A controlled sharing method and system for Internet of Vehicles data

Abstract

The present invention relates to the field of vehicle networking communication technology, and discloses a method and system for controlled sharing of vehicle networking data. The method includes a data uploading stage: the data owner uses a quantum session key to encrypt the data plaintext into ciphertext, and uploads the ciphertext to a cloud server; the quantum session key is composed of a quantum key generated by the data owner and a quantum key distributed by the cloud server; the data owner also performs identity authentication when interacting with the cloud server. Authorization access stage: the data uploader obtains public key information from the blockchain based on the pseudonym information of the data accessor, constructs an authorization message containing the service data ciphertext, and broadcasts it to the data accessor and the cloud server. Data decryption stage: the data accessor calculates a temporary authorization code based on the authorization message, and uses the temporary authorization code to restore the quantum session key to decrypt the service data ciphertext. The present invention can realize the rapid sharing of vehicle networking data among multiple receiving entities and protect the privacy of the data.

Description

Technical Field

[0001] The present invention relates to the field of vehicle networking communication technology, and in particular to a method and system for controlled sharing of vehicle networking data. Background Art

[0002] As the functions of connected cars become more and more complex, the amount and type of data they generate during driving are also increasing. Sharing data between connected vehicles can improve users' driving experience and reduce traffic pressure. However, the leakage of user privacy information caused by data sharing may harm the interests and safety of vehicle users. At the same time, since the quality of data collected by vehicles varies, high-quality data sharing means that users get more reliable services, while low-quality data will reduce service reliability, reduce driving experience, and even cause traffic accidents.

[0003] At present, the Internet of Vehicles system uses sensors and interconnected devices to transmit key information and provide cloud servers for connected vehicles. In order to protect the privacy of Internet of Vehicles users, the information collected by sensors needs to be encrypted before uploading to the cloud. However, although the existing Internet of Vehicles data encryption schemes have achieved data confidentiality and authenticity, they have not taken into account data sharing in multi-receiver scenarios, such as data sharing between various devices in V2X. Moreover, in these schemes, the session keys between communication entities are generated through negotiation or issuance by the key center, facing problems such as key escrow and key leakage attacks. At the same time, most of these schemes use proxy re-encryption technology based on bilinear pairings to achieve secure sharing of vehicle data. However, the high computational complexity of bilinear pairing operations will lead to high latency, which is difficult to meet the needs of rapid response of cloud services in intelligent transportation systems, and therefore needs to be solved urgently. Summary of the invention

[0004] In order to solve the technical problems existing in the prior art, the present invention provides a method and system for controlled sharing of Internet of Vehicles data, which can realize rapid sharing of Internet of Vehicles data among multiple receiving entities and protect the privacy of the data.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] The present invention discloses a method for controlled sharing of vehicle network data, comprising:

[0007] Data upload stage: The data owner uses the quantum session key to encrypt the data plaintext into ciphertext, and uploads the ciphertext to the cloud server; wherein the quantum session key is formed by the quantum key generated by the quantum random number generator of the data owner and the pre-injected quantum key; the data owner also performs identity authentication when interacting with the cloud server.

[0008] Authorized access phase: When the data access party needs to obtain service data, the cloud server queries the corresponding data uploader and informs the data uploader of the data access party's pseudonym information; the data uploader obtains the data access party's public key information from the blockchain based on the pseudonym information, and constructs an authorization message containing the service data ciphertext and broadcasts it to the data access party and the cloud server.

[0009] Data decryption stage: The data access party calculates a temporary authorization code based on the authorization message, and uses the temporary authorization code to recover the quantum session key to decrypt the service data ciphertext.

[0010] As a further improvement of the above solution, the method for controlled sharing of Internet of Vehicles data further includes:

[0011] Initialization phase: The cloud server selects elliptic curve y 2 =x 3 +ax+bmod q, and select a one-way hash function h, and then disclose the system parameters Para; where Para = {P, q, h, PuK C}; The elliptic curve satisfies 4a 3 +27b 2 ≠0, mod q means modulo q, q is a prime number greater than 3, a,b∈F p , F p represents a finite field, P is the base point of the elliptic curve; PuK C The public key of the cloud server.

[0012] As a further improvement of the above solution, the method for controlled sharing of Internet of Vehicles data further includes:

[0013] Registration phase: Each communication entity sends its real identity ID to the cloud server; each communication entity is a vehicle or a roadside unit or a third-party cloud server.

[0014] The cloud server obtains the temporary identity key TQK and the key index Ktag of the communication entity from its own database TQK , generate the pseudonym PID, public-private key pair (PK, SK), authentication parameters Pub = TQK·P and PSK = f·TQK-SK corresponding to the communication entity, and then construct the message m R1 And send message m through the secure channel R1 To the corresponding communication entity, call the blockchain's smart contract writing interface at the same time, and write the pseudonym, public key and key index Ktag of the communication entity TQK Deposited into blockchain; Indicates XOR operation; PK = SK·P; f = h(PID||PK)modq; m R1={PID,(PK,SK),Pub,PSK,f}; || is a connection symbol.

[0015] The communication entity receives the message m R1 Then store the content of the message.

[0016] As a further improvement of the above solution, the data owner is a vehicle; the data access party is a vehicle or a roadside unit or a third-party cloud server, and the number of the data access parties is greater than 1.

[0017] Among them, for any vehicle V i , the data upload phase includes the following specific steps:

[0018] Vehicle V i Extract the (SQK i ,Ktag SQKi ), select a random number K and calculate the security parameter Spa; where SQK i For vehicle V i Security parameter key, Ktag SQKi For SQK i Key index of; Spa=K·P.

[0019] Vehicle V i Select the quantum key QK generated by its own quantum random number generator i and QK i Key index Ktag QKi , and extract the quantum key EQK distributed by the cloud server from its own security chip i and EQK i Key index Ktag EQKi , and use symmetric encryption to encrypt the data plaintext M to generate ciphertext C i Among them, C i =E SEK (M i ); SEK is the quantum session key, SEK = (QK i ||EQK i );E SEK (·) indicates a symmetric encryption algorithm using SEK as the key.

[0020] Vehicle V i Calculate signature parameters r and S to generate message signature δ Vi , then calculate the message verification code Mac1 and construct the message m A1 And send message m through the public channel A1 To the cloud server; where r = g + Spa modq, S = (1 + SK Vi )-1 [K+(SQK i -r) SK Vi ]modq, g=h(SQK i ||C i ||Req);SK Vi For vehicle V i Req is a message request, and the types of message requests include message requests for data upload, message requests for data request, and message requests for registration; Vi =(Ktag SQKi ,r,S); Mac1=h(δ Vi ||C i ||Req||t1);m A1 =(Req||δ Vi ||Mac1||C i ||t1); t1 is the vehicle V i The timestamp generated when Mac1 was calculated.

[0021] The cloud server receives the message m A1 Generate a timestamp t1', determine whether the inequality t1'-t1≤Δt holds, and if so, calculate the message verification code And judge the equation Is it true? If so, determine whether the type of Req is a message request for data upload. If so, the cloud server will SQKi Query and obtain the security parameter key SQK from the data memory i , and calculate g * =h(SQK i ||C i ||Req), Spa * =S·P+(r+S-SQK i )·PK Vi , r * =g * +Spa * modq; Δt is the preset duration; PK Vi For vehicle V i The public key of

[0022] Cloud server judgment * Is it equal to r? If so, then the vehicle V i The identity is legitimate, and the cloud server stores the encrypted data C i .

[0023] As a further improvement of the above solution, if the service data that the data access party needs to obtain comes from the vehicle V i , the authorization access phase includes the following specific steps:

[0024] When the data access party needs to obtain service data, it sends a query request to the cloud server and requests authorization from the data owner;

[0025] The cloud server verifies the identity of the data accessor. If it is legitimate, it will query the database to find that the data owner of the service data is the vehicle V. i After that, the pseudonym information set of all data access parties requesting authorization is sent to the vehicle V i ; The pseudonym information set is represented by {PID1, PID2, ···, PID n}, PID j Represents the pseudonym information of the jth data access party, j = 1, 2, ..., n, n is the total number of data access parties, n ≥ 2.

[0026] Vehicle V i Calculate temporary authorization code And construct the following equation R1 and R2 are two randomly selected quantum random numbers; then the vehicle V i Construct the Lagrange interpolation polynomial F(x):

[0027]

[0028] Among them, F j (x) is the jth Lagrangian basis function, When x=x j When F j (x) = 1, the Lagrange interpolation polynomial passes through n known data points (x1, y1), (x2, y2), ..., (x n ,y n ), and thus solve the coefficients a1, a2, …, a n .

[0029] Vehicle V i Generate authorization information A Info ={Ak1,Ak2}; where Ak1 = (R1||R2), Ak2 = (a1,a2,...,a n ).

[0030] Vehicle V i By calling the blockchain's smart contract information query interface, the public key information PK of the data access party is obtained. j , then the vehicle V i choose And calculate the temporary authorization key KQK i and message verification code Mac2; where R Si is a random number, represents the group of all integers coprime to q under multiplication modulo q; Mac2=h(A Info ||C i ||D i ||KQK i ||t2);E i =R Si ·PK j ;D i =R Si ·P; t2 is the vehicle V i The timestamp generated when Mac2 was calculated.

[0031] Vehicle V i Construct authorization message m A2 And the authorization message m A2 Broadcast to data access entities and cloud servers; where m A2 ={A Info ,C i ,D i ,KQK i ,Mac2,t2}.

[0032] As a further improvement of the above solution, in the early stage of the authorized access phase, the cloud server verifies the identity of the data access party including the following steps:

[0033] Step 1: n data access parties initiate identity authentication to the cloud server; the authentication process for the jth data access party is as follows:

[0034] The jth data access party selects the authentication random number AR j And calculate X j =AR j P, calculate batch signature parameters: e j =h(PID j ||X j ), f j =h(PID j ||PK j ), S j =(AR j +e j ) -1 (SK j -f j -1 PSK j ), where PID j ,PK j SK j 、f j and PSK j They are the pseudonym, public key, private key, f and PSK of the jth data access party respectively;

[0035] The jth data access party generates the corresponding signature message m j =(Req'||δ j ||PID j ||AR j ), where δ j =(S j ,X j ); Req' is a message request;

[0036] Step 2: When the cloud server receives the signed messages from n data access parties, after determining that the type of each Req' is a message request for data request, it performs batch signature verification to improve the efficiency of identity authentication. The specific process is as follows:

[0037] Cloud server calculation parameters e j =h(PID j ||X j ), f j * =h(PID j ||PK j ) and BPK j =PK j -AR j ;

[0038] Cloud Server Verification Batch Authentication Equation Is it true? If so, the identities of all data access parties are legal.

[0039] As a further improvement of the above solution, in the data decryption stage, the data access party calculates the temporary authorization code according to the authorization message, including:

[0040] After receiving the authorization message m A2 Generate timestamp t2', determine whether the inequality t2'-t2≤Δt holds, and if so, calculate the message verification code And judge the equation Is it established? If established, then according to the authorization information A Info ={Ak1,Ak2} calculation y j =F(x j ), from which the temporary authorization code is calculated

[0041] As a further improvement of the above solution, in the data decryption stage, the use of the temporary authorization code to recover the quantum session key to decrypt the service data ciphertext includes:

[0042] Data access party calculates quantum key identity And through Ktag EQKi *Get the first part of the quantum session key, the quantum key, from the cloud server

[0043] Data access party calculation Thus, the second part of the quantum session key is calculated

[0044]

[0045] The data access party calculates the quantum session key So through the equation Get the data plaintext; among them, Indicates A symmetric decryption algorithm with a key.

[0046] As a further improvement of the above solution, when any communication entity exhibits malicious behavior, the cloud server traces the real identity of the communication entity and revokes the cloud service authority. The specific process is as follows:

[0047] The cloud server calls the information query interface of the blockchain's smart contract to obtain the key index Ktag of the temporary identity key of the malicious communication entity. TQK , query the corresponding temporary identity key TQK according to the key index, and thus calculate the real identity of the malicious communication entity The registration information of the malicious communication entity is revoked according to the real identity, and the public key information of the malicious communication entity is revoked by calling the revocation interface of the smart contract. When the cloud server detects that any communication entity reports data at an abnormal frequency, the communication entity is judged as a malicious communication entity.

[0048] The present invention also discloses a controlled sharing system for Internet of Vehicles data, which applies the controlled sharing method for Internet of Vehicles data as described above; the controlled sharing system for Internet of Vehicles data includes a blockchain, a cloud server, a data owner and a data access party; wherein the data owner is a vehicle; the data access party is a vehicle or a roadside unit or a third-party cloud server, and the number of data access parties is greater than 1.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] 1. The invention discloses a controlled sharing method for Internet of Vehicles data. The quantum session key between communication entities is generated by a quantum key generated by a quantum random number generator integrated by the data owner and a pre-filled quantum key. Only authorized data accessors can obtain the session key, which realizes the privacy of the session key and avoids the problems of key escrow and key leakage attacks. Batch authorization can realize the rapid sharing of Internet of Vehicles data among multiple receiving entities and protect the privacy of data.

[0051] 2. The present invention proposes a data authorization access mechanism based on quantum key and lightweight signature algorithm. Compared with the traditional data sharing scheme based on proxy re-encryption, this mechanism has lower computational complexity and communication latency, and can realize controlled data sharing in scenarios with multiple receiving communication entities.

[0052] 3. The present invention proposes lightweight batch identity authentication, and the cloud server can authenticate the identities of multiple data accessors at the same time, which can reduce the communication rounds and computational complexity of identity authentication, thereby improving the response speed of data sharing requests.

[0053] 4. The present invention proposes to use blockchain to record only the identities of communication entities in the Internet of Vehicles system. Compared with the traditional blockchain-based data sharing solution, the data sharing process of the present invention only queries the identities of communication entities through blockchain, and does not perform blockchain write operations, thereby avoiding the calculation delay caused by block consensus. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a network architecture diagram for controlled sharing of Internet of Vehicles data in an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] This embodiment provides a controlled sharing system for Internet of Vehicles data, including a blockchain, a cloud server, a data owner, and a data access party. The data owner is a vehicle; the data access party is a vehicle or a roadside unit or a third-party cloud server, and the number of data access parties is greater than 1. In this embodiment, the data access party is n vehicle data requesting parties, n≥2.

[0057] Among them, blockchain is a decentralized distributed ledger that is tamper-proof, secure and reliable. Smart contracts are computer protocols stored on blockchains, written in programming languages ​​(such as Solidity), and can automatically execute related operations when preset conditions are met without human intervention. Principle: The operation of smart contracts is based on the distributed ledger technology of blockchains, which realizes decentralized information verification and dissemination through point-to-point links. This link is distributed and there is no centralization, which ensures the immutability and transparency of the contract content. Smart contracts write the contract content into the blockchain in a digital form. Each contract will be copied and stored in the distributed ledger, and all transaction information will not be destroyed or tampered with.

[0058] The vehicle is equipped with a quantum random number generator (QRNG). A quantum random number generator is a device that generates true random numbers based on the principles of quantum mechanics. It uses the uncertainty of the quantum state of microscopic particles (such as photons) to generate an unpredictable and theoretically unrepeatable sequence of random numbers. This randomness is derived from the intrinsic randomness in quantum mechanics, which ensures the high security and unpredictability of random numbers. QRNG has a wide range of applications in information security, encrypted communications, scientific research sampling and other fields, and can significantly improve the security and randomness quality of the system. With the rapid development of quantum technology, QRNG technology is also constantly improving, gradually realizing more efficient, more stable and more economical random number generation solutions, providing strong support for future information security protection.

[0059] See also Figure 1 This embodiment also provides a method for controlled sharing of Internet of Vehicles data, which is applied to the above-mentioned Internet of Vehicles data controlled sharing system. The method for controlled sharing of Internet of Vehicles data includes: S1, initialization phase, S2, registration phase, S3, data uploading phase, S4, authorized access phase, and S5, data decryption phase.

[0060] For ease of understanding, the relevant symbols in the method are explained as shown in Table 1 below.

[0061] Table 1: Explanation of relevant symbols in the method

[0062]

[0063]

[0064] S1, initialization phase: the cloud server selects the elliptic curve y 2 =x 3 +ax+bmod q, and select a one-way hash function h, and then disclose the system parameters Para; where Para = {P, q, h, PuK C}; The elliptic curve satisfies 4a 3 +27b2 ≠0, mod q means modulo q, q is a prime number greater than 3, a,b∈F p , F p represents a finite field, P is the base point of the elliptic curve; PuK C The public key of the cloud server.

[0065] Elliptic Curve Cryptography (ECC) is an advanced public key cryptography technology that builds a security system based on mathematical operations on elliptic curves. ECC uses point groups and discrete logarithm problems on elliptic curves to achieve encryption, decryption, key exchange, and digital signatures. Compared with traditional encryption algorithms (such as RSA), ECC can provide the same or higher security level with a shorter key length, thereby saving storage space and computing resources. It is widely used in blockchain technology, network security, the Internet of Things and other fields, providing strong security for data communications and transactions.

[0066] S2: Registration phase, which includes steps S21 to S23.

[0067] S21. Each communication entity sends its own real identity ID to the cloud server; wherein each communication entity is a vehicle or a roadside unit or a third-party cloud server.

[0068] S22, the cloud server obtains the temporary identity key TQK and the key index Ktag of the communication entity from its own database TQK , generate the pseudonym PID, public-private key pair (PK, SK), authentication parameters Pub = TQK·P and PSK = f·TQK-SK corresponding to the communication entity, and then construct the message m R1 And send message m through the secure channel R1 To the corresponding communication entity, call the blockchain's smart contract writing interface at the same time, and write the pseudonym, public key and key index Ktag of the communication entity TQK Deposited into blockchain; where Indicates XOR operation; PK = SK·P; f = h(PID||PK)modq; m R1 ={PID,(PK,SK),Pub,PSK,f}; || is a connection symbol.

[0069] It should be noted that the secure channel usually appears during the registration phase. This means that this channel will not be attacked. The public channel means that there may be attackers and needs to be protected by a security protocol.

[0070] S23, the communication entity receives the message m R1 Then store the content of the message.

[0071] S3, data upload stage: the data owner uses the quantum session key to encrypt the data plaintext into ciphertext, and uploads the ciphertext to the cloud server; wherein, the quantum session key is formed by the quantum key generated by the quantum random number generator of the data owner and the pre-injected quantum key; the data owner also performs identity authentication when interacting with the cloud server for data.

[0072] For any vehicle V i , its data uploading stage includes the following specific steps, namely S31 to S35.

[0073] S31, Vehicle V i Extract the (SQK) pre-distributed by the cloud server from its own security chip (i.e., the vehicle-side integrated security chip) i ,Ktag SQKi ), select a random number K and calculate the security parameter Spa; where SQK i For vehicle V i Security parameter key, Ktag SQKi For SQK i Key index of; Spa=K·P.

[0074] S32, Vehicle V i Select the quantum key QK generated by its own quantum random number generator i and QK i Key index Ktag QKi , and extract the quantum key EQK distributed by the cloud server from its own security chip i and EQK i Key index Ktag EQKi , and use symmetric encryption to encrypt the data plaintext M to generate ciphertext C i Among them, C i =E SEK (M i ); SEK is the quantum session key, SEK = (QK i ||EQK i );E SEK (·) indicates a symmetric encryption algorithm using SEK as the key.

[0075] S33, Vehicle V i Calculate signature parameters r and S to generate message signature δ Vi , then calculate the message verification code Mac1 and construct the message m A1 And send message m through the public channel A1 To the cloud server; where r = g + Spa modq, S = (1 + SK Vi ) -1 [K+(SQK i-r) SK Vi ]modq, g=h(SQK i ||C i ||Req);SK Vi For vehicle V i Req is a message request, and the types of message requests include message requests for data upload, message requests for data request, and message requests for registration; Vi =(Ktag SQKi ,r,S); Mac1=h(δ Vi ||C i ||Req||t1);m A1 =(Req||δ Vi ||Mac1||C i ||t1); t1 is the vehicle V i The timestamp generated when Mac1 was calculated.

[0076] S34, the cloud server receives the message m A1 Generate a timestamp t1', determine whether the inequality t1'-t1≤Δt holds, and if so, calculate the message verification code And judge the equation Is it true? If so, determine whether the type of Req is a message request for data upload. If so, the cloud server will SQKi Query and obtain the security parameter key SQK from the data memory i , and calculate g * =h(SQK i ||C i ||Req), Spa * =S·P+(r+S-SQK i )·PK Vi , r * =g * +Spa * modq; Δt is the preset duration; PK Vi For vehicle V i The public key of

[0077] S35, cloud server judgment r * Is it equal to r? If so, then the vehicle V i The identity is legitimate, and the cloud server stores the encrypted data C i .

[0078] S4, authorized access stage: When the data access party needs to obtain service data, the cloud server queries the corresponding data uploader and informs the data uploader of the data access party's pseudonym information; the data uploader obtains the data access party's public key information from the blockchain based on the pseudonym information, constructs an authorization message containing the service data ciphertext, and broadcasts it to the data access party and the cloud server.

[0079] If the service data that the data access party needs to obtain comes from the vehicle V i , then the authorized access stage includes the following specific steps, namely S41 to S46.

[0080] S41. When the data access party needs to obtain service data, it sends a query request to the cloud server and requests authorization from the data owner.

[0081] S42, the cloud server verifies the identity of the data access party, and if it is legitimate, it searches the database to find that the data owner corresponding to the service data is the vehicle V i After that, the pseudonym information set of all data access parties requesting authorization is sent to the vehicle V i ; The pseudonym information set is represented by {PID1, PID2, ···, PID n}, PID j Represents the pseudonym information of the jth data access party, j = 1, 2, ..., n, n is the total number of data access parties, n ≥ 2.

[0082] S43, Vehicle V i Calculate temporary authorization code And construct the following equation R1 and R2 are two randomly selected quantum random numbers; then the vehicle V i Construct the Lagrange interpolation polynomial F(x):

[0083]

[0084] Among them, F j (x) is the jth Lagrangian basis function, When x=x j When F j (x) = 1, the Lagrange interpolation polynomial passes through n known data points (x1, y1), (x2, y2), ..., (x n ,y n ), and thus solve the coefficients a1, a2, …, a n .

[0085] S44, Vehicle V i Generate authorization information A Info={Ak1,Ak2}; where Ak1 = (R1||R2), Ak2 = (a1,a2,...,a n ).

[0086] S45, Vehicle V i By calling the blockchain's smart contract information query interface, the public key information PK of the data access party is obtained. j , then the vehicle V i choose And calculate the temporary authorization key KQK i and message verification code Mac2; where R Si is a random number, represents the group of all integers coprime to q under multiplication modulo q; Mac2=h(A Info ||C i ||D i ||KQK i ||t2);E i =R Si ·PK j ;D i =R Si ·P; t2 is the vehicle V i The timestamp generated when Mac2 was calculated.

[0087] S46, Vehicle V i Construct authorization message m A2 And the authorization message m A2 Broadcast to data access entities and cloud servers; where m A2 ={A Info ,C i ,D i ,KQK i ,Mac2,t2}.

[0088] In this embodiment, in the early stage of the authorized access phase, the cloud server verifies the identity of the data access party including the following steps 1 and 2.

[0089] Step 1: n data access parties initiate identity authentication to the cloud server; the authentication process for the jth data access party is as follows:

[0090] The jth data access party selects the authentication random number AR j And calculate X j =AR j P, calculate batch signature parameters: e j =h(PID j ||X j ), f j =h(PID j ||PKj ), S j =(AR j +e j ) -1 (SK j -f j -1 PSK j ), where PID j ,PK j SK j 、f j and PSK j They are the pseudonym, public key, private key, f and PSK of the jth data access party respectively;

[0091] The jth data access party generates the corresponding signature message m j =(Req'||δ j ||PID j ||AR j ), where δ j =(S j ,X j ); Req' is a message request.

[0092] Step 2: When the cloud server receives the signed messages from n data access parties, after determining that the type of each Req' is a message request for data request, it performs batch signature verification to improve the efficiency of identity authentication. The specific process is as follows:

[0093] Cloud server calculation parameters e j =h(PID j ||X j ), f j * =h(PID j ||PK j ) and BPK j =PK j -AR j ;

[0094] Cloud Server Verification Batch Authentication Equation Is it true? If so, the identities of all data access parties are legal.

[0095] S5, data decryption stage: the data access party calculates a temporary authorization code according to the authorization message, and uses the temporary authorization code to restore the quantum session key to decrypt the service data ciphertext.

[0096] The data decryption stage includes the following specific steps, namely S51 to S54.

[0097] S51. The data access party receives the authorization message m A2Generate timestamp t2', determine whether the inequality t2'-t2≤Δt holds, and if so, calculate the message verification code And judge the equation Is it established? If established, then according to the authorization information A Info ={Ak1,Ak2} calculation y j =F(x j ), from which the temporary authorization code is calculated

[0098] S52. Data access party calculates quantum key identifier And through Ktag EQKi * Get the first part of the quantum session key, the quantum key, from the cloud server

[0099] S53, data access party calculation Thus, the second part of the quantum session key is calculated

[0100]

[0101] S54. The data access party calculates the quantum session key So through the equation Get the data plaintext; among them, Indicates A symmetric decryption algorithm with a key.

[0102] In addition, when any communication entity exhibits malicious behavior, the cloud server will trace the real identity of the communication entity and revoke the cloud service permissions. The specific process is as follows:

[0103] The cloud server calls the information query interface of the blockchain's smart contract to obtain the key index Ktag of the temporary identity key of the malicious communication entity. TQK , query the corresponding temporary identity key TQK according to the key index, and thus calculate the real identity of the malicious communication entity The registration information of the malicious communication entity is revoked based on its real identity, and the public key information of the malicious communication entity is revoked by calling the revocation interface of the smart contract.

[0104] In this embodiment, when the cloud server detects that any communication entity reports data at an abnormal frequency, the communication entity is determined to be a malicious communication entity.

[0105] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for controlled sharing of Internet of Vehicles data, characterized in that: include: Data upload stage: The data owner uses the quantum session key to encrypt the data plaintext into ciphertext, and uploads the ciphertext to the cloud server; wherein the quantum session key is formed by the quantum key generated by the quantum random number generator of the data owner and the pre-injected quantum key; the data owner also performs identity authentication when interacting with the cloud server; Authorized access phase: When the data access party needs to obtain service data, the cloud server queries the corresponding data uploader and informs the data uploader of the data access party's pseudonym information; the data uploader obtains the data access party's public key information from the blockchain based on the pseudonym information, constructs an authorization message containing the service data ciphertext, and broadcasts it to the data access party and the cloud server; Data decryption stage: the data access party calculates a temporary authorization code based on the authorization message, and uses the temporary authorization code to recover the quantum session key to decrypt the service data ciphertext; Among them, if the service data that the data access party needs to obtain comes from the vehicle V i , the authorization access phase includes the following specific steps: When the data access party needs to obtain service data, it sends a query request to the cloud server and requests authorization from the data owner; The cloud server verifies the identity of the data accessor. If it is legitimate, it will query the database to find that the data owner of the service data is the vehicle V. i After that, the pseudonym information set of all data access parties requesting authorization is sent to the vehicle V i ; The pseudonym information set is represented by {PID1, PID2, ···, PID n }, PID j represents the pseudonym information of the jth data access party, j = 1, 2, ..., n, n is the total number of data access parties, n ≥ 2; Vehicle V i Calculate temporary authorization code And construct the following equation R1 and R2 are two randomly selected quantum random numbers; Indicates XOR operation; Ktag EQKi EQK is the quantum key distributed by the cloud server i The key index; h is a one-way hash function; || is a connection symbol; then the vehicle V i Construct the Lagrange interpolation polynomial F(x): Among them, F j (x) is the jth Lagrangian basis function, When x=x j When F j (x) = 1, the Lagrange interpolation polynomial passes through n known data points (x1, y1), (x2, y2), ..., (x n ,y n ), and thus solve the coefficients a1, a2, …, a n ; Vehicle V i Generate authorization information A Info ={Ak1,Ak2}; where Ak1 = (R1||R2), Ak2 = (a1,a2,...,a n ); Vehicle V i By calling the blockchain's smart contract information query interface, the public key information PK of the data access party is obtained. j , then the vehicle V i choose And calculate the temporary authorization key KQK i and message verification code Mac2; where R Si is a random number, represents the group of all integers coprime to q under modular q multiplication, where q is a prime number greater than 3; Mac2=h(A Info ||C i ||D i ||KQK i ||t2);QK i For vehicle V i The quantum key generated by its own quantum random number generator; E i =R Si ·PK j ;D i =R Si P; P is the base point of the elliptic curve, C i For vehicle V i The ciphertext generated during the data upload phase; t2 is the vehicle V i The timestamp generated when calculating Mac2; Vehicle V i Construct authorization message m A2 And the authorization message m A2 Broadcast to data access entities and cloud servers; where m A2 ={A Info ,C i ,D i ,KQK i ,Mac2,t2}.

2. A method for controlled sharing of Internet of Vehicles data according to claim 1, characterized in that: Also includes: Initialization phase: The cloud server selects elliptic curve y 2 =x 3 +ax+bmod q, and select a one-way hash function h, and then disclose the system parameters Para; where Para = {P, q, h, PuK C }; The elliptic curve satisfies 4a 3 +27b 2 ≠0, mod q means modulo q, a,b∈F p , F p represents a finite field, P is the base point of the elliptic curve; PuK C The public key of the cloud server.

3. A method for controlled sharing of Internet of Vehicles data according to claim 2, characterized in that: Also includes: Registration phase: Each communication entity sends its real identity ID to the cloud server; each communication entity is a vehicle, a roadside unit, or a third-party cloud server; The cloud server obtains the temporary identity key TQK and the key index Ktag of the communication entity from its own database TQK , generate the pseudonym PID, public-private key pair (PK, SK), authentication parameters Pub = TQK·P and PSK = f·TQK-SK corresponding to the communication entity, and then construct the message m R1 And send message m through the secure channel R1 To the corresponding communication entity, call the blockchain's smart contract writing interface at the same time, and write the pseudonym, public key and key index Ktag of the communication entity TQK Deposited into blockchain; where PK=SK·P; f=h(PID||PK)modq;m R1 ={PID,(PK,SK),Pub,PSK,f}; The communication entity receives the message m R1 Then store the content of the message.

4. A method for controlled sharing of Internet of Vehicles data according to claim 3, characterized in that: The data owner is a vehicle; the data access party is a vehicle or a roadside unit or a third-party cloud server, and the number of the data access parties is greater than 1; Among them, for any vehicle V i , the data upload phase includes the following specific steps: Vehicle V i Extract the (SQK i ,Ktag SQKi ), select a random number K and calculate the security parameter Spa; where SQK i For vehicle V i Security parameter key, Ktag SQKi For SQK i Key index of; Spa = K·P; Vehicle V i Select the quantum key QK generated by its own quantum random number generator i and QK i Key index Ktag QKi , and extract the quantum key EQK distributed by the cloud server from its own security chip i and EQK i Key index Ktag EQKi , and use symmetric encryption to encrypt the data plaintext M to generate ciphertext C i Among them, C i =E SEK (M i ); SEK is the quantum session key, SEK = (QK i ||EQK i );E SEK (·) indicates a symmetric encryption algorithm using SEK as the key; Vehicle V i Calculate signature parameters r and S to generate message signature δ Vi , then calculate the message verification code Mac1 and construct the message m A1 And send message m through the public channel A1 To the cloud server; where r = g + Spa modq, S = (1 + SK Vi ) -1 [K+(SQK i -r) SK Vi ]modq, g=h(SQK i ||C i ||Req);SK Vi For vehicle V i Req is a message request, and the types of message requests include message requests for data upload, message requests for data request, and message requests for registration; Vi =(Ktag SQKi ,r,S); Mac1=h(δ Vi ||C i ||Req||t1);m A1 =(Req||δ Vi ||Mac1||C i ||t1); t1 is the vehicle V i The timestamp generated when Mac1 is calculated; The cloud server receives the message m A1 Generate a timestamp t1', determine whether the inequality t1'-t1≤Δt holds, and if so, calculate the message verification code And judge the equation Is it true? If so, determine whether the type of Req is a message request for data upload. If so, the cloud server will SQKi Query and obtain the security parameter key SQK from the data memory i , and calculate g * =h(SQK i ||C i ||Req), Spa * =S·P+(r+S-SQK i )·PK Vi , r * =g * +Spa * modq; Δt is the preset duration; PK Vi For vehicle V i 's public key; Cloud server judgment * Is it equal to r? If so, then the vehicle V i The identity is legitimate, and the cloud server stores the encrypted data C i .

5. A method for controlled sharing of Internet of Vehicles data according to claim 4, characterized in that: In the early stage of the authorized access phase, the cloud server verifies the identity of the data access party by the following steps: Step 1: n data access parties initiate identity authentication to the cloud server; the authentication process for the jth data access party is as follows: The jth data access party selects the authentication random number AR j And calculate X j =AR j P, calculate batch signature parameters: e j =h(PID j ||X j ), f j =h(PID j ||PK j ), S j =(AR j +e j ) -1 (SK j -f j -1 PSK j ), where PID j ,PK j SK j 、f j and PSK j They are the pseudonym, public key, private key, f and PSK of the jth data access party respectively; The jth data access party generates the corresponding signature message m j =(Req'||δ j ||PID j ||AR j ), where δ j =(S j ,X j ); Req' is a message request; Step 2: When the cloud server receives the signed messages from n data access parties, after determining that the type of each Req' is a message request for data request, it performs batch signature verification to improve the efficiency of identity authentication. The specific process is as follows: Cloud server calculation parameters e j =h(PID j ||X j ), f j * =h(PID j ||PK j ) and BPK j =PK j -AR j ; Cloud Server Verification Batch Authentication Equation Is it true? If so, the identities of all data access parties are legal.

6. A method for controlled sharing of Internet of Vehicles data according to claim 5, characterized in that: In the data decryption stage, the data access party calculates the temporary authorization code according to the authorization message, including: After receiving the authorization message m A2 Generate timestamp t2', determine whether the inequality t2'-t2≤Δt holds, and if so, calculate the message verification code And judge the equation Is it established? If established, then according to the authorization information A Info ={Ak1,Ak2} calculation y j =F(x j ), from which the temporary authorization code is calculated 7. A method for controlled sharing of Internet of Vehicles data according to claim 6, characterized in that: In the data decryption stage, the use of the temporary authorization code to recover the quantum session key to decrypt the service data ciphertext includes: Data access party calculates quantum key identity And through Ktag EQKi * Get the first part of the quantum session key, the quantum key, from the cloud server Data access party calculation Thus, the second part of the quantum session key is calculated The data access party calculates the quantum session key So through the equation Get the data plaintext; among them, Indicates A symmetric decryption algorithm with a key.

8. A method for controlled sharing of Internet of Vehicles data according to any one of claims 3 to 7, characterized in that: When any communication entity exhibits malicious behavior, the cloud server will trace the real identity of the communication entity and revoke the cloud service permissions. The specific process is as follows: The cloud server calls the information query interface of the blockchain's smart contract to obtain the key index Ktag of the temporary identity key of the malicious communication entity. TQK , query the corresponding temporary identity key TQK according to the key index, and thus calculate the real identity of the malicious communication entity The registration information of the malicious communication entity is revoked according to the real identity, and the public key information of the malicious communication entity is revoked by calling the revocation interface of the smart contract; wherein, when the cloud server detects that any communication entity reports data at an abnormal frequency, the communication entity is determined to be a malicious communication entity.

9. A controlled sharing system for Internet of Vehicles data, characterized in that: A method for controlled sharing of Internet of Vehicles data as described in claim 8 is applied; the Internet of Vehicles data controlled sharing system includes a blockchain, a cloud server, a data owner and a data access party; wherein the data owner is a vehicle; the data access party is a vehicle or a roadside unit or a third-party cloud server, and the number of data access parties is greater than 1.

Images