 ||ID Ai ), and the negotiated key with each IoT device in the corresponding IoT device cluster DEC TKAi () indicates the use of symmetric key TK Ai Symmetric decryption algorithm to verify the received message authentication code MAC A * Is it equal to the locally calculated message authentication code XMAC? A * =H(ID A1 ||K 1-UAV * ||RAND1||sID UAV1 ||sID UAV2 ||Cipher A1 )⊕...⊕H(ID An ||K n-UAV * ||RAND1 ||sID UAV1 ||sID UAV2 ||Cipher An ), if the verification is successful, the response value is calculated Finally, the new UAV sends a cluster switch response message ({{XRES Ai * } i＝1,..,n } A＝1,..,m ) broadcast to all gateways; The gateway will switch the response message ({XRES Ai * } i＝1,..,n ,flag MACA ) broadcast to each IoT device in the corresponding IoT device cluster; Each IoT device in each IoT device cluster calculates a local response value And verify the local response value RES Ai * Is it equal to the received response value XRES? Ai * , if they are equal, the switch is successful.

10. The method for concurrent access and switching authentication of multiple clusters of IoT devices based on UAV assistance according to claim 9 is characterized in that: After the IoT device multi-cluster concurrent switching authentication process, the IoT devices in each IoT device cluster share the negotiation key K with the new UAV i-UAV * , to ensure the security of communication data transmission in the communication system.

Images