Internet of Vehicles security batch authentication method oriented to cloud service scene

Abstract

The invention provides an Internet of Vehicles security batch authentication method oriented to a cloud service scene, and relates to the field of Internet of Vehicles and post quantum security. The batch authentication method comprises the following steps: a trusted mechanism generates a public parameter and a public and private key pair of the trusted mechanism; the vehicle and the road test unit apply for registration from the trusted mechanism, and the trusted mechanism generates an identifier and a private key for the vehicle and the road test unit according to an access control strategy; when the vehicle and the road test unit communicate with the cloud server, the vehicle and the road test unit perform digital signature on the sent message by using the private keys thereof; when the cloud server receives massive messages, the cloud server carries out batch authentication on the messages with the same attribute to verify the authenticity and integrity of the messages and accelerate the authentication process at the same time; according to the batch authentication method provided by the invention, a safe and efficient data authentication service can be provided for the cloud server, the consumption of storage and computing resources is reduced, and meanwhile, the response delay and the average message packet loss rate are reduced; and the method can realize fine-grained access control and post-quantum security.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Vehicles data signature supporting post-quantum security, and specifically relates to an Internet of Vehicles security batch authentication method for cloud service scenarios. Background Art

[0002] As an important part of intelligent transportation systems (ITSs), vehicle self-organizing networks (V2Is) not only improve the safety and efficiency of road traffic management systems, but also enhance the driving experience of users. In V2Is, there are at least three participants: vehicles with on-board units (OBUs), road test units (RSUs), and cloud servers. V2Is support multiple types of communication protocols, such as vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), vehicle-to-cloud (V2C), vehicle-to-person (V2P), and infrastructure-to-cloud (I2C). In fact, all wired communications, dedicated short-range communication protocols (DSRC), 5G, and even future 6G can be used for V2I communications.

[0003] Since the Internet of Vehicles generates a large amount of traffic data in real time, cloud servers play an important role in processing this massive data. In practical applications, after receiving traffic data from vehicles and roadside units through protocols such as V2C and I2C (for simplicity, X2C is used to represent the communication between the cloud server and X, where X represents vehicles, roadside units, etc.), the cloud server processes these massive traffic data to complete traffic situation awareness and traffic management, which is the basis for improving traffic efficiency and realizing intelligent transportation. How to ensure the security and efficiency of communication with the cloud server is a very necessary requirement. The cloud server hopes to ensure the legitimacy of the requirements of vehicles and road test units before providing services. At the same time, vehicles and others also hope that the cloud server can respond to their needs as soon as possible, especially when a large number of vehicles and road test units need the services of the cloud server.

[0004] Batch authentication provides an effective solution to ensure the security and efficiency of communication with cloud servers. In batch authentication, multiple authentications from different parties can be verified at the same time. Obviously, the cloud server of the Internet of Vehicles can use batch authentication to process messages from different vehicles and road test units. In this way, the security and efficiency requirements of the Internet of Vehicles can be met at the same time. Furthermore, the data-sending vehicle also has the need for privacy protection during the data authentication process. Otherwise, the leakage of vehicle privacy information will pose a threat to the safety of the owner. Attribute-based signatures (ABS) provide a feasible solution to the privacy protection requirements of batch authentication. In ABS, the characteristics of a vehicle or road test unit are regarded as attributes, and an access control policy is used to verify the validity of the attributes. Attribute-based signatures can only be verified and accepted when the attributes match the access control policy correctly. When the signature is generated by a vehicle and a road test unit with the same attribute, the cloud server can use the same access control policy to check the attribute. Once the attribute matches the given access control policy, these signatures from vehicles and road test units can be verified in batches.

[0005] As mentioned above, data authentication, data communication efficiency and privacy protection are important practical needs in IoV data communication. However, most of the existing IoV batch authentication schemes cannot meet the above requirements at the same time. The main manifestations are: 1) In the known attribute signature-based batch authentication algorithm [1], when multiple signatures need to be verified simultaneously, the batch authentication time will increase rapidly, resulting in the cloud server being unable to respond in time; 2) Some schemes [2-4] cannot guarantee the identity privacy of the data sending vehicle during the IoV data batch authentication process, and there is a risk of identity privacy leakage, leading to network attacks; 3) Most of the existing schemes [5,6] cannot provide long-term security. Most of the existing schemes are designed based on the difficulty of large integer factorization and discrete logarithm problems and cannot resist quantum attacks.

[0006] Among them, [1] Yu P, Ni W, Yu G, et al. Efficient anonymous data authentication for vehicular ad hoc networks[J]. Security and Communication Networks, 2021, 2021(1): 6638453. [2] Liu F, Wang Q. IBRS: an efficient identity-based batch verification scheme for VANETs based on ring signature[C] / / 2019 IEEE Vehicular Networking Conference (VNC). IEEE, 2019: 1-8. [3] Ali I, Lawrence T, Li F. An efficient identity-based signature scheme without bilinear pairing for vehicle-to-vehicle communication in VANETs[J]. Journal of Systems Architecture, 2020, 103: 101692. [4] Vangujar A K, Umrani A, Palmieri P. Identity-Based Cluster Authentication and Key Exchange (ID-CAKE) Message Broadcasting and Batch Verification in VANETs[C] / / International Conference on Applied Cryptography and Network Security. Cham: Springer Nature Switzerland, 2024: 162-179. [5] Li J, Chen X, Huang X. New attribute–based authentication and its application in anonymous cloud access service[J].International Journal of Web and Grid Services, 2015, 11(1): 125-141.[6] Tao Q, Cui X, Iftekhar A. A novel lightweight decentralized attribute-based signature scheme for social co-governance[J]. Information Sciences, 2024, 654: 119839. Summary of the invention

[0007] The purpose of the present invention is to provide a secure batch authentication method for Internet of Vehicles in a cloud service scenario, and to provide a safe and efficient solution for data authentication, data communication efficiency and privacy protection in the process of Internet of Vehicles data communication.

[0008] To achieve the above objectives, the present invention provides a vehicle networking data communication solution consisting of four entities: a trusted institution, a cloud server, a vehicle, and a drive test unit as follows:

[0009] A method for batch authentication of Internet of Vehicles security in a cloud service scenario includes the following steps:

[0010] Step A, system establishment phase: the trusted institution generates system public parameters and the public and private key pairs of the trusted institution;

[0011] Step B, key extraction phase: Entities such as vehicles and drive test units submit registration requests to trusted institutions and send access control policies. Trusted institutions generate identifiers and private keys based on their access control policies and return them to the corresponding entities.

[0012] Step C, the vehicle and the drive test unit send a message to the cloud server: the vehicle and the drive test unit use their own private keys to digitally sign the message to be sent, and then send the message, signature, attributes and identifier to the cloud server;

[0013] Step D, cloud server single authentication phase: When the cloud server receives only a single message, it first checks whether the attributes and access control policies match. If they match, it uses a single authentication algorithm to verify the authenticity and integrity of the message;

[0014] Step E, cloud server batch authentication phase: When the cloud server receives a large number of messages, it first checks whether the attributes and access control policies match. If they match, it uses a batch authentication algorithm to batch verify the authenticity and integrity of the messages;

[0015] Furthermore, the step A specifically includes:

[0016] Trusted institutions based on system parameters , generate a security parameter set Finally, choose three secure hash functions: .

[0017] The secure hash function inputs a string of 0s and 1s of a specified length, and outputs a string of a fixed range of a specific length.

[0018] Trusted institution settings and an identity matrix , trusted institutions use Algorithm generation and Trapdoor , then the public key of the trusted institution is , the private key is .

[0019] Furthermore, the step B specifically includes:

[0020] Trusted institutions based on access control policies Generates an identifier for a vehicle or a road test unit , where the attribute , , .

[0021] Trusted Computing , .

[0022] Trusted institutions modify access control policies Then get the function , ,according to calculate , .

[0023] Trusted institution operation algorithm, Get the private key and the identifier and private key Sent to the vehicle or road test unit, the vehicle or road test unit calculates the equation Is it established to verify the correctness of the private key it received.

[0024] Furthermore, the step C specifically comprises:

[0025] The vehicle or road test unit sends a message to the cloud server Digitally sign.

[0026] Vehicle or road test unit calculation , , ,in According to Gaussian distribution selected.

[0027] Vehicle or road test unit calculation , and .

[0028] Vehicle or road test unit calculation and .

[0029] Vehicle or road test unit operation algorithm, , get the signature , then Send to the cloud server.

[0030] Furthermore, the step D specifically includes:

[0031] The cloud server only received a single message , which first calculates ,if , then the verification ends if , perform the following steps.

[0032] Cloud Server Computing , and .

[0033] Cloud Server Computing and .

[0034] Cloud Server Computing , .

[0035] Cloud servers calculate the equation Whether to receive this message is determined by whether the condition is established.

[0036] Furthermore, the step E specifically includes:

[0037] The cloud server receives a large number of messages , which first calculates ,if , then the verification ends if , perform the following steps.

[0038] Cloud Server Computing , and .

[0039] Cloud Server Computing and .

[0040] Cloud Server Computing , .

[0041] Cloud servers calculate the equation Whether to receive this batch of messages is determined by whether the condition is established.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] The present invention proposes a method for batch authentication of Internet of Vehicles security in a cloud service scenario, which has high communication efficiency. In this method, attributes are defined as characteristics of vehicles and road test units, the signature keys of vehicles and road test units are associated with access control policies, and the signatures of vehicles and road test units are associated with their attributes. Once the attributes match the access control policies, the cloud server can batch verify multiple messages from vehicles and road test units with the same attributes at the same time, thereby improving authentication efficiency and reducing the response time of the cloud server. Therefore, the present invention achieves high communication efficiency through cloud server batch authentication, thereby effectively improving traffic efficiency, traffic safety and driving experience.

[0044] The present invention proposes a secure batch authentication method for the Internet of Vehicles in a cloud service scenario, which has privacy protection and post-quantum security. In the process of data communication, since only some attributes of the vehicle and the road test unit are disclosed, no one can know their identities, so the privacy protection of the vehicle and the road test unit is effectively realized, which is more in line with the needs of the Internet of Vehicles communication scenario. At the same time, the present invention uses lattice-based cryptographic tools, so the proposed method can achieve post-quantum security. Based on this method, security protection under selected attribute and selected message attacks is provided during the interaction between the vehicle and the road test unit and the cloud server.

[0045] The present invention proposes a method for batch authentication of Internet of Vehicles security in cloud service scenarios, which has good space efficiency and computational efficiency. Thanks to the fact that the length of attribute-based signatures is independent of the attribute size, our method achieves a shorter single signature length, which can effectively save the system bandwidth of X2C communication. In addition, for multiple signatures from vehicles and road test units with the same attributes, the cloud server can complete batch authentication only through multiple vector addition operations. Therefore, as the number of signatures increases, the time for batch authentication increases slowly, which directly leads to a shorter response time of the cloud server. Therefore, our method shows significant advantages in both storage space efficiency and computational efficiency. Compared with the existing batch authentication scheme, it fully saves the system's space resources and computing resources, thereby achieving more efficient resource utilization. In addition, a more realistic network simulation was performed using Network Simulator 3 (NS3), and the response delay and average message loss rate of the method were tested. The simulation results show that the response time of batch authentication is at least 30% shorter than that of single authentication, and the average message loss rate is always less than 15%. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is a model architecture diagram of the present invention;

[0047] Figure 2 It is a flow chart of the scheme of the present invention;

[0048] Figure 3 Comparison between the present invention and existing achievements in terms of signature length;

[0049] Figure 4 Comparison between the present invention and existing achievements in the computational efficiency of message signature algorithms;

[0050] Figure 5 Comparison between the present invention and existing results in terms of computational efficiency of message batch authentication algorithms;

[0051] Figure 6 This is a response time diagram of the cloud server under the influence of vehicle density of the present invention;

[0052] Figure 7 Comparison of single authentication and batch authentication response time of cloud servers under the influence of vehicle density of the present invention;

[0053] Figure 8 is a diagram of packet loss rate under the influence of vehicle speed and vehicle density of the present invention;

[0054] Fig. 9 A radar chart comparing the effects of this invention with existing achievements; DETAILED DESCRIPTION

[0055] The present invention is fully and clearly described below in conjunction with the accompanying drawings and specific implementation cases in the embodiments of the present invention. This embodiment is implemented based on the technical solution of the present invention, and it should be understood that the specific embodiments are only used to illustrate the present invention rather than to limit the scope of the present invention.

[0056] The present invention provides a vehicle networking security batch authentication method for a cloud service scenario.

[0057] First, the following terms are explained:

[0058] Attribute-based signature: Attribute-based signature is a special digital signature technology. Its signature is associated with a set of attributes rather than a specific entity, and it has flexible and fine-grained access control capabilities. It is suitable for scenarios that require authorization and authentication based on user attributes, such as access control, cloud computing and other fields.

[0059] Batch authentication: Batch authentication is a method of authenticating multiple entities or requests at one time. It helps improve authentication efficiency and reduce repeated operations. It is suitable for authenticating large amounts of data in network communications.

[0060] Cloud service: Cloud servers store and manage a large amount of vehicle and road test unit data, including vehicle driving trajectories, road traffic conditions, etc., providing a basis for vehicle traffic planning. Cloud servers can analyze real-time and historical data. Cloud servers analyze vehicle location, speed, acceleration, etc. in real time to provide users with more optimized navigation routes. Cloud servers provide intelligent services for vehicles, such as emergency rescue services, gas stations, parking lots, charging pile information, etc.

[0061] Ideal lattice: An ideal lattice is a special lattice that is an improvement on the random lattice. Compared with the random lattice, the ideal lattice can reduce the spatial size of the matrix or vector in the algorithm.

[0062] This embodiment explains the required symbols, as shown in Table 1: Table 1: Explanation of symbols symbol Explanation of symbols A (bold capital letter) matrix b (bold lowercase letter) Column vector R <![CDATA[Z[X] / [X n +1]]]> <![CDATA[R q ]]> <![CDATA[Z q [X] / [X n +1]]]> ||.|| Euclidean norm H Secure Hash Function <![CDATA[|id f |]]> Identifier length τ Attribute Vector Access Control Policy Functions <![CDATA[R g ]]> Private key for access control policy functions e sign <![CDATA[D c,s ]]> Gaussian distribution s,δ Gaussian parameters r#timg#R Randomly select an element r from the set R <![CDATA[T mv ]]> Matrix and vector multiplication operation time <![CDATA[T mm ]]> Matrix modular multiplication time <![CDATA[T h ]]> Hash operation time <![CDATA[T add ]]> Vector addition operation time

[0063] This example describes the concepts and design tools involved:

[0064] Lattice: Given a linearly independent set of basis vectors ,definition Vig for In this method, we focus on an ideal lattice For an integer , Indicates that its ring element coefficients are from The quotient ring selected from . , we focus on a q-dimensional grid and its coset .

[0065] Discrete Gaussian distribution: grid The discrete Gaussian distribution on is defined as: ,in , centered at of Dimensional Gaussian distribution It can be expressed as .

[0066] Ring-SIS problem: Given a uniform random vector and a norm bound , the shortest integer solution to the ring is to find a non-zero vector Make , .

[0067] - Trapdoor: Given a set of security parameters , a raw vector , a trapdoor tag , and an identity matrix ,So of -The trapdoor can be defined as a matrix And meet .

[0068] Trapdoor Generation Algorithm ( ): For parameters , there is a probabilistic polynomial-time algorithm , whose output is a statistically close uniformly distributed vector and its - Trapdoor .

[0069] Gaussian sampling algorithm ( ): For parameters , there is a probabilistic polynomial-time algorithm ,enter , , Trapdoor and a target element , which outputs a vector with a distribution close to that of a Gaussian distribution ,and .

[0070] The system architecture model of this embodiment is as follows Figure 1This embodiment provides a specific implementation plan including four parts: system establishment, key extraction, message signing and message authentication. Figure 2 As shown in the figure. The system establishment module generates system public parameters and public and private key pairs of trusted institutions. The key extraction module generates user identifiers and private keys and transmits them to the corresponding entities. The message signing module is the process in which vehicles and road test units sign messages to be sent. The message authentication module is the process in which the cloud server batch authenticates massive messages and signature pairs from vehicles and road test units with the same attributes.

[0071] System establishment phase: The trusted institution generates system public parameters and the public and private key pairs of the trusted institution. , generate a security parameter set 2. The trusted authority selects three secure hash functions: 3. Trusted institution setup and an identity matrix , trusted institutions use Algorithm generation and Trapdoor , then the public key of the trusted institution is , the private key is . Expose public parameters and the public key of the trusted authority , secretly storing the private key of the trusted institution .

[0072] Key extraction phase: Vehicles and road test units submit registration requests to trusted institutions and send access control policies. Trusted institutions use their access control policies to obtain key information. Generate Identifier and private key , and returns it to the corresponding entity. 1. The trusted institution Generates an identifier for a vehicle or a road test unit , where the attribute , , 2. Trusted Institution Computing , 3. The trusted institution modifies the access control policy Then get the function , ,according to calculate , 4. Trusted institution operation algorithm, Get the private key and the identifier and private key Sent to the vehicle or road test unit, the vehicle or road test unit calculates the equation Is it established to verify the correctness of the private key it received.

[0073] Message signing phase: with attributes , and the corresponding access control policy The vehicle or road test unit is sending a message 1. Vehicle or road test unit calculation , , ,in According to Gaussian distribution 2. Vehicle or road test unit calculation , and 3. Vehicle or road test unit calculation and 4. Vehicle or road test unit operation algorithm, , get the signature , then Send to the cloud server.

[0074] Message authentication phase: The cloud server authenticates the received message to verify the authenticity and integrity of the message.

[0075] The cloud server only received a single message 1. Cloud Server Computing ,if , then the verification ends if , then execute the following steps. 2. Cloud server calculation , and 3. Cloud Server Computing and 4. Cloud Server Computing , 5. The cloud server calculates the equation Whether to receive this message is determined by whether the condition is established.

[0076] If the cloud server receives multiple messages with the same attributes ,in Indicates the total number of messages. 1. Cloud Server Computing ,if , then the verification ends if , then execute the following steps. 2. Cloud server calculation , and 3. Cloud Server Computing and 4. Cloud Server Computing , 5. The cloud server calculates the equation Whether to receive this batch of messages is determined by whether the condition is established.

[0077] The solution provided in this embodiment has the following functions:

[0078] 1. The cloud server improves communication efficiency while achieving message authenticity and integrity through batch authentication. The present invention designs a batch authentication technology based on attribute signatures to enable the cloud server to batch-verify multiple messages from vehicles and road test units with the same attributes at the same time, thereby improving authentication efficiency. As the number of signatures increases, the time for batch authentication increases slowly, which directly leads to a shorter response time for the cloud server. And because the length of the attribute-based signature is independent of the attribute size, a shorter single signature length is achieved, which can effectively save the system bandwidth of X2C communication. The system's space resources and computing resources are fully saved, thereby achieving more efficient resource utilization.

[0079] 2. Realize the protection of the identity privacy of vehicles and road test units. The present invention designs attribute-based signature technology for use in the process of data communication. Since only some attributes of vehicles and road test units are disclosed, no one can know their true identities. Therefore, the privacy of vehicles and road test units is effectively protected, effectively preventing damage caused by identity privacy leakage.

[0080] 3. Satisfy the strong unforgeability of signatures and effectively resist quantum attacks. The present invention designs a lattice-based attribute-based signature technology to achieve strong unforgeability of signatures under selected attribute and selected message attacks during the interaction between the vehicle and the road test unit and the cloud server. Lattice-based cryptographic tools are used, so the proposed method can achieve post-quantum security.

[0081] Safety demonstration of this embodiment:

[0082] Under the random oracle model, the algorithm involved in the present invention can realize the strong unforgeability of batch authentication under selected attribute and selected message attacks. Since the scheme is designed by using lattice cryptographic tools, the present invention has the characteristic of resisting quantum attacks.

[0083] The idea of ​​strong unforgeability security proof of batch authentication is briefly summarized as follows: Assume that there is an adversary who can forge the message designed by the present invention, and set the adversary's forgery success rate to be , we can use this adversary to construct a challenger to solve the ring-SIS problem. During this period, the challenger allows the adversary to adaptively perform Second-rate Hash asks, Second-rate Hash asks, Second-rate Hash asks, Secondary key extraction query and The probability that the challenger solves the ring-SIS problem is In fact, if the challenger receives a SIS instance , the challenger will set ,Will As the public key of the trusted institution. Assume that the challenge attribute is , the adversary wants to forge a message and its signature on it. Once the adversary succeeds in forging, the forged signature satisfy , and obtain another signature by recording the adversary's query results Also satisfied , then the challenger can obtain a ring-SIS solution and

[0084] Functional demonstration of this embodiment:

[0085] 1. Functional comparison between the solution of the present invention and relevant comparative literature: As shown in Table 2, the Internet of Vehicles security batch authentication method for cloud service scenarios of the present invention has advantages in security level, resistance to quantum attacks, etc., and is more in line with the data communication needs of the Internet of Vehicles.

[0086] Among them, [7] Cui H, Deng R H, Liu J K, et al. Server-aided attribute-based signature with revocation for resource-constrained industrial-internet-of-things devices[J]. IEEE Transactions on Industrial Informatics, 2018, 14(8): 3724-3732. [8] Xiong H, Bao Y, Nie X, et al. Server-aided attribute-based signature supporting expressive access structures for industrialinternet of things[J]. IEEE Transactions on Industrial Informatics, 2019, 16(2): 1013-1023. [9] Mukherjee S, Gupta D S, Biswas G P. An efficient andbatch verifiable conditional privacy-preserving authentication scheme forVANETs using lattice[J]. Computing, 2019, 101(12): 1763-1788.

[10] Li Q, HeD, Yang Z, et al. Lattice-based conditional privacy-preserving authenticationprotocol for the vehicular ad hoc network[J]. IEEE Transactions on VehicularTechnology, 2022, 71(4): 4336-4347.

[11] Maurya C, Chaurasiya V K. Efficientanonymous batch authentication scheme with conditional privacy in theInternet of Vehicles (IoV) applications[J].IEEE Transactions on IntelligentTransportation Systems, 2023, 24(9): 9670-9683. Table 2: Comparison of solution functions plan Single Authentication Batch certification Completeness Fine-grained access control Security Level Post-quantum security [7] √ × √ √ SU × [8] √ × √ √ EU × [9] √ √ √ × SU √

[10] √ √ √ × EU √

[11] √ √ √ × SU × This program √ √ √ √ SU √

[0087] Among them, "SU" stands for strong unforgeability and "EU" stands for existential unforgeability.

[0088] 2. Space efficiency analysis of the scheme designed by the present invention: As shown in Table 3, the signature length designed by the present method has some advantages.

[0089] Among them, [9] Maurya C, Chaurasiya V K. Efficient anonymous batch authentication scheme with conditional privacy in the Internet of Vehicles (IoV) applications[J]. IEEE Transactions on Intelligent Transportation Systems, 2023, 24(9): 9670-9683.

[12] Liu H, Sun Y, Xu Y, et al. A secure lattice-based anonymous authentication scheme for VANETs[J]. Journal of the Chinese Institute of Engineers, 2019, 42(1): 66-73.

[13] Li Q, He D, Yang Z, et al. Lattice-based conditional privacy-preserving authentication protocol for the vehicular ad hoc network[J]. IEEE Transactions on Vehicular Technology, 2022, 71(4): 4336-4347.

[14] Almazroi A A, Alqarni M A, Al-Shareeda M A, et al. L-CPPA: Lattice-based conditional privacy-preserving authentication scheme for fog computing with 5G-enabled vehicular system[J]. Plos one, 2023, 18(10): e0292690.

[15] Gupta D S, Karati A, Saad W, et al. Quantum-defended blockchain-assisted data authentication protocol for internet of vehicles[J].IEEE Transactions on Vehicular Technology, 2022, 71(3): 3255-3266. Table 3: Comparison of solution space efficiency plan Master public key length Master private key length The length of the private key of the vehicle or road test unit Signature length [9] (mn+n)logq mlogq mlogq (m+2n)logq

[12] mnlogq mlogq 2mlogq 2(m+n)logq

[13] mnlogq <![CDATA[m 2 logq]]> mlogq (m+2n+nk)logq

[14] <![CDATA[m 2 logq]]> mnlogq mklogq (m+2n+nk)logq

[15] mnlogq mlogq mlogq (m+n)logq This program (l+2k)nlogq lknlogq <![CDATA[(l+k)knlogq+|id f |]]> (l+2k)nlogq+|τ|

[0090] 4. Comparison of the computational efficiency of the scheme designed by the present invention: As shown in Table 4, as the number of messages increases, the cloud server only changes the number of vector addition operations. Therefore, the batch authentication time increases slowly with the increase in the number of messages, resulting in a shorter response time for the cloud server. Table 4: Comparison of calculation efficiency of the schemes plan Vehicle or road test unit message signature Cloud Server Single Authentication Cloud Server Batch Certification [9] <![CDATA[T mv +T h ]]> <h2 style=";text-align:left;direction:ltr"><![CDATA[T <h2 style=";text-align:left;direction:ltr"> mv <h2 style=";text-align:left;direction:ltr"> +2T<h2 style=";text-align:left;direction:ltr"> h <h2 style=";text-align:left;direction:ltr"> ]]><h2 style=";text-align:left;direction:ltr"> <![CDATA[T mv +2dT h +4dT add ]]>

[12] <![CDATA[T mv +3T h ]]> <![CDATA[T mv +T h ]]> <![CDATA[T mv +dT h +3dT add ]]>

[13] <![CDATA[T mm +T mv +T h ]]> <![CDATA[3T mv +3T h ]]> <![CDATA[(2d+1)T mv +3dT h +4dT add ]]>

[14] <![CDATA[T mm +2T mv +3T h ]]> <![CDATA[3T mv +3T h ]]> <![CDATA[(2d+1)T mv +3dT h +4dT add ]]>

[15] <![CDATA[T mv +T h ]]> <![CDATA[T mv +T h ]]> <![CDATA[T mv +dT h +4dT add ]]> This program <![CDATA[T sd +T mv +(p+k)T h ]]> <![CDATA[T mv +(p+k)T h ]]> <![CDATA[T mv +(p+k)T h +2dT add ]]>

[0091] Here, "d" represents the number of messages.

[0092] Functional verification of this embodiment:

[0093] After determining the values ​​of various parameters, specific data are used to discuss the advantages of the present invention over other references in terms of storage space and computing efficiency. , the specific results are as follows:

[0094] Comparison of the present invention with related references in terms of signature length: Figure 3 As shown, the signature length designed by this method is 1 / 2 or even more shorter than that of other batch authentication methods. Since the cloud server receives multiple signatures for batch authentication, this method can improve the communication efficiency of the cloud server and save bandwidth resources. Therefore, the present invention is more suitable for situations where the vehicle density in the Internet of Vehicles is high.

[0095] Comparison of the present invention with related references in terms of message signature algorithm computation efficiency: Figure 4 As shown, the attribute-based batch authentication method designed by the method for the security of the Internet of Vehicles has a faster message signing speed than other schemes in the message signing stage. Therefore, the present invention is more suitable for vehicles with limited resources in the Internet of Vehicles.

[0096] Comparison of the computational efficiency of the message batch authentication algorithm between the present invention and related references: Figure 5 As shown, in the message batch authentication stage, the attribute-based batch authentication method designed by the method for the security of the Internet of Vehicles increases with the increase in the number of signatures, which directly leads to a shorter response time of the cloud server. Therefore, the present invention is more suitable for massive message communications in the Internet of Vehicles.

[0097] The response time diagram of the cloud server under the influence of vehicle density of the present invention is as follows: Figure 6As shown, the scheme of the present invention uses professional network simulation software to simulate the network, setting the parameter simulation area to 1×1 ( ), data transmission rate 6Mbps, physical layer uses IEEE802.11p protocol. Simulation shows that the batch authentication method involved in the present invention can complete the response within 3.5s even if it provides services to 40 vehicles at the same time. Therefore, the present invention can meet the actual needs of vehicle networking batch authentication.

[0098] Comparison of single authentication and batch authentication response time of cloud servers under the influence of vehicle density in the present invention: Figure 7 As shown in the figure, the batch authentication response delay of the present invention is only 55%-70% of that of a single authentication, saving at least 30% of the time. The response delay of 20-40 vehicles is only 4-13 times that of one vehicle. Therefore, the present invention is more suitable for massive message communication in the Internet of Vehicles.

[0099] The packet loss rate diagram of the present invention under the influence of vehicle speed and vehicle density is as follows: Figure 8 As shown, the Internet of Vehicles batch authentication method of the present invention has a packet loss rate of less than 3% when the vehicle density is 20-25 vehicles and the vehicle speed is 5-25m / s. Even when the vehicle density is 40 and the vehicle speed is 25m / s, the packet loss rate of the invention is always less than 15%. Therefore, the present invention can meet the actual needs of Internet of Vehicles batch authentication.

[0100] Radar chart comparing the effects of the present invention and existing achievements: Fig. 9 As shown, the Internet of Vehicles batch authentication scheme designed by the present invention is more powerful and can meet more security requirements while efficiently completing batch authentication.

[0101] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products of the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of the processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0102] The specific embodiments described above are only preferred embodiments of the present invention and do not limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for batch authentication of Internet of Vehicles security in cloud service scenarios, characterized in that: The batch authentication method comprises: Step 1: Taking the application of cloud services in the Internet of Vehicles as the research background, a secure batch authentication protocol for vehicle-to-cloud, road-to-cloud and vehicle-to-road communication technologies is designed. The protocol includes four entities: a trusted institution, a cloud server, a vehicle and a road test unit. Step 2: System establishment phase: The trusted institution generates system public parameters and the public and private key pairs of the trusted institution; Step 3: Key extraction phase: Entities such as vehicles and road test units submit registration requests to trusted institutions and send access control policies. Trusted institutions generate identifiers and private keys based on their access control policies and return them to the corresponding entities. Step 4: Vehicles and road test units send messages to the cloud server: Vehicles and road test units use their own private keys to digitally sign the messages they send, and then send the messages, signatures, attributes, and identifiers to the cloud server; Step 5: Cloud server single authentication phase: When the cloud server receives only a single message, it first checks whether the attributes and access control policies match. If not, the verification ends. If they match, the single authentication algorithm is used to verify the authenticity and integrity of the message. Step 6: Cloud server batch authentication phase: When the cloud server receives a large number of messages, it first checks whether the attributes and access control policies match. If not, the verification ends; if they match, the batch authentication algorithm is used to batch verify the authenticity and integrity of the messages.

2. The vehicle network security batch authentication method for cloud service scenarios as claimed in claim 1 is characterized in that: The specific steps of the system establishment phase include: Trusted institutions based on system parameters , generate a security parameter set Finally, choose three secure hash functions: ; Among them, the secure hash function inputs a string of 0s and 1s of a specified length, and the output is a string of a fixed range of a specific length; Trusted institution settings and an identity matrix , trusted institutions use Algorithm generation and Trapdoor , then the public key of the trusted institution is , the private key is .

3. The vehicle network security batch authentication method for cloud service scenarios as claimed in claim 1 is characterized in that: The specific steps of the key extraction stage include: Trusted institutions based on access control policies Generates an identifier for a vehicle or a road test unit , where the attribute , , ; Trusted Computing , ; Trusted institutions modify access control policies Then get the function , ,according to calculate , ; Trusted institution operation algorithm, Get the private key and the identifier and private key Sent to the vehicle or road test unit, the vehicle or road test unit calculates the equation Is it established to verify the correctness of the private key it received.

4. The vehicle network security batch authentication method for cloud service scenarios as claimed in claim 1 is characterized in that: The specific steps of the stage where the vehicle and the road test unit send a message to the cloud server include: The vehicle or road test unit sends a message to the cloud server Digital signature; Vehicle or road test unit calculation , , ,in According to Gaussian distribution selected; Vehicle or road test unit calculation , and ; Vehicle or road test unit calculation and ; Vehicle or road test unit operation algorithm, , get the signature , then Send to the cloud server.

5. The vehicle network security batch authentication method for cloud service scenarios as claimed in claim 1 is characterized in that: The specific steps of the cloud server single authentication phase include: The cloud server only received a single message , which first calculates ,if , then the verification ends if , then execute the following steps; Cloud Server Computing , and ; Cloud Server Computing and ; Cloud Server Computing , ; Cloud servers calculate the equation Whether to receive this message is determined by whether the condition is established.

6. The vehicle networking security batch authentication method for cloud service scenarios as claimed in claim 1 is characterized in that: The specific steps of the cloud server batch certification stage include: The cloud server receives a large number of messages , which first calculates ,if , then the verification ends if , then execute the following steps; Cloud Server Computing , and ; Cloud Server Computing and ; Cloud Server Computing , ; Cloud servers calculate the equation Whether to receive this batch of messages is determined by whether the condition is established.

7. The cloud server single authentication phase as claimed in claim 5, characterized in that: The cloud server calculates the equation The correctness of receiving this message is determined by whether the following conditions are met: 。 8. The cloud server batch authentication stage as claimed in claim 6, characterized in that: The cloud server calculates the equation Whether the correctness of receiving this batch of messages is determined by whether the following conditions are met: 。

Images