Internet of vehicles broadcast message authentication method based on attribute encryption

Abstract

The invention provides an Internet of Vehicles broadcast message security authentication method based on attribute encryption, and belongs to the technical field of Internet of Vehicles security. The technical problems that the Internet of Vehicles broadcast message security authentication time is long, the calculated amount overhead is large, and the communication complexity is high are solved. According to the technical scheme, the method comprises the following steps that S1, a TA generates system public parameters and registers a vehicle and an RSU; s2, the RSU and the entering vehicle carry out bidirectional authentication; s3, the sending vehicle signs the broadcast message; s4, the receiving vehicle verifies the broadcast message; and S5, tracking and revoking the malicious vehicle by the system. The method has the beneficial effects that lightweight anonymous and efficient authentication of the Internet of Vehicles broadcast message and a security policy that the identity of a malicious vehicle can be revoked are realized.

Description

Technical Field

[0001] The present invention relates to the field of vehicle networking security technology, and in particular to a vehicle networking broadcast message authentication method based on attribute encryption. Background Art

[0002] According to statistics, by the end of June 2023, the national motor vehicle ownership reached 426 million, the motor vehicle drivers were 513 million, and the car ownership in 88 cities exceeded 1 million. With the rapid expansion of domestic car ownership, my country is rapidly entering a car society, and the contradictions between cars and roads, cars and the environment, cars and cars, and cars and pedestrians are becoming increasingly prominent. Among them, traffic jams cause huge social costs. In the case of difficulty in expanding urban roads, how to optimize resource allocation, improve urban traffic efficiency, and reduce traffic accident rates has become a topic facing large and medium-sized cities in China. The emergence of intelligent transportation technology provides feasible technical support for solving these pain points, and vehicle self-organizing networks (Vehicular Ad-hoc NETworks, VANETs) are the core of intelligent transportation technology. The Internet of Vehicles uses vehicles in motion as information perception objects, and with the help of new generation information and communication technologies, realizes network connection between vehicles and X (i.e., vehicles, people, roads, and service platforms), improves the overall intelligent driving level of vehicles, and provides users with safe, comfortable, intelligent, and efficient driving experience and traffic services, while improving traffic operation efficiency and the level of intelligence of social transportation services. At present, Internet of Vehicles communication mainly adopts dedicated short range communication protocol (DSRC), which stipulates that vehicles send broadcast packets every 100-300ms, carrying traffic status information such as speed, location, direction, road flow, safety warning, etc., to realize rapid communication and sharing of traffic information between Internet of Vehicles entities, so as to facilitate other vehicle nodes to make intelligent driving decisions.

[0003] The adoption of new technologies brings huge social benefits, but also huge challenges. Due to the large number of network nodes in the Internet of Vehicles, each vehicle node periodically broadcasts status information to all vehicles around it. Malicious vehicle attackers can collect these broadcast messages to analyze and locate the identity of the message sender and obtain privacy information such as the sender's driving trajectory. Furthermore, malicious attackers can use the sender's identity to forge broadcast packets to achieve a series of security attacks such as camouflage attacks and message tampering. This involves the integrity protection and identity authentication of vehicle node broadcast messages. For example, on September 1, 2022, hackers manipulated the Yandex Taxi online car-hailing service to forge traffic information to make available taxis arrive in Moscow at the same time, causing a two-hour traffic jam. According to statistics, malicious behaviors against the Internet of Vehicles platform in the first half of 2021 have exceeded 1 million times, an increase of more than 80% compared with the same period in 2020. By the end of 2022, the number of public vulnerabilities directly related to cars released was as high as 284, nearly 9 times that of 2020, and forged messages were the most typical attack method.

[0004] To solve this problem, the IEEE Vehicular Technology Society standard has developed the IEEE Vehicle Message Security Standard. The standard ensures the integrity of the message, identifies the identity of the message sender, provides protection methods such as certificates and signatures, and develops the protocol format of the broadcast packet to eliminate the security vulnerabilities of the broadcast packet in the DSRC protocol. The broadcast message format of the vehicle message security standard is shown in the figure below.

[0005]

[0006] Broadcast message format

[0007] The broadcast message contains five fields, of which the message field carries the vehicle's driving status information; the certificate is used for identity authentication; the signature is based on the ECDSA algorithm and is used to prevent tampering attacks on the broadcast packet. This standard effectively protects the security of the broadcast packet, but there are also many problems:

[0008] 1. The communication of the message field accounts for 26.6%, while the security overhead (certificate and signature) accounts for 72.5%. This shows that the vehicle message security standard has a huge security overhead to ensure the identity correctness and data integrity of the broadcast packet, resulting in a small payload and very low overall communication efficiency.

[0009] 2. Since the security standard directly uses the sender's PKI certificate in the identity authentication of the broadcast packet, the attacker can obtain the sender's real vehicle identity through the PKI certificate and complete the analysis of the sender's private information such as the license plate number and movement trajectory.

[0010] 3. The PKI certificate verification method has a large amount of computation, which is a heavy burden for vehicles with weak computing power. The receiver needs to verify the public key certificates and signatures of massive messages. The verification process cannot meet the low processing delay requirements of the VANET network.

[0011] In order to solve the many defects of IEEE vehicle message security standards, a large number of identity-based and certificateless vehicle network message authentication schemes have been proposed. In the identity-based message authentication scheme, the vehicle generates a key through its own identity identifier. Neither the vehicle nor the RSU needs to store certificates, and the authentication function is supported. For example, LEE CC and other scholars proposed a batch authentication scheme based on bilinear pairing in "Toward a secure batch verification with group testing for VANET", but the scheme has the problem of not being able to resist replay attacks and unable to track the true identity of the message sender; ZHANG J and other scholars improved the former scheme in "On the security of a secure batch verification with group testing for VANET" and realized anonymity and identity tracking functions, but the above schemes all use bilinear pairing cryptographic algorithms, and the computational complexity and computational overhead are very huge, which is not suitable for the low-latency characteristics of vehicle networks; HE BD and other scholars proposed a CPPA scheme that does not use bilinear pairing in "An efficient iden-tity-based conditional privacy-preserving authentication scheme for vehicular ad hoc networks", but it is vulnerable to replay attacks.In the certificateless message scheme, the keys of the authentication center and the vehicle are independent of each other, so that the vehicle and RSU do not store certificates but support authentication functions. For example, Du RY, Xun TT and other scholars proposed their own certificateless key isolation schemes in "A certificateless key-insulated signature scheme" and "Key-insulated certificateless aggregate signature", but the schemes cannot be applied to the specific vehicle ad hoc network environment; Liang and other scholars improved the scheme based on the certificateless cryptographic system to adapt to the vehicle ad hoc network environment, and proposed a certificateless quota proxy re-signature authentication scheme in the document "Proxy re-signature scheme based on certificateless public-key cryptosystem", but the scheme has problems of low security and computational efficiency; YANG XD and other scholars proposed an improved scheme in "A message authentication scheme for VANET based on certificateless proxy re-signature", which improved security and reduced communication overhead, but still had problems of high computational and storage overhead.

[0012] In summary, although a large number of researchers have proposed different IoV message authentication schemes, there are still problems such as certificate management, key escrow, resistance to various attacks, huge communication and computing overhead and difficulty in updating, which makes it difficult to apply in IoV environments with low latency, high efficiency and strong protection for secure communication. The concept of attribute-based encryption (ABE) was first proposed by Sahai and Waters in 2005. Because it is suitable for data security sharing, it has been widely used in cloud platform data security communication schemes. The basic idea of ​​attribute encryption is to associate ciphertext and key with attribute set and access structure. Decryption can be successful only when and only when the attribute set satisfies the access structure. According to the corresponding different associations, attribute-based encryption can be divided into two categories, namely key policy attribute-based encryption (KP-ABE) and ciphertext policy attribute-based encryption (CP-ABE). KP-ABE means that the user's key contains an access structure (access policy), and the ciphertext corresponds to a series of attribute sets. The user can decrypt successfully only when and only when the attribute set of the ciphertext satisfies the access structure of the user's key. CP-ABE means that the user's key corresponds to a set of attributes, and the ciphertext contains an access structure (policy). The user can decrypt successfully only when the user's attribute set satisfies the access structure of the ciphertext. For example, the literature "Revocable-storage and Hierarchical Attributeoased Access Scheme for Secure Sharing of e-Health Records in Public Cloud" and "AttributeBased Encryption with Privacy Protection and Accountability for Cloud IoT" propose to associate a series of attribute sets with users, extend the unique identifier to an attribute set composed of multiple attributes, and embed the access structure into the attribute set. The literature "Attribute-based encryption for fine-grained access control of encrypted data" and "Ciphertext-policy attribute-based encryption" propose two variant mechanisms, ciphertext policies CP-ABE and KP-ABE, both of which can achieve one-to-many communication.Waters et al. proposed a new method to implement CP-ABE in the paper "Ciphertext-policy at-tribute-based encryption: An expressive, efficient, and provably secure realization", which changes the traditional tree-shaped attribute encryption structure, maps the attributes to the secret sharing matrix, and implements an attribute encryption scheme with an LSSS structure. However, the above scheme uses bilinear mapping operations, which has a relatively large computational overhead and cannot fully meet the performance requirements of secure communication of nodes with limited computing power in the Internet of Vehicles.

[0013] Based on this, the present invention proposes an innovative solution that adapts to the communication characteristics of the Internet of Vehicles based on a thorough investigation of the defects of the current Internet of Vehicles message authentication related technologies. The solution, based on the ECC attribute encryption algorithm, proposes a solution to implement broadcast message authentication services using the LSSS matrix structure to reduce computing overhead, communication overhead, and authentication overhead, and to achieve efficient and fast authentication of broadcast messages in the Internet of Vehicles environment. Since this solution uses related technologies such as ciphertext-based attribute encryption and linear secret sharing schemes in cryptography, in order to clearly explain the principles and steps of the present invention, the relevant background technology is first explained:

[0014] 1. Elliptic Curve Cryptography (ECC)

[0015] The definition of an elliptic curve is as follows: if the group G is a finite cyclic group on the elliptic curve E, its order is q, the generator is P, where G contains a point O at infinity, and G has two operation rules: addition and multiplication.

[0016] Elliptic Curve Discrete Logarithm Problem (ECDLP) for group G: Let Q be a random point on G, and compute a solution x that satisfies Q = x·P, where If the problem cannot be solved on the group G with non-negligible probability ε within time t, then the problem is said to be hard on the group G.

[0017] 2. Traditional Ciphertext Policy-Based Attribute Encryption (CP-ABE)

[0018] In CP-ABE, data owners can define appropriate access structures according to their needs, so that entities with certain types of information rights can decrypt, which is suitable for anonymous authentication of broadcast communications in the RSU domain of the Internet of Vehicles. This scheme selects the CP-ABE algorithm, associates the user's private key with the user attribute set, and associates the ciphertext with the access structure. Only when the vehicle user attributes meet the access control policy can the ciphertext be decrypted to obtain the plaintext, and the decryptor does not need to know the identity of the encryptor.

[0019] The CP-ABE algorithm mainly consists of four parts: Setup, KeyGen, Encrypt, and Decrypt. Their functions are described as follows:

[0020] (1) Setup()→{PK,MK} RSU uses security parameters to calculate the system public key PK and the master private key MK.

[0021] (2)KeyGen(PK,MK,D)→{SK} The vehicle data receiving user calculates the private key SK based on PK, MK and its own attribute set D.

[0022] (3)Encrypt(PK,M,M j ,T)→{CT} The vehicle data owner uses the system public key PK, plaintext M, plaintext summary M j ,The access control policy T encrypts the data to obtain the ciphertext CT and broadcasts it.

[0023] (4) Decrypt(SK, CT, PK) → {M} The data receiver uses the private key SK, the ciphertext CT, and the system public key PK to try to decrypt the ciphertext. If the user attributes meet the access control policy and have not been revoked, the plaintext M can be obtained.

[0024] 3. Linear Secret Sharing (LSSS)

[0025] Linear secret sharing is a method to transform attribute access control policy into a computable secret sharing matrix. Each attribute is represented by M U ∈Z 1×1 A single-entry matrix of type , there exists a matrix Represents access policy P a , C a ∈Z e Represents the matrix M a The first column of Indicates the removal of C a Matrix M a There are three rules for the secret sharing matrix:

[0026] Rule 1: Access each variable p in policy P i The matrix M can be used U express.

[0027] Rule 2: For the OR structure P = P a ∨P b , using the matrix To express.

[0028]

[0029] Rule 3: For structures P = Pa ∧P b , using the matrix To express.

[0030]

[0031] According to the above three rules, the access policy P is converted into the secret sharing matrix M, and then the encryption and decryption calculations are performed.

[0032] (1) The encryption algorithm is defined as: Introduce a secret sharing matrix ν = (s, y1, y2, ..., y n ) T , s represents the secret value, y i is a set of random numbers, which are encrypted by the following calculation to obtain a set of secret values: λ = M·ν = (s1,...,s d ) T .

[0033] (2) The decryption algorithm is defined as: There exists a target vector ω = (1, 0, 0, ..., 0) T ∈Z e Make The secret value s can be solved by the equation, and the calculation is as follows:

[0034] The linear secret sharing scheme is based on the characteristics of linear equations and uses one-time random numbers to confuse the secret values ​​to ensure the security of the secret values. That is, the attacker cannot restore the correct decryption matrix without the corresponding correct attributes, and a one-time random number is used to confuse the secret values ​​row by row, so the attacker cannot infer the secret value from the final obfuscation result. Summary of the invention

[0035] In response to the technical problems existing in the security authentication of Internet of Vehicles broadcast messages, the present invention provides a broadcast message authentication method based on attribute encryption.

[0036] The inventive concept of the present invention is: comprehensively consider the two elements of security and efficiency, respond to the anonymous, flexible, efficient and fast message authentication requirements in the Internet of Vehicles environment, hide the sensitive information of the vehicle through the attribute encryption technology based on the ciphertext strategy, and realize anonymous authentication. The present invention uses a linear secret sharing matrix to describe the access strategy, which is more direct and flexible than the tree structure expression. At the same time, the elliptic curve operation with low computational overhead replaces the bilinear operation to avoid high computational overhead. Innovative improvements are made when using the attribute encryption algorithm based on the ciphertext strategy. The reason is that although the traditional attribute encryption algorithm based on the ciphertext strategy is safe in each operation under the bilinear operation, in the Internet of Vehicles environment, the traditional attribute encryption based on the ciphertext strategy requires the trusted institution TA to interact with the vehicle to generate a decryption key. For dynamic attributes, TA and the vehicle need to interact frequently to update the key, and the resulting computation and communication overhead is huge. For example, assuming that the attribute set when the vehicle decrypts the first broadcast information is S1, and the corresponding decryption key generated by interacting with the trusted institution TA is K1, but as the vehicle travels in the domain, the distance and time attributes are dynamically changing, and the vehicle needs to continuously update its own attribute set S n At this time, every time the vehicle needs to decrypt a message, it needs to interact with the TA again to generate a new decryption key K n For decryption algorithms, in the real Internet of Vehicles environment, in order to reflect road conditions in real time, vehicles in the domain will frequently broadcast to achieve message sharing, which will bring huge interaction overhead. Obviously, the traditional attribute encryption based on ciphertext strategy cannot effectively meet the high efficiency requirements in the Internet of Vehicles broadcast environment. Therefore, in order to adapt to the characteristics of the Internet of Vehicles, the present invention proposes an improved attribute encryption algorithm based on ciphertext strategy, which moves part of the calculation in generating attribute decryption keys to the registration stage, avoiding multiple interactions between vehicles and trust institutions during the decryption process, and reducing the time and computational overhead of broadcast message verification and decryption. The specific implementation steps are given below.

[0037] The present invention is implemented by the following measures: a vehicle network broadcast message authentication method based on attribute encryption, comprising the following steps:

[0038] S1. The trusted authentication center TA initializes system parameters, registers RSU and vehicles, and initializes domain attribute parameters for RSU

[0039] S2, the roadside unit RSU performs two-way identity authentication with the incoming vehicle and distributes the authentication attributes within the domain;

[0040] S3. The sending vehicle signs the intended broadcast message to ensure message integrity and authenticity;

[0041] S4, after receiving the broadcast information, the receiving vehicle quickly verifies the broadcast message through attribute decryption based on the message verification algorithm;

[0042] S5. Track the identity of malicious vehicles and revoke their domain attributes.

[0043] Furthermore, the S1 step includes:

[0044] S11, TA selects a large prime number p and a finite field Z with order p p , in Z p Define an elliptic curve E on E, and B is a base point of order q on E. TA randomly selects As the system master key, calculate the public key PK = α·B and select a secure hash function H: Public parameters PARAMS = {PK, H};

[0045] S12, the vehicle is registered offline and basic information is submitted to TA for registration. TA selects a random number κ to generate a pseudonym for the vehicle user At the same time, a signature public-private key pair (SK v , PK v ) and generate a corresponding digital certificate Cert for it v The information generated by the registration is stored in the vehicle's non-tamperable device. The process is:

[0046] S121. Before entering the Internet of Vehicles, the vehicle must provide its real ID to the TA v Register. TA selects a random number κ and generates a pseudonym At the same time, a signature public-private key pair (SK v , PK v ) and generate a corresponding digital certificate Cert for it v ;

[0047] S122, TA registers the information {ID v ||RID v ||SK v ||PK v ||Cert v}Send to vehicle;

[0048] S13. RSU performs offline registration, and TA generates an identity ID for the RSU r , randomly selected As the private key, calculate the public key PK r = r·B, and generate the corresponding digital certificate Cert for it r ; Select the attribute private key of the attribute in the RSU domain and assign the identifier corresponding to the access policy, calculate and generate the attribute decryption element, the process is:

[0049] S131. TA sets a unique real identity ID for the RSU in its management arear , random selection As the private key, calculate PK r = r·B as the public key, and generate the corresponding digital certificate Cert for it r ;

[0050] S132, TA random selection As the RSU domain attribute r i The attribute private key is assigned and the unique identifier uid corresponding to the access policy P is mapped to An element of which is used to calculate the attribute decryption element

[0051] S133, TA will register the information {ID r ||PK r ||Cert r ||α i ||uid||μ} is distributed to RSU;

[0052] S14, RSU generates parameters in the domain. First, it generates an attribute authentication function according to its own equipment conditions, randomly selects a special attribute r1 in the domain, and defines an access control policy in the domain. i As a domain attribute r i Attribute private key, calculate attribute public key PK i =α i B, the process is:

[0053] S141, RSU generates an attribute authentication function, selects ΔT and ΔD as the effective time range of the time attribute and the effective distance range of the distance attribute in the domain according to its own equipment conditions, and defines the attribute piecewise function according to the parameters, and publishes the function F in the domain T ,F D , the function is:

[0054] F T :

[0055] F D :

[0056] S142, RSU generates an intra-domain access policy and randomly selects an authorization token As the special attribute r1 in the domain, define the access control policy P in the domain = {p1, p2, p3} = p1∧(p2∨p3), where p1 is the RSU authorization token nonce, p2 is the valid value of the vehicle identity authentication time, and p3 is the valid value of the vehicle's driving distance in the domain;

[0057] S143, RSU generates a domain attribute public key and registers the value αi As a domain attribute r i Attribute private key, calculate attribute public key PK i =α i ·B.

[0058] Furthermore, the S2 step includes:

[0059] S21, vehicle A selects a random number s1 and sends the vehicle certificate Cert v and random number s1 to RSU;

[0060] S22, RSU selects random number s2, calculates The RSU certificate Cert r , s2 and y1 are sent to vehicle A;

[0061] S23, vehicle A receives the message sent by RSU and uses the certificate Cert r Verify the legitimacy of the RSU's public key, and then use PK r Decrypt y1. If the verification is successful, accept the message and calculate Send to RSU;

[0062] S24, RSU use certificate Cert v Verify vehicle A’s public key PK v Legitimacy, then use PK v Decrypt y2. If the verification is successful, the two-way identity authentication is successful. At this time, RSU assigns the vehicle identity legal attribute r1, and records and stores the authentication time of vehicle A as T1;

[0063] S25. RSU uses the authorization token nonce as the intra-domain authorization attribute r1, and composes the intra-domain attribute encryption parameter message {r1||T1||P||uid||μ} consisting of r1, authentication time T1, access policy P, access policy identifier uid, and attribute decryption element μ to distribute it to the legitimate vehicle so that the vehicle can encrypt the broadcast information.

[0064] Furthermore, the S3 step includes:

[0065] S31, in order to prevent the access strategy from being imitated, the sending vehicle generates the matrix according to the linear secret sharing scheme LSSS and The authorization element p1 is defined as a single-head matrix (nonce), and the remaining elements are recorded as single-head matrices (1) according to the original definition. The access policy P distributed by RSU P = {p1, p2, p3} = p1 ∧ (p2 ∨ p3) is converted into the access matrix M A , the process is:

[0066]

[0067] S32, send vehicle random selection vector s is the secret value corresponding to the attribute in the access policy. The secret value is multiplied by the system master public key to generate the encryption key SK = s PK, which is used for the subsequent symmetric encryption of the message hash value.

[0068] S33, send vehicle pair M A Each row M Ai Calculate inner product Will The secret value s in is hidden in the inner product after matrix multiplication with the generated random number. The calculation process is:

[0069]

[0070] ρ is the A Each row of The mapping matrix generated after the dot multiplication. The sending vehicle uses the attribute public key and the attribute inner product to calculate C i =λ i ·PK i , realize the mapping of access policy to elliptic curve calculation;

[0071] S34, the sending vehicle A calculates the hash value H(M) for the message M to be sent, and generates a message authentication code C M =ENC(H(M),SK), the corresponding access policy P, the mapping encryption matrix C i , plaintext M, message authentication code C M Encapsulate into broadcast message {M||P||C i ||C M} for broadcasting.

[0072] Furthermore, the S4 step includes:

[0073] S41. The vehicle receives the broadcast message, verifies whether the time and distance are within the specified range, and then adds the time and distance attributes to its own attribute set. The process is as follows:

[0074] S411. Calculate r T =T n -T1, where T1 is the authentication time, T n is the current system time, and executes the attribute comparison function F T , if F T If it is less than or equal to the effective time ΔT specified in the domain, the time is considered valid and r2 = 1; otherwise, r2 = 0;

[0075] S412, according to the electromagnetic wave attenuation formula D (KM) = 10 (Loss(dB)-32.44-20logF(MHz)) / 20), calculate the relative distance r between the vehicle and the RSU D , and execute the attribute comparison function F D , if r D If it is less than or equal to the effective distance ΔD specified in the domain, then r3=1; otherwise r3=0;

[0076] S413, the receiving vehicle adds the time attribute r2 and the distance attribute r3 to its own attribute set S B middle;

[0077] S42, in order to prevent the access policy from being forged, the sending vehicle changes the definition of matrix generation, performs matrix operations correctly, and the receiving vehicle uses the matrix generation rules of the linear secret sharing scheme LSSS and The authorization attribute r1 is defined as a single-head matrix (nonce), and the other attributes are substituted according to the calculated values ​​of the attribute comparison function, and the access policy P distributed by RSU is generated as its own attribute matrix M B , the process is:

[0078]

[0079] Because there is a target vector ω=(1,0,0,……,0) T ∈Z e Make By Transformed into an augmented matrix, and easily obtained by Gaussian elimination method Because the definition of attribute r1 in the matrix has changed, in order to correctly restore the secret value s, the receiving vehicle modifies itself according to the authorization token nonce

[0080] S43, the receiving vehicle calculates the attribute decryption key D according to the access policy identifier uid and the decryption parameter μ, the process is:

[0081]

[0082] S44, the receiving vehicle obtains the mapping decryption matrix C from the broadcast data packet to be verified i , and the decryption matrix ω B ′ and the attribute decryption key D are substituted into the decryption function decrypt() to calculate the message authentication code key SK′. The calculation process is:

[0083]

[0084] S45. If the domain attributes of the receiving vehicle meet the access control rules, the decrypted message authentication key SK′=SK can be obtained. The receiving vehicle obtains the message authentication code C from the broadcast data packet.M After that, the message hash value generated by the sender can be correctly decrypted. The sending vehicle recalculates the hash value H(M) of the message plaintext. If H(M)′=DEC(C(M),SK′), the broadcast message is considered to be legal, complete and not tampered with, and the plaintext is received; otherwise, the broadcast message is illegal or tampered with, and the broadcast message is discarded. The process is as follows:

[0085] S451. If the domain attributes of the receiving vehicle meet the access control rules, the decrypted message authentication key SK′=SK can be obtained. The receiving vehicle obtains the message authentication code C from the broadcast data packet. M After that, the message hash value H(M)′=DEC(C(M),SK′) generated by the sender can be correctly decrypted.

[0086] S452. The sending vehicle recalculates the hash value H(M) of the plain text of the message. If H(M)=H(M)′, the broadcast information is considered to be legal, complete and not tampered with. Otherwise, the broadcast message is illegal or has been tampered with, and is discarded.

[0087] Furthermore, the step S5 includes:

[0088] S51, if the vehicle behaves maliciously, TA will track its identity according to the pseudonym. Perform inverse operation To obtain the true identity, delete the mapping ρ(x) of a row x of the matrix corresponding to its special attribute set. The process is:

[0089] S511,TA according to Get the real ID of the malicious vehicle v , and the real ID v Conduct traceability;

[0090] S512, TA based on real ID v , delete the mapping ρ(x) of the authentication attribute row x of the matrix corresponding to the special attribute set of the malicious vehicle, and complete the revocation of the malicious vehicle.

[0091] For ease of understanding, the symbols and their meanings involved in the present invention are given as shown in the following table:

[0092]

[0093]

[0094] Compared with the prior art, the present invention has the following beneficial effects:

[0095] (1) The present invention provides a broadcast message authentication method based on attribute encryption in a vehicle networking environment. It designs an anonymous, efficient, and revocable message authentication algorithm and adopts an attribute encryption algorithm to solve the broadcast message authentication service in the vehicle networking environment, thereby realizing the privacy protection of vehicle users. To verify a broadcast message, it is not necessary to identify the identity of the vehicle that sent the message, but to determine whether the sender of the message is one of the entities with the right to this type of information, thereby ensuring the unlinkability and anonymous authentication of the message. At the same time, a revocation algorithm is added to achieve instant revocation. If a malicious vehicle appears, its identity can be tracked and its trusted identity can be revoked in real time.

[0096] (2) The present invention provides a broadcast message authentication method based on attribute encryption in a vehicle networking environment. It designs an improved attribute encryption algorithm based on ciphertext strategy suitable for a vehicle networking broadcast environment. It adopts an improved elliptic curve algorithm attribute encryption algorithm and uses the LSSS matrix structure to describe access control to determine whether the sender is an entity with a certain type of information right. It is more expressive and flexible than a tree structure and can realize any monotonous access structure. Compared with the traditional bilinear mapping operation, it reduces the computational overhead and is more suitable for a vehicle networking environment.

[0097] (3) The present invention provides a broadcast message authentication method based on attribute encryption in a vehicle networking environment. It innovatively moves part of the calculation in generating the attribute decryption key to the registration stage, avoiding the interaction between the vehicle and the trust institution in the traditional attribute decryption process, and realizing the direct calculation of the attribute decryption key by the vehicle. It greatly reduces the time overhead of the decryption process, provides more time for individual vehicles, and thus improves the efficiency of the entire vehicle networking environment. Compared with the traditional attribute encryption algorithm, it is more suitable for the high-efficiency environment of the vehicle networking. BRIEF DESCRIPTION OF THE DRAWINGS

[0098] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0099] Figure 1 An overall flow chart of Internet of Vehicles broadcast message authentication based on attribute encryption provided by the present invention.

[0100] Figure 2 Schematic diagram of the system architecture of the present invention.

[0101] Figure 3 A schematic diagram of the registration phase in a vehicle networking broadcast message authentication method based on attribute encryption provided by the present invention.

[0102] Figure 4 A schematic diagram of the two-way authentication phase in a vehicle networking broadcast message authentication method based on attribute encryption provided by the present invention.

[0103] Figure 5 A schematic diagram of the encryption phase in a vehicle network broadcast message authentication method based on attribute encryption provided by the present invention.

[0104] Figure 6 A schematic diagram of the decryption phase in a vehicle network broadcast message authentication method based on attribute encryption provided by the present invention.

[0105] Figure 7 A comparison chart of the computational overhead provided by the present invention. DETAILED DESCRIPTION

[0106] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. Of course, the specific embodiments described here are only used to explain the present invention and are not used to limit the present invention.

[0107] Example 1

[0108] This embodiment 1 provides a method for secure authentication of Internet of Vehicles broadcast messages based on attribute encryption, such as Figure 1 As shown, the following steps are included:

[0109] S1. The trusted authentication center TA initializes system parameters, registers RSU and vehicles, and initializes domain attribute parameters for RSU

[0110] S2, the roadside unit RSU performs two-way identity authentication with the incoming vehicle and distributes the authentication attributes within the domain;

[0111] S3. The sending vehicle signs the intended broadcast message to ensure message integrity and authenticity;

[0112] S4, after receiving the broadcast information, the receiving vehicle quickly verifies the broadcast message through attribute decryption based on the message verification algorithm;

[0113] S5. Track the identity of malicious vehicles and revoke their domain attributes.

[0114] like Figure 2 As shown in the figure, the Internet of Vehicles architecture in the Internet of Vehicles broadcast message security authentication based on attribute encryption includes: a trusted authentication center (TA), a roadside infrastructure (RSU) and an on-board unit (OBU).

[0115] like Figure 3 As shown, the specific contents of S1 include the following steps:

[0116] S11, TA selects a large prime number p and a finite field Z with order p p , in Z p Define an elliptic curve E on E, and B is a base point of order q on E. TA randomly selects As the system master key, calculate the public key PK = α·B and select a secure hash function H: Public parameters PARAMS = {PK, H};

[0117] S12, the vehicle is registered offline and basic information is submitted to TA for registration. TA selects a random number κ to generate a pseudonym for the vehicle user At the same time, a signature public-private key pair (SK v , PK v ) and generate a corresponding digital certificate Cert for it v The information generated by the registration is stored in the vehicle's non-tamperable device. The process is:

[0118] S121. Before entering the Internet of Vehicles, the vehicle must provide its real ID to the TA v Register. TA selects a random number κ and generates a pseudonym At the same time, a signature public-private key pair (SK v , PK v ) and generate a corresponding digital certificate Cert for it v ;

[0119] S122, TA registers the information {ID v ||RID v ||SK v ||PK v ||Cert v}Send to vehicle;

[0120] S13. RSU performs offline registration, and TA generates an identity ID for the RSU r , randomly selected As the private key, calculate the public key PK r = r·B, and generate the corresponding digital certificate Cert for it r ; Select the attribute private key of the attribute in the RSU domain and assign the identifier corresponding to the access policy, calculate and generate the attribute decryption element, the process is:

[0121] S131. TA sets a unique real identity ID for the RSU in its management area r , random selection As the private key, calculate PK r = r·B as the public key, and generate the corresponding digital certificate Cert for it r ;

[0122] S132, TA random selection As the RSU domain attribute r iThe attribute private key is assigned and the unique identifier uid corresponding to the access policy P is mapped to An element of which is used to calculate the attribute decryption element

[0123] S133, TA will register the information {ID r ||PK r ||Cert r ||α i ||uid||μ} is distributed to RSU;

[0124] S14, RSU generates parameters in the domain. First, it generates an attribute authentication function according to its own equipment conditions, randomly selects a special attribute r1 in the domain, and defines an access control policy in the domain. i As a domain attribute r i Attribute private key, calculate attribute public key PK i =α i B, the process is:

[0125] S141, RSU generates an attribute authentication function, selects ΔT and ΔD as the effective time range of the time attribute and the effective distance range of the distance attribute in the domain according to its own equipment conditions, and defines the attribute piecewise function according to the parameters, and publishes the function F in the domain T ,F D , the function is:

[0126] F T :

[0127] F D :

[0128] S142, RSU generates an intra-domain access policy and randomly selects an authorization token As the special attribute r1 in the domain, define the access control policy P in the domain = {p1, p2, p3} = p1∧(p2∨p3), where p1 is the RSU authorization token nonce, p2 is the valid value of the vehicle identity authentication time, and p3 is the valid value of the vehicle's driving distance in the domain;

[0129] S143, RSU generates a domain attribute public key and registers the value α i As a domain attribute r i Attribute private key, calculate attribute public key PK i =α i ·B.

[0130] like Figure 4 As shown, the specific contents of S2 include the following steps:

[0131] S21, vehicle A selects a random number s1 and sends the vehicle certificate Cert v and random number s1 to RSU;

[0132] S22, RSU selects random number s2, calculates The RSU certificate Cert r , s2 and y1 are sent to vehicle A;

[0133] S23, vehicle A receives the message sent by RSU and uses the certificate Cert r Verify the legitimacy of the RSU's public key, and then use PK r Decrypt y1. If the verification is successful, accept the message and calculate Send to RSU;

[0134] S24, RSU use certificate Cert v Verify vehicle A’s public key PK v Legitimacy, then use PK v Decrypt y2. If the verification is successful, the two-way identity authentication is successful. At this time, RSU assigns the vehicle identity legal attribute r1, and records and stores the authentication time of vehicle A as T1;

[0135] S25. RSU uses the authorization token nonce as the intra-domain authorization attribute r1, and composes the intra-domain attribute encryption parameter message {r1||T1||P||uid||μ} consisting of r1, authentication time T1, access policy P, access policy identifier uid, and attribute decryption element μ to distribute it to the legitimate vehicle so that the vehicle can encrypt the broadcast information.

[0136] like Figure 5 As shown, the specific contents of S3 include the following steps:

[0137] S31, in order to prevent the access strategy from being imitated, the sending vehicle generates the matrix according to the linear secret sharing scheme LSSS and The authorization element p1 is defined as a single-head matrix (nonce), and the remaining elements are recorded as single-head matrices (1) according to the original definition. The access policy P distributed by RSU P = {p1, p2, p3} = p1 ∧ (p2 ∨ p3) is converted into the access matrix M A , the process is:

[0138]

[0139] S32, send vehicle random selection vector s is the secret value corresponding to the attribute in the access policy. The secret value is multiplied by the system master public key to generate the encryption key SK = s PK, which is used for the subsequent symmetric encryption of the message hash value.

[0140] S33, send vehicle pair M A Each row M Ai Calculate inner product Will The secret value s in is hidden in the inner product after matrix multiplication with the generated random number. The calculation process is:

[0141]

[0142] ρ is the A Each row of The mapping matrix generated after the dot multiplication. The sending vehicle uses the attribute public key and the attribute inner product to calculate C i =λ i ·PK i , realize the mapping of access policy to elliptic curve calculation;

[0143] S34, the sending vehicle A calculates the hash value H(M) for the message M to be sent, and generates a message authentication code C M =ENC(H(M),SK), the corresponding access policy P, the mapping encryption matrix C i , plaintext M, message authentication code C M Encapsulate into broadcast message {M||P||C i ||C M} for broadcasting.

[0144] like Figure 6 As shown, the specific contents of S4 include the following steps:

[0145] S41. The vehicle receives the broadcast message, verifies whether the time and distance are within the specified range, and then adds the time and distance attributes to its own attribute set. The process is as follows:

[0146] S411. Calculate r T =T n -T1, where T1 is the authentication time, T n is the current system time, and executes the attribute comparison function F T , if F T If it is less than or equal to the effective time ΔT specified in the domain, the time is considered valid and r2 = 1; otherwise, r2 = 0;

[0147] S412, according to the electromagnetic wave attenuation formula D (KM) = 10 (Loss(dB)-32.44-20logF(MHz)) / 20) , calculate the relative distance r between the vehicle and the RSU D , and execute the attribute comparison function F D , if r D If it is less than or equal to the effective distance ΔD specified in the domain, then r3=1; otherwise r3=0;

[0148] S413, the receiving vehicle adds the time attribute r2 and the distance attribute r3 to its own attribute set S B middle;

[0149] S42, in order to prevent the access policy from being forged, the sending vehicle changes the definition of matrix generation. In order to correctly perform matrix operations, the receiving vehicle uses the matrix generation rules of the linear secret sharing scheme LSSS and The authorization attribute r1 is defined as a single-head matrix (nonce), and the other attributes are substituted according to the calculated values ​​of the attribute comparison function, and the access policy P distributed by RSU is generated as its own attribute matrix M B , the process is:

[0150]

[0151] Because there is a target vector ω=(1,0,0,……,0) T ∈Z e Make By Transformed into an augmented matrix, and easily obtained by Gaussian elimination method Because the definition of attribute r1 in the matrix has changed, in order to correctly restore the secret value s, the receiving vehicle modifies itself according to the authorization token nonce

[0152] S43, the receiving vehicle calculates the attribute decryption key D according to the access policy identifier uid and the decryption parameter μ, the process is:

[0153]

[0154] S44, the receiving vehicle obtains the mapping decryption matrix C from the broadcast data packet to be verified i , and the decryption matrix ω B ′ and the attribute decryption key D are substituted into the decryption function decrypt() to calculate the message authentication code key SK′. The calculation process is:

[0155]

[0156] S45. If the domain attributes of the receiving vehicle meet the access control rules, the decrypted message authentication key SK′=SK can be obtained. The receiving vehicle obtains the message authentication code C from the broadcast data packet. MAfter that, the message hash value generated by the sender can be correctly decrypted. The sending vehicle recalculates the hash value H(M) of the message plaintext. If H(M)′=DEC(C(M),SK′), the broadcast message is considered to be legal, complete and not tampered with, and the plaintext is received; otherwise, the broadcast message is illegal or tampered with, and the broadcast message is discarded. The process is as follows:

[0157] S451. If the domain attributes of the receiving vehicle meet the access control rules, the decrypted message authentication key SK′=SK can be obtained. The receiving vehicle obtains the message authentication code C from the broadcast data packet. M After that, the message hash value H(M)′=DEC(C(M),SK′) generated by the sender can be correctly decrypted.

[0158] S452. The sending vehicle recalculates the hash value H(M) of the plain text of the message. If H(M)=H(M)′, the broadcast information is considered to be legal, complete and not tampered with. Otherwise, the broadcast message is illegal or has been tampered with, and is discarded.

[0159] Furthermore, the step S5 includes:

[0160] S51, if the vehicle behaves maliciously, TA will track its identity according to the pseudonym. Perform inverse operation To obtain the true identity, delete the mapping ρ(x) of a row x of the matrix corresponding to its special attribute set. The process is:

[0161] S511,TA according to Get the real ID of the malicious vehicle v , and the real ID v Traceability; S512, TA based on real ID v , delete the mapping ρ(x) of the authentication attribute row x of the matrix corresponding to the special attribute set of the malicious vehicle, and complete the revocation of the malicious vehicle.

[0162] In order to verify the feasibility of the present invention, the security of this embodiment 1 is analyzed:

[0163] Lemma 1 Under the selective security model, each operation in this embodiment is safe.

[0164] Proof Assume that under the selective security model, adversary A can attack our scheme with a non-negligible advantage ε in polynomial time.

[0165] Challenger C sets G to be in Z p A base point of order q on the elliptic curve E, C is randomly selected By tossing a coin, we choose a β∈{0,1}. If β=0, C chooses the ECDDH example (B,C,D)=(b·G,c·G,b·c·G). If β=1, C uses a random example (B,C,D)=(b·G,c·G,d·G). Simulator B wants to attack, and is trained by C to obtain an access policy (A,ρ). Adversary A uses B as a challenger and attacks B.

[0166] (1) Initialization: Simulator B selects the security parameter p to execute the algorithm (Setup) and sets the system parameters to Y = B = b·G. i ∈S, randomly selected Calculate Y i =γ i G, the public parameters {Y,Y i ,H} is sent to enemy A. B keeps the private key {γ i ,y}.

[0167] (2) Query Phase 1:

[0168] Phase 1: Adversary A queries B for the decryption key based on its own attribute set. B sets the decryption key

[0169] Challenge phase: A sends two messages M0 and M1 of equal length to B and encrypts them using access policy (A, ρ). B tosses a coin and chooses a μ∈{0,1}, generating M μ Ciphertext CT μ .

[0170] Step 1:

[0171] B randomly selects a vector s is the secret value corresponding to the special attribute, and SK is calculated using the secret value B =s·Y, they are the encryption key and integrity key of the broadcast message respectively.

[0172] Step2:

[0173] B uses H to calculate the hash value H(M) of M, and then calculates C i =λ i ·Y i , and using the encryption key K x Symmetrically encrypt the hash value of the message to obtain C M =Enc(H(M),K x ), calculate the final output ciphertext CT = (C i ||C M ||H(M)) is sent to adversary A.

[0174] Challenger C chooses a β∈{0,1} by tossing a coin. There are two cases:

[0175] β=0:C chooses ECDDH example, let D=b·c·G. If s=c, then SK B =c·Y=c·b·G.,C i =s·Y i =c·Y i =c·γ i G = γ i C is the same as this plan.

[0176] β=1:C selects random examples, D=d·G, if s=d, then SK B =d·Y=d·b·G,C i =d·Y i =d·γ i G = γ i ·D.

[0177] (4) Query Phase 2:

[0178] The operation of Phase 1 of the repeated query phase continues.

[0179] (5) Guess: A sends a message to simulator B: μ′ The guess results.

[0180] If μ′=μ, then the simulator outputs β′=0, i.e., the ECDDH example (B,C,D)=(b·G,c·G,b·c·G). Otherwise, B outputs β′=1, i.e., the random example (B,C,D)=(b·G,c·G,d·G).

[0181] When β = 1, the adversary A cannot guess the correct ciphertext, so

[0182] When μ′≠μ, simulator B outputs β′=1:

[0183] When β = 0, the adversary can guess the correct ciphertext:

[0184] For Simulator B:

[0185] Finally, in the ECDDH game, the advantage of simulator B is

[0186]

[0187] Conflict with assumptions.

[0188] Theorem 1 This embodiment can realize the revocability of attributes and reduce the possibility of malicious vehicles repeatedly sending malicious information.

[0189] Prove that when a malicious vehicle appears, TA passes After finding the real identity of the malicious vehicle, the mapping ρ(r1) corresponding to its special attributes in the matrix is ​​deleted, that is, the malicious vehicle loses its special attributes in the domain.

[0190] If a malicious vehicle wants to encrypt the broadcast message again, when searching for the special attribute in the domain from its own attribute set S, the malicious vehicle cannot calculate the secret value s corresponding to the special attribute r1 because TA has deleted its special attribute, and cannot give the access control policy corresponding to the special attribute. Therefore, it cannot calculate the corresponding encryption key through SK=s·PK. The broadcasted message cannot be decrypted normally by the vehicle in the domain that has the special attribute decryption key and is considered an unreliable message. Therefore, the scheme in this paper satisfies the attribute revocability and reduces the possibility of malicious vehicles repeatedly sending malicious information by using attribute revocation.

[0191] Therefore, this embodiment can ensure that the attribute is revocable, and the malicious vehicle cannot send malicious information again through calculation. The proof is complete.

[0192] Theorem 2 This embodiment can resist conspiracy attacks.

[0193] Prove attribute key and attribute set and their corresponding unique identifier uid v If multiple malicious vehicles do not have the right to encrypt broadcast messages, and the unique identifiers corresponding to each attribute set are different, even if the corresponding attribute sets are merged, they cannot collude their attributes to broadcast messages or decrypt messages.

[0194] Therefore, this embodiment can achieve anti-conspiracy attack, and the proof is complete.

[0195] Theorem 3 This embodiment can achieve conditional privacy protection of the vehicle.

[0196] Prove that the vehicle used a random pseudonym RID when broadcasting messages v , the pseudonym is a combination of a random number and a real ID v Together, Each time a vehicle broadcasts a message, the time T, random data r and u are different each time, which will generate unrelated pseudonyms and different signatures. To conduct an identity information attack, it is necessary to solve it. According to the ECDLP problem assumption, it is impossible to complete it in polynomial time. Therefore, the scheme in this paper satisfies identity privacy protection.

[0197] When TA needs to track the true identity of the message sender, he can use Calculate the real identity of the message sender. Therefore, the scheme in this paper meets the traceability of identity.

[0198] Example 2

[0199] To verify the feasibility of the present invention, Example 2 compares the functionality and feasibility of the present invention with other vehicle network broadcast message authentication schemes, including Scheme 1 proposed by BAYAT M et al. in "A secure authentication scheme for VANETs with batch verification", Scheme 2 proposed by LEE CC et al. in "Toward a secure batch verification with group testing for VANET", Scheme 3 proposed by WANG W et al. in "Bayesian cognitive trust model based self-clustering algorithm for MANETs", and Scheme 4 proposed by GAYATHRI NB et al. in "Efficient pairing-free certificateless authentication scheme with batch verification for vehicular ad-hoc networks".

[0200] 1. Functional comparison

[0201] Functional comparison includes: the cryptographic algorithm used, whether malicious identity revocation is supported, and whether identity timeliness can be guaranteed:

[0202]

[0203] Note: × means no such function

[0204] First, compared with the other four solutions, this embodiment supports the real-time revocation of malicious vehicle identities, while ensuring that user identities meet timeliness and security. Solutions 1-4 all sign messages using the vehicle's own identity, and it is difficult for the system to remove public and private keys to revoke members, and it is impossible to ensure that the identity of the key holder is time-effective, which poses a major security vulnerability. This embodiment, however, uses the system to delete the authentication attributes within the domain to revoke the malicious vehicle's identity in real time, and ensures the timeliness of the vehicle's identity through dynamic changes in time attributes.

[0205] Secondly, schemes 1-4 all use their own identities to sign messages, and the adversary can easily obtain the sender's identity through broadcast information. However, this embodiment uses attribute encryption to sign messages. To verify a broadcast message, it is not necessary to identify the identity of the vehicle that sends the message, but to determine whether the sender of the message is one of the entities with the right to this type of information, which ensures the unlinkability and anonymous authentication of the message, and has stronger security.

[0206] Finally, except for Scheme 4, the remaining schemes all use bilinear operation equations to complete message verification, but the attribute encryption operation of this embodiment has lower computational overhead.

[0207] 2. Performance Analysis

[0208] (1) Computational Cost Analysis and Comparison

[0209] 1) Relevant preparation

[0210] Since the attribute encryption algorithm of this embodiment is based on the ciphertext strategy, multiple bilinear pairing operations are required for vehicle encryption and decryption. In order to further reduce the computational overhead, the elliptic curve operation with lower computational overhead is used instead of the bilinear pairing operation:

[0211] For example, in the decryption and signature verification phase, traditional attribute encryption based on ciphertext strategy requires multiple bilinear operations to verify the equation Is it true? In this experiment, we only need to perform multiple elliptic curve scalar multiplication calculations. The symmetric key used to verify the message authentication code can be obtained, which greatly shortens the calculation time.

[0212] This section only considers the main computational overhead, ignoring the time overhead of matrix operations that have a smaller impact. The single computational overhead of the main cryptographic operations is experimentally evaluated. The experiment is based on the experimental environment of Yang Jiyun and other scholars in "Efficient Authentication Scheme for Internet of Vehicles Based on Chebyshev Chaotic Mapping", and the security level of the bilinear cryptographic algorithm and the elliptic curve cryptographic algorithm are set to 80 bits. The bilinear pair cryptographic operation scheme is set to: e:G b ×G b →G′, where G b is an additive group of order q′ generated by generator p′; p′ is a supersingular elliptic curve E′:y of degree 2 2 =x 3 +a′x+b′(mod p′); p′ is a prime number with a length of 512 bits. The elliptic curve cryptographic operation scheme is set to: E:y 2 =x 3 +ax+b(mod p), where p is a point on the non-singular elliptic curve E, and the additive group of order q generated by p as a generator is denoted by G; p and q are prime numbers of length 160 bits; The symmetric encryption algorithm AES-192 is used, and the length of the large prime numbers p and q are both 192 bits. Using the JAVA cryptography library, running in the Win10 operating system environment configured with Intel i5-8400CPU and 8GB memory, this paper implements various cryptographic operations in the above cryptographic operation scheme and records the corresponding average time. The results are shown in the following table:

[0213]

[0214]

[0215] 2) Comparison and analysis

[0216] The following table shows the comparison of the time cost of message signing and verification between this embodiment and solutions 1-4.

[0217]

[0218] As can be seen from the table above, since this embodiment avoids bilinear operations with high computational overhead and uses elliptic curve operations instead, the computational overhead of signing and verification is greatly reduced. Therefore, the total computational overhead of signing and authenticating the message in this embodiment is only 5T. em +2T sym +3T h ≈1.8376ms, with low computational overhead. In contrast, Scheme 1 requires five bilinear small factor multiplication operations, one bilinear addition operation, one Map-to-point hash function operation, and two one-way hash operations in the message signing phase, and three bilinear pairing operations, one bilinear small factor multiplication operation, one Map-to-point hash function operation, and one one-way hash function operation in the message authentication phase. The total cost of the scheme is

[0219] 6T bm +3T bp +T ba +2T mtp +3T h ≈33.4025ms; Scheme 2 requires four bilinear scalar multiplication operations, one bilinear addition operation, two Map-to-Point hash function operations, and one one-way hash function operation in the message signing phase, and three bilinear pairing operations, one bilinear scalar multiplication operation, one Map-to-Point hash function operation, and one one-way hash function operation in the message authentication phase. The total cost of the scheme is 5T bm +3T bp +T ba +3T mtp +2T h≈33.9165ms; Scheme 3 requires five elliptic curve scalar multiplication operations, one elliptic curve addition operation, one Map-to-Point hash function operation, and one one-way hash function operation in the message signing phase. In the message authentication phase, it requires three bilinear pairing operations, two bilinear addition operations, one bilinear small factor multiplication operation, one Map-to-Point hash function operation, and one one-way hash function operation. The total cost of the scheme is T bm +3T bp +2T ba +5T em +T ea +2T mtp +2T h ≈29.1487ms; Scheme 4 requires two elliptic curve scalar multiplication operations and three one-way hash function operations in the message signing phase, and five elliptic curve scalar multiplication operations, three elliptic curve addition operations, and two one-way hash function operations in the message authentication phase. The total cost of the scheme is 7T em +3T ea +5T h ≈2.2229ms.

[0220] Figure 7 The computational overhead comparison of this embodiment and schemes 1 to 4 in the signing and authentication phase of a single broadcast message is shown. Scheme 4 also uses elliptic curve operations to replace bilinear operations, which greatly reduces the computational overhead time, and the time overhead is similar to that of this embodiment.

[0221] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for authenticating broadcast messages in an Internet of Vehicles based on attribute encryption, characterized in that: The steps include: S1. The trusted authentication center TA initializes system parameters, registers RSU and vehicles, and initializes domain attribute parameters for RSU; S2, the roadside unit RSU performs two-way authentication with the incoming vehicle and distributes the authentication attributes within the domain; S3. The sending vehicle signs the intended broadcast message to ensure message integrity and authenticity; S4, after receiving the broadcast message, the receiving vehicle quickly verifies the broadcast message through attribute decryption based on the message verification algorithm; S5. Track the identity of malicious vehicles and revoke their domain attributes.

2. The vehicle networking broadcast message authentication method based on attribute encryption in the vehicle networking environment according to claim 1 is characterized in that: The step S1 comprises the following steps: S11, TA selects a large prime number p and a finite field Z with order p p , in Z p Define an elliptic curve E on the graph, B is a base point of order q on E, and TA randomly selects As the system master key, calculate the public key PK = αB and select a secure hash function H: Public parameters PARAMS = {PK, H}; S12, the vehicle is registered offline, and basic information is submitted to TA for registration. TA selects a random number κ and generates a pseudonym for the vehicle user At the same time, a signature public-private key pair (SK v , PK v ) and generate a corresponding digital certificate Cert for it v ,The information generated by registration is stored in the vehicle’s tamper-proof device; S13. RSU performs offline registration, and TA generates an identity ID for the RSU r , randomly selected As the private key, calculate the public key PK r = rB, and generate the corresponding digital certificate Cert for it r ; Select the attribute private key of the attribute in the RSU domain and assign the identifier corresponding to the access policy, and calculate and generate the attribute decryption element; S14, RSU generates parameters in the domain. First, it generates an attribute authentication function according to its own equipment conditions, randomly selects a special attribute r1 in the domain, and defines an access control policy in the domain. i As a domain attribute r i Attribute private key, calculate attribute public key PK i =α i B; In step S12, the vehicle registration process includes the following steps: S121. Before entering the Internet of Vehicles, the vehicle must provide its real ID to the TA v To register, TA selects a random number κ and generates a pseudonym At the same time, a signature public-private key pair (SK v , PK v ) and generate a corresponding digital certificate Cert for it v ; S122, TA registers the information {ID v ||RID v ||SK v ||PK v ||Cert v }Send to vehicle; In step S13, the RSU registration process includes the following steps: S131. TA sets a unique real identity ID for the RSU in its management area r , random selection As the private key, calculate PK r = r·B as the public key, and generate the corresponding digital certificate Cert for it r ; S132, TA random selection As the RSU domain attribute r i The attribute private key is assigned and the unique identifier uid corresponding to the access policy P is mapped to An element of which is used to calculate the attribute decryption element S133, TA will register the information {ID r ||PK r ||Cert r ||α i ||uid||μ} is distributed to RSU; In step S14, the process of generating the domain parameters includes the following steps: S141, RSU generates an attribute authentication function, selects ΔT and ΔD as the effective time range of the time attribute and the effective distance range of the distance attribute in the domain according to its own equipment conditions, and defines the attribute piecewise function according to the parameters, and publishes the function F in the domain T ,F D ; S142, RSU generates an intra-domain access policy and randomly selects an authorization token As the special attribute r1 in the domain, define the access control policy P in the domain = {p1, p2, p3} = p1∧(p2∨p3), where p1 is the RSU authorization token nonce, p2 is the valid value of the vehicle identity authentication time, and p3 is the valid value of the vehicle's driving distance in the domain; S143, RSU generates a domain attribute public key and registers the value α i As a domain attribute r i Attribute private key, calculate attribute public key PK i =α i ·B.

3. The vehicle networking broadcast message authentication method based on attribute encryption in the vehicle networking environment according to claim 1 is characterized in that: The step S2 comprises the following steps: S21, vehicle A selects a random number s1 and sends the vehicle certificate Cert v and random number s1 to RSU; S22, RSU selects random number s2, calculates The RSU certificate Cert r , s2 and y1 are sent to vehicle A; S23, vehicle A receives the message sent by RSU and uses the certificate Cert r Verify the legitimacy of the RSU's public key, and then use PK r Decrypt y1. If the verification is successful, the message is accepted and the calculation is performed. Send to RSU; S24, RSU use certificate Cert v Verify vehicle A’s public key PK v Legitimacy, then use PK v Decrypt y2. If the verification is successful, the two-way identity authentication is successful. At this time, RSU assigns the vehicle identity legal attribute r1 and records and stores the authentication time of vehicle A as T1; S25. RSU uses the authorization token nonce as the intra-domain authorization attribute r1, and composes the intra-domain attribute encryption parameter message {r1||T1||P||uid||μ} consisting of r1, authentication time T1, access policy P, access policy identifier uid, and attribute decryption element μ to distribute it to the legitimate vehicle so that the vehicle can encrypt the broadcast information.

4. The vehicle networking broadcast message authentication method based on attribute encryption in the vehicle networking environment according to claim 1 is characterized in that: The step S3 comprises the following steps: S31, the matrix generation rule of the sending vehicle according to the linear secret sharing scheme LSSS and The authorization element p1 is defined as a single-head matrix (nonce), and the remaining elements are recorded as single-head matrices (1) according to the original definition. The access policy P distributed by RSU P = {p1, p2, p3} = p1 ∧ (p2 ∨ p3) is converted into the access matrix M A ; S32, send vehicle random selection vector s is the secret value corresponding to the attribute in the access policy. The secret value is multiplied by the system master public key to generate the encryption key SK = s PK, which is used for the subsequent symmetric encryption of the message hash value. S33, send vehicle pair M A Each row M Ai Calculate inner product Will The secret value s in the matrix is ​​hidden in the inner product after matrix multiplication with the generated random number. The sending vehicle uses the attribute public key and the attribute inner product to calculate C i =λ i ·PK i , realize the mapping of access policy to elliptic curve calculation; S34, the sending vehicle A calculates the hash value H(M) for the message M to be sent, and generates a message authentication code C M =ENC(H(M),SK), the corresponding access policy P, the mapping encryption matrix C i , plaintext M, message authentication code C M Encapsulate into broadcast message {M||P||C i ||C M } for broadcasting.

5. The vehicle networking broadcast message authentication method based on attribute encryption in the vehicle networking environment according to claim 1 is characterized in that: The step S4 comprises the following steps: S41, the vehicle receives the broadcast message, verifies whether the time and distance are within the specified range, and then adds the time and distance attributes to its own attribute set; S42, in order to prevent the access policy from being forged, the sending vehicle changes the definition of matrix generation, performs matrix operations correctly, and the receiving vehicle uses the matrix generation rules of the linear secret sharing scheme LSSS and The authorization attribute r1 is defined as a single-eye matrix, and the other attributes are substituted according to the calculated values ​​of the attribute comparison function, and the access policy P distributed by RSU is generated as its own attribute matrix M B ; S43, the receiving vehicle calculates the attribute decryption key D according to the access policy identifier uid and the decryption parameter μ; S44, the receiving vehicle obtains the mapping decryption matrix C from the broadcast data packet to be verified i , and the decryption matrix ω B ′ and the attribute decryption key D are substituted into the decryption function decrypt() to calculate the message authentication code key SK′; S45. If the domain attributes of the receiving vehicle meet the access control rules, the decrypted message authentication key SK′=SK can be obtained, and the receiving vehicle obtains the message authentication code C from the broadcast data packet. M After correctly decrypting the message hash value generated by the sender, the sending vehicle recalculates the hash value H(M) of the message plaintext. If H(M)′=DEC(C(M),SK′), the broadcast message is considered to be legal and complete and has not been tampered with, and the plaintext is received; otherwise, the broadcast message is illegal or has been tampered with, and the broadcast message is discarded; In step S41, the message verification process includes the following steps: S411. Calculate r T =T n -T1, where T1 is the authentication time, T n is the current system time, and executes the attribute comparison function F T , if F T If it is less than or equal to the effective time ΔT specified in the domain, the time is considered valid and r2 = 1; otherwise, r2 = 0; S412, according to the electromagnetic wave attenuation formula D (KM) = 10 (Loss(dB)-32.44-20logF(MHz)) / 20) , calculate the relative distance r between the vehicle and the RSU D , and execute the attribute comparison function F D , if r D If it is less than or equal to the effective distance ΔD specified in the domain, then r3=1; otherwise r3=0; S413, the receiving vehicle adds the time attribute r2 and the distance attribute r3 to its own attribute set S B middle; In step S45, the message verification process includes the following steps: S451. If the domain attributes of the receiving vehicle meet the access control rules, the decrypted message authentication key SK′=SK can be obtained, and the receiving vehicle obtains the message authentication code C from the broadcast data packet. M Then correctly decrypt the message hash value H(M)′=DEC(C(M),SK′) generated by the sender; S452. The sending vehicle recalculates the hash value H(M) of the plain text of the message. If H(M)=H(M)′, the broadcast information is considered to be legal, complete and not tampered with. Otherwise, the broadcast message is illegal or has been tampered with, and is discarded.

6. The vehicle networking broadcast message authentication method based on attribute encryption in the vehicle networking environment according to claim 1 is characterized in that: The step S5 comprises the following steps: S51, if the vehicle shows malicious behavior, TA will track the identity according to the pseudonym. Perform inverse operation To obtain the true identity, delete the mapping ρ(x) of a row x of the matrix corresponding to its special attribute set; In step S51, the attribute revocation process includes the following steps: S511,TA according to Get the real ID of the malicious vehicle v , and the real ID v Conduct traceability; S512, TA based on real ID v , delete the mapping ρ(x) of the authentication attribute row x of the matrix corresponding to the special attribute set of the malicious vehicle, and complete the revocation of the malicious vehicle.

Images