Cross-domain dynamic authentication method and system for privacy protection in Internet of Vehicles

Abstract

The invention discloses a cross-domain dynamic authentication method and system for privacy protection in the Internet of Vehicles, and the method comprises the steps: enabling each vehicle to register with a root trusted institution through the real biological feature information, and enabling the root trusted institution to generate a pseudonym for each registered vehicle; the root trusted mechanism sends the reversible bloom filter ciphertext for storing the vehicle biological recognition identity to the sub-trusted mechanism; when the vehicle formation needs cross-domain communication, the pilot vehicle sends a cross-domain request to the sub-trusted mechanism of the target domain through the road side unit; the sub-trusted mechanism of the target domain verifies the validity of the cross-domain request according to the timestamp, and performs vehicle identity legality authentication and cross-domain request message integrity authentication in combination with an intra-domain service provider; in a large-scale cross-domain scene and a highly dynamic scene, the sub-trusted mechanism can provide batch authentication and dynamic authentication. By adopting the technical scheme of the invention, on the premise of ensuring that vehicle privacy is not leaked, cross-domain vehicle identity legality authentication and cross-domain request message integrity authentication are realized.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Vehicles security, and specifically relates to a cross-domain dynamic authentication method and system for privacy protection in an Internet of Vehicles. Background Art

[0002] With the rapid development of my country's intelligent transportation system, modern transportation networks have become safer and more efficient, and vehicle platooning technology plays a key role in this process. As an emerging intelligent driving method, vehicle platooning relies on real-time communication in the Internet of Vehicles, allowing vehicles to drive closely together. This model not only significantly alleviates traffic congestion, but also reduces human driving errors, reduces the incidence of traffic accidents, and improves fuel efficiency, contributing to my country's energy conservation, emission reduction and environmental protection.

[0003] In the Internet of Vehicles environment, vehicles need to frequently communicate with trusted organizations and service providers in different domains. However, traditional cross-domain authentication methods are often computationally complex and ignore privacy protection, resulting in the risk of leakage of vehicle privacy information. In addition, private information is easily tampered with during transmission, and if the receiver cannot effectively verify the authenticity of the information, it may become invalid. At the same time, the dynamic changes of vehicles in the formation (such as vehicles joining or leaving) require the cross-domain authentication method to have a highly scalable dynamic authentication mechanism to adapt to the dynamic changes in the vehicle formation structure.

[0004] At present, decentralized authentication methods such as blockchain and secure communication methods such as session keys provide support for the basic security of cross-domain scenarios, but when applied to large-scale cross-domain scenarios, they often result in high computational overhead. In addition, these methods may indirectly lead to the risk of privacy leakage, such as exposing the true identity of the vehicle. To solve the above problems, Xia et al. [Yingjie Xia, Siyu Zhu, Xuejiao Liu, et al. EPP-GAS: An Efficient and Privacy-Preserving Cross Trust-Domain Group Authentication Scheme for VehiclePlatoon Based on Blockchain[J]. IEEE Transactions on IntelligentTransportation Systems, 2024.] proposed a privacy-preserving cross-domain authentication scheme based on blockchain, but its reliance on blockchain generates a lot of overhead, which limits its application efficiency in large-scale cross-domain scenarios involving various vehicle formations. Chen et al. [Yuxuan Chen, Jing Zhang, Xiyang Wei, et al. Cross-Domain Authentication Scheme for Vehicles Based on Given Virtual Identities[J]. IEEE Internet of Things Journal, 2024, 11(9): 15869-15879.] proposed a certificate-based cross-domain authentication scheme. By introducing an efficient batch authentication mechanism and a two-way synchronization database, the scheme improved reliability while reducing computational overhead, successfully avoiding the high overhead brought by blockchain. However, the scheme was not optimized for the vehicle platooning scenario, which limited its applicability in this scenario.

[0005] Although many cross-domain authentication schemes have been proposed, most of them fail to fully address the unique challenges brought by vehicle platooning. Therefore, a more efficient and scalable cross-domain authentication method is urgently needed to effectively protect privacy and adapt to the dynamic characteristics of vehicle platooning while ensuring performance. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a cross-domain dynamic authentication method and system for privacy protection in the Internet of Vehicles, which realizes cross-domain vehicle identity legitimacy authentication and cross-domain request message integrity authentication while ensuring that vehicle privacy is not leaked, and introduces a batch authentication mechanism and a scalable dynamic authentication mechanism to improve the efficiency of cross-domain authentication and adapt to the dynamic characteristics of vehicle formations.

[0007] To achieve the above object, the present invention adopts the following technical solution: A cross-domain dynamic authentication method for privacy protection in an Internet of Vehicles, comprising: Each vehicle registers with the root trusted authority RTA using real biometric information, and the root trusted authority RTA generates a pseudonym for each registered vehicle, wherein multiple vehicle formations are formed based on the vehicle pseudonyms, and each vehicle formation includes: a leading vehicle and a following vehicle; The root trusted authority RTA sends the reversible Bloom filter ciphertext used to store the vehicle biometric identity to the sub-trusted authority STA; When the vehicle formation needs to communicate across domains, the pilot vehicle sends traffic to the target domain through the roadside units (RSUs). D k Sub-trusted institution STA k Send cross-domain requests; Target domain D k Sub-trusted institution STA k Verify the validity of cross-domain requests based on timestamps and join with service providers in the domain SP k Carry out vehicle identity legitimacy authentication and cross-domain request message integrity authentication; based on bilinear aggregate signature, multiple vehicle formations simultaneously initiate cross-domain requests, and the signatures of each vehicle formation are aggregated into a single signature to achieve batch authentication; when a vehicle leaves or joins a vehicle formation, the pilot vehicle will send the vehicle formation update information to STA k , STA k and SP k Dynamic cross-domain authentication is performed based on vehicle platoon update information.

[0008] The present invention also provides a cross-domain dynamic authentication system for privacy protection in an Internet of Vehicles, comprising: The first processing module is used for each vehicle to register with the root trusted authority RTA using real biometric information, and the root trusted authority RTA generates a pseudonym for each registered vehicle, wherein a plurality of vehicle formations are formed based on the vehicle pseudonyms, and each vehicle formation includes: a leading vehicle and a following vehicle; The second processing module device is used for the root trusted authority RTA to send the reversible Bloom filter ciphertext storing the vehicle biometric identity to the sub-trusted authority STA; The third processing module is used for the pilot vehicle to communicate with the target domain through the roadside unit RSUs when the vehicle formation needs cross-domain communication. D k Sub-trusted institution STA k Send cross-domain requests; The fourth processing module is used for the target domain D k Sub-trusted institution STA k Verify the validity of cross-domain requests based on timestamps and join with service providers in the domain SP k Perform vehicle identity legitimacy authentication and cross-domain request message integrity authentication.

[0009] The present invention has the following technical effects: 1. The present invention is applicable to vehicle formation scenarios. It combines reversible Bloom filters and BGLS aggregate signatures to achieve dual authentication of vehicle identity legitimacy and message integrity, and integrates the homomorphic properties of the Paillier algorithm to achieve identity privacy protection in the cross-domain authentication process.

[0010] 2. The present invention adopts a batch authentication mechanism, which can simultaneously process multiple cross-domain requests from multiple vehicle formations, significantly improving the efficiency in large-scale cross-domain authentication scenarios.

[0011] 3. The present invention adopts a scalable dynamic authentication mechanism, allowing vehicles to flexibly join or leave without frequent re-authentication. This mechanism ensures the continuity and reliability of cross-domain authentication even in highly dynamic scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0013] Figure 1 A schematic diagram of the composition of a cross-domain dynamic authentication method for privacy protection in an Internet of Vehicles provided by an embodiment of the present invention; Figure 2 A flow chart of a cross-domain dynamic authentication method for privacy protection in an Internet of Vehicles provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0015] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0016] Embodiment 1: The embodiment of the present invention provides a cross-domain dynamic authentication method for privacy protection in an Internet of Vehicles. Figure 1 As shown, this embodiment involves four entities, a Trust Authority (TA), including a root trusted authority RTA and sub-trusted authorities STA of each domain. The root trusted authority RTA is mainly responsible for generating system parameters, pseudonyms, and keys, and the sub-trusted authority STA is mainly responsible for cross-domain authentication of vehicle formations. The service provider SP has sufficient computing and storage capabilities to assist the sub-trusted authority STA in completing the cross-domain authentication of vehicle formations. The road-side unit (RSU) only serves as a communication interface between the vehicle and the upper-level entities (ie, TA and SP).

[0017] The vehicle has two roles in the vehicle formation, namely the pilot vehicle and the follower vehicle. The pilot vehicle manages the communication between the vehicle formation and external entities. When the vehicle formation changes dynamically, the pilot vehicle sends the vehicle formation update information to the STA in the domain to achieve dynamic authentication. The follower vehicles are responsible for receiving the control instructions issued by the pilot vehicle and adjusting their driving behaviors accordingly. Among them, TA is completely trustworthy, while RSU and SP are honest and curious, which means that they will honestly execute the instructions of the system, but may be interested in some privacy information.

[0018] like Figure 2 As shown, an embodiment of the present invention provides a cross-domain dynamic authentication method for privacy protection in an Internet of Vehicles, comprising the following steps: Step S1, system initialization: The root trusted authority RTA initializes multiple parameters, broadcasts public parameters, and securely transmits private keys to the service providers SP of each domain D.

[0019] Step S2: Vehicle registration: Each vehicle registers with the root trusted authority RTA using its real biometric information. The root trusted authority RTA generates a pseudonym for each registered vehicle and loads it into the vehicle's TPM.

[0020] Step S3: Vehicle formation registration: The root trusted authority RTA generates a public-private key pair and a reversible Bloom filter ciphertext that stores the vehicle's biometric identity for the vehicle formation. The private key is loaded in the vehicle's TPM. Subsequently, the root trusted authority RTA sends the public key and the reversible Bloom filter ciphertext to the sub-trusted authority STA of each domain D.

[0021] Step S4: Cross-domain authentication request: When the vehicle formation needs to communicate across domains, the pilot vehicle sends traffic to the target domain through the roadside units (RSUs). D k Sub-trusted institution STA k Send a cross-origin request.

[0022] Step S5: cross-domain authentication: Target domain D k Sub-trusted institution STA k First, verify the validity of the cross-domain request through the timestamp, and then communicate with the service provider in the domain SP k The vehicle identity legitimacy and cross-domain request message integrity are jointly authenticated. Due to the characteristics of bilinear aggregate signatures, the signatures of multiple vehicle formations can be aggregated into a single signature to achieve batch authentication. When a vehicle joins or leaves a vehicle formation, the pilot vehicle will promptly send the update information to STA k , in order to perform dynamic cross-domain authentication.

[0023] As an implementation of the embodiment of the present invention, step S1 includes: RTA Definition and For two cyclic groups, and choose a random element As The generator of , and the prime order is . Define the bilinear map as . RTA selects 3 secure hash functions , Then, RTA initializes a homomorphic key pair , the key pair is generated by the Paillier algorithm as the master public key and master private key. D k Service Provider SP k generate K Asymmetric key pair ,in Finally, RTA broadcasts the public parameters , and each Sent to each via a secure wired link SP k .

[0024] As an implementation of the embodiment of the present invention, step S2 includes: Record the vehicle as Before joining the Internet of Vehicles, each vehicle Registration with the RTA is required. Provide their real biometric information to RTA through fingerprint data collection and recognition system . Subsequently, RTA is Generate Biometric Identity ,in, The biometric information is converted into a biometric identity through an irreversible process. It is no different from random data, and the original biometric information cannot be inferred from it. Then, RTA uses the public key encryption To generate pseudonym , and Equipped with TPM for storage And other key information.

[0025] As an implementation of the embodiment of the present invention, step S3 includes: Generally speaking, assuming that the vehicle For the i The first vehicle formation j The car, whose pseudonym is ,in, It is a vehicle formation i A collection of pseudonyms.

[0026] In vehicle formation i After formation (assuming that there is 1 pilot vehicle and Following vehicles), RTA is a vehicle formation i Generate a private key and the public key ,in are two random numbers. RTA also needs to Safely loaded into vehicle formation i Next, RTA prepares a reversible Bloom filter To store vehicle fleets i Specifically, based on the vehicle formation i Collection of pseudonyms , RTA is per vehicle Recover their biometric identity . RTA then formed a convoy of vehicles i Biometric ID Insertion in Vehicles In, for Finally, RTA Encryption, Generate , then Send to each STA k .

[0027] As an implementation of the embodiment of the present invention, step S4 includes: When the vehicle platoon i When cross-domain communication is required (i.e. vehicle platooning i From the domain D k-1 The communication scope is moved to the domain D k ), vehicle formation i The pilot vehicle needs to send D k of STA k Send a cross-domain request message. Specifically, each following vehicle (denoted as ) generates a number based on its location, attributes, and other information d The polynomial , and compute the polynomial commitment .Then, Generate signature (1) Each following vehicle will Sent to the pilot vehicle.

[0028] The pilot vehicle selects a random value ,calculate , and aggregate the pseudonyms of the entire vehicle formation into Then, the pilot vehicle generates a cross-domain request , and send it to the domain D k of STA k ,in Is the timestamp.

[0029] As an implementation of the embodiment of the present invention, step S5 includes: Single authentication upon receipt of vehicle formation i After the cross-domain authentication request of the pilot vehicle, the domain D k of STA k Perform the following steps.STA k First, check Is it established to ensure During the validity period, yes STA k Receiving a request The timestamp generated when is the time threshold. If During the validity period, STA k Start to verify the legitimacy of the cross-domain vehicle identity and the integrity of the cross-domain request message in turn.

[0030] To complete the identity verification, STA k Requires verification (2) Is it true? If so, it means that the vehicle formation i Passed the identity authentication. Then, STA k Random Selection Generate Challenge , and Send to SP k , entrusted SP k Assists in verifying the integrity of cross-origin request messages.

[0031] Upon receiving STA k After the news, SP k First, check Is it established to ensure During the validity period, yes SP k The timestamp generated when the message was received. If efficient, SP k Generate challenge polynomial (3) Compute the quotient polynomial and witness value , where the witness value yes Then, SP k Random Selection ,calculate and .at last, SP k polymerization (4) And generate proof , send it to STA k .

[0032] Upon receiving SP k After the proof, STA k calculate And verified (5) Check whether the cross-domain request message is established. If established, the vehicle formation is completed. i Cross-domain authentication, STA k Start platooning vehicles i Provide cross-domain services; otherwise, cross-domain authentication fails. STA k Reject vehicle platooning i Cross-domain request.

[0033] In addition to the single authentication of a single vehicle formation, the present invention also supports the simultaneous processing of multiple cross-domain requests from multiple vehicle formations. Based on the characteristics of bilinear aggregate signatures, the signatures of multiple vehicle formations can be aggregated into a single signature, thereby improving the verification efficiency. Assume that there is now n A fleet of vehicles, SP k Can be aggregated for (6) and aggregation for (7) Then, quilt SP k Send to STA k , STA k Pass verification (8) Is it established to check from n The integrity of the cross-domain request message of the vehicle formation.

[0034] Dynamic authentication takes into account the impact of vehicles joining or leaving the vehicle formation on cross-domain authentication. i When the pilot vehicle needs to STA k Send platoon updates , i.e., vehicle formation i No. l Update information. The present invention uses To represent vehicle formations i If the change =1, indicating vehicle Join a vehicle fleet i ;like =0, indicating vehicle Leaving the vehicle formation i Specifically, the pilot vehicle will send Give STA k ,in, If the vehicle Join a vehicle fleet i , which generates the signature (9) And send to the pilot vehicle; if Leaving the vehicle formation i , the pilot vehicle will retrieve the .

[0035] Upon receiving update information after, STA k Perform the following steps. STA k First, check Is it established to ensure The effectiveness of yes STA k Receive updates The timestamp generated when efficient, STA k Then randomly select , generate challenges , and Send to the current domain SP k .

[0036] Upon receiving STA k After the news, SP k First, check Is it established to ensure The effectiveness of yes SP k The timestamp generated when the message was received. If efficient, SP k Decryption Get .like ,but SP k calculate (10) as well as ;like ,but SP k calculate (11) as well as .then, SP k calculate and ,Then SP k Random Selection ,calculate and .at last, SP k polymerization (12) And generate a new proof , send it to STA k .

[0037] Assume that within a given time interval, the vehicle platoon i The number of updated information is , STA k polymerization (13) as well as (14) Then, STA k calculate (15) And verified (16) Is it possible to implement dynamic cross-domain authentication of vehicle platoons?

[0038] Embodiment 2: The embodiment of the present invention further provides a cross-domain dynamic authentication system for privacy protection in an Internet of Vehicles, including: The first processing module is used for each vehicle to register with the root trusted authority RTA using real biometric information, and the root trusted authority RTA generates a pseudonym for each registered vehicle, wherein a plurality of vehicle formations are formed based on the vehicle pseudonyms, and each vehicle formation includes: a leading vehicle and a following vehicle; The second processing module device is used for the root trusted authority RTA to send the reversible Bloom filter ciphertext storing the vehicle biometric identity to the sub-trusted authority STA; The third processing module is used for the pilot vehicle to communicate with the target domain through the roadside unit RSUs when the vehicle formation needs cross-domain communication. D k Sub-trusted institution STA k Send cross-domain requests; The fourth processing module is used for the target domain D k Sub-trusted institution STA k Verify the validity of cross-domain requests based on timestamps and join with service providers in the domain SP k Perform vehicle identity legitimacy authentication and cross-domain request message integrity authentication.

[0039] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A cross-domain dynamic authentication method for privacy protection in an Internet of Vehicles, characterized in that: include: Each vehicle registers with the root trusted authority RTA using real biometric information, and the root trusted authority RTA generates a pseudonym for each registered vehicle, wherein multiple vehicle formations are formed based on the vehicle pseudonyms, and each vehicle formation includes: a leading vehicle and a following vehicle; The root trusted authority RTA sends the reversible Bloom filter ciphertext used to store the vehicle biometric identity to the sub-trusted authority STA; When the vehicle formation needs to communicate across domains, the pilot vehicle sends traffic to the target domain through the roadside units (RSUs). D k Sub-trusted institution STA k Send cross-domain requests; Target domain D k Sub-trusted institution STA k Verify the validity of cross-domain requests based on timestamps and join with service providers in the domain SP k Carry out vehicle identity legitimacy authentication and cross-domain request message integrity authentication; based on bilinear aggregate signature, multiple vehicle formations simultaneously initiate cross-domain requests, and the signatures of each vehicle formation are aggregated into a single signature to achieve batch authentication; when a vehicle leaves or joins a vehicle formation, the pilot vehicle will send the vehicle formation update information to STA k , STA k and SP k Dynamic cross-domain authentication is performed based on vehicle platoon update information.

2. A cross-domain dynamic authentication system for privacy protection in an Internet of Vehicles, characterized in that: include: The first processing module is used for each vehicle to register with the root trusted authority RTA using real biometric information, and the root trusted authority RTA generates a pseudonym for each registered vehicle, wherein a plurality of vehicle formations are formed based on the vehicle pseudonyms, and each vehicle formation includes: a leading vehicle and a following vehicle; The second processing module device is used for the root trusted authority RTA to send the reversible Bloom filter ciphertext storing the vehicle biometric identity to the sub-trusted authority STA; The third processing module is used for the pilot vehicle to communicate with the target domain through the roadside unit RSUs when the vehicle formation needs cross-domain communication. D k Sub-trusted institution STA k Send cross-domain requests; The fourth processing module is used for the target domain D k Sub-trusted institution STA k Verify the validity of cross-domain requests based on timestamps and join with service providers in the domain SP k Perform vehicle identity legitimacy authentication and cross-domain request message integrity authentication.

Images